@shipfox/api-auth 5.0.0 → 6.0.0

package/drizzle/0000_initial.sql

@@ -1,13 +1,4 @@
 CREATE TYPE "public"."auth_user_status" AS ENUM('active', 'suspended', 'deleted');--> statement-breakpoint
-CREATE TABLE "auth_email_verifications" (
-	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
-	"user_id" uuid NOT NULL,
-	"hashed_token" text NOT NULL,
-	"expires_at" timestamp with time zone NOT NULL,
-	"used_at" timestamp with time zone,
-	"created_at" timestamp with time zone DEFAULT now() NOT NULL
-);
---> statement-breakpoint
 CREATE TABLE "auth_outbox" (
 	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
 	"event_type" text NOT NULL,
@@ -65,11 +56,8 @@ CREATE TABLE "auth_users" (
 	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
 );
 --> statement-breakpoint
-ALTER TABLE "auth_email_verifications" ADD CONSTRAINT "auth_email_verifications_user_id_auth_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."auth_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "auth_password_resets" ADD CONSTRAINT "auth_password_resets_user_id_auth_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."auth_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "auth_refresh_tokens" ADD CONSTRAINT "auth_refresh_tokens_user_id_auth_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."auth_users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-CREATE UNIQUE INDEX "auth_email_verifications_hashed_token_unique" ON "auth_email_verifications" USING btree ("hashed_token");--> statement-breakpoint
-CREATE INDEX "auth_email_verifications_user_id_idx" ON "auth_email_verifications" USING btree ("user_id");--> statement-breakpoint
 CREATE INDEX "auth_outbox_pending_idx" ON "auth_outbox" USING btree ("next_dispatch_at","created_at") WHERE "dispatched_at" IS NULL AND "dead_lettered_at" IS NULL;--> statement-breakpoint
 CREATE INDEX "auth_outbox_dispatched_retention_idx" ON "auth_outbox" USING btree ("dispatched_at","id") WHERE "dispatched_at" IS NOT NULL;--> statement-breakpoint
 CREATE UNIQUE INDEX "auth_password_resets_hashed_token_unique" ON "auth_password_resets" USING btree ("hashed_token");--> statement-breakpoint
@@ -78,4 +66,4 @@ CREATE UNIQUE INDEX "auth_rate_limits_window_unique" ON "auth_rate_limits" USING
 CREATE INDEX "auth_rate_limits_expires_at_idx" ON "auth_rate_limits" USING btree ("expires_at");--> statement-breakpoint
 CREATE UNIQUE INDEX "auth_refresh_tokens_hashed_token_unique" ON "auth_refresh_tokens" USING btree ("hashed_token");--> statement-breakpoint
 CREATE INDEX "auth_refresh_tokens_user_id_idx" ON "auth_refresh_tokens" USING btree ("user_id");--> statement-breakpoint
-CREATE UNIQUE INDEX "auth_users_email_unique" ON "auth_users" USING btree ("email");
+CREATE UNIQUE INDEX "auth_users_email_unique" ON "auth_users" USING btree ("email");

