@shipfox/api-auth 5.0.0 → 6.0.0

package/src/core/auth.ts

@@ -1,20 +1,18 @@
-import {EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS, emailSchema} from '@shipfox/api-auth-dto';
+import {emailSchema} from '@shipfox/api-auth-dto';
 import {
-  acceptWorkspaceInvitation,
-  InvitationEmailMismatchError,
-  listMembershipsByUser,
-  peekInvitationByRawToken,
-  TokenAlreadyUsedError,
-  TokenExpiredError,
-  TokenInvalidError as WorkspacesTokenInvalidError,
-} from '@shipfox/api-workspaces';
+  confirmEmailChallenge,
+  consumeEmailChallengeProof,
+  createEmailChallenge,
+  resendEmailChallenge,
+} from '@shipfox/api-email-challenges';
+import {
+  type WorkspacesInterModuleClient,
+  workspacesInterModuleContract,
+} from '@shipfox/api-workspaces-dto/inter-module';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
+import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
 import {generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';
 import {config} from '#config.js';
-import {
-  consumeEmailVerification,
-  createEmailVerification,
-  createResendEmailVerification,
-} from '#db/email-verifications.js';
 import {consumePasswordReset, createPasswordReset} from '#db/password-resets.js';
 import {
   createRefreshToken,
@@ -40,14 +38,17 @@ import {
   EmailNotVerifiedError,
   EmailTakenError,
   InvalidCredentialsError,
+  InvitationEmailMismatchError,
+  TokenAlreadyUsedError,
+  TokenExpiredError,
   TokenInvalidError,
   UserNotFoundError,
 } from './errors.js';
 import {signUserToken} from './jwt.js';
 import {hashPassword, verifyPassword} from './password.js';
 
-const VERIFICATION_TTL_HOURS = 24;
 const RESET_TTL_HOURS = 1;
+const PASSWORD_VERIFICATION_PURPOSE = 'password-verification';
 
 let dummyHashCache: string | undefined;
 async function getDummyHash(): Promise<string> {
@@ -69,16 +70,21 @@ function recordRefreshOutcome(outcome: AuthTokenRefreshOutcome): void {
   recordTokenRefreshed(outcome);
 }
 
-async function signAccessToken(user: User): Promise<string> {
-  const memberships = await listMembershipsByUser({userId: user.id}).catch((error: unknown) => {
-    throw new AuthDependencyUnavailableError('workspaces', error);
-  });
+async function signAccessToken(
+  user: User,
+  workspaces: WorkspacesInterModuleClient,
+): Promise<string> {
+  const memberships = await workspaces
+    .listMembershipsForTokenClaims({userId: user.id})
+    .catch((error: unknown) => {
+      throw new AuthDependencyUnavailableError('workspaces', error);
+    });
   return await signUserToken({
     userId: user.id,
     email: user.email,
     name: user.name,
-    memberships: memberships.map((m) => ({workspaceId: m.workspaceId, role: 'admin' as const})),
-    secret: config.AUTH_JWT_SECRET,
+    memberships: memberships.memberships,
+    secret: userAccessTokenKey(),
     expiresIn: config.AUTH_JWT_EXPIRES_IN,
   });
 }
@@ -99,25 +105,35 @@ async function createRefreshSession(user: User): Promise<string> {
   return refreshToken;
 }
 
-function verificationLink(rawToken: string): string {
-  return `${config.CLIENT_BASE_URL}/auth/verify-email?token=${rawToken}`;
-}
-
 function passwordResetLink(rawToken: string): string {
   return `${config.CLIENT_BASE_URL}/auth/reset?token=${rawToken}`;
 }
 
