@shipfox/api-auth 2.0.0

package/dist/index.js

@@ -0,0 +1,52 @@
+import { AUTH_EMAIL_VERIFICATION_SEND_REQUESTED, AUTH_PASSWORD_RESET_SEND_REQUESTED, authEventSchemas } from '@shipfox/api-auth-dto';
+import { subscriberFactory } from '@shipfox/node-module';
+import { db } from '#db/db.js';
+import { migrationsPath } from '#db/migrations.js';
+import { authOutbox } from '#db/schema/outbox.js';
+import { createJwtAuthMethod } from '#presentation/auth/jwt-auth.js';
+import { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
+import { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
+import { authE2eRoutes } from '#presentation/e2eRoutes/index.js';
+import { authRoutes } from '#presentation/routes/index.js';
+import { onEmailVerificationSendRequested, onPasswordResetSendRequested } from '#presentation/subscribers/index.js';
+export { createSessionForUser, provisionUser } from '#core/auth.js';
+export { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError } from '#core/errors.js';
+export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken } from '#core/job-lease-token.js';
+export { issueRunnerSessionToken, verifyRunnerSessionToken } from '#core/runner-session-token.js';
+export { createJwtAuthMethod } from '#presentation/auth/jwt-auth.js';
+export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
+export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
+export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
+const subscriber = subscriberFactory();
+export const authModule = {
+    name: 'auth',
+    database: {
+        db,
+        migrationsPath
+    },
+    auth: [
+        createJwtAuthMethod(),
+        createLeaseTokenAuthMethod(),
+        createRunnerSessionAuthMethod()
+    ],
+    routes: [
+        authRoutes
+    ],
+    e2eRoutes: [
+        authE2eRoutes
+    ],
+    publishers: [
+        {
+            name: 'auth',
+            table: authOutbox,
+            db,
+            eventSchemas: authEventSchemas
+        }
+    ],
+    subscribers: [
+        subscriber(AUTH_EMAIL_VERIFICATION_SEND_REQUESTED, onEmailVerificationSendRequested),
+        subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)
+    ]
+};
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {authE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {authRoutes} from '#presentation/routes/index.js';\nimport {\n  onEmailVerificationSendRequested,\n  onPasswordResetSendRequested,\n} from '#presentation/subscribers/index.js';\n\nexport type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport type {\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  InvalidCredentialsError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport const authModule: ShipfoxModule = {\n  name: 'auth',\n  database: {db, migrationsPath},\n  auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n  routes: [authRoutes],\n  e2eRoutes: [authE2eRoutes],\n  publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],\n  subscribers: [\n    subscriber(AUTH_EMAIL_VERIFICATION_SEND_REQUESTED, onEmailVerificationSendRequested),\n    subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested),\n  ],\n};\n"],"names":["AUTH_EMAIL_VERIFICATION_SEND_REQUESTED","AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","subscriberFactory","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","authE2eRoutes","authRoutes","onEmailVerificationSendRequested","onPasswordResetSendRequested","createSessionForUser","provisionUser","AuthDependencyUnavailableError","EmailNotVerifiedError","InvalidCredentialsError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","authModule","name","database","auth","routes","e2eRoutes","publishers","table","eventSchemas","subscribers"],"mappings":"AAAA,SACEA,sCAAsC,EACtCC,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAE/B,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,aAAa,QAAO,mCAAmC;AAC/D,SAAQC,UAAU,QAAO,gCAAgC;AACzD,SACEC,gCAAgC,EAChCC,4BAA4B,QACvB,qCAAqC;AAS5C,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElE,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,uBAAuB,EACvBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAClC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SAAQjB,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SACEiB,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQnB,6BAA6B,QAAO,4CAA4C;AAExF,MAAMoB,aAAa1B;AAEnB,OAAO,MAAM2B,aAA4B;IACvCC,MAAM;IACNC,UAAU;QAAC5B;QAAIC;IAAc;IAC7B4B,MAAM;QAAC1B;QAAuBC;QAA8BC;KAAgC;IAC5FyB,QAAQ;QAACvB;KAAW;IACpBwB,WAAW;QAACzB;KAAc;IAC1B0B,YAAY;QAAC;YAACL,MAAM;YAAQM,OAAO/B;YAAYF;YAAIkC,cAAcpC;QAAgB;KAAE;IACnFqC,aAAa;QACXV,WAAW7B,wCAAwCY;QACnDiB,WAAW5B,oCAAoCY;KAChD;AACH,EAAE"}

package/dist/metrics/index.d.ts

@@ -0,0 +1,2 @@
+export { type AuthRateLimitAction, type AuthRateLimitOutcome, type AuthRateLimitScope, type AuthTokenRefreshOutcome, type AuthTokenType, type AuthTokenVerificationOutcome, recordAuthRateLimitCheck, recordAuthRateLimitPruneFailure, recordTokenIssued, recordTokenRefreshed, recordTokenVerified, } from './instance.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/metrics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/metrics/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,+BAA+B,EAC/B,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,eAAe,CAAC"}

package/dist/metrics/index.js

@@ -0,0 +1,3 @@
+export { recordAuthRateLimitCheck, recordAuthRateLimitPruneFailure, recordTokenIssued, recordTokenRefreshed, recordTokenVerified } from './instance.js';
+
+//# sourceMappingURL=index.js.map

package/dist/metrics/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/metrics/index.ts"],"sourcesContent":["export {\n  type AuthRateLimitAction,\n  type AuthRateLimitOutcome,\n  type AuthRateLimitScope,\n  type AuthTokenRefreshOutcome,\n  type AuthTokenType,\n  type AuthTokenVerificationOutcome,\n  recordAuthRateLimitCheck,\n  recordAuthRateLimitPruneFailure,\n  recordTokenIssued,\n  recordTokenRefreshed,\n  recordTokenVerified,\n} from './instance.js';\n"],"names":["recordAuthRateLimitCheck","recordAuthRateLimitPruneFailure","recordTokenIssued","recordTokenRefreshed","recordTokenVerified"],"mappings":"AAAA,SAOEA,wBAAwB,EACxBC,+BAA+B,EAC/BC,iBAAiB,EACjBC,oBAAoB,EACpBC,mBAAmB,QACd,gBAAgB"}

