@shipfox/api-auth 4.0.0 → 6.0.0

package/src/core/auth.test.ts

@@ -1,24 +1,20 @@
-import {
-  AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
-  AUTH_PASSWORD_RESET_SEND_REQUESTED,
-  EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS,
-} from '@shipfox/api-auth-dto';
+import {AUTH_PASSWORD_RESET_SEND_REQUESTED, AUTH_USER_SIGNED_UP} from '@shipfox/api-auth-dto';
+import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
 import type {Mailer, MailMessage} from '@shipfox/node-mailer';
 import {hashOpaqueToken} from '@shipfox/node-tokens';
 import {and, desc, eq, sql} from 'drizzle-orm';
 import {
   changePassword,
-  confirmEmailVerification,
-  confirmPasswordReset,
-  createSessionForUser,
+  confirmPasswordReset as coreConfirmPasswordReset,
+  createSessionForUser as coreCreateSessionForUser,
+  login as coreLogin,
+  refreshAccessToken as coreRefreshAccessToken,
   getCurrentUser,
-  login,
   logout,
   provisionUser,
-  refreshAccessToken,
   requestPasswordReset,
-  resendEmailVerification,
   signup,
+  signupWithInvitation,
 } from '#core/auth.js';
 import {
   AuthDependencyUnavailableError,
@@ -31,7 +27,6 @@ import {
 import {verifyUserToken} from '#core/jwt.js';
 import {db} from '#db/db.js';
 import * as refreshTokenDb from '#db/refresh-tokens.js';
-import {emailVerifications} from '#db/schema/email-verifications.js';
 import {authOutbox} from '#db/schema/outbox.js';
 import {passwordResets} from '#db/schema/password-resets.js';
 import {refreshTokens} from '#db/schema/refresh-tokens.js';
@@ -62,7 +57,6 @@ const testConfig = vi.hoisted(
 
 vi.mock('#config.js', () => ({
   config: {
-    AUTH_JWT_SECRET: 'auth-core-test-secret',
     AUTH_JWT_EXPIRES_IN: '15m',
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: 30,
@@ -72,12 +66,25 @@ vi.mock('#config.js', () => ({
   mailer: testConfig.mailer,
 }));
 
-vi.mock('@shipfox/api-workspaces', () => ({
-  listMembershipsByUser: vi.fn(() => Promise.resolve([])),
-}));
+vi.mock('@shipfox/node-mailer', () => ({mailer: testConfig.mailer}));
 
-const {listMembershipsByUser} = await import('@shipfox/api-workspaces');
-const listMembershipsByUserMock = vi.mocked(listMembershipsByUser);
+const listMembershipsByUserMock = vi.fn(() =>
+  Promise.resolve({memberships: [] as Array<{workspaceId: string; role: 'admin'}>}),
+);
+const workspaces = {
+  listMembershipsForTokenClaims: listMembershipsByUserMock,
+  preflightInvitationAcceptance: vi.fn(),
+  acceptInvitation: vi.fn(),
+  requireActiveMembership: vi.fn(),
+};
+
+const login = (params: {email: string; password: string}) => coreLogin({...params, workspaces});
+const createSessionForUser = (params: {userId?: string; email?: string}) =>
+  coreCreateSessionForUser({...params, workspaces});
+const refreshAccessToken = (params: {refreshToken: string}) =>
+  coreRefreshAccessToken({...params, workspaces});
+const confirmPasswordReset = (params: {token: string; newPassword: string}) =>
+  coreConfirmPasswordReset({...params, workspaces});
 
 const TOKEN_RE = /token=([\w\-_=]+)/;
 