-async function createAndQueueEmailVerification(user: User): Promise<void> {
-  const rawToken = generateOpaqueToken('emailVerification');
-  await createEmailVerification({
-    userId: user.id,
-    hashedToken: hashOpaqueToken(rawToken),
-    expiresAt: hoursFromNow(VERIFICATION_TTL_HOURS),
-    sendEmail: {
-      email: user.email,
-      verifyLink: verificationLink(rawToken),
-    },
-  });
+function invitationErrorFromKnownError(
+  error: unknown,
+  method: 'preflightInvitationAcceptance' | 'acceptInvitation',
+): Error {
+  const contractMethod = workspacesInterModuleContract.methods[method];
+  if (!isInterModuleKnownError(contractMethod, error)) return error as Error;
+
+  if (error.code === 'invitation-token-invalid')
+    return new TokenInvalidError('Invitation token is invalid');
+  if (error.code === 'invitation-token-used') return new TokenAlreadyUsedError();
+  if (error.code === 'invitation-token-expired') return new TokenExpiredError();
+  return new InvitationEmailMismatchError();
+}
+
+function invitationErrorMessage(
+  code:
+    | 'invitation-token-invalid'
+    | 'invitation-token-used'
+    | 'invitation-token-expired'
+    | 'invitation-email-mismatch',
+): string {
+  if (code === 'invitation-token-invalid') return 'Invitation token is invalid';
+  if (code === 'invitation-token-used') return 'Invitation has already been accepted';
+  if (code === 'invitation-token-expired') return 'Invitation has expired';
+  return 'Signup email does not match the invitation';
 }
 
 export interface SignupParams {
@@ -142,9 +158,27 @@ export async function provisionUser(params: ProvisionUserParams): Promise<User>
   });
 }
 
-export async function signup(params: SignupParams): Promise<User> {
+export type SignupResult = User & {
+  emailChallenge: {id: string; nextResendAvailableAt: Date};
+};
+
+export async function signup(params: SignupParams & {sourceIp?: string}): Promise<SignupResult> {
   const existing = await findUserByEmail({email: params.email});
   if (existing) {
+    const canResumeVerification =
+      existing.status === 'active' &&
+      existing.emailVerifiedAt === null &&
+      existing.hashedPassword !== null &&
+      (await verifyPassword({password: params.password, hash: existing.hashedPassword}));
+    if (canResumeVerification) {
+      const emailChallenge = await createEmailChallenge({
+        email: existing.email,
+        purpose: PASSWORD_VERIFICATION_PURPOSE,
+        continuation: existing.id,
+        sourceIp: params.sourceIp ?? '0.0.0.0',
+      });
+      return {...existing, emailChallenge};
+    }
     throw new EmailTakenError(params.email);
   }
 
@@ -153,15 +187,22 @@ export async function signup(params: SignupParams): Promise<User> {
     email: params.email,
     hashedPassword,
     name: params.name ?? null,
+    signedUp: {viaInvitation: false},
   });
 
-  await createAndQueueEmailVerification(user);
+  const emailChallenge = await createEmailChallenge({
+    email: user.email,
+    purpose: PASSWORD_VERIFICATION_PURPOSE,
+    continuation: user.id,
+    sourceIp: params.sourceIp ?? '0.0.0.0',
+  });
 
-  return user;
+  return {...user, emailChallenge};
 }
 
 export interface SignupWithInvitationParams extends SignupParams {
   invitationToken: string;
+  workspaces: WorkspacesInterModuleClient;
 }
 
 export interface SignupWithInvitationResult extends LoginResult {
@@ -175,18 +216,13 @@ export async function signupWithInvitation(
   // Step 1: Pre-validate the invitation BEFORE any user write so an invalid
   // token never produces an orphan user. Re-validation happens again inside
   // acceptWorkspaceInvitation (race-safe) after the user is created.
-  const invitation = await peekInvitationByRawToken({token: params.invitationToken});
-  if (!invitation) {
-    throw new WorkspacesTokenInvalidError('Invitation token is invalid');
-  }
-  if (invitation.acceptedAt !== null) {
-    throw new TokenAlreadyUsedError();
-  }
-  if (invitation.expiresAt.getTime() <= Date.now()) {
-    throw new TokenExpiredError();
-  }
-  if (invitation.email !== params.email) {
-    throw new InvitationEmailMismatchError();
+  try {
+    await params.workspaces.preflightInvitationAcceptance({
+      token: params.invitationToken,
+      email: params.email,
+    });
+  } catch (error) {
+    throw invitationErrorFromKnownError(error, 'preflightInvitationAcceptance');
   }
 
