@shipfox/api-auth 5.0.0 → 6.0.0

package/src/presentation/routes/password/password-reset-confirm.ts

@@ -2,34 +2,37 @@ import {
   passwordResetConfirmBodySchema,
   passwordResetConfirmResponseSchema,
 } from '@shipfox/api-auth-dto';
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {confirmPasswordReset} from '#core/auth.js';
 import {TokenInvalidError} from '#core/errors.js';
 import {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';
 import {toAuthSessionDto} from '#presentation/dto/user.js';
 
-export const passwordResetConfirmRoute = defineRoute({
-  method: 'POST',
-  path: '/password-reset/confirm',
-  description: 'Set a new password using the link sent by email.',
-  schema: {
-    body: passwordResetConfirmBodySchema,
-    response: {
-      200: passwordResetConfirmResponseSchema,
+export function createPasswordResetConfirmRoute(workspaces: WorkspacesInterModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/password-reset/confirm',
+    description: 'Set a new password using the link sent by email.',
+    schema: {
+      body: passwordResetConfirmBodySchema,
+      response: {
+        200: passwordResetConfirmResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof TokenInvalidError) {
-      throw new ClientError('Reset token is invalid or expired', 'token-invalid', {status: 410});
-    }
-    throw error;
-  },
-  handler: async (request, reply) => {
-    const {token, new_password} = request.body;
+    errorHandler: (error) => {
+      if (error instanceof TokenInvalidError) {
+        throw new ClientError('Reset token is invalid or expired', 'token-invalid', {status: 410});
+      }
+      throw error;
+    },
+    handler: async (request, reply) => {
+      const {token, new_password} = request.body;
 
-    const result = await confirmPasswordReset({token, newPassword: new_password});
-    setRefreshTokenCookie(reply, result.refreshToken);
+      const result = await confirmPasswordReset({token, newPassword: new_password, workspaces});
+      setRefreshTokenCookie(reply, result.refreshToken);
 
-    return toAuthSessionDto(result);
-  },
-});
+      return toAuthSessionDto(result);
+    },
+  });
+}

package/src/presentation/routes/password/password-reset-request.test.ts

@@ -27,6 +27,7 @@ describe('POST /auth/password-reset', () => {
 
   test('returns 204 and sends reset mail for an active account', async () => {
     const account = await signupVerifyLogin(app, 'reset-request');
+    resetCapturedMail();
 
     const res = await app.inject({
       method: 'POST',

package/src/presentation/routes/rate-limit.test.ts

@@ -210,13 +210,13 @@ describe('auth rate-limit routes', () => {
       method: 'POST',
       url: '/auth/password-reset',
       headers: {'x-forwarded-for': uniqueIp()},
-      payload: {email: account.email},
+      payload: {email: account.email, challenge_id: account.emailChallengeId},
     });
     const blockedResend = await app.inject({
       method: 'POST',
       url: '/auth/verify-email/resend',
       headers: {'x-forwarded-for': uniqueIp()},
-      payload: {email: account.email},
+      payload: {email: account.email, challenge_id: account.emailChallengeId},
     });
 
     expect(blockedReset.statusCode).toBe(429);

package/src/presentation/routes/registration/signup.test.ts

@@ -1,4 +1,5 @@
-import {AUTH_EMAIL_VERIFICATION_SEND_REQUESTED} from '@shipfox/api-auth-dto';
+import {workspacesInterModuleContract} from '@shipfox/api-workspaces-dto/inter-module';
+import {createInterModuleKnownError} from '@shipfox/inter-module';
 import type {FastifyInstance} from 'fastify';
 import {verifyUserToken} from '#core/jwt.js';
 import {
@@ -6,9 +7,7 @@ import {
   capturedMail,
   createAuthTestApp,
   getSetCookie,
-  latestEmailLinkTo,
   listMembershipsByUserMock,
-  outboxEventsTo,
   peekInvitationByRawTokenMock,
   ROUTE_TEST_SECRET,
   resetCapturedMail,
@@ -36,7 +35,7 @@ describe('POST /auth/signup', () => {
     const email = uniqueEmail('signup');
 