package/drizzle/meta/0000_snapshot.json

@@ -4,98 +4,6 @@
   "version": "7",
   "dialect": "postgresql",
   "tables": {
-    "public.auth_email_verifications": {
-      "name": "auth_email_verifications",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "uuid",
-          "primaryKey": true,
-          "notNull": true,
-          "default": "uuidv7()"
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "uuid",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "hashed_token": {
-          "name": "hashed_token",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "used_at": {
-          "name": "used_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {
-        "auth_email_verifications_hashed_token_unique": {
-          "name": "auth_email_verifications_hashed_token_unique",
-          "columns": [
-            {
-              "expression": "hashed_token",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": true,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "auth_email_verifications_user_id_idx": {
-          "name": "auth_email_verifications_user_id_idx",
-          "columns": [
-            {
-              "expression": "user_id",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "auth_email_verifications_user_id_auth_users_id_fk": {
-          "name": "auth_email_verifications_user_id_auth_users_id_fk",
-          "tableFrom": "auth_email_verifications",
-          "tableTo": "auth_users",
-          "columnsFrom": ["user_id"],
-          "columnsTo": ["id"],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
     "public.auth_outbox": {
       "name": "auth_outbox",
       "schema": "",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-auth",
   "license": "MIT",
-  "version": "5.0.0",
+  "version": "6.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -30,22 +30,24 @@
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "5.0.0",
-    "@shipfox/api-auth-dto": "5.0.0",
-    "@shipfox/api-workspaces": "5.0.0",
-    "@shipfox/api-workspaces-dto": "5.0.0",
+    "@shipfox/api-auth-context": "6.0.0",
+    "@shipfox/api-auth-dto": "6.0.0",
+    "@shipfox/api-email-challenges": "0.2.0",
+    "@shipfox/api-workspaces-dto": "6.0.0",
+    "@shipfox/inter-module": "0.2.0",
     "@shipfox/config": "1.2.2",
-    "@shipfox/node-drizzle": "0.3.1",
-    "@shipfox/node-fastify": "0.2.3",
-    "@shipfox/node-jwt": "0.2.1",
+    "@shipfox/node-drizzle": "0.3.2",
+    "@shipfox/node-auth-root-key": "0.2.0",
+    "@shipfox/node-fastify": "0.2.4",
+    "@shipfox/node-jwt": "0.3.0",
     "@shipfox/node-email": "0.2.2",
-    "@shipfox/node-mailer": "0.1.4",
-    "@shipfox/node-module": "0.3.2",
+    "@shipfox/node-mailer": "0.2.0",
+    "@shipfox/node-module": "0.4.0",
     "@shipfox/node-opentelemetry": "0.5.2",
-    "@shipfox/node-outbox": "0.2.3",
+    "@shipfox/node-outbox": "0.2.4",
     "@shipfox/node-postgres": "0.4.2",
-    "@shipfox/node-rate-limit": "0.2.1",
-    "@shipfox/node-tokens": "0.2.1"
+    "@shipfox/node-rate-limit": "0.3.0",
+    "@shipfox/node-tokens": "0.3.0"
   },
   "devDependencies": {
     "@types/pg": "^8.15.5",
@@ -55,6 +57,7 @@
     "fishery": "^2.4.0",
     "jose": "^6.0.0",
     "@shipfox/biome": "1.8.2",
+    "@shipfox/depcruise": "1.0.2",
     "@shipfox/swc": "1.2.6",
     "@shipfox/ts-config": "1.3.8",
     "@shipfox/typescript": "1.1.7",
@@ -64,6 +67,7 @@
     "build": "shipfox-swc",
     "check": "shipfox-biome-check",
     "check:fix": "shipfox-biome-check --write",
+    "depcruise": "shipfox-depcruise",
     "test": "shipfox-vitest-run",
     "test:watch": "shipfox-vitest-watch",
     "type": "shipfox-tsc-check",

package/src/config.ts

@@ -1,24 +1,14 @@
 import {bool, createConfig, num, str} from '@shipfox/config';
-import {createConsoleMailer, createSmtpMailer, type Mailer} from '@shipfox/node-mailer';
 