   // Step 2: Create the user as verified. The invitation email is the proof of
@@ -201,6 +237,7 @@ export async function signupWithInvitation(
     hashedPassword,
     name: params.name ?? null,
     emailVerifiedAt: new Date(),
+    signedUp: {viaInvitation: true},
   });
 
   // Step 3: Accept the invitation through the workspaces module boundary.
@@ -210,7 +247,7 @@ export async function signupWithInvitation(
   let membership: SignupWithInvitationResult['membership'] = null;
   let acceptError: SignupWithInvitationResult['acceptError'];
   try {
-    const result = await acceptWorkspaceInvitation({
+    const result = await params.workspaces.acceptInvitation({
       token: params.invitationToken,
       userId: user.id,
       email: user.email,
@@ -222,13 +259,8 @@ export async function signupWithInvitation(
       workspaceId: result.membership.workspaceId,
     };
   } catch (error) {
-    if (
-      error instanceof WorkspacesTokenInvalidError ||
-      error instanceof TokenAlreadyUsedError ||
-      error instanceof TokenExpiredError ||
-      error instanceof InvitationEmailMismatchError
-    ) {
-      acceptError = {code: error.name, message: error.message};
+    if (isInterModuleKnownError(workspacesInterModuleContract.methods.acceptInvitation, error)) {
+      acceptError = {code: error.code, message: invitationErrorMessage(error.code)};
     } else {
       acceptError = {
         code: 'AcceptFailed',
@@ -239,7 +271,7 @@ export async function signupWithInvitation(
 
   // Step 4: Issue session. signAccessToken reads memberships through the
   // workspaces module API, so a successful accept is reflected in the JWT.
-  const token = await signAccessToken(user);
+  const token = await signAccessToken(user, params.workspaces);
   const refreshToken = await createRefreshSession(user);
 
   if (acceptError) {
@@ -272,6 +304,7 @@ export async function createUser(params: CreateUserParams): Promise<User> {
 export interface LoginParams {
   email: string;
   password: string;
+  workspaces: WorkspacesInterModuleClient;
 }
 
 export interface LoginResult {
@@ -301,7 +334,7 @@ export async function login(params: LoginParams): Promise<LoginResult> {
     throw new EmailNotVerifiedError();
   }
 
-  const token = await signAccessToken(user);
+  const token = await signAccessToken(user, params.workspaces);
   const refreshToken = await createRefreshSession(user);
 
   return {token, refreshToken, user};
@@ -310,6 +343,7 @@ export async function login(params: LoginParams): Promise<LoginResult> {
 export interface CreateSessionForUserParams {
   userId?: string | undefined;
   email?: string | undefined;
+  workspaces: WorkspacesInterModuleClient;
 }
 
 export interface CreateSessionForUserResult {
@@ -330,7 +364,7 @@ export async function createSessionForUser(
   const user = params.userId
     ? await findUserById({id: params.userId})
     : params.email
-      ? await findUserByEmail({email: params.email})
+      ? await findUserByEmail({email: emailSchema.parse(params.email)})
       : undefined;
 
   if (!user) {
@@ -343,7 +377,7 @@ export async function createSessionForUser(
     throw new InvalidCredentialsError();
   }
 