     const res = await signup(app, {
-      email: email.toUpperCase(),
+      email: `  ${email.toUpperCase()}  `,
       password,
       name: '  New User  ',
     });
@@ -45,10 +44,11 @@ describe('POST /auth/signup', () => {
     expect(res.json().user.email).toBe(email);
     expect(res.json().user.name).toBe('New User');
     expect(res.json().user.email_verified_at).toBeNull();
-    expect(await latestEmailLinkTo(email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toContain(
-      '/auth/verify-email?token=',
-    );
-    expect(capturedMail()).toHaveLength(0);
+    expect(res.json().email_challenge).toEqual({
+      id: expect.any(String),
+      next_resend_available_at: expect.any(String),
+    });
+    expect(capturedMail()).toHaveLength(1);
   });
 
   test.each([
@@ -72,14 +72,24 @@ describe('POST /auth/signup', () => {
     expect(res.statusCode).toBe(400);
   });
 
-  test('transforms duplicate email into 409', async () => {
+  test('resumes verification when an unverified user retries signup with the same password', async () => {
     const email = uniqueEmail('duplicate');
     await signup(app, {email, password});
 
     const res = await signup(app, {email, password});
 
-    expect(res.statusCode).toBe(409);
-    expect(res.json().code).toBe('email-taken');
+    expect(res.statusCode).toBe(201);
+    expect(res.json().email_challenge.id).toEqual(expect.any(String));
+  });
+
+  test('normalizes email when resuming verification', async () => {
+    const email = uniqueEmail('duplicate-equivalent');
+    await signup(app, {email, password});
+
+    const res = await signup(app, {email: `  ${email.toUpperCase()}  `, password});
+
+    expect(res.statusCode).toBe(201);
+    expect(res.json().email_challenge.id).toEqual(expect.any(String));
   });
 
   test('accepts a valid invitation during signup and skips verification email', async () => {
@@ -93,6 +103,7 @@ describe('POST /auth/signup', () => {
       email,
       hashedToken: 'hashed',
       expiresAt: new Date(Date.now() + 86_400_000),
+      revokedAt: null,
       acceptedAt: null,
       acceptedByUserId: null,
       invitedByUserId: crypto.randomUUID(),
@@ -107,6 +118,7 @@ describe('POST /auth/signup', () => {
         email,
         hashedToken: 'hashed',
         expiresAt: new Date(Date.now() + 86_400_000),
+        revokedAt: null,
         acceptedAt: new Date(),
         acceptedByUserId: params.userId,
         invitedByUserId: crypto.randomUUID(),
@@ -126,18 +138,9 @@ describe('POST /auth/signup', () => {
       },
       alreadyMember: false,
     }));
-    listMembershipsByUserMock.mockResolvedValueOnce([
-      {
-        id: membershipId,
-        userId: crypto.randomUUID(),
-        userEmail: email,
-        userName: 'Invitee',
-        workspaceId,
-        workspaceName: 'Acme',
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      },
-    ]);
+    listMembershipsByUserMock.mockResolvedValueOnce({
+      memberships: [{workspaceId, role: 'admin' as const}],
+    });
     const res = await app.inject({
       method: 'POST',
       url: '/auth/signup',
@@ -162,7 +165,6 @@ describe('POST /auth/signup', () => {
     });
     expect(body.accept_error).toBeUndefined();
     expect(claims.memberships).toEqual([{workspaceId, role: 'admin'}]);
-    expect(await outboxEventsTo(email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toHaveLength(0);
     expect(capturedMail()).toHaveLength(0);
   });
 
@@ -175,6 +177,7 @@ describe('POST /auth/signup', () => {
       email,
       hashedToken: 'hashed',
       expiresAt: new Date(Date.now() + 86_400_000),
+      revokedAt: null,
       acceptedAt: null,
       acceptedByUserId: null,
       invitedByUserId: crypto.randomUUID(),
@@ -206,65 +209,27 @@ describe('POST /auth/signup', () => {
   });
 