package/dist/metrics/instance.d.ts

@@ -0,0 +1,16 @@
+export type AuthTokenType = 'session' | 'job_lease' | 'runner_session';
+export type AuthTokenVerificationOutcome = 'ok' | 'rejected';
+export type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';
+export type AuthRateLimitAction = 'login' | 'email-send';
+export type AuthRateLimitScope = 'ip' | 'email';
+export type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';
+export declare function recordTokenIssued(tokenType: AuthTokenType): void;
+export declare function recordTokenVerified(tokenType: AuthTokenType, outcome: AuthTokenVerificationOutcome): void;
+export declare function recordTokenRefreshed(outcome: AuthTokenRefreshOutcome): void;
+export declare function recordAuthRateLimitCheck(params: {
+    action: AuthRateLimitAction;
+    scope: AuthRateLimitScope;
+    outcome: AuthRateLimitOutcome;
+}): void;
+export declare function recordAuthRateLimitPruneFailure(): void;
+//# sourceMappingURL=instance.d.ts.map

package/dist/metrics/instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,gBAAgB,CAAC;AACvE,MAAM,MAAM,4BAA4B,GAAG,IAAI,GAAG,UAAU,CAAC;AAC7D,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,YAAY,CAAC;AACzD,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAsCzE,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAEhE;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,4BAA4B,GACpC,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAE3E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,GAAG,IAAI,CAQP;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}

package/dist/metrics/instance.js

@@ -0,0 +1,52 @@
+import { instanceMetrics } from '@shipfox/node-opentelemetry';
+const meter = instanceMetrics.getMeter('auth');
+const tokenIssuedCount = meter.createCounter('auth_token_issued', {
+    description: 'Tokens issued by token type'
+});
+const tokenVerifiedCount = meter.createCounter('auth_token_verified', {
+    description: 'Token verification attempts by token type and outcome'
+});
+const tokenRefreshedCount = meter.createCounter('auth_token_refreshed', {
+    description: 'Refresh-token exchanges by outcome'
+});
+const rateLimitCheckCount = meter.createCounter('auth_rate_limit_checks', {
+    description: 'Authentication rate limit checks by action, scope, and outcome'
+});
+const rateLimitPruneFailureCount = meter.createCounter('auth_rate_limit_prune_failures', {
+    description: 'Authentication rate limit prune failures'
+});
+function recordMetric(record) {
+    try {
+        record();
+    } catch  {
+    // Metrics must not affect authentication outcomes.
+    }
+}
+export function recordTokenIssued(tokenType) {
+    recordMetric(()=>tokenIssuedCount.add(1, {
+            token_type: tokenType
+        }));
+}
+export function recordTokenVerified(tokenType, outcome) {
+    recordMetric(()=>tokenVerifiedCount.add(1, {
+            token_type: tokenType,
+            outcome
+        }));
+}
+export function recordTokenRefreshed(outcome) {
+    recordMetric(()=>tokenRefreshedCount.add(1, {
+            outcome
+        }));
+}
+export function recordAuthRateLimitCheck(params) {
+    recordMetric(()=>rateLimitCheckCount.add(1, {
+            action: params.action,
+            scope: params.scope,
+            outcome: params.outcome
+        }));
+}
+export function recordAuthRateLimitPruneFailure() {
+    recordMetric(()=>rateLimitPruneFailureCount.add(1));
+}
+
+//# sourceMappingURL=instance.js.map

package/dist/metrics/instance.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/metrics/instance.ts"],"sourcesContent":["import {instanceMetrics} from '@shipfox/node-opentelemetry';\n\nexport type AuthTokenType = 'session' | 'job_lease' | 'runner_session';\nexport type AuthTokenVerificationOutcome = 'ok' | 'rejected';\nexport type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';\nexport type AuthRateLimitAction = 'login' | 'email-send';\nexport type AuthRateLimitScope = 'ip' | 'email';\nexport type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';\n\nconst meter = instanceMetrics.getMeter('auth');\n\nconst tokenIssuedCount = meter.createCounter<{token_type: AuthTokenType}>('auth_token_issued', {\n  description: 'Tokens issued by token type',\n});\n\nconst tokenVerifiedCount = meter.createCounter<{\n  token_type: AuthTokenType;\n  outcome: AuthTokenVerificationOutcome;\n}>('auth_token_verified', {description: 'Token verification attempts by token type and outcome'});\n\nconst tokenRefreshedCount = meter.createCounter<{outcome: AuthTokenRefreshOutcome}>(\n  'auth_token_refreshed',\n  {description: 'Refresh-token exchanges by outcome'},\n);\n\nconst rateLimitCheckCount = meter.createCounter<{\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}>('auth_rate_limit_checks', {\n  description: 'Authentication rate limit checks by action, scope, and outcome',\n});\n\nconst rateLimitPruneFailureCount = meter.createCounter('auth_rate_limit_prune_failures', {\n  description: 'Authentication rate limit prune failures',\n});\n\nfunction recordMetric(record: () => void): void {\n  try {\n    record();\n  } catch {\n    // Metrics must not affect authentication outcomes.\n  }\n}\n\nexport function recordTokenIssued(tokenType: AuthTokenType): void {\n  recordMetric(() => tokenIssuedCount.add(1, {token_type: tokenType}));\n}\n\nexport function recordTokenVerified(\n  tokenType: AuthTokenType,\n  outcome: AuthTokenVerificationOutcome,\n): void {\n  recordMetric(() => tokenVerifiedCount.add(1, {token_type: tokenType, outcome}));\n}\n\nexport function recordTokenRefreshed(outcome: AuthTokenRefreshOutcome): void {\n  recordMetric(() => tokenRefreshedCount.add(1, {outcome}));\n}\n\nexport function recordAuthRateLimitCheck(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}): void {\n  recordMetric(() =>\n    rateLimitCheckCount.add(1, {\n      action: params.action,\n      scope: params.scope,\n      outcome: params.outcome,\n    }),\n  );\n}\n\nexport function recordAuthRateLimitPruneFailure(): void {\n  recordMetric(() => rateLimitPruneFailureCount.add(1));\n}\n"],"names":["instanceMetrics","meter","getMeter","tokenIssuedCount","createCounter","description","tokenVerifiedCount","tokenRefreshedCount","rateLimitCheckCount","rateLimitPruneFailureCount","recordMetric","record","recordTokenIssued","tokenType","add","token_type","recordTokenVerified","outcome","recordTokenRefreshed","recordAuthRateLimitCheck","params","action","scope","recordAuthRateLimitPruneFailure"],"mappings":"AAAA,SAAQA,eAAe,QAAO,8BAA8B;AAS5D,MAAMC,QAAQD,gBAAgBE,QAAQ,CAAC;AAEvC,MAAMC,mBAAmBF,MAAMG,aAAa,CAA8B,qBAAqB;IAC7FC,aAAa;AACf;AAEA,MAAMC,qBAAqBL,MAAMG,aAAa,CAG3C,uBAAuB;IAACC,aAAa;AAAuD;AAE/F,MAAME,sBAAsBN,MAAMG,aAAa,CAC7C,wBACA;IAACC,aAAa;AAAoC;AAGpD,MAAMG,sBAAsBP,MAAMG,aAAa,CAI5C,0BAA0B;IAC3BC,aAAa;AACf;AAEA,MAAMI,6BAA6BR,MAAMG,aAAa,CAAC,kCAAkC;IACvFC,aAAa;AACf;AAEA,SAASK,aAAaC,MAAkB;IACtC,IAAI;QACFA;IACF,EAAE,OAAM;IACN,mDAAmD;IACrD;AACF;AAEA,OAAO,SAASC,kBAAkBC,SAAwB;IACxDH,aAAa,IAAMP,iBAAiBW,GAAG,CAAC,GAAG;YAACC,YAAYF;QAAS;AACnE;AAEA,OAAO,SAASG,oBACdH,SAAwB,EACxBI,OAAqC;IAErCP,aAAa,IAAMJ,mBAAmBQ,GAAG,CAAC,GAAG;YAACC,YAAYF;YAAWI;QAAO;AAC9E;AAEA,OAAO,SAASC,qBAAqBD,OAAgC;IACnEP,aAAa,IAAMH,oBAAoBO,GAAG,CAAC,GAAG;YAACG;QAAO;AACxD;AAEA,OAAO,SAASE,yBAAyBC,MAIxC;IACCV,aAAa,IACXF,oBAAoBM,GAAG,CAAC,GAAG;YACzBO,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBL,SAASG,OAAOH,OAAO;QACzB;AAEJ;AAEA,OAAO,SAASM;IACdb,aAAa,IAAMD,2BAA2BK,GAAG,CAAC;AACpD"}