-  const token = await signAccessToken(user);
+  const token = await signAccessToken(user, params.workspaces);
   const refreshToken = await createRefreshSession(user);
 
   return {token, refreshToken, user};
@@ -358,6 +392,7 @@ export interface RefreshAccessTokenResult {
 
 export async function refreshAccessToken(params: {
   refreshToken: string;
+  workspaces: WorkspacesInterModuleClient;
 }): Promise<RefreshAccessTokenResult> {
   const currentHashedToken = hashOpaqueToken(params.refreshToken);
   const current = await findRefreshTokenByHash({hashedToken: currentHashedToken});
@@ -377,7 +412,7 @@ export async function refreshAccessToken(params: {
   // second tab); past it, reuse of a retired token means a compromised session.
   if (current.rotatedAt) {
     if (isWithinRotationGrace(current)) {
-      const token = await signAccessToken(user);
+      const token = await signAccessToken(user, params.workspaces);
       recordRefreshOutcome('grace');
       return {token, refreshToken: undefined, user};
     }
@@ -401,12 +436,12 @@ export async function refreshAccessToken(params: {
       recordRefreshOutcome('rejected');
       throw new TokenInvalidError('Refresh token is invalid or expired');
     }
-    const token = await signAccessToken(user);
+    const token = await signAccessToken(user, params.workspaces);
     recordRefreshOutcome('grace');
     return {token, refreshToken: undefined, user};
   }
 
-  const token = await signAccessToken(user);
+  const token = await signAccessToken(user, params.workspaces);
   recordRefreshOutcome('rotated');
   return {token, refreshToken: nextRefreshToken, user};
 }
@@ -422,36 +457,44 @@ export interface ResendEmailVerificationResult {
 }
 
 export async function confirmEmailVerification(params: {
-  token: string;
+  email: string;
+  challengeId: string;
+  code: string;
+  workspaces: WorkspacesInterModuleClient;
 }): Promise<ConfirmEmailVerificationResult> {
-  const consumed = await consumeEmailVerification({hashedToken: hashOpaqueToken(params.token)});
-  if (!consumed) {
-    throw new TokenInvalidError('Verification token is invalid or expired');
-  }
+  const user = await findUserByEmail({email: emailSchema.parse(params.email)});
+  if (!user) throw new TokenInvalidError('Verification code is invalid or expired');
+  await confirmEmailChallenge({id: params.challengeId, code: params.code, continuation: user.id});
+  await consumeEmailChallengeProof({
+    id: params.challengeId,
+    purpose: PASSWORD_VERIFICATION_PURPOSE,
+    continuation: user.id,
+  });
 
-  const user = await markEmailVerified({userId: consumed.userId});
-  if (user?.status !== 'active') {
-    throw new TokenInvalidError('Verification token is invalid or expired');
+  const verifiedUser = await markEmailVerified({userId: user.id});
+  if (verifiedUser?.status !== 'active') {
+    throw new TokenInvalidError('Verification code is invalid or expired');
   }
 
-  const token = await signAccessToken(user);
-  const refreshToken = await createRefreshSession(user);
+  const token = await signAccessToken(verifiedUser, params.workspaces);
+  const refreshToken = await createRefreshSession(verifiedUser);
 
-  return {token, refreshToken, user};
+  return {token, refreshToken, user: verifiedUser};
 }
 
 export async function resendEmailVerification(params: {
   email: string;
+  challengeId: string;
+  sourceIp: string;
 }): Promise<ResendEmailVerificationResult> {
-  const rawToken = generateOpaqueToken('emailVerification');
-  const result = await createResendEmailVerification({
-    email: params.email,
-    hashedToken: hashOpaqueToken(rawToken),
-    expiresAt: hoursFromNow(VERIFICATION_TTL_HOURS),
-    cooldownSeconds: EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS,
-    sendEmail: {
-      verifyLink: verificationLink(rawToken),
-    },
+  const user = await findUserByEmail({email: emailSchema.parse(params.email)});
+  if (!user || user.emailVerifiedAt || user.status !== 'active') {
+    return {nextResendAvailableAt: new Date()};
+  }
+  const result = await resendEmailChallenge({
+    id: params.challengeId,
+    continuation: user.id,
+    sourceIp: params.sourceIp,
   });
 
   return {nextResendAvailableAt: result.nextResendAvailableAt};
@@ -485,6 +528,7 @@ export interface ConfirmPasswordResetResult {
 export async function confirmPasswordReset(params: {
   token: string;
   newPassword: string;
+  workspaces: WorkspacesInterModuleClient;
 }): Promise<ConfirmPasswordResetResult> {
   const consumed = await consumePasswordReset({hashedToken: hashOpaqueToken(params.token)});
   if (!consumed) {
@@ -504,7 +548,7 @@ export async function confirmPasswordReset(params: {
 
   await revokeRefreshTokensForUser({userId: consumed.userId});
 