 export const config = createConfig({
-  AUTH_JWT_SECRET: str({
-    desc: 'Secret used to sign and verify user access tokens (JWTs). Required, with no default, so startup fails when it is missing.',
-  }),
   AUTH_JWT_EXPIRES_IN: str({
     desc: 'How long an access token stays valid. Accepts a duration string such as 15m, 1h, or 7d.',
     default: '15m',
   }),
-  AUTH_JOB_LEASE_TOKEN_SECRET: str({
-    desc: 'Secret used to sign and verify job lease tokens. Required, with no default, so startup fails when it is missing.',
-  }),
   AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: str({
     desc: 'How long a job lease token stays valid. Set it longer than the longest job (JOB_MAX_DURATION is 60 minutes) plus a safety margin.',
     default: '90m',
   }),
-  AUTH_RUNNER_SESSION_TOKEN_SECRET: str({
-    desc: 'Secret used to sign and verify runner session tokens. Required, with no default, so startup fails when it is missing.',
-  }),
   AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN: str({
     desc: 'How long a runner session token stays valid. A revoked registration token can leave existing sessions usable until this lifetime ends.',
     default: '1h',
@@ -39,54 +29,8 @@ export const config = createConfig({
     desc: 'Whether password login is available. Use true or false. Defaults to true. When false, password and email-verification routes are not registered, and server startup requires another module to contribute a login method.',
     default: true,
   }),
-  RATE_LIMIT_IDENTIFIER_SECRET: str({
-    desc: 'Optional secret used to HMAC identifiers before storing rate-limit counters. Leave it unset to derive a stable key from AUTH_JWT_SECRET.',
-    default: undefined,
-  }),
   CLIENT_BASE_URL: str({
     desc: 'Base URL of the client app. Used to build links in emails such as password resets.',
     default: 'http://localhost:5173',
   }),
-  MAILER_TRANSPORT: str({
-    desc: 'How emails are delivered. Use console to print them to the log, or smtp to send them through an SMTP server.',
-    choices: ['console', 'smtp'],
-    default: 'console',
-  }),
-  MAILER_FROM: str({
-    desc: 'Sender address shown on outgoing emails.',
-    default: 'noreply@shipfox.local',
-  }),
-  SMTP_HOST: str({
-    desc: 'Hostname of the SMTP server. Required when MAILER_TRANSPORT is smtp.',
-    default: undefined,
-  }),
-  SMTP_PORT: num({
-    desc: 'Port of the SMTP server.',
-    default: 587,
-  }),
-  SMTP_USER: str({
-    desc: 'Username for SMTP authentication. Leave it unset if the server needs no login.',
-    default: undefined,
-  }),
-  SMTP_PASSWORD: str({
-    desc: 'Password for SMTP authentication. Leave it unset if the server needs no login.',
-    default: undefined,
-  }),
 });
-
-function createMailer(): Mailer {
-  if (config.MAILER_TRANSPORT === 'smtp') {
-    if (!config.SMTP_HOST) throw new Error('SMTP_HOST is required when MAILER_TRANSPORT=smtp');
-    return createSmtpMailer({
-      host: config.SMTP_HOST,
-      port: config.SMTP_PORT,
-      ...(config.SMTP_USER ? {user: config.SMTP_USER} : {}),
-      ...(config.SMTP_PASSWORD ? {password: config.SMTP_PASSWORD} : {}),
-      from: config.MAILER_FROM,
-    });
-  }
-
-  return createConsoleMailer({from: config.MAILER_FROM});
-}
-
-export const mailer = createMailer();

package/src/core/auth.test.ts

@@ -1,24 +1,20 @@
-import {
-  AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
-  AUTH_PASSWORD_RESET_SEND_REQUESTED,
-  EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS,
-} from '@shipfox/api-auth-dto';
+import {AUTH_PASSWORD_RESET_SEND_REQUESTED, AUTH_USER_SIGNED_UP} from '@shipfox/api-auth-dto';
+import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
 import type {Mailer, MailMessage} from '@shipfox/node-mailer';
 import {hashOpaqueToken} from '@shipfox/node-tokens';
 import {and, desc, eq, sql} from 'drizzle-orm';
 import {
   changePassword,
-  confirmEmailVerification,
-  confirmPasswordReset,
-  createSessionForUser,
+  confirmPasswordReset as coreConfirmPasswordReset,
+  createSessionForUser as coreCreateSessionForUser,
+  login as coreLogin,
+  refreshAccessToken as coreRefreshAccessToken,
   getCurrentUser,
-  login,
   logout,
   provisionUser,
-  refreshAccessToken,
   requestPasswordReset,
-  resendEmailVerification,
   signup,
+  signupWithInvitation,
 } from '#core/auth.js';
 import {
   AuthDependencyUnavailableError,
@@ -31,7 +27,6 @@ import {
 import {verifyUserToken} from '#core/jwt.js';
 import {db} from '#db/db.js';
 import * as refreshTokenDb from '#db/refresh-tokens.js';
-import {emailVerifications} from '#db/schema/email-verifications.js';
 import {authOutbox} from '#db/schema/outbox.js';
 import {passwordResets} from '#db/schema/password-resets.js';
 import {refreshTokens} from '#db/schema/refresh-tokens.js';
@@ -62,7 +57,6 @@ const testConfig = vi.hoisted(
 