package/dist/presentation/auth/bearer-token-auth.d.ts

@@ -0,0 +1,15 @@
+import { type AuthMethod } from '@shipfox/node-fastify';
+import type { FastifyRequest } from 'fastify';
+interface UnauthorizedErrorParams {
+    message: string;
+    code: string;
+}
+interface BearerTokenAuthMethodOptions<TClaims> {
+    name: string;
+    verifyToken: (token: string) => Promise<TClaims | null>;
+    invalidTokenError: UnauthorizedErrorParams;
+    setContext: (request: FastifyRequest, claims: TClaims) => void;
+}
+export declare function createBearerTokenAuthMethod<TClaims>(options: BearerTokenAuthMethodOptions<TClaims>): AuthMethod;
+export {};
+//# sourceMappingURL=bearer-token-auth.d.ts.map

package/dist/presentation/auth/bearer-token-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-token-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/bearer-token-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,UAAU,EAAkC,MAAM,uBAAuB,CAAC;AACvF,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAE5C,UAAU,uBAAuB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,4BAA4B,CAAC,OAAO;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,uBAAuB,CAAC;IAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CAChE;AAOD,wBAAgB,2BAA2B,CAAC,OAAO,EACjD,OAAO,EAAE,4BAA4B,CAAC,OAAO,CAAC,GAC7C,UAAU,CAaZ"}

package/dist/presentation/auth/bearer-token-auth.js

@@ -0,0 +1,31 @@
+import { ClientError, extractBearerToken } from '@shipfox/node-fastify';
+const missingBearerError = {
+    message: 'Missing or invalid Authorization header',
+    code: 'unauthorized'
+};
+export function createBearerTokenAuthMethod(options) {
+    return {
+        name: options.name,
+        authenticate: async (request)=>{
+            const token = extractBearerToken(request.headers.authorization);
+            if (!token) throwUnauthorized(missingBearerError);
+            const claims = await verifyBearerToken(token, options.verifyToken);
+            if (!claims) throwUnauthorized(options.invalidTokenError);
+            options.setContext(request, claims);
+        }
+    };
+}
+async function verifyBearerToken(token, verifyToken) {
+    try {
+        return await verifyToken(token);
+    } catch  {
+        return null;
+    }
+}
+function throwUnauthorized(error) {
+    throw new ClientError(error.message, error.code, {
+        status: 401
+    });
+}
+
+//# sourceMappingURL=bearer-token-auth.js.map

package/dist/presentation/auth/bearer-token-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/auth/bearer-token-auth.ts"],"sourcesContent":["import {type AuthMethod, ClientError, extractBearerToken} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\n\ninterface UnauthorizedErrorParams {\n  message: string;\n  code: string;\n}\n\ninterface BearerTokenAuthMethodOptions<TClaims> {\n  name: string;\n  verifyToken: (token: string) => Promise<TClaims | null>;\n  invalidTokenError: UnauthorizedErrorParams;\n  setContext: (request: FastifyRequest, claims: TClaims) => void;\n}\n\nconst missingBearerError: UnauthorizedErrorParams = {\n  message: 'Missing or invalid Authorization header',\n  code: 'unauthorized',\n};\n\nexport function createBearerTokenAuthMethod<TClaims>(\n  options: BearerTokenAuthMethodOptions<TClaims>,\n): AuthMethod {\n  return {\n    name: options.name,\n    authenticate: async (request) => {\n      const token = extractBearerToken(request.headers.authorization);\n      if (!token) throwUnauthorized(missingBearerError);\n\n      const claims = await verifyBearerToken(token, options.verifyToken);\n      if (!claims) throwUnauthorized(options.invalidTokenError);\n\n      options.setContext(request, claims);\n    },\n  };\n}\n\nasync function verifyBearerToken<TClaims>(\n  token: string,\n  verifyToken: (token: string) => Promise<TClaims | null>,\n): Promise<TClaims | null> {\n  try {\n    return await verifyToken(token);\n  } catch {\n    return null;\n  }\n}\n\nfunction throwUnauthorized(error: UnauthorizedErrorParams): never {\n  throw new ClientError(error.message, error.code, {status: 401});\n}\n"],"names":["ClientError","extractBearerToken","missingBearerError","message","code","createBearerTokenAuthMethod","options","name","authenticate","request","token","headers","authorization","throwUnauthorized","claims","verifyBearerToken","verifyToken","invalidTokenError","setContext","error","status"],"mappings":"AAAA,SAAyBA,WAAW,EAAEC,kBAAkB,QAAO,wBAAwB;AAevF,MAAMC,qBAA8C;IAClDC,SAAS;IACTC,MAAM;AACR;AAEA,OAAO,SAASC,4BACdC,OAA8C;IAE9C,OAAO;QACLC,MAAMD,QAAQC,IAAI;QAClBC,cAAc,OAAOC;YACnB,MAAMC,QAAQT,mBAAmBQ,QAAQE,OAAO,CAACC,aAAa;YAC9D,IAAI,CAACF,OAAOG,kBAAkBX;YAE9B,MAAMY,SAAS,MAAMC,kBAAkBL,OAAOJ,QAAQU,WAAW;YACjE,IAAI,CAACF,QAAQD,kBAAkBP,QAAQW,iBAAiB;YAExDX,QAAQY,UAAU,CAACT,SAASK;QAC9B;IACF;AACF;AAEA,eAAeC,kBACbL,KAAa,EACbM,WAAuD;IAEvD,IAAI;QACF,OAAO,MAAMA,YAAYN;IAC3B,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA,SAASG,kBAAkBM,KAA8B;IACvD,MAAM,IAAInB,YAAYmB,MAAMhB,OAAO,EAAEgB,MAAMf,IAAI,EAAE;QAACgB,QAAQ;IAAG;AAC/D"}