-  const token = await signAccessToken(user);
+  const token = await signAccessToken(user, params.workspaces);
   const refreshToken = await createRefreshSession(user);
 
   return {token, refreshToken, user};

package/src/core/email-owner.test.ts

@@ -0,0 +1,86 @@
+import {generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';
+import {eq} from 'drizzle-orm';
+import {ZodError} from 'zod';
+import {findUserByEmail} from '#core/email-owner.js';
+import {db} from '#db/db.js';
+import {refreshTokens} from '#db/schema/refresh-tokens.js';
+import {users} from '#db/schema/users.js';
+import * as usersDb from '#db/users.js';
+import {userFactory} from '#test/index.js';
+
+describe('findUserByEmail (email owner)', () => {
+  test('returns undefined for a missing owner', async () => {
+    const result = await findUserByEmail({
+      email: `missing-${crypto.randomUUID()}@example.com`,
+    });
+
+    expect(result).toBeUndefined();
+  });
+
+  test.each([
+    'active',
+    'suspended',
+    'deleted',
+  ] as const)('returns the owner of a(n) %s account', async (status) => {
+    const user = await userFactory.create({emailVerifiedAt: new Date()});
+    await db().update(users).set({status}).where(eq(users.id, user.id));
+
+    const result = await findUserByEmail({email: user.email});
+
+    expect(result).toEqual({id: user.id, email: user.email, status});
+  });
+
+  test('projects only id, email, and status', async () => {
+    const user = await userFactory.create({emailVerifiedAt: new Date()});
+
+    const result = await findUserByEmail({email: user.email});
+
+    expect(Object.keys(result ?? {}).sort()).toEqual(['email', 'id', 'status']);
+  });
+
+  test('resolves surrounding whitespace and mixed case to the same owner', async () => {
+    const user = await userFactory.create();
+
+    const result = await findUserByEmail({email: `  ${user.email.toUpperCase()}  `});
+
+    expect(result).toEqual({id: user.id, email: user.email, status: 'active'});
+  });
+
+  test('performs no user or refresh-session writes', async () => {
+    const user = await userFactory.create({emailVerifiedAt: new Date()});
+    const rawRefreshToken = generateOpaqueToken('refreshToken');
+    await db()
+      .insert(refreshTokens)
+      .values({
+        userId: user.id,
+        hashedToken: hashOpaqueToken(rawRefreshToken),
+        expiresAt: new Date(Date.now() + 60_000),
+      });
+
+    const beforeUser = await db().select().from(users).where(eq(users.id, user.id));
+    const beforeRefreshTokens = await db()
+      .select()
+      .from(refreshTokens)
+      .where(eq(refreshTokens.userId, user.id));
+
+    await findUserByEmail({email: user.email});
+
+    const afterUser = await db().select().from(users).where(eq(users.id, user.id));
+    const afterRefreshTokens = await db()
+      .select()
+      .from(refreshTokens)
+      .where(eq(refreshTokens.userId, user.id));
+
+    expect(afterUser).toEqual(beforeUser);
+    expect(afterRefreshTokens).toEqual(beforeRefreshTokens);
+  });
+
+  test('rejects invalid email syntax without querying the database', async () => {
+    const findUserByEmailInDbSpy = vi.spyOn(usersDb, 'findUserByEmail');
+
+    const promise = findUserByEmail({email: 'not-an-email'});
+
+    await expect(promise).rejects.toBeInstanceOf(ZodError);
+    expect(findUserByEmailInDbSpy).not.toHaveBeenCalled();
+  });
+});