   test.each([
-    {
-      name: 'invalid token',
-      invitation: undefined,
-      expectedStatus: 410,
-      expectedCode: 'invitation-token-invalid',
-    },
+    {name: 'invalid token', expectedCode: 'invitation-token-invalid' as const, expectedStatus: 410},
     {
       name: 'already accepted token',
-      invitation: {
-        acceptedAt: new Date(),
-        expiresAt: new Date(Date.now() + 86_400_000),
-        email: uniqueEmail('signup-invite-used'),
-      },
-      expectedStatus: 410,
-      expectedCode: 'invitation-token-used',
-    },
-    {
-      name: 'expired token',
-      invitation: {
-        acceptedAt: null,
-        expiresAt: new Date(Date.now() - 60_000),
-        email: uniqueEmail('signup-invite-expired'),
-      },
+      expectedCode: 'invitation-token-used' as const,
       expectedStatus: 410,
-      expectedCode: 'invitation-token-expired',
     },
+    {name: 'expired token', expectedCode: 'invitation-token-expired' as const, expectedStatus: 410},
     {
       name: 'email mismatch',
-      invitation: {
-        acceptedAt: null,
-        expiresAt: new Date(Date.now() + 86_400_000),
-        email: uniqueEmail('signup-invite-other'),
-      },
+      expectedCode: 'invitation-email-mismatch' as const,
       expectedStatus: 403,
-      expectedCode: 'invitation-email-mismatch',
     },
-  ])('rejects signup with invitation for $name', async ({
-    invitation,
-    expectedStatus,
-    expectedCode,
-  }) => {
+  ])('rejects signup with invitation for $name', async ({expectedCode, expectedStatus}) => {
     const email = uniqueEmail('signup-invite-error');
-    if (invitation === undefined) {
-      peekInvitationByRawTokenMock.mockResolvedValueOnce(undefined);
-    } else {
-      peekInvitationByRawTokenMock.mockResolvedValueOnce({
-        id: crypto.randomUUID(),
-        workspaceId: crypto.randomUUID(),
-        email: invitation.email,
-        hashedToken: 'hashed',
-        expiresAt: invitation.expiresAt,
-        acceptedAt: invitation.acceptedAt,
-        acceptedByUserId: null,
-        invitedByUserId: crypto.randomUUID(),
-        invitedByDisplay: null,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      });
-    }
+    peekInvitationByRawTokenMock.mockRejectedValueOnce(
+      createInterModuleKnownError(
+        workspacesInterModuleContract.methods.preflightInvitationAcceptance,
+        expectedCode,
+        {},
+      ),
+    );
 
     const res = await app.inject({
       method: 'POST',

package/src/presentation/routes/registration/signup.ts

@@ -1,81 +1,100 @@
 import {signupBodySchema, signupResponseSchema} from '@shipfox/api-auth-dto';
+import {EmailChallengeError} from '@shipfox/api-email-challenges';
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {signup, signupWithInvitation} from '#core/auth.js';
 import {
+  EmailTakenError,
   InvitationEmailMismatchError,
   TokenAlreadyUsedError,
   TokenExpiredError,
-  TokenInvalidError as WorkspacesTokenInvalidError,
-} from '@shipfox/api-workspaces';
-import {ClientError, defineRoute} from '@shipfox/node-fastify';
-import {signup, signupWithInvitation} from '#core/auth.js';
-import {EmailTakenError} from '#core/errors.js';
+  TokenInvalidError,
+} from '#core/errors.js';
 import {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';
 import {toUserDto} from '#presentation/dto/user.js';
 
-export const signupRoute = defineRoute({
-  method: 'POST',
-  path: '/signup',
-  description:
-    'Create a user account. Sends a verification email unless an invitation token is supplied.',
-  schema: {
-    body: signupBodySchema,
-    response: {
-      201: signupResponseSchema,
+export function createSignupRoute(workspaces: WorkspacesInterModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/signup',
+    description:
+      'Create a user account. Sends a verification email unless an invitation token is supplied.',
+    schema: {
+      body: signupBodySchema,
+      response: {
+        201: signupResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof EmailTakenError) {
-      throw new ClientError('Email already registered', 'email-taken', {status: 409});
-    }
-    if (error instanceof WorkspacesTokenInvalidError) {
-      throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {
-        status: 410,
-      });
-    }
-    if (error instanceof TokenAlreadyUsedError) {
-      throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {
-        status: 410,
-      });
-    }
-    if (error instanceof TokenExpiredError) {
-      throw new ClientError('Invitation has expired', 'invitation-token-expired', {status: 410});
-    }
-    if (error instanceof InvitationEmailMismatchError) {
-      throw new ClientError(
-        'Signup email does not match the invitation',
-        'invitation-email-mismatch',
-        {status: 403},
-      );
-    }
-    throw error;
-  },
-  handler: async (request, reply) => {
-    const {email, password, name, invitation_token} = request.body;
+    errorHandler: (error) => {
+      if (error instanceof EmailChallengeError) {
+        throw new ClientError(error.message, `email-challenge-${error.code}`, {
+          status: error.code === 'limited' ? 429 : 400,
+          ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),
+        });
+      }
+      if (error instanceof EmailTakenError) {
+        throw new ClientError('Email already registered', 'email-taken', {status: 409});
+      }
+      if (error instanceof TokenInvalidError) {
+        throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {
+          status: 410,
+        });
+      }
+      if (error instanceof TokenAlreadyUsedError) {
+        throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {
+          status: 410,
+        });
+      }
+      if (error instanceof TokenExpiredError) {
+        throw new ClientError('Invitation has expired', 'invitation-token-expired', {
+          status: 410,
+        });
+      }
+      if (error instanceof InvitationEmailMismatchError) {
+        throw new ClientError(
+          'Signup email does not match the invitation',
+          'invitation-email-mismatch',
+          {status: 403},
+        );
+      }
+      throw error;
+    },
+    handler: async (request, reply) => {
+      const {email, password, name, invitation_token} = request.body;
 