package/dist/presentation/auth/jwt-auth.d.ts

@@ -0,0 +1,10 @@
+import { type UserContext } from '@shipfox/api-auth-context';
+import type { AuthMethod } from '@shipfox/node-fastify';
+import type { FastifyRequest } from 'fastify';
+export type ClientContext = UserContext;
+export interface CreateJwtAuthMethodOptions {
+    secret: string;
+}
+export declare function getClientContext(request: FastifyRequest): ClientContext | null;
+export declare function createJwtAuthMethod(): AuthMethod;
+//# sourceMappingURL=jwt-auth.d.ts.map

package/dist/presentation/auth/jwt-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/jwt-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAK5C,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AAExC,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,GAAG,IAAI,CAE9E;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAehD"}

package/dist/presentation/auth/jwt-auth.js

@@ -0,0 +1,31 @@
+import { AUTH_USER, buildUserContext, getUserContext, setUserContext } from '@shipfox/api-auth-context';
+import { config } from '#config.js';
+import { verifyUserToken } from '#core/jwt.js';
+import { createBearerTokenAuthMethod } from './bearer-token-auth.js';
+export function getClientContext(request) {
+    return getUserContext(request);
+}
+export function createJwtAuthMethod() {
+    return createBearerTokenAuthMethod({
+        name: AUTH_USER,
+        verifyToken: (token)=>verifyUserToken({
+                token,
+                secret: config.AUTH_JWT_SECRET
+            }),
+        invalidTokenError: {
+            message: 'Invalid or expired token',
+            code: 'unauthorized'
+        },
+        setContext: (request, claims)=>{
+            const clientContext = buildUserContext({
+                userId: claims.sub,
+                email: claims.email,
+                name: claims.name ?? null,
+                memberships: claims.memberships
+            });
+            setUserContext(request, clientContext);
+        }
+    });
+}
+
+//# sourceMappingURL=jwt-auth.js.map

package/dist/presentation/auth/jwt-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/auth/jwt-auth.ts"],"sourcesContent":["import {\n  AUTH_USER,\n  buildUserContext,\n  getUserContext,\n  setUserContext,\n  type UserContext,\n} from '@shipfox/api-auth-context';\nimport type {AuthMethod} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport {config} from '#config.js';\nimport {verifyUserToken} from '#core/jwt.js';\nimport {createBearerTokenAuthMethod} from './bearer-token-auth.js';\n\nexport type ClientContext = UserContext;\n\nexport interface CreateJwtAuthMethodOptions {\n  secret: string;\n}\n\nexport function getClientContext(request: FastifyRequest): ClientContext | null {\n  return getUserContext(request);\n}\n\nexport function createJwtAuthMethod(): AuthMethod {\n  return createBearerTokenAuthMethod({\n    name: AUTH_USER,\n    verifyToken: (token) => verifyUserToken({token, secret: config.AUTH_JWT_SECRET}),\n    invalidTokenError: {message: 'Invalid or expired token', code: 'unauthorized'},\n    setContext: (request, claims) => {\n      const clientContext: ClientContext = buildUserContext({\n        userId: claims.sub,\n        email: claims.email,\n        name: claims.name ?? null,\n        memberships: claims.memberships,\n      });\n      setUserContext(request, clientContext);\n    },\n  });\n}\n"],"names":["AUTH_USER","buildUserContext","getUserContext","setUserContext","config","verifyUserToken","createBearerTokenAuthMethod","getClientContext","request","createJwtAuthMethod","name","verifyToken","token","secret","AUTH_JWT_SECRET","invalidTokenError","message","code","setContext","claims","clientContext","userId","sub","email","memberships"],"mappings":"AAAA,SACEA,SAAS,EACTC,gBAAgB,EAChBC,cAAc,EACdC,cAAc,QAET,4BAA4B;AAGnC,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,eAAe,QAAO,eAAe;AAC7C,SAAQC,2BAA2B,QAAO,yBAAyB;AAQnE,OAAO,SAASC,iBAAiBC,OAAuB;IACtD,OAAON,eAAeM;AACxB;AAEA,OAAO,SAASC;IACd,OAAOH,4BAA4B;QACjCI,MAAMV;QACNW,aAAa,CAACC,QAAUP,gBAAgB;gBAACO;gBAAOC,QAAQT,OAAOU,eAAe;YAAA;QAC9EC,mBAAmB;YAACC,SAAS;YAA4BC,MAAM;QAAc;QAC7EC,YAAY,CAACV,SAASW;YACpB,MAAMC,gBAA+BnB,iBAAiB;gBACpDoB,QAAQF,OAAOG,GAAG;gBAClBC,OAAOJ,OAAOI,KAAK;gBACnBb,MAAMS,OAAOT,IAAI,IAAI;gBACrBc,aAAaL,OAAOK,WAAW;YACjC;YACArB,eAAeK,SAASY;QAC1B;IACF;AACF"}

package/dist/presentation/auth/lease-token-auth.d.ts

@@ -0,0 +1,15 @@
+import type { AuthMethod } from '@shipfox/node-fastify';
+/**
+ * Trust boundary: the signed token is the sole authority — `claims.jobId` scopes
+ * every runner request to exactly one job. `workflowRunId`/`workflowRunAttemptId`/`workspaceId`
+ * are carried for consumers but are NOT verified against the database here.
+ *
+ * Revocation tradeoff: `runnerSessionId` is carried in the claims but is not checked
+ * against runner-session storage, so a lease minted before its registration token is
+ * revoked stays usable until it expires (`AUTH_JOB_LEASE_TOKEN_EXPIRES_IN`, 90m).
+ * Accepted deliberately for a short-lived, job-scoped capability token; tightening
+ * this would mean a per-request DB lookup on the hot status-reporting path. See the
+ * "Security model" section in the package README for the full rationale.
+ */
+export declare function createLeaseTokenAuthMethod(): AuthMethod;
+//# sourceMappingURL=lease-token-auth.d.ts.map