package/src/core/email-owner.ts

@@ -0,0 +1,23 @@
+import {emailSchema} from '@shipfox/api-auth-dto';
+import {findUserByEmail as findUserByEmailInDb} from '#db/users.js';
+import type {User} from './entities/user.js';
+
+export type EmailOwner = Pick<User, 'id' | 'email' | 'status'>;
+
+export interface FindUserByEmailParams {
+  email: string;
+}
+
+/**
+ * Read-only lookup of the current owner of a normalized email. Performs no
+ * user, session, or verification writes; returns undefined when no user owns
+ * the address.
+ */
+export async function findUserByEmail(
+  params: FindUserByEmailParams,
+): Promise<EmailOwner | undefined> {
+  const email = emailSchema.parse(params.email);
+  const user = await findUserByEmailInDb({email});
+  if (!user) return undefined;
+  return {id: user.id, email: user.email, status: user.status};
+}

package/src/core/job-lease-token.test.ts

@@ -1,9 +1,10 @@
 import {JOB_LEASE_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
+import {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';
 import {signHs256} from '@shipfox/node-jwt';
 import {issueJobLeaseToken, verifyJobLeaseToken} from './job-lease-token.js';
 
 // Matches test/env.ts; the codec reads this same value from config.
-const SECRET = process.env.AUTH_JOB_LEASE_TOKEN_SECRET ?? 'test-lease-secret';
+const SECRET = jobLeaseTokenKey();
 
 function claims() {
   return {

package/src/core/job-lease-token.ts

@@ -3,6 +3,7 @@ import {
   type JobLeaseTokenClaims,
   jobLeaseTokenClaimsSchema,
 } from '@shipfox/api-auth-dto';
+import {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';
 import {signHs256, verifyHs256} from '@shipfox/node-jwt';
 import {config} from '#config.js';
 import {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';
@@ -57,7 +58,7 @@ export async function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Prom
           }
         : {}),
     },
-    secret: config.AUTH_JOB_LEASE_TOKEN_SECRET,
+    secret: jobLeaseTokenKey(),
     expiresIn: config.AUTH_JOB_LEASE_TOKEN_EXPIRES_IN,
     audience: JOB_LEASE_TOKEN_AUDIENCE,
   });
@@ -70,7 +71,7 @@ export async function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenC
   try {
     const claims = await verifyHs256({
       token,
-      secret: config.AUTH_JOB_LEASE_TOKEN_SECRET,
+      secret: jobLeaseTokenKey(),
       schema: jobLeaseTokenClaimsSchema,
       audience: JOB_LEASE_TOKEN_AUDIENCE,
     });

package/src/core/jwt.ts

@@ -26,13 +26,13 @@ export interface SignUserTokenParams {
   email: string;
   name?: string | null | undefined;
   memberships: TokenMembership[];
-  secret: string;
+  secret: string | Uint8Array;
   expiresIn: string;
 }
 
 export interface VerifyUserTokenParams {
   token: string;
-  secret: string;
+  secret: string | Uint8Array;
 }
 
 export async function signUserToken(params: SignUserTokenParams): Promise<string> {

package/src/core/rate-limit.test.ts

@@ -258,12 +258,6 @@ describe('checkAuthRateLimit', () => {
     });
     const pruneExpiredAuthRateLimits = vi.fn(() => pendingPrune);
     vi.resetModules();
-    vi.doMock('#config.js', () => ({
-      config: {
-        AUTH_JWT_SECRET: 'jwt-secret',
-        RATE_LIMIT_IDENTIFIER_SECRET: undefined,
-      },
-    }));
     vi.doMock('#db/rate-limits.js', () => ({
       consumeAuthRateLimit,
       pruneExpiredAuthRateLimits,
@@ -293,7 +287,6 @@ describe('checkAuthRateLimit', () => {
       expect(pruneExpiredAuthRateLimits).toHaveBeenCalledWith({now});
     } finally {
       finishPrune?.(0);
-      vi.doUnmock('#config.js');
       vi.doUnmock('#db/rate-limits.js');
       vi.doUnmock('#metrics/index.js');
       vi.resetModules();
@@ -421,41 +414,31 @@ describe('checkAuthRateLimit', () => {
     });
   });
 