 vi.mock('#config.js', () => ({
   config: {
-    AUTH_JWT_SECRET: 'auth-core-test-secret',
     AUTH_JWT_EXPIRES_IN: '15m',
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: 30,
@@ -72,12 +66,25 @@ vi.mock('#config.js', () => ({
   mailer: testConfig.mailer,
 }));
 
-vi.mock('@shipfox/api-workspaces', () => ({
-  listMembershipsByUser: vi.fn(() => Promise.resolve([])),
-}));
+vi.mock('@shipfox/node-mailer', () => ({mailer: testConfig.mailer}));
 
-const {listMembershipsByUser} = await import('@shipfox/api-workspaces');
-const listMembershipsByUserMock = vi.mocked(listMembershipsByUser);
+const listMembershipsByUserMock = vi.fn(() =>
+  Promise.resolve({memberships: [] as Array<{workspaceId: string; role: 'admin'}>}),
+);
+const workspaces = {
+  listMembershipsForTokenClaims: listMembershipsByUserMock,
+  preflightInvitationAcceptance: vi.fn(),
+  acceptInvitation: vi.fn(),
+  requireActiveMembership: vi.fn(),
+};
+
+const login = (params: {email: string; password: string}) => coreLogin({...params, workspaces});
+const createSessionForUser = (params: {userId?: string; email?: string}) =>
+  coreCreateSessionForUser({...params, workspaces});
+const refreshAccessToken = (params: {refreshToken: string}) =>
+  coreRefreshAccessToken({...params, workspaces});
+const confirmPasswordReset = (params: {token: string; newPassword: string}) =>
+  coreConfirmPasswordReset({...params, workspaces});
 
 const TOKEN_RE = /token=([\w\-_=]+)/;
 
@@ -101,9 +108,8 @@ async function outboxEventsTo(email: string, eventType: string) {
 
 async function latestEmailLinkTo(email: string, eventType: string): Promise<string> {
   const event = (await outboxEventsTo(email, eventType))[0];
-  const payload = event?.payload as {verifyLink?: string; resetLink?: string} | undefined;
-  const link =
-    eventType === AUTH_EMAIL_VERIFICATION_SEND_REQUESTED ? payload?.verifyLink : payload?.resetLink;
+  const payload = event?.payload as {resetLink?: string} | undefined;
+  const link = payload?.resetLink;
   if (!link) throw new Error(`No ${eventType} outbox link for ${email}`);
   return link;
 }
@@ -128,14 +134,22 @@ describe('auth core', () => {
     expect(user.email).toBe(email);
     expect(user.name).toBe('Sign Up');
     expect(user.emailVerifiedAt).toBeNull();
-    expect(captured).toHaveLength(0);
-    expect(await latestEmailLinkTo(email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toContain(
-      `${testConfig.clientBaseUrl}/auth/verify-email?token=`,
-    );
+    expect(user.emailChallenge.id).toEqual(expect.any(String));
+    expect(user.emailChallenge.nextResendAvailableAt).toBeInstanceOf(Date);
+    expect(captured).toHaveLength(1);
+
+    const events = await outboxEventsTo(email, AUTH_USER_SIGNED_UP);
+    expect(events).toHaveLength(1);
+    expect(events[0]?.payload).toEqual({
+      userId: user.id,
+      email,
+      name: 'Sign Up',
+      viaInvitation: false,
+    });
   });
 
   test('signup rejects duplicate email with a business error', async () => {
-    const existing = await userFactory.create();
+    const existing = await userFactory.create({emailVerifiedAt: new Date()});
 
     const promise = signup({
       email: existing.email,
@@ -145,6 +159,33 @@ describe('auth core', () => {
     await expect(promise).rejects.toBeInstanceOf(EmailTakenError);
   });
 