package/dist/presentation/auth/lease-token-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-token-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/lease-token-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAItD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,IAAI,UAAU,CAOvD"}

package/dist/presentation/auth/lease-token-auth.js

@@ -0,0 +1,27 @@
+import { AUTH_LEASED_JOB, setLeasedJobContext } from '@shipfox/api-auth-context';
+import { verifyJobLeaseToken } from '#core/job-lease-token.js';
+import { createBearerTokenAuthMethod } from './bearer-token-auth.js';
+/**
+ * Trust boundary: the signed token is the sole authority — `claims.jobId` scopes
+ * every runner request to exactly one job. `workflowRunId`/`workflowRunAttemptId`/`workspaceId`
+ * are carried for consumers but are NOT verified against the database here.
+ *
+ * Revocation tradeoff: `runnerSessionId` is carried in the claims but is not checked
+ * against runner-session storage, so a lease minted before its registration token is
+ * revoked stays usable until it expires (`AUTH_JOB_LEASE_TOKEN_EXPIRES_IN`, 90m).
+ * Accepted deliberately for a short-lived, job-scoped capability token; tightening
+ * this would mean a per-request DB lookup on the hot status-reporting path. See the
+ * "Security model" section in the package README for the full rationale.
+ */ export function createLeaseTokenAuthMethod() {
+    return createBearerTokenAuthMethod({
+        name: AUTH_LEASED_JOB,
+        verifyToken: verifyJobLeaseToken,
+        invalidTokenError: {
+            message: 'Invalid or expired job lease token',
+            code: 'unauthorized'
+        },
+        setContext: setLeasedJobContext
+    });
+}
+
+//# sourceMappingURL=lease-token-auth.js.map

package/dist/presentation/auth/lease-token-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/auth/lease-token-auth.ts"],"sourcesContent":["import {AUTH_LEASED_JOB, setLeasedJobContext} from '@shipfox/api-auth-context';\nimport type {AuthMethod} from '@shipfox/node-fastify';\nimport {verifyJobLeaseToken} from '#core/job-lease-token.js';\nimport {createBearerTokenAuthMethod} from './bearer-token-auth.js';\n\n/**\n * Trust boundary: the signed token is the sole authority — `claims.jobId` scopes\n * every runner request to exactly one job. `workflowRunId`/`workflowRunAttemptId`/`workspaceId`\n * are carried for consumers but are NOT verified against the database here.\n *\n * Revocation tradeoff: `runnerSessionId` is carried in the claims but is not checked\n * against runner-session storage, so a lease minted before its registration token is\n * revoked stays usable until it expires (`AUTH_JOB_LEASE_TOKEN_EXPIRES_IN`, 90m).\n * Accepted deliberately for a short-lived, job-scoped capability token; tightening\n * this would mean a per-request DB lookup on the hot status-reporting path. See the\n * \"Security model\" section in the package README for the full rationale.\n */\nexport function createLeaseTokenAuthMethod(): AuthMethod {\n  return createBearerTokenAuthMethod({\n    name: AUTH_LEASED_JOB,\n    verifyToken: verifyJobLeaseToken,\n    invalidTokenError: {message: 'Invalid or expired job lease token', code: 'unauthorized'},\n    setContext: setLeasedJobContext,\n  });\n}\n"],"names":["AUTH_LEASED_JOB","setLeasedJobContext","verifyJobLeaseToken","createBearerTokenAuthMethod","createLeaseTokenAuthMethod","name","verifyToken","invalidTokenError","message","code","setContext"],"mappings":"AAAA,SAAQA,eAAe,EAAEC,mBAAmB,QAAO,4BAA4B;AAE/E,SAAQC,mBAAmB,QAAO,2BAA2B;AAC7D,SAAQC,2BAA2B,QAAO,yBAAyB;AAEnE;;;;;;;;;;;CAWC,GACD,OAAO,SAASC;IACd,OAAOD,4BAA4B;QACjCE,MAAML;QACNM,aAAaJ;QACbK,mBAAmB;YAACC,SAAS;YAAsCC,MAAM;QAAc;QACvFC,YAAYT;IACd;AACF"}

package/dist/presentation/auth/refresh-cookie.d.ts

@@ -0,0 +1,7 @@
+import cookie from '@fastify/cookie';
+import type { FastifyReply, FastifyRequest } from 'fastify';
+export declare const authCookiePlugin: typeof cookie;
+export declare function getRefreshTokenCookie(request: FastifyRequest): string | undefined;
+export declare function setRefreshTokenCookie(reply: FastifyReply, refreshToken: string): void;
+export declare function clearRefreshTokenCookie(reply: FastifyReply): void;
+//# sourceMappingURL=refresh-cookie.d.ts.map

package/dist/presentation/auth/refresh-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-cookie.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/refresh-cookie.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,KAAK,EAAC,YAAY,EAAE,cAAc,EAAC,MAAM,SAAS,CAAC;AAK1D,eAAO,MAAM,gBAAgB,eAAS,CAAC;AAMvC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAEjF;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAQrF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAOjE"}

package/dist/presentation/auth/refresh-cookie.js

@@ -0,0 +1,29 @@
+import cookie from '@fastify/cookie';
+import { config } from '#config.js';
+const REFRESH_COOKIE_PATH = '/auth';
+export const authCookiePlugin = cookie;
+function refreshCookieMaxAgeSeconds() {
+    return config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS * 24 * 60 * 60;
+}
+export function getRefreshTokenCookie(request) {
+    return request.cookies[config.AUTH_REFRESH_COOKIE_NAME];
+}
+export function setRefreshTokenCookie(reply, refreshToken) {
+    reply.setCookie(config.AUTH_REFRESH_COOKIE_NAME, refreshToken, {
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        path: REFRESH_COOKIE_PATH,
+        maxAge: refreshCookieMaxAgeSeconds()
+    });
+}
+export function clearRefreshTokenCookie(reply) {
+    reply.clearCookie(config.AUTH_REFRESH_COOKIE_NAME, {
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        path: REFRESH_COOKIE_PATH
+    });
+}
+
+//# sourceMappingURL=refresh-cookie.js.map

