@shipfox/api-auth 5.0.0 → 6.0.0

package/src/presentation/subscribers/email-send-requested.test.ts

@@ -1,5 +1,5 @@
 import type {Mailer, MailMessage} from '@shipfox/node-mailer';
-import {onEmailVerificationSendRequested, onPasswordResetSendRequested} from './index.js';
+import {onPasswordResetSendRequested} from './index.js';
 
 const testMailer = vi.hoisted(
   (): {
@@ -16,7 +16,7 @@ const testMailer = vi.hoisted(
   },
 );
 
-vi.mock('#config.js', () => ({
+vi.mock('@shipfox/node-mailer', () => ({
   mailer: testMailer.mailer,
 }));
 
@@ -30,22 +30,6 @@ describe('auth email subscribers', () => {
     });
   });
 
-  test('sends a rendered email verification message', async () => {
-    await onEmailVerificationSendRequested({
-      email: 'verify@example.com',
-      verifyLink: 'https://app.example.test/auth/verify-email?token=verify-token',
-    });
-
-    expect(testMailer.captured).toHaveLength(1);
-    expect(testMailer.captured[0]).toMatchObject({
-      to: 'verify@example.com',
-      subject: 'Verify your email',
-    });
-    expect(testMailer.captured[0]?.text).toContain('/auth/verify-email?token=verify-token');
-    expect(testMailer.captured[0]?.html).toContain('/auth/verify-email?token');
-    expect(testMailer.captured[0]?.html).toContain('verify-token');
-  });
-
   test('sends a rendered password reset message', async () => {
     await onPasswordResetSendRequested({
       email: 'reset@example.com',
@@ -62,16 +46,4 @@ describe('auth email subscribers', () => {
     expect(testMailer.captured[0]?.html).toContain('/auth/reset?token');
     expect(testMailer.captured[0]?.html).toContain('reset-token');
   });
-
-  test('rethrows mailer failures so the outbox dispatcher retries', async () => {
-    const failure = new Error('smtp unavailable');
-    testMailer.send.mockRejectedValueOnce(failure);
-
-    const promise = onEmailVerificationSendRequested({
-      email: 'verify-failure@example.com',
-      verifyLink: 'https://app.example.test/auth/verify-email?token=verify-token',
-    });
-
-    await expect(promise).rejects.toBe(failure);
-  });
 });

package/src/presentation/subscribers/index.ts

@@ -1,2 +1 @@
-export {onEmailVerificationSendRequested} from './on-email-verification-send-requested.js';
 export {onPasswordResetSendRequested} from './on-password-reset-send-requested.js';

package/src/presentation/subscribers/on-password-reset-send-requested.ts

@@ -1,6 +1,6 @@
 import type {AuthPasswordResetSendRequestedEvent} from '@shipfox/api-auth-dto';
 import {renderEmail} from '@shipfox/node-email';
-import {mailer} from '#config.js';
+import {mailer} from '@shipfox/node-mailer';
 
 export async function onPasswordResetSendRequested(
   payload: AuthPasswordResetSendRequestedEvent,

package/test/env.ts

@@ -4,7 +4,5 @@ process.env.POSTGRES_USERNAME ??= 'shipfox';
 process.env.POSTGRES_PASSWORD ??= 'password';
 process.env.POSTGRES_DATABASE = 'api_test';
 process.env.POSTGRES_MAX_CONNECTIONS ??= '5';
-process.env.AUTH_JWT_SECRET = 'test-secret';
-process.env.AUTH_JOB_LEASE_TOKEN_SECRET = 'test-lease-secret';
-process.env.AUTH_RUNNER_SESSION_TOKEN_SECRET = 'test-runner-session-secret';
+process.env.AUTH_ROOT_KEY = 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=';
 process.env.TZ = 'UTC';