@@ -101,9 +108,8 @@ async function outboxEventsTo(email: string, eventType: string) {
 
 async function latestEmailLinkTo(email: string, eventType: string): Promise<string> {
   const event = (await outboxEventsTo(email, eventType))[0];
-  const payload = event?.payload as {verifyLink?: string; resetLink?: string} | undefined;
-  const link =
-    eventType === AUTH_EMAIL_VERIFICATION_SEND_REQUESTED ? payload?.verifyLink : payload?.resetLink;
+  const payload = event?.payload as {resetLink?: string} | undefined;
+  const link = payload?.resetLink;
   if (!link) throw new Error(`No ${eventType} outbox link for ${email}`);
   return link;
 }
@@ -128,14 +134,22 @@ describe('auth core', () => {
     expect(user.email).toBe(email);
     expect(user.name).toBe('Sign Up');
     expect(user.emailVerifiedAt).toBeNull();
-    expect(captured).toHaveLength(0);
-    expect(await latestEmailLinkTo(email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toContain(
-      `${testConfig.clientBaseUrl}/auth/verify-email?token=`,
-    );
+    expect(user.emailChallenge.id).toEqual(expect.any(String));
+    expect(user.emailChallenge.nextResendAvailableAt).toBeInstanceOf(Date);
+    expect(captured).toHaveLength(1);
+
+    const events = await outboxEventsTo(email, AUTH_USER_SIGNED_UP);
+    expect(events).toHaveLength(1);
+    expect(events[0]?.payload).toEqual({
+      userId: user.id,
+      email,
+      name: 'Sign Up',
+      viaInvitation: false,
+    });
   });
 
   test('signup rejects duplicate email with a business error', async () => {
-    const existing = await userFactory.create();
+    const existing = await userFactory.create({emailVerifiedAt: new Date()});
 
     const promise = signup({
       email: existing.email,
@@ -145,6 +159,33 @@ describe('auth core', () => {
     await expect(promise).rejects.toBeInstanceOf(EmailTakenError);
   });
 
+  test('signup with an invitation writes the signed-up event with its user insert', async () => {
+    const email = `signup-invitation-${crypto.randomUUID()}@example.com`;
+    const userId = crypto.randomUUID();
+    const workspaceId = crypto.randomUUID();
+    workspaces.preflightInvitationAcceptance.mockResolvedValueOnce(undefined);
+    workspaces.acceptInvitation.mockResolvedValueOnce({
+      membership: {id: crypto.randomUUID(), userId, workspaceId},
+    });
+
+    const result = await signupWithInvitation({
+      email,
+      password: 'correct horse battery staple',
+      name: 'Invited User',
+      invitationToken: `invite-${crypto.randomUUID()}`,
+      workspaces,
+    });
+
+    const events = await outboxEventsTo(email, AUTH_USER_SIGNED_UP);
+    expect(events).toHaveLength(1);
+    expect(events[0]?.payload).toEqual({
+      userId: result.user.id,
+      email,
+      name: 'Invited User',
+      viaInvitation: true,
+    });
+  });
+
   test('provisionUser creates a verified, password-less user with a normalized email', async () => {
     const email = `Provision-${crypto.randomUUID()}@EXAMPLE.COM`;
 
@@ -165,11 +206,11 @@ describe('auth core', () => {
     const storedSuspended = await findUserById({id: suspended.id});
 
     const existingUnverified = await provisionUser({
-      email: unverified.email.toUpperCase(),
+      email: `  ${unverified.email.toUpperCase()}  `,
       name: 'Replacement Name',
     });
     const existingSuspended = await provisionUser({
-      email: suspended.email.toUpperCase(),
+      email: `  ${suspended.email.toUpperCase()}  `,
       name: 'Replacement Name',
     });
 
@@ -257,6 +298,30 @@ describe('auth core', () => {
     );
   });
 
+  test('createSessionForUser({email}) resolves surrounding whitespace and mixed case', async () => {
+    const user = await userFactory.create({emailVerifiedAt: new Date()});
+
+    const result = await createSessionForUser({email: `  ${user.email.toUpperCase()}  `});
+
+    expect(result.user.id).toBe(user.id);
+    expect(result.token).toEqual(expect.any(String));
+  });
+
+  test('createSessionForUser({email}) retains eligibility checks', async () => {
+    const unverified = await userFactory.create();
+    const suspended = await userFactory.create({emailVerifiedAt: new Date()});
+    await db().update(users).set({status: 'suspended'}).where(eq(users.id, suspended.id));
+
+    const unverifiedExpectation = expect(
+      createSessionForUser({email: unverified.email}),
+    ).rejects.toBeInstanceOf(EmailNotVerifiedError);
+    const suspendedExpectation = expect(
+      createSessionForUser({email: suspended.email}),
+    ).rejects.toBeInstanceOf(InvalidCredentialsError);
+
+    await Promise.all([unverifiedExpectation, suspendedExpectation]);
+  });
+
   test('refreshAccessToken rotates the refresh token', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
     const loginResult = await login({email: user.email, password: user.plainPassword});
@@ -329,127 +394,6 @@ describe('auth core', () => {
     await expect(promise).rejects.toBeInstanceOf(TokenInvalidError);
   });
 