+  test('signup with an invitation writes the signed-up event with its user insert', async () => {
+    const email = `signup-invitation-${crypto.randomUUID()}@example.com`;
+    const userId = crypto.randomUUID();
+    const workspaceId = crypto.randomUUID();
+    workspaces.preflightInvitationAcceptance.mockResolvedValueOnce(undefined);
+    workspaces.acceptInvitation.mockResolvedValueOnce({
+      membership: {id: crypto.randomUUID(), userId, workspaceId},
+    });
+
+    const result = await signupWithInvitation({
+      email,
+      password: 'correct horse battery staple',
+      name: 'Invited User',
+      invitationToken: `invite-${crypto.randomUUID()}`,
+      workspaces,
+    });
+
+    const events = await outboxEventsTo(email, AUTH_USER_SIGNED_UP);
+    expect(events).toHaveLength(1);
+    expect(events[0]?.payload).toEqual({
+      userId: result.user.id,
+      email,
+      name: 'Invited User',
+      viaInvitation: true,
+    });
+  });
+
   test('provisionUser creates a verified, password-less user with a normalized email', async () => {
     const email = `Provision-${crypto.randomUUID()}@EXAMPLE.COM`;
 
@@ -165,11 +206,11 @@ describe('auth core', () => {
     const storedSuspended = await findUserById({id: suspended.id});
 
     const existingUnverified = await provisionUser({
-      email: unverified.email.toUpperCase(),
+      email: `  ${unverified.email.toUpperCase()}  `,
       name: 'Replacement Name',
     });
     const existingSuspended = await provisionUser({
-      email: suspended.email.toUpperCase(),
+      email: `  ${suspended.email.toUpperCase()}  `,
       name: 'Replacement Name',
     });
 
@@ -257,6 +298,30 @@ describe('auth core', () => {
     );
   });
 
+  test('createSessionForUser({email}) resolves surrounding whitespace and mixed case', async () => {
+    const user = await userFactory.create({emailVerifiedAt: new Date()});
+
+    const result = await createSessionForUser({email: `  ${user.email.toUpperCase()}  `});
+
+    expect(result.user.id).toBe(user.id);
+    expect(result.token).toEqual(expect.any(String));
+  });
+
+  test('createSessionForUser({email}) retains eligibility checks', async () => {
+    const unverified = await userFactory.create();
+    const suspended = await userFactory.create({emailVerifiedAt: new Date()});
+    await db().update(users).set({status: 'suspended'}).where(eq(users.id, suspended.id));
+
+    const unverifiedExpectation = expect(
+      createSessionForUser({email: unverified.email}),
+    ).rejects.toBeInstanceOf(EmailNotVerifiedError);
+    const suspendedExpectation = expect(
+      createSessionForUser({email: suspended.email}),
+    ).rejects.toBeInstanceOf(InvalidCredentialsError);
+
+    await Promise.all([unverifiedExpectation, suspendedExpectation]);
+  });
+
   test('refreshAccessToken rotates the refresh token', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
     const loginResult = await login({email: user.email, password: user.plainPassword});
@@ -329,127 +394,6 @@ describe('auth core', () => {
     await expect(promise).rejects.toBeInstanceOf(TokenInvalidError);
   });
 