package/test/globalSetup.ts

@@ -1,4 +1,5 @@
 import './env.js';
+import {emailChallengesModule} from '@shipfox/api-email-challenges';
 import {runMigrations} from '@shipfox/node-drizzle';
 import {closePostgresClient, createPostgresClient} from '@shipfox/node-postgres';
 import {sql} from 'drizzle-orm';
@@ -9,8 +10,16 @@ export async function setup() {
   createPostgresClient();
 
   await runMigrations(db(), migrationsPath, '__drizzle_migrations_auth');
+  const emailChallengesDatabase = emailChallengesModule.database;
+  const emailChallengesMigrations =
+    emailChallengesDatabase && !Array.isArray(emailChallengesDatabase)
+      ? emailChallengesDatabase.migrationsPath
+      : undefined;
+  if (!emailChallengesMigrations)
+    throw new Error('Email challenges module has no database migrations');
+  await runMigrations(db(), emailChallengesMigrations, '__drizzle_migrations_email_challenges');
   await db().execute(
-    sql`TRUNCATE auth_outbox, auth_email_verifications, auth_password_resets, auth_rate_limits, auth_refresh_tokens, auth_users CASCADE`,
+    sql`TRUNCATE email_challenges_challenges, email_challenges_send_limits, auth_outbox, auth_password_resets, auth_rate_limits, auth_refresh_tokens, auth_users CASCADE`,
   );
 
   closeDb();

package/test/routes.ts

@@ -1,21 +1,20 @@
 import type {OutgoingHttpHeaders} from 'node:http';
-import {
-  AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
-  type AUTH_PASSWORD_RESET_SEND_REQUESTED,
-} from '@shipfox/api-auth-dto';
+import type {AUTH_PASSWORD_RESET_SEND_REQUESTED} from '@shipfox/api-auth-dto';
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
+import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
 import {type AppConfig, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import type {Mailer, MailMessage} from '@shipfox/node-mailer';
 import {and, desc, eq, sql} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {authOutbox} from '#db/schema/outbox.js';
 import {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';
-import {authRoutes} from '#presentation/routes/index.js';
+import {buildAuthRoutes} from '#presentation/routes/index.js';
 
 const testConfig = vi.hoisted(
   (): {
     captured: MailMessage[];
+    challenges: Map<string, string>;
     mailer: Mailer;
-    secret: string;
     clientBaseUrl: string;
   } => {
     const captured: MailMessage[] = [];
@@ -27,56 +26,27 @@ const testConfig = vi.hoisted(
     };
     return {
       captured,
+      challenges: new Map(),
       mailer,
-      secret: 'route-tests-secret',
       clientBaseUrl: 'https://app.example.test',
     };
   },
 );
 
 const workspaceTestDoubles = vi.hoisted(() => {
-  class InvitationEmailMismatchError extends Error {
-    constructor(message = 'Invitation email does not match') {
-      super(message);
-      this.name = 'InvitationEmailMismatchError';
-    }
-  }
-
-  class TokenAlreadyUsedError extends Error {
-    constructor(message = 'Invitation token has already been used') {
-      super(message);
-      this.name = 'TokenAlreadyUsedError';
-    }
-  }
-
-  class TokenExpiredError extends Error {
-    constructor(message = 'Invitation token has expired') {
-      super(message);
-      this.name = 'TokenExpiredError';
-    }
-  }
-
-  class TokenInvalidError extends Error {
-    constructor(message = 'Invitation token is invalid') {
-      super(message);
-      this.name = 'TokenInvalidError';
-    }
-  }
-
   return {
-    acceptWorkspaceInvitation: vi.fn(),
-    peekInvitationByRawToken: vi.fn(),
-    listMembershipsByUser: vi.fn(() => Promise.resolve([])),
-    InvitationEmailMismatchError,
-    TokenAlreadyUsedError,
-    TokenExpiredError,
-    TokenInvalidError,
+    acceptInvitation: vi.fn(),
+    preflightInvitationAcceptance: vi.fn(),
+    listMembershipsForTokenClaims: vi.fn(() => Promise.resolve({memberships: []})),
+    requireActiveMembership: vi.fn(),
   };
-});
+}) as {
+  [Method in keyof WorkspacesInterModuleClient]: ReturnType<typeof vi.fn>;
+};
+const workspaces = workspaceTestDoubles as unknown as WorkspacesInterModuleClient;
 