package/dist/presentation/auth/refresh-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/auth/refresh-cookie.ts"],"sourcesContent":["import cookie from '@fastify/cookie';\nimport type {FastifyReply, FastifyRequest} from 'fastify';\nimport {config} from '#config.js';\n\nconst REFRESH_COOKIE_PATH = '/auth';\n\nexport const authCookiePlugin = cookie;\n\nfunction refreshCookieMaxAgeSeconds(): number {\n  return config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS * 24 * 60 * 60;\n}\n\nexport function getRefreshTokenCookie(request: FastifyRequest): string | undefined {\n  return request.cookies[config.AUTH_REFRESH_COOKIE_NAME];\n}\n\nexport function setRefreshTokenCookie(reply: FastifyReply, refreshToken: string): void {\n  reply.setCookie(config.AUTH_REFRESH_COOKIE_NAME, refreshToken, {\n    httpOnly: true,\n    secure: true,\n    sameSite: 'lax',\n    path: REFRESH_COOKIE_PATH,\n    maxAge: refreshCookieMaxAgeSeconds(),\n  });\n}\n\nexport function clearRefreshTokenCookie(reply: FastifyReply): void {\n  reply.clearCookie(config.AUTH_REFRESH_COOKIE_NAME, {\n    httpOnly: true,\n    secure: true,\n    sameSite: 'lax',\n    path: REFRESH_COOKIE_PATH,\n  });\n}\n"],"names":["cookie","config","REFRESH_COOKIE_PATH","authCookiePlugin","refreshCookieMaxAgeSeconds","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","getRefreshTokenCookie","request","cookies","AUTH_REFRESH_COOKIE_NAME","setRefreshTokenCookie","reply","refreshToken","setCookie","httpOnly","secure","sameSite","path","maxAge","clearRefreshTokenCookie","clearCookie"],"mappings":"AAAA,OAAOA,YAAY,kBAAkB;AAErC,SAAQC,MAAM,QAAO,aAAa;AAElC,MAAMC,sBAAsB;AAE5B,OAAO,MAAMC,mBAAmBH,OAAO;AAEvC,SAASI;IACP,OAAOH,OAAOI,kCAAkC,GAAG,KAAK,KAAK;AAC/D;AAEA,OAAO,SAASC,sBAAsBC,OAAuB;IAC3D,OAAOA,QAAQC,OAAO,CAACP,OAAOQ,wBAAwB,CAAC;AACzD;AAEA,OAAO,SAASC,sBAAsBC,KAAmB,EAAEC,YAAoB;IAC7ED,MAAME,SAAS,CAACZ,OAAOQ,wBAAwB,EAAEG,cAAc;QAC7DE,UAAU;QACVC,QAAQ;QACRC,UAAU;QACVC,MAAMf;QACNgB,QAAQd;IACV;AACF;AAEA,OAAO,SAASe,wBAAwBR,KAAmB;IACzDA,MAAMS,WAAW,CAACnB,OAAOQ,wBAAwB,EAAE;QACjDK,UAAU;QACVC,QAAQ;QACRC,UAAU;QACVC,MAAMf;IACR;AACF"}

package/dist/presentation/auth/runner-session-auth.d.ts

@@ -0,0 +1,3 @@
+import type { AuthMethod } from '@shipfox/node-fastify';
+export declare function createRunnerSessionAuthMethod(): AuthMethod;
+//# sourceMappingURL=runner-session-auth.d.ts.map

package/dist/presentation/auth/runner-session-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-session-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/runner-session-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAItD,wBAAgB,6BAA6B,IAAI,UAAU,CAO1D"}

package/dist/presentation/auth/runner-session-auth.js

@@ -0,0 +1,16 @@
+import { AUTH_RUNNER_SESSION, setRunnerSessionContext } from '@shipfox/api-auth-context';
+import { verifyRunnerSessionToken } from '#core/runner-session-token.js';
+import { createBearerTokenAuthMethod } from './bearer-token-auth.js';
+export function createRunnerSessionAuthMethod() {
+    return createBearerTokenAuthMethod({
+        name: AUTH_RUNNER_SESSION,
+        verifyToken: verifyRunnerSessionToken,
+        invalidTokenError: {
+            message: 'Invalid or expired runner session token',
+            code: 'unauthorized'
+        },
+        setContext: setRunnerSessionContext
+    });
+}
+
+//# sourceMappingURL=runner-session-auth.js.map

package/dist/presentation/auth/runner-session-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/auth/runner-session-auth.ts"],"sourcesContent":["import {AUTH_RUNNER_SESSION, setRunnerSessionContext} from '@shipfox/api-auth-context';\nimport type {AuthMethod} from '@shipfox/node-fastify';\nimport {verifyRunnerSessionToken} from '#core/runner-session-token.js';\nimport {createBearerTokenAuthMethod} from './bearer-token-auth.js';\n\nexport function createRunnerSessionAuthMethod(): AuthMethod {\n  return createBearerTokenAuthMethod({\n    name: AUTH_RUNNER_SESSION,\n    verifyToken: verifyRunnerSessionToken,\n    invalidTokenError: {message: 'Invalid or expired runner session token', code: 'unauthorized'},\n    setContext: setRunnerSessionContext,\n  });\n}\n"],"names":["AUTH_RUNNER_SESSION","setRunnerSessionContext","verifyRunnerSessionToken","createBearerTokenAuthMethod","createRunnerSessionAuthMethod","name","verifyToken","invalidTokenError","message","code","setContext"],"mappings":"AAAA,SAAQA,mBAAmB,EAAEC,uBAAuB,QAAO,4BAA4B;AAEvF,SAAQC,wBAAwB,QAAO,gCAAgC;AACvE,SAAQC,2BAA2B,QAAO,yBAAyB;AAEnE,OAAO,SAASC;IACd,OAAOD,4BAA4B;QACjCE,MAAML;QACNM,aAAaJ;QACbK,mBAAmB;YAACC,SAAS;YAA2CC,MAAM;QAAc;QAC5FC,YAAYT;IACd;AACF"}

package/dist/presentation/dto/user.d.ts

@@ -0,0 +1,8 @@
+import type { LoginResponseDto, UserDto } from '@shipfox/api-auth-dto';
+import type { User } from '#core/entities/user.js';
+export declare function toUserDto(user: User): UserDto;
+export declare function toAuthSessionDto(result: {
+    token: string;
+    user: User;
+}): LoginResponseDto;
+//# sourceMappingURL=user.d.ts.map

package/dist/presentation/dto/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/presentation/dto/user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,gBAAgB,EAAE,OAAO,EAAC,MAAM,uBAAuB,CAAC;AACrE,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAU7C;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAC,GAAG,gBAAgB,CAKtF"}