-  test('confirmEmailVerification marks the user verified, creates a session, and rejects reused tokens', async () => {
-    const user = await signup({
-      email: `verify-${crypto.randomUUID()}@example.com`,
-      password: 'correct horse battery staple',
-    });
-    const token = extractToken(
-      await latestEmailLinkTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    );
-
-    const result = await confirmEmailVerification({token});
-    const verified = await findUserById({id: user.id});
-    const refreshSession = await refreshTokenDb.findActiveRefreshTokenByHash({
-      hashedToken: hashOpaqueToken(result.refreshToken),
-    });
-    const reused = confirmEmailVerification({token});
-
-    expect(verified?.emailVerifiedAt).toBeInstanceOf(Date);
-    expect(result.token).toEqual(expect.any(String));
-    expect(result.user.id).toBe(user.id);
-    expect(refreshSession?.userId).toBe(user.id);
-    await expect(reused).rejects.toBeInstanceOf(TokenInvalidError);
-  });
-
-  test('resendEmailVerification only sends for active unverified users', async () => {
-    const unverified = await userFactory.create();
-    const verified = await userFactory.create({emailVerifiedAt: new Date()});
-    const inactive = await userFactory.create();
-    await db().update(users).set({status: 'suspended'}).where(eq(users.id, inactive.id));
-
-    const sent = await resendEmailVerification({email: unverified.email});
-    const verifiedResult = await resendEmailVerification({email: verified.email});
-    const inactiveResult = await resendEmailVerification({email: inactive.email});
-    const missingResult = await resendEmailVerification({
-      email: `missing-${crypto.randomUUID()}@example.com`,
-    });
-
-    expect(captured).toHaveLength(0);
-    expect(
-      await outboxEventsTo(unverified.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    ).toHaveLength(1);
-    expect(
-      await outboxEventsTo(verified.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    ).toHaveLength(0);
-    expect(
-      await outboxEventsTo(inactive.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    ).toHaveLength(0);
-    expect(sent.nextResendAvailableAt).toBeInstanceOf(Date);
-    expect(verifiedResult.nextResendAvailableAt).toBeInstanceOf(Date);
-    expect(inactiveResult.nextResendAvailableAt).toBeInstanceOf(Date);
-    expect(missingResult.nextResendAvailableAt).toBeInstanceOf(Date);
-  });
-
-  test('resendEmailVerification respects cooldown without invalidating the current token', async () => {
-    const user = await signup({
-      email: `resend-cooldown-${crypto.randomUUID()}@example.com`,
-      password: 'correct horse battery staple',
-    });
-    const token = extractToken(
-      await latestEmailLinkTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED),
-    );
-    const existingCreatedAt = new Date(
-      Date.now() - (EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS / 2) * 1000,
-    );
-    await db()
-      .update(emailVerifications)
-      .set({createdAt: existingCreatedAt})
-      .where(eq(emailVerifications.userId, user.id));
-
-    const beforeCall = Date.now();
-    const result = await resendEmailVerification({email: user.email});
-    const verified = await confirmEmailVerification({token});
-
-    // The cooldown branch must return the generic `now + cooldown` estimate, not
-    // `latest.createdAt + cooldown`, so the response cannot leak prior timing.
-    expect(result.nextResendAvailableAt.getTime()).toBeGreaterThanOrEqual(
-      beforeCall + EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS * 1000,
-    );
-    expect(captured).toHaveLength(0);
-    expect(await outboxEventsTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toHaveLength(
-      1,
-    );
-    expect(verified.user.id).toBe(user.id);
-  });
-
-  test('resendEmailVerification sends again after cooldown', async () => {
-    const user = await signup({
-      email: `resend-after-cooldown-${crypto.randomUUID()}@example.com`,
-      password: 'correct horse battery staple',
-    });
-    const staleCreatedAt = new Date(
-      Date.now() - (EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS + 1) * 1000,
-    );
-    await db()
-      .update(emailVerifications)
-      .set({createdAt: staleCreatedAt})
-      .where(eq(emailVerifications.userId, user.id));
-
-    const result = await resendEmailVerification({email: user.email});
-
-    expect(result.nextResendAvailableAt).toBeInstanceOf(Date);
-    expect(captured).toHaveLength(0);
-    expect(await outboxEventsTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toHaveLength(
-      2,
-    );
-  });
-
-  test('resendEmailVerification serializes duplicate requests for one user', async () => {
-    const user = await userFactory.create();
-
-    const results = await Promise.all([
-      resendEmailVerification({email: user.email}),
-      resendEmailVerification({email: user.email}),
-    ]);
-
-    expect(results).toHaveLength(2);
-    expect(captured).toHaveLength(0);
-    expect(await outboxEventsTo(user.email, AUTH_EMAIL_VERIFICATION_SEND_REQUESTED)).toHaveLength(
-      1,
-    );
-  });
-
   test('password reset request and confirm update the password and invalidate the token', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
     const loginResult = await login({email: user.email, password: user.plainPassword});
@@ -593,32 +537,16 @@ describe('auth core', () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
     const workspaceA = crypto.randomUUID();
     const workspaceB = crypto.randomUUID();
-    listMembershipsByUserMock.mockResolvedValueOnce([
-      {
-        id: crypto.randomUUID(),
-        userId: user.id,
-        userEmail: user.email,
-        userName: null,
-        workspaceId: workspaceA,
-        workspaceName: 'Workspace A',
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      },
-      {
-        id: crypto.randomUUID(),
-        userId: user.id,
-        userEmail: user.email,
-        userName: null,
-        workspaceId: workspaceB,
-        workspaceName: 'Workspace B',
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      },
-    ]);
+    listMembershipsByUserMock.mockResolvedValueOnce({
+      memberships: [
+        {workspaceId: workspaceA, role: 'admin'},
+        {workspaceId: workspaceB, role: 'admin'},
+      ],
+    });
 