-  it('uses the configured identifier secret when present', async () => {
+  it('uses the root-derived identifier key', async () => {
     vi.resetModules();
-    vi.doMock('#config.js', () => ({
-      config: {
-        AUTH_JWT_SECRET: 'jwt-secret',
-        RATE_LIMIT_IDENTIFIER_SECRET: 'configured-secret',
-      },
-    }));
+    vi.stubEnv('AUTH_ROOT_KEY', 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=');
 
     try {
-      const configuredSecretModule = await import('./rate-limit.js');
-      const configuredSecretHash = configuredSecretModule.hashAuthRateLimitIdentifier({
+      const firstModule = await import('./rate-limit.js');
+      const firstHash = firstModule.hashAuthRateLimitIdentifier({
         action: 'login',
         scope: 'email',
         identifier: 'person@example.com',
       });
-      vi.doMock('#config.js', () => ({
-        config: {
-          AUTH_JWT_SECRET: 'jwt-secret',
-          RATE_LIMIT_IDENTIFIER_SECRET: undefined,
-        },
-      }));
+      vi.stubEnv('AUTH_ROOT_KEY', 'ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=');
       vi.resetModules();
-      const derivedSecretModule = await import('./rate-limit.js');
-      const derivedSecretHash = derivedSecretModule.hashAuthRateLimitIdentifier({
+      const secondModule = await import('./rate-limit.js');
+      const secondHash = secondModule.hashAuthRateLimitIdentifier({
         action: 'login',
         scope: 'email',
         identifier: 'person@example.com',
       });
 
-      expect(configuredSecretHash).toMatch(HMAC_HEX_PATTERN);
-      expect(derivedSecretHash).toMatch(HMAC_HEX_PATTERN);
-      expect(configuredSecretHash).not.toBe(derivedSecretHash);
+      expect(firstHash).toMatch(HMAC_HEX_PATTERN);
+      expect(secondHash).toMatch(HMAC_HEX_PATTERN);
+      expect(firstHash).not.toBe(secondHash);
     } finally {
-      vi.doUnmock('#config.js');
+      vi.unstubAllEnvs();
       vi.resetModules();
     }
   });

package/src/core/rate-limit.ts

@@ -1,4 +1,4 @@
-import {createHmac} from 'node:crypto';
+import {rateLimitIdentifierKey} from '@shipfox/node-auth-root-key';
 import {
   checkRateLimit,
   hashRateLimitIdentifier,
@@ -6,7 +6,6 @@ import {
   type RateLimitPolicy,
   RateLimitUnavailableError,
 } from '@shipfox/node-rate-limit';
-import {config} from '#config.js';
 import {consumeAuthRateLimit, pruneExpiredAuthRateLimits} from '#db/rate-limits.js';
 import {
   type AuthRateLimitAction,
@@ -64,17 +63,10 @@ export class AuthRateLimitUnavailableError extends RateLimitUnavailableError<
 }
 
 const DEFAULT_TIMEOUT_MS = 250;
-const IDENTIFIER_SECRET_DERIVATION_DOMAIN = 'shipfox.auth.rate-limit.identifier-secret.v1';
 const IDENTIFIER_HASH_DOMAIN = 'shipfox.auth.rate-limit.identifier.v1';
 
-function effectiveIdentifierSecret(): Buffer | string {
-  if (config.RATE_LIMIT_IDENTIFIER_SECRET) {
-    return config.RATE_LIMIT_IDENTIFIER_SECRET;
-  }
-
-  return createHmac('sha256', config.AUTH_JWT_SECRET)
-    .update(IDENTIFIER_SECRET_DERIVATION_DOMAIN)
-    .digest();
+function effectiveIdentifierSecret(): Uint8Array {
+  return rateLimitIdentifierKey();
 }
 
 export function hashAuthRateLimitIdentifier(params: {