-    if (invitation_token === undefined) {
-      const user = await signup({email, password, name});
-      reply.code(201);
-      return {user: toUserDto(user)};
-    }
+      if (invitation_token === undefined) {
+        const result = await signup({email, password, name, sourceIp: request.ip});
+        reply.code(201);
+        return {
+          user: toUserDto(result),
+          email_challenge: {
+            id: result.emailChallenge.id,
+            next_resend_available_at: result.emailChallenge.nextResendAvailableAt.toISOString(),
+          },
+        };
+      }
 
-    const result = await signupWithInvitation({
-      email,
-      password,
-      name,
-      invitationToken: invitation_token,
-    });
-    setRefreshTokenCookie(reply, result.refreshToken);
-    reply.code(201);
-    return {
-      user: toUserDto(result.user),
-      token: result.token,
-      membership: result.membership
-        ? {
-            id: result.membership.id,
-            user_id: result.membership.userId,
-            workspace_id: result.membership.workspaceId,
-          }
-        : null,
-      ...(result.acceptError ? {accept_error: result.acceptError} : {}),
-    };
-  },
-});
+      const result = await signupWithInvitation({
+        email,
+        password,
+        name,
+        invitationToken: invitation_token,
+        workspaces,
+      });
+      setRefreshTokenCookie(reply, result.refreshToken);
+      reply.code(201);
+      return {
+        user: toUserDto(result.user),
+        token: result.token,
+        membership: result.membership
+          ? {
+              id: result.membership.id,
+              user_id: result.membership.userId,
+              workspace_id: result.membership.workspaceId,
+            }
+          : null,
+        ...(result.acceptError ? {accept_error: result.acceptError} : {}),
+      };
+    },
+  });
+}

package/src/presentation/routes/session/login.ts

@@ -1,4 +1,5 @@
 import {loginBodySchema, loginResponseSchema} from '@shipfox/api-auth-dto';
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {login} from '#core/auth.js';
 import {
@@ -10,41 +11,43 @@ import {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';
 import {toAuthSessionDto} from '#presentation/dto/user.js';
 import {createAuthRateLimitPreHandler} from '#presentation/routes/rate-limit.js';
 
-export const loginRoute = defineRoute({
-  method: 'POST',
-  path: '/login',
-  description: 'Sign in with an email address and password.',
-  schema: {
-    body: loginBodySchema,
-    response: {
-      200: loginResponseSchema,
+export function createLoginRoute(workspaces: WorkspacesInterModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/login',
+    description: 'Sign in with an email address and password.',
+    schema: {
+      body: loginBodySchema,
+      response: {
+        200: loginResponseSchema,
+      },
     },
-  },
-  preHandler: createAuthRateLimitPreHandler('login'),
-  errorHandler: (error) => {
-    if (error instanceof InvalidCredentialsError) {
-      throw new ClientError('Invalid credentials', 'invalid-credentials', {status: 401});
-    }
-    if (error instanceof EmailNotVerifiedError) {
-      throw new ClientError('Email not verified', 'email-not-verified', {status: 403});
-    }
-    if (error instanceof AuthDependencyUnavailableError) {
-      throw new ClientError(
-        'Authentication dependency unavailable',
-        'auth-dependency-unavailable',
-        {
-          status: 503,
-        },
-      );
-    }
-    throw error;
-  },
-  handler: async (request, reply) => {
-    const {email, password} = request.body;
+    preHandler: createAuthRateLimitPreHandler('login'),
+    errorHandler: (error) => {
+      if (error instanceof InvalidCredentialsError) {
+        throw new ClientError('Invalid credentials', 'invalid-credentials', {status: 401});
+      }
+      if (error instanceof EmailNotVerifiedError) {
+        throw new ClientError('Email not verified', 'email-not-verified', {status: 403});
+      }
+      if (error instanceof AuthDependencyUnavailableError) {
+        throw new ClientError(
+          'Authentication dependency unavailable',
+          'auth-dependency-unavailable',
+          {
+            status: 503,
+          },
+        );
+      }
+      throw error;
+    },
+    handler: async (request, reply) => {
+      const {email, password} = request.body;
 