     const result = await login({email: user.email, password: user.plainPassword});
 
-    const claims = await verifyUserToken({token: result.token, secret: 'auth-core-test-secret'});
+    const claims = await verifyUserToken({token: result.token, secret: userAccessTokenKey()});
     expect(claims.name).toBe(user.name);
     expect(claims.memberships).toEqual([
       {workspaceId: workspaceA, role: 'admin'},
@@ -628,27 +556,18 @@ describe('auth core', () => {
 
   test('refresh re-fetches memberships so newly-added workspaces appear in the next token', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
-    listMembershipsByUserMock.mockResolvedValueOnce([]);
+    listMembershipsByUserMock.mockResolvedValueOnce({memberships: []});
     const loginResult = await login({email: user.email, password: user.plainPassword});
 
     const newWorkspaceId = crypto.randomUUID();
-    listMembershipsByUserMock.mockResolvedValueOnce([
-      {
-        id: crypto.randomUUID(),
-        userId: user.id,
-        userEmail: user.email,
-        userName: null,
-        workspaceId: newWorkspaceId,
-        workspaceName: 'New Workspace',
-        createdAt: new Date(),
-        updatedAt: new Date(),
-      },
-    ]);
+    listMembershipsByUserMock.mockResolvedValueOnce({
+      memberships: [{workspaceId: newWorkspaceId, role: 'admin'}],
+    });
     const refreshed = await refreshAccessToken({refreshToken: loginResult.refreshToken});
 
     const refreshedClaims = await verifyUserToken({
       token: refreshed.token,
-      secret: 'auth-core-test-secret',
+      secret: userAccessTokenKey(),
     });
     expect(refreshedClaims.memberships).toEqual([{workspaceId: newWorkspaceId, role: 'admin'}]);
   });
@@ -664,7 +583,7 @@ describe('auth core', () => {
 
   test('refresh fails closed when listMembershipsByUser throws', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
-    listMembershipsByUserMock.mockResolvedValueOnce([]);
+    listMembershipsByUserMock.mockResolvedValueOnce({memberships: []});
     const loginResult = await login({email: user.email, password: user.plainPassword});
 
     listMembershipsByUserMock.mockRejectedValueOnce(new Error('workspaces DB down'));