@shipfox/api-auth 5.0.0 → 7.0.1

package/src/core/runner-session-token.test.ts

@@ -1,10 +1,11 @@
 import {JOB_LEASE_TOKEN_AUDIENCE, RUNNER_SESSION_TOKEN_AUDIENCE} from '@shipfox/api-auth-dto';
+import {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';
 import {signHs256} from '@shipfox/node-jwt';
 import {generateKeyPair, SignJWT} from 'jose';
 import {issueJobLeaseToken, verifyJobLeaseToken} from './job-lease-token.js';
 import {issueRunnerSessionToken, verifyRunnerSessionToken} from './runner-session-token.js';
 
-const SECRET = process.env.AUTH_RUNNER_SESSION_TOKEN_SECRET ?? 'test-runner-session-secret';
+const SECRET = runnerSessionTokenKey();
 
 function claims() {
   return {

package/src/core/runner-session-token.ts

@@ -3,6 +3,7 @@ import {
   type RunnerSessionTokenClaims,
   runnerSessionTokenClaimsSchema,
 } from '@shipfox/api-auth-dto';
+import {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';
 import {signHs256, verifyHs256} from '@shipfox/node-jwt';
 import {config} from '#config.js';
 import {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';
@@ -21,7 +22,7 @@ export async function issueRunnerSessionToken(
       labels: claims.labels,
       maxClaims: claims.maxClaims,
     },
-    secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,
+    secret: runnerSessionTokenKey(),
     expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,
     audience: RUNNER_SESSION_TOKEN_AUDIENCE,
   });
@@ -36,7 +37,7 @@ export async function verifyRunnerSessionToken(
   try {
     const claims = await verifyHs256({
       token,
-      secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,
+      secret: runnerSessionTokenKey(),
       schema: runnerSessionTokenClaimsSchema,
       audience: RUNNER_SESSION_TOKEN_AUDIENCE,
     });

package/src/db/db.ts

@@ -1,6 +1,5 @@
 import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';
 import {pgClient} from '@shipfox/node-postgres';
-import {emailVerifications} from './schema/email-verifications.js';
 import {authOutbox} from './schema/outbox.js';
 import {passwordResets} from './schema/password-resets.js';
 import {authRateLimits} from './schema/rate-limits.js';
@@ -11,7 +10,6 @@ export const schema = {
   users,
   passwordResets,
   refreshTokens,
-  emailVerifications,
   authOutbox,
   authRateLimits,
 };

package/src/db/users.ts

@@ -1,7 +1,10 @@
+import {AUTH_USER_SIGNED_UP, type AuthEventMap} from '@shipfox/api-auth-dto';
+import {writeOutboxEvent} from '@shipfox/node-outbox';
 import {eq} from 'drizzle-orm';
 import type {User} from '#core/entities/user.js';
 import {EmailTakenError} from '#core/errors.js';
 import {db} from './db.js';
+import {authOutbox} from './schema/outbox.js';
 import {toUser, type UserDb, users} from './schema/users.js';
 
 export interface CreateUserParams {
@@ -9,6 +12,7 @@ export interface CreateUserParams {
   hashedPassword: string | null;
   name?: string | null;
   emailVerifiedAt?: Date | null;
+  signedUp?: {viaInvitation: boolean};
 }
 
 export interface ProvisionUserParams {
@@ -29,27 +33,41 @@ function isAuthUsersEmailUniqueViolation(error: unknown): boolean {
 }
 
 export async function createUser(params: CreateUserParams): Promise<User> {
-  let rows: UserDb[];
   try {
-    rows = await db()
-      .insert(users)
-      .values({
-        email: params.email,
-        hashedPassword: params.hashedPassword,
-        name: params.name ?? null,
-        emailVerifiedAt: params.emailVerifiedAt ?? null,
-      })
-      .returning();
+    return await db().transaction(async (tx) => {
+      const rows: UserDb[] = await tx
+        .insert(users)
+        .values({
+          email: params.email,
+          hashedPassword: params.hashedPassword,
+          name: params.name ?? null,
+          emailVerifiedAt: params.emailVerifiedAt ?? null,
+        })
+        .returning();
+
+      const row = rows[0];
+      if (!row) throw new Error('Insert returned no rows');
+
+      const user = toUser(row);
+      if (params.signedUp) {
+        await writeOutboxEvent<AuthEventMap>(tx, authOutbox, {
+          type: AUTH_USER_SIGNED_UP,
+          payload: {
+            userId: user.id,
+            email: user.email,
+            ...(user.name ? {name: user.name} : {}),
+            viaInvitation: params.signedUp.viaInvitation,
+          },
+        });
+      }
+      return user;
+    });
   } catch (error) {
     if (isAuthUsersEmailUniqueViolation(error)) {
       throw new EmailTakenError(params.email);
     }
     throw error;
   }
-
-  const row = rows[0];
-  if (!row) throw new Error('Insert returned no rows');
-  return toUser(row);
 }
 
 export async function provisionUser(params: ProvisionUserParams): Promise<User> {

package/src/index.test.ts

@@ -1,16 +1,14 @@
 import {
-  AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
   AUTH_PASSWORD_RESET_SEND_REQUESTED,
+  AUTH_USER_SIGNED_UP,
   authEventSchemas,
 } from '@shipfox/api-auth-dto';
-import {authModule} from './index.js';
+import {createAuthModule} from './index.js';
 import {passwordLoginMethods} from './login-methods.js';
 