 vi.mock('#config.js', () => ({
   config: {
-    AUTH_JWT_SECRET: testConfig.secret,
     AUTH_JWT_EXPIRES_IN: '15m',
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: 30,
@@ -87,42 +57,27 @@ vi.mock('#config.js', () => ({
   mailer: testConfig.mailer,
 }));
 
-vi.mock('@shipfox/api-workspaces', () => ({
-  acceptWorkspaceInvitation: workspaceTestDoubles.acceptWorkspaceInvitation,
-  peekInvitationByRawToken: workspaceTestDoubles.peekInvitationByRawToken,
-  InvitationEmailMismatchError: workspaceTestDoubles.InvitationEmailMismatchError,
-  listMembershipsByUser: workspaceTestDoubles.listMembershipsByUser,
-  TokenAlreadyUsedError: workspaceTestDoubles.TokenAlreadyUsedError,
-  TokenExpiredError: workspaceTestDoubles.TokenExpiredError,
-  TokenInvalidError: workspaceTestDoubles.TokenInvalidError,
-}));
-
-const {acceptWorkspaceInvitation, peekInvitationByRawToken, listMembershipsByUser} = await import(
-  '@shipfox/api-workspaces'
-);
+vi.mock('@shipfox/node-mailer', () => ({mailer: testConfig.mailer}));
 
+const CODE_RE = /\b\d{8}\b/u;
 const TOKEN_RE = /token=([\w\-_=]+)/;
-type AuthEmailEventType =
-  | typeof AUTH_EMAIL_VERIFICATION_SEND_REQUESTED
-  | typeof AUTH_PASSWORD_RESET_SEND_REQUESTED;
+type AuthEmailEventType = typeof AUTH_PASSWORD_RESET_SEND_REQUESTED;
 
-export const ROUTE_TEST_SECRET = testConfig.secret;
-export const acceptWorkspaceInvitationMock = vi.mocked(acceptWorkspaceInvitation);
-export const peekInvitationByRawTokenMock = vi.mocked(peekInvitationByRawToken);
-export const listMembershipsByUserMock = vi.mocked(listMembershipsByUser);
-export const workspaceErrors = {
-  InvitationEmailMismatchError: workspaceTestDoubles.InvitationEmailMismatchError,
-  TokenAlreadyUsedError: workspaceTestDoubles.TokenAlreadyUsedError,
-  TokenExpiredError: workspaceTestDoubles.TokenExpiredError,
-  TokenInvalidError: workspaceTestDoubles.TokenInvalidError,
-};
+export const ROUTE_TEST_SECRET = userAccessTokenKey();
+export const acceptWorkspaceInvitationMock: ReturnType<typeof vi.fn> =
+  workspaceTestDoubles.acceptInvitation;
+export const peekInvitationByRawTokenMock: ReturnType<typeof vi.fn> =
+  workspaceTestDoubles.preflightInvitationAcceptance;
+export const listMembershipsByUserMock: ReturnType<typeof vi.fn> =
+  workspaceTestDoubles.listMembershipsForTokenClaims;
 
 export function resetCapturedMail(): void {
   testConfig.captured.length = 0;
+  testConfig.challenges.clear();
   acceptWorkspaceInvitationMock.mockReset();
   peekInvitationByRawTokenMock.mockReset();
   listMembershipsByUserMock.mockReset();
-  listMembershipsByUserMock.mockResolvedValue([]);
+  listMembershipsByUserMock.mockResolvedValue({memberships: []});
 }
 
 export function capturedMail(): MailMessage[] {
@@ -143,6 +98,12 @@ export function uniqueEmail(prefix: string): string {
   return `${prefix}-${crypto.randomUUID()}@example.com`;
 }
 