-  test('confirmEmailVerification marks the user verified, creates a session, and rejects reused tokens', async () => {
-    const user = await signup({
-      email: `verify-${crypto.randomUUID()}@example.com`,
-      password: 'correct horse battery staple',
-    });
-    const token = extractToken(
-      await latestEmailLinkTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    );
-
-    const result = await confirmEmailVerification({token});
-    const verified = await findUserById({id: user.id});
-    const refreshSession = await refreshTokenDb.findActiveRefreshTokenByHash({
-      hashedToken: hashOpaqueToken(result.refreshToken),
-    });
-    const reused = confirmEmailVerification({token});
-
-    expect(verified?.emailVerifiedAt).toBeInstanceOf(Date);
-    expect(result.token).toEqual(expect.any(String));
-    expect(result.user.id).toBe(user.id);
-    expect(refreshSession?.userId).toBe(user.id);
-    await expect(reused).rejects.toBeInstanceOf(TokenInvalidError);
-  });
-
-  test('resendEmailVerification only sends for active unverified users', async () => {
-    const unverified = await userFactory.create();
-    const verified = await userFactory.create({emailVerifiedAt: new Date()});
-    const inactive = await userFactory.create();
-    await db().update(users).set({status: 'suspended'}).where(eq(users.id, inactive.id));
-
-    const sent = await resendEmailVerification({email: unverified.email});
-    const verifiedResult = await resendEmailVerification({email: verified.email});
-    const inactiveResult = await resendEmailVerification({email: inactive.email});
-    const missingResult = await resendEmailVerification({
-      email: `missing-${crypto.randomUUID()}@example.com`,
-    });
-
-    expect(captured).toHaveLength(0);
-    expect(
-      await outboxEventsTo(unverified.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    ).toHaveLength(1);
-    expect(
-      await outboxEventsTo(verified.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    ).toHaveLength(0);
-    expect(
-      await outboxEventsTo(inactive.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    ).toHaveLength(0);
-    expect(sent.nextResendAvailableAt).toBeInstanceOf(Date);
-    expect(verifiedResult.nextResendAvailableAt).toBeInstanceOf(Date);
-    expect(inactiveResult.nextResendAvailableAt).toBeInstanceOf(Date);
-    expect(missingResult.nextResendAvailableAt).toBeInstanceOf(Date);
-  });
-
-  test('resendEmailVerification respects cooldown without invalidating the current token', async () => {
-    const user = await signup({
-      email: `resend-cooldown-${crypto.randomUUID()}@example.com`,
-      password: 'correct horse battery staple',
-    });
-    const token = extractToken(
-      await latestEmailLinkTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    );
-    const existingCreatedAt = new Date(
-      Date.now() - (EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS / 2) * 1000,
-    );
-    await db()
-      .update(emailVerifications)
-      .set({createdAt: existingCreatedAt})
-      .where(eq(emailVerifications.userId, user.id));
-
-    const beforeCall = Date.now();
-    const result = await resendEmailVerification({email: user.email});
-    const verified = await confirmEmailVerification({token});
-
-    // The cooldown branch must return the generic `now + cooldown` estimate, not
-    // `latest.createdAt + cooldown`, so the response cannot leak prior timing.
-    expect(result.nextResendAvailableAt.getTime()).toBeGreaterThanOrEqual(
-      beforeCall + EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS * 1000,
-    );
-    expect(captured).toHaveLength(0);
-    expect(await outboxEventsTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toHaveLength(
-      1,
-    );
-    expect(verified.user.id).toBe(user.id);
-  });
-
-  test('resendEmailVerification sends again after cooldown', async () => {
-    const user = await signup({
-      email: `resend-after-cooldown-${crypto.randomUUID()}@example.com`,
-      password: 'correct horse battery staple',
-    });
-    const staleCreatedAt = new Date(
-      Date.now() - (EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS + 1) * 1000,
-    );
-    await db()
-      .update(emailVerifications)
-      .set({createdAt: staleCreatedAt})
-      .where(eq(emailVerifications.userId, user.id));
-
-    const result = await resendEmailVerification({email: user.email});
-
-    expect(result.nextResendAvailableAt).toBeInstanceOf(Date);
-    expect(captured).toHaveLength(0);
-    expect(await outboxEventsTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toHaveLength(
-      2,
-    );
-  });
-
-  test('resendEmailVerification serializes duplicate requests for one user', async () => {
-    const user = await userFactory.create();
-
-    const results = await Promise.all([
-      resendEmailVerification({email: user.email}),
-      resendEmailVerification({email: user.email}),
-    ]);
-
-    expect(results).toHaveLength(2);
-    expect(captured).toHaveLength(0);
-    expect(await outboxEventsTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toHaveLength(
-      1,
-    );
-  });
-
   test('password reset request and confirm update the password and invalidate the token', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
     const loginResult = await login({email: user.email, password: user.plainPassword});
@@ -593,32 +537,16 @@ describe('auth core', () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
     const workspaceA = crypto.randomUUID();
     const workspaceB = crypto.randomUUID();
-    listMembershipsByUserMock.mockResolvedValueOnce([
-      {
-        id: crypto.randomUUID(),
-        userId: user.id,
-        userEmail: user.email,
-        userName: null,
-        workspaceId: workspaceA,
-        workspaceName: 'Workspace A',
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      },
-      {
-        id: crypto.randomUUID(),
-        userId: user.id,
-        userEmail: user.email,
-        userName: null,
-        workspaceId: workspaceB,
-        workspaceName: 'Workspace B',
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      },
-    ]);
+    listMembershipsByUserMock.mockResolvedValueOnce({
+      memberships: [
+        {workspaceId: workspaceA, role: 'admin'},
+        {workspaceId: workspaceB, role: 'admin'},
+      ],
+    });
 