-    const result = await login({email, password});
-    setRefreshTokenCookie(reply, result.refreshToken);
+      const result = await login({email, password, workspaces});
+      setRefreshTokenCookie(reply, result.refreshToken);
 
-    return toAuthSessionDto(result);
-  },
-});
+      return toAuthSessionDto(result);
+    },
+  });
+}

package/src/presentation/routes/session/refresh.ts

@@ -1,4 +1,5 @@
 import {refreshResponseSchema} from '@shipfox/api-auth-dto';
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {refreshAccessToken} from '#core/auth.js';
 import {AuthDependencyUnavailableError, TokenInvalidError} from '#core/errors.js';
@@ -9,46 +10,48 @@ import {
 } from '#presentation/auth/refresh-cookie.js';
 import {toAuthSessionDto} from '#presentation/dto/user.js';
 
-export const refreshRoute = defineRoute({
-  method: 'POST',
-  path: '/refresh',
-  description: 'Refresh the current browser session access token.',
-  schema: {
-    response: {
-      200: refreshResponseSchema,
+export function createRefreshRoute(workspaces: WorkspacesInterModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/refresh',
+    description: 'Refresh the current browser session access token.',
+    schema: {
+      response: {
+        200: refreshResponseSchema,
+      },
     },
-  },
-  errorHandler: (error, _request, reply) => {
-    if (error instanceof TokenInvalidError) {
-      clearRefreshTokenCookie(reply);
-      throw new ClientError('Refresh token is invalid or expired', 'unauthorized', {
-        status: 401,
-      });
-    }
-    if (error instanceof AuthDependencyUnavailableError) {
-      throw new ClientError(
-        'Authentication dependency unavailable',
-        'auth-dependency-unavailable',
-        {
-          status: 503,
-        },
-      );
-    }
-    throw error;
-  },
-  handler: async (request, reply) => {
-    const refreshToken = getRefreshTokenCookie(request);
-    if (!refreshToken) {
-      clearRefreshTokenCookie(reply);
-      throw new ClientError('Refresh token is invalid or expired', 'unauthorized', {status: 401});
-    }
+    errorHandler: (error, _request, reply) => {
+      if (error instanceof TokenInvalidError) {
+        clearRefreshTokenCookie(reply);
+        throw new ClientError('Refresh token is invalid or expired', 'unauthorized', {
+          status: 401,
+        });
+      }
+      if (error instanceof AuthDependencyUnavailableError) {
+        throw new ClientError(
+          'Authentication dependency unavailable',
+          'auth-dependency-unavailable',
+          {
+            status: 503,
+          },
+        );
+      }
+      throw error;
+    },
+    handler: async (request, reply) => {
+      const refreshToken = getRefreshTokenCookie(request);
+      if (!refreshToken) {
+        clearRefreshTokenCookie(reply);
+        throw new ClientError('Refresh token is invalid or expired', 'unauthorized', {status: 401});
+      }
 
-    const result = await refreshAccessToken({refreshToken});
+      const result = await refreshAccessToken({refreshToken, workspaces});
 
-    // Absent on a grace-window hit: keep the existing cookie rather than overwrite it.
-    if (result.refreshToken) {
-      setRefreshTokenCookie(reply, result.refreshToken);
-    }
-    return toAuthSessionDto(result);
-  },
-});
+      // Absent on a grace-window hit: keep the existing cookie rather than overwrite it.
+      if (result.refreshToken) {
+        setRefreshTokenCookie(reply, result.refreshToken);
+      }
+      return toAuthSessionDto(result);
+    },
+  });
+}