package/dist/presentation/dto/user.js

@@ -0,0 +1,19 @@
+export function toUserDto(user) {
+    return {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        email_verified_at: user.emailVerifiedAt ? user.emailVerifiedAt.toISOString() : null,
+        status: user.status,
+        created_at: user.createdAt.toISOString(),
+        updated_at: user.updatedAt.toISOString()
+    };
+}
+export function toAuthSessionDto(result) {
+    return {
+        token: result.token,
+        user: toUserDto(result.user)
+    };
+}
+
+//# sourceMappingURL=user.js.map

package/dist/presentation/dto/user.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/dto/user.ts"],"sourcesContent":["import type {LoginResponseDto, UserDto} from '@shipfox/api-auth-dto';\nimport type {User} from '#core/entities/user.js';\n\nexport function toUserDto(user: User): UserDto {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    email_verified_at: user.emailVerifiedAt ? user.emailVerifiedAt.toISOString() : null,\n    status: user.status,\n    created_at: user.createdAt.toISOString(),\n    updated_at: user.updatedAt.toISOString(),\n  };\n}\n\nexport function toAuthSessionDto(result: {token: string; user: User}): LoginResponseDto {\n  return {\n    token: result.token,\n    user: toUserDto(result.user),\n  };\n}\n"],"names":["toUserDto","user","id","email","name","email_verified_at","emailVerifiedAt","toISOString","status","created_at","createdAt","updated_at","updatedAt","toAuthSessionDto","result","token"],"mappings":"AAGA,OAAO,SAASA,UAAUC,IAAU;IAClC,OAAO;QACLC,IAAID,KAAKC,EAAE;QACXC,OAAOF,KAAKE,KAAK;QACjBC,MAAMH,KAAKG,IAAI;QACfC,mBAAmBJ,KAAKK,eAAe,GAAGL,KAAKK,eAAe,CAACC,WAAW,KAAK;QAC/EC,QAAQP,KAAKO,MAAM;QACnBC,YAAYR,KAAKS,SAAS,CAACH,WAAW;QACtCI,YAAYV,KAAKW,SAAS,CAACL,WAAW;IACxC;AACF;AAEA,OAAO,SAASM,iBAAiBC,MAAmC;IAClE,OAAO;QACLC,OAAOD,OAAOC,KAAK;QACnBd,MAAMD,UAAUc,OAAOb,IAAI;IAC7B;AACF"}

package/dist/presentation/e2eRoutes/create-session.d.ts

@@ -0,0 +1,2 @@
+export declare const createE2eSessionRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=create-session.d.ts.map

package/dist/presentation/e2eRoutes/create-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-session.d.ts","sourceRoot":"","sources":["../../../src/presentation/e2eRoutes/create-session.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,qBAAqB,iDA+BhC,CAAC"}

package/dist/presentation/e2eRoutes/create-session.js

@@ -0,0 +1,49 @@
+import { e2eCreateSessionBodySchema, e2eCreateSessionResponseSchema } from '@shipfox/api-auth-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { createSessionForUser } from '#core/auth.js';
+import { EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError } from '#core/errors.js';
+import { setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
+import { toAuthSessionDto } from '#presentation/dto/user.js';
+export const createE2eSessionRoute = defineRoute({
+    method: 'POST',
+    path: '/sessions',
+    description: 'Create an authenticated browser session for E2E tests.',
+    schema: {
+        body: e2eCreateSessionBodySchema,
+        response: {
+            200: e2eCreateSessionResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof UserNotFoundError) {
+            throw new ClientError('User not found', 'user-not-found', {
+                status: 404
+            });
+        }
+        if (error instanceof EmailNotVerifiedError) {
+            throw new ClientError('Email not verified', 'email-not-verified', {
+                status: 403
+            });
+        }
+        if (error instanceof InvalidCredentialsError) {
+            throw new ClientError('User is not active', 'user-inactive', {
+                status: 409
+            });
+        }
+        throw error;
+    },
+    handler: async (request, reply)=>{
+        const result = await createSessionForUser({
+            ...request.body.user_id ? {
+                userId: request.body.user_id
+            } : {},
+            ...request.body.email ? {
+                email: request.body.email
+            } : {}
+        });
+        setRefreshTokenCookie(reply, result.refreshToken);
+        return toAuthSessionDto(result);
+    }
+});
+
+//# sourceMappingURL=create-session.js.map

package/dist/presentation/e2eRoutes/create-session.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/e2eRoutes/create-session.ts"],"sourcesContent":["import {e2eCreateSessionBodySchema, e2eCreateSessionResponseSchema} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {createSessionForUser} from '#core/auth.js';\nimport {EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError} from '#core/errors.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toAuthSessionDto} from '#presentation/dto/user.js';\n\nexport const createE2eSessionRoute = defineRoute({\n  method: 'POST',\n  path: '/sessions',\n  description: 'Create an authenticated browser session for E2E tests.',\n  schema: {\n    body: e2eCreateSessionBodySchema,\n    response: {\n      200: e2eCreateSessionResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof UserNotFoundError) {\n      throw new ClientError('User not found', 'user-not-found', {status: 404});\n    }\n    if (error instanceof EmailNotVerifiedError) {\n      throw new ClientError('Email not verified', 'email-not-verified', {status: 403});\n    }\n    if (error instanceof InvalidCredentialsError) {\n      throw new ClientError('User is not active', 'user-inactive', {status: 409});\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const result = await createSessionForUser({\n      ...(request.body.user_id ? {userId: request.body.user_id} : {}),\n      ...(request.body.email ? {email: request.body.email} : {}),\n    });\n\n    setRefreshTokenCookie(reply, result.refreshToken);\n    return toAuthSessionDto(result);\n  },\n});\n"],"names":["e2eCreateSessionBodySchema","e2eCreateSessionResponseSchema","ClientError","defineRoute","createSessionForUser","EmailNotVerifiedError","InvalidCredentialsError","UserNotFoundError","setRefreshTokenCookie","toAuthSessionDto","createE2eSessionRoute","method","path","description","schema","body","response","errorHandler","error","status","handler","request","reply","result","user_id","userId","email","refreshToken"],"mappings":"AAAA,SAAQA,0BAA0B,EAAEC,8BAA8B,QAAO,wBAAwB;AACjG,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,oBAAoB,QAAO,gBAAgB;AACnD,SAAQC,qBAAqB,EAAEC,uBAAuB,EAAEC,iBAAiB,QAAO,kBAAkB;AAClG,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,gBAAgB,QAAO,4BAA4B;AAE3D,OAAO,MAAMC,wBAAwBP,YAAY;IAC/CQ,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMf;QACNgB,UAAU;YACR,KAAKf;QACP;IACF;IACAgB,cAAc,CAACC;QACb,IAAIA,iBAAiBX,mBAAmB;YACtC,MAAM,IAAIL,YAAY,kBAAkB,kBAAkB;gBAACiB,QAAQ;YAAG;QACxE;QACA,IAAID,iBAAiBb,uBAAuB;YAC1C,MAAM,IAAIH,YAAY,sBAAsB,sBAAsB;gBAACiB,QAAQ;YAAG;QAChF;QACA,IAAID,iBAAiBZ,yBAAyB;YAC5C,MAAM,IAAIJ,YAAY,sBAAsB,iBAAiB;gBAACiB,QAAQ;YAAG;QAC3E;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC,SAASC;QACvB,MAAMC,SAAS,MAAMnB,qBAAqB;YACxC,GAAIiB,QAAQN,IAAI,CAACS,OAAO,GAAG;gBAACC,QAAQJ,QAAQN,IAAI,CAACS,OAAO;YAAA,IAAI,CAAC,CAAC;YAC9D,GAAIH,QAAQN,IAAI,CAACW,KAAK,GAAG;gBAACA,OAAOL,QAAQN,IAAI,CAACW,KAAK;YAAA,IAAI,CAAC,CAAC;QAC3D;QAEAlB,sBAAsBc,OAAOC,OAAOI,YAAY;QAChD,OAAOlB,iBAAiBc;IAC1B;AACF,GAAG"}