     const result = await login({email: user.email, password: user.plainPassword});
 
-    const claims = await verifyUserToken({token: result.token, secret: 'auth-core-test-secret'});
+    const claims = await verifyUserToken({token: result.token, secret: userAccessTokenKey()});
     expect(claims.name).toBe(user.name);
     expect(claims.memberships).toEqual([
       {workspaceId: workspaceA, role: 'admin'},
@@ -628,27 +556,18 @@ describe('auth core', () => {
 
   test('refresh re-fetches memberships so newly-added workspaces appear in the next token', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
-    listMembershipsByUserMock.mockResolvedValueOnce([]);
+    listMembershipsByUserMock.mockResolvedValueOnce({memberships: []});
     const loginResult = await login({email: user.email, password: user.plainPassword});
 
     const newWorkspaceId = crypto.randomUUID();
-    listMembershipsByUserMock.mockResolvedValueOnce([
-      {
-        id: crypto.randomUUID(),
-        userId: user.id,
-        userEmail: user.email,
-        userName: null,
-        workspaceId: newWorkspaceId,
-        workspaceName: 'New Workspace',
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      },
-    ]);
+    listMembershipsByUserMock.mockResolvedValueOnce({
+      memberships: [{workspaceId: newWorkspaceId, role: 'admin'}],
+    });
     const refreshed = await refreshAccessToken({refreshToken: loginResult.refreshToken});
 
     const refreshedClaims = await verifyUserToken({
       token: refreshed.token,
-      secret: 'auth-core-test-secret',
+      secret: userAccessTokenKey(),
     });
     expect(refreshedClaims.memberships).toEqual([{workspaceId: newWorkspaceId, role: 'admin'}]);
   });
@@ -664,7 +583,7 @@ describe('auth core', () => {
 
   test('refresh fails closed when listMembershipsByUser throws', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
-    listMembershipsByUserMock.mockResolvedValueOnce([]);
+    listMembershipsByUserMock.mockResolvedValueOnce({memberships: []});
     const loginResult = await login({email: user.email, password: user.plainPassword});
 
     listMembershipsByUserMock.mockRejectedValueOnce(new Error('workspaces DB down'));