+export function latestVerificationCode(email: string): string {
+  const code = latestMailTo(email).text?.match(CODE_RE)?.[0];
+  expect(code).toBeDefined();
+  return code ?? '';
+}
+
 export function extractToken(url: string): string {
   const match = url.match(TOKEN_RE);
   expect(match?.[1]).toBeDefined();
@@ -175,8 +136,7 @@ export async function latestEmailLinkTo(
   const event = (await outboxEventsTo(email, eventType))[0];
   expect(event).toBeDefined();
   const payload = event?.payload as {verifyLink?: string; resetLink?: string} | undefined;
-  const link =
-    eventType === AUTH_EMAIL_VERIFICATION_SEND_REQUESTED ? payload?.verifyLink : payload?.resetLink;
+  const link = payload?.resetLink;
   expect(link).toBeDefined();
   return link ?? '';
 }
@@ -186,7 +146,7 @@ export async function createAuthTestApp(params?: {
 }): Promise<FastifyInstance> {
   const appConfig: AppConfig = {
     auth: [createJwtAuthMethod()],
-    routes: [authRoutes],
+    routes: [buildAuthRoutes(true, workspaces)],
     swagger: false,
   };
   if (params?.fastifyOptions) appConfig.fastifyOptions = params.fastifyOptions;
@@ -197,22 +157,26 @@ export async function signup(
   app: FastifyInstance,
   params: {email: string; password: string; name?: string},
 ) {
-  return await app.inject({
+  const result = await app.inject({
     method: 'POST',
     url: '/auth/signup',
     payload: {name: 'Test User', ...params},
   });
+  const challengeId = result.json().email_challenge?.id;
+  if (typeof challengeId === 'string')
+    testConfig.challenges.set(params.email.trim().toLowerCase(), challengeId);
+  return result;
 }
 
-export async function verifyEmail(app: FastifyInstance, email: string): Promise<void> {
-  const token = extractToken(
-    await latestEmailLinkTo(email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-  );
-
+export async function verifyEmail(
+  app: FastifyInstance,
+  email: string,
+  challengeId = testConfig.challenges.get(email) ?? '',
+): Promise<void> {
   const res = await app.inject({
     method: 'POST',
     url: '/auth/verify-email/confirm',
-    payload: {token},
+    payload: {email, challenge_id: challengeId, code: latestVerificationCode(email)},
   });
 
   expect(res.statusCode).toBe(200);
@@ -235,11 +199,13 @@ export async function signupVerifyLogin(
   refreshCookie: string;
   token: string;
   userId: string;
+  emailChallengeId: string;
 }> {
   const email = uniqueEmail(prefix);
   const password = 'correct horse battery staple';
-  await signup(app, {email, password, name: prefix});
-  await verifyEmail(app, email);
+  const signupResult = await signup(app, {email, password, name: prefix});
+  const emailChallengeId = signupResult.json().email_challenge.id;
+  await verifyEmail(app, email, emailChallengeId);
 
   const loginRes = await login(app, {email, password});
 
@@ -250,6 +216,7 @@ export async function signupVerifyLogin(
     refreshCookie: getSetCookie(loginRes),
     token: loginRes.json().token,
     userId: loginRes.json().user.id,
+    emailChallengeId,
   };
 }
 
@@ -264,7 +231,7 @@ export async function createVerifiedSession(prefix: string): Promise<{
   const email = uniqueEmail(prefix);
   const password = 'correct horse battery staple';
   const user = await createUser({email, password, name: prefix, verified: true});
-  const session = await createSessionForUser({userId: user.id});
+  const session = await createSessionForUser({userId: user.id, workspaces});
 
   return {
     email,