package/dist/presentation/e2eRoutes/create-user.d.ts

@@ -0,0 +1,2 @@
+export declare const createE2eUserRoute: import("@shipfox/node-fastify").RouteDefinition;
+//# sourceMappingURL=create-user.d.ts.map

package/dist/presentation/e2eRoutes/create-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-user.d.ts","sourceRoot":"","sources":["../../../src/presentation/e2eRoutes/create-user.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,kBAAkB,iDA+B7B,CAAC"}

package/dist/presentation/e2eRoutes/create-user.js

@@ -0,0 +1,42 @@
+import { e2eCreateUserBodySchema, e2eCreateUserResponseSchema } from '@shipfox/api-auth-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { createUser } from '#core/auth.js';
+import { EmailTakenError } from '#core/errors.js';
+import { toUserDto } from '#presentation/dto/user.js';
+export const createE2eUserRoute = defineRoute({
+    method: 'POST',
+    path: '/users',
+    description: 'Create a user for E2E tests.',
+    schema: {
+        body: e2eCreateUserBodySchema,
+        response: {
+            201: e2eCreateUserResponseSchema
+        }
+    },
+    errorHandler: (error)=>{
+        if (error instanceof EmailTakenError) {
+            throw new ClientError('Email already registered', 'email-taken', {
+                status: 409
+            });
+        }
+        throw error;
+    },
+    handler: async (request, reply)=>{
+        const user = await createUser({
+            email: request.body.email,
+            password: request.body.password,
+            verified: request.body.verified,
+            ...request.body.name ? {
+                name: request.body.name
+            } : {}
+        });
+        reply.code(201);
+        return {
+            user: toUserDto(user),
+            email: user.email,
+            password: request.body.password
+        };
+    }
+});
+
+//# sourceMappingURL=create-user.js.map

package/dist/presentation/e2eRoutes/create-user.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/e2eRoutes/create-user.ts"],"sourcesContent":["import {e2eCreateUserBodySchema, e2eCreateUserResponseSchema} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {createUser} from '#core/auth.js';\nimport {EmailTakenError} from '#core/errors.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nexport const createE2eUserRoute = defineRoute({\n  method: 'POST',\n  path: '/users',\n  description: 'Create a user for E2E tests.',\n  schema: {\n    body: e2eCreateUserBodySchema,\n    response: {\n      201: e2eCreateUserResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof EmailTakenError) {\n      throw new ClientError('Email already registered', 'email-taken', {status: 409});\n    }\n    throw error;\n  },\n  handler: async (request, reply) => {\n    const user = await createUser({\n      email: request.body.email,\n      password: request.body.password,\n      verified: request.body.verified,\n      ...(request.body.name ? {name: request.body.name} : {}),\n    });\n\n    reply.code(201);\n    return {\n      user: toUserDto(user),\n      email: user.email,\n      password: request.body.password,\n    };\n  },\n});\n"],"names":["e2eCreateUserBodySchema","e2eCreateUserResponseSchema","ClientError","defineRoute","createUser","EmailTakenError","toUserDto","createE2eUserRoute","method","path","description","schema","body","response","errorHandler","error","status","handler","request","reply","user","email","password","verified","name","code"],"mappings":"AAAA,SAAQA,uBAAuB,EAAEC,2BAA2B,QAAO,wBAAwB;AAC3F,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,UAAU,QAAO,gBAAgB;AACzC,SAAQC,eAAe,QAAO,kBAAkB;AAChD,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,OAAO,MAAMC,qBAAqBJ,YAAY;IAC5CK,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAMZ;QACNa,UAAU;YACR,KAAKZ;QACP;IACF;IACAa,cAAc,CAACC;QACb,IAAIA,iBAAiBV,iBAAiB;YACpC,MAAM,IAAIH,YAAY,4BAA4B,eAAe;gBAACc,QAAQ;YAAG;QAC/E;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC,SAASC;QACvB,MAAMC,OAAO,MAAMhB,WAAW;YAC5BiB,OAAOH,QAAQN,IAAI,CAACS,KAAK;YACzBC,UAAUJ,QAAQN,IAAI,CAACU,QAAQ;YAC/BC,UAAUL,QAAQN,IAAI,CAACW,QAAQ;YAC/B,GAAIL,QAAQN,IAAI,CAACY,IAAI,GAAG;gBAACA,MAAMN,QAAQN,IAAI,CAACY,IAAI;YAAA,IAAI,CAAC,CAAC;QACxD;QAEAL,MAAMM,IAAI,CAAC;QACX,OAAO;YACLL,MAAMd,UAAUc;YAChBC,OAAOD,KAAKC,KAAK;YACjBC,UAAUJ,QAAQN,IAAI,CAACU,QAAQ;QACjC;IACF;AACF,GAAG"}

package/dist/presentation/e2eRoutes/index.d.ts

@@ -0,0 +1,3 @@
+import type { RouteGroup } from '@shipfox/node-fastify';
+export declare const authE2eRoutes: RouteGroup;
+//# sourceMappingURL=index.d.ts.map

package/dist/presentation/e2eRoutes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/e2eRoutes/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAItD,eAAO,MAAM,aAAa,EAAE,UAI3B,CAAC"}