 vi.mock('#config.js', () => ({
   config: {
-    AUTH_JWT_SECRET: 'auth-module-test-secret',
     AUTH_JWT_EXPIRES_IN: '15m',
-    AUTH_JOB_LEASE_TOKEN_SECRET: 'auth-module-test-job-secret',
     AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: '90m',
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: 30,
@@ -18,10 +16,21 @@ vi.mock('#config.js', () => ({
     AUTH_PASSWORD_ENABLED: true,
     CLIENT_BASE_URL: 'https://app.example.test',
   },
+}));
+
+vi.mock('@shipfox/node-mailer', () => ({
   mailer: {send: vi.fn()},
 }));
 
 describe('authModule', () => {
+  const authModule = createAuthModule({
+    workspaces: {
+      listMembershipsForTokenClaims: vi.fn(),
+      preflightInvitationAcceptance: vi.fn(),
+      acceptInvitation: vi.fn(),
+      requireActiveMembership: vi.fn(),
+    },
+  });
   test('declares password login only when password login is enabled', () => {
     expect(passwordLoginMethods(true)).toEqual([{id: 'password'}]);
     expect(passwordLoginMethods(false)).toEqual([]);
@@ -34,14 +43,9 @@ describe('authModule', () => {
 
     expect(publisher?.eventSchemas).toBe(authEventSchemas);
     expect(Object.keys(publisher?.eventSchemas ?? {}).sort()).toEqual([
-      AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
       AUTH_PASSWORD_RESET_SEND_REQUESTED,
+      AUTH_USER_SIGNED_UP,
     ]);
-    expect(events).toEqual(
-      expect.arrayContaining([
-        AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
-        AUTH_PASSWORD_RESET_SEND_REQUESTED,
-      ]),
-    );
+    expect(events).toEqual(expect.arrayContaining([AUTH_PASSWORD_RESET_SEND_REQUESTED]));
   });
 });

package/src/index.ts

@@ -1,5 +1,4 @@
 import {
-  AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
   AUTH_PASSWORD_RESET_SEND_REQUESTED,
   type AuthEventMap,
   authEventSchemas,
@@ -13,12 +12,10 @@ import {authOutbox} from '#db/schema/outbox.js';
 import {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';
 import {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';
 import {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';
-import {authE2eRoutes} from '#presentation/e2eRoutes/index.js';
-import {authRoutes} from '#presentation/routes/index.js';
-import {
-  onEmailVerificationSendRequested,
-  onPasswordResetSendRequested,
-} from '#presentation/subscribers/index.js';
+import {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';
+import {createAuthInterModulePresentation} from '#presentation/inter-module.js';
+import {buildAuthRoutes} from '#presentation/routes/index.js';
+import {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';
 import {passwordLoginMethods} from './login-methods.js';
 
 export type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';
@@ -29,6 +26,8 @@ export type {
   ProvisionUserParams,
 } from '#core/auth.js';
 export {createSessionForUser, provisionUser} from '#core/auth.js';
+export type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';
+export {findUserByEmail} from '#core/email-owner.js';
 export type {User, UserStatus} from '#core/entities/user.js';
 export {
   AuthDependencyUnavailableError,
@@ -57,16 +56,20 @@ export {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-a
 
 const subscriber = subscriberFactory<AuthEventMap>();
 
-export const authModule: ShipfoxModule = {
-  name: 'auth',
-  database: {db, migrationsPath},
-  auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],
-  loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),
-  routes: [authRoutes],
-  e2eRoutes: [authE2eRoutes],
-  publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],
-  subscribers: [
-    subscriber(AUTH_EMAIL_VERIFICATION_SEND_REQUESTED, onEmailVerificationSendRequested),
-    subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested),
-  ],
-};
+export function createAuthModule({
+  workspaces,
+}: {
+  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;
+}): ShipfoxModule {
+  return {
+    name: 'auth',
+    database: {db, migrationsPath},
+    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],
+    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),
+    routes: [buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces)],
+    e2eRoutes: [createAuthE2eRoutes(workspaces)],
+    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],
+    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],
+    interModulePresentations: [createAuthInterModulePresentation()],
+  };
+}

package/src/presentation/auth/jwt-auth.test.ts

@@ -1,3 +1,4 @@
+import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';
 import {serializerCompiler, validatorCompiler} from 'fastify-type-provider-zod';
@@ -5,7 +6,7 @@ import {signUserToken} from '#core/jwt.js';
 import {createUser, findUserById} from '#db/users.js';
 import {createJwtAuthMethod, getClientContext} from './jwt-auth.js';
 
-const SECRET = 'test-secret';
+const SECRET = userAccessTokenKey();
 
 function emailFor(suffix: string): string {
   return `${suffix}-${crypto.randomUUID()}@example.com`;

package/src/presentation/auth/jwt-auth.ts

@@ -5,9 +5,9 @@ import {
   setUserContext,
   type UserContext,
 } from '@shipfox/api-auth-context';
+import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
 import type {AuthMethod} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
-import {config} from '#config.js';
 import {verifyUserToken} from '#core/jwt.js';
 import {createBearerTokenAuthMethod} from './bearer-token-auth.js';
 
@@ -24,7 +24,7 @@ export function getClientContext(request: FastifyRequest): ClientContext | null
 export function createJwtAuthMethod(): AuthMethod {
   return createBearerTokenAuthMethod({
     name: AUTH_USER,
-    verifyToken: (token) => verifyUserToken({token, secret: config.AUTH_JWT_SECRET}),
+    verifyToken: (token) => verifyUserToken({token, secret: userAccessTokenKey()}),
     invalidTokenError: {message: 'Invalid or expired token', code: 'unauthorized'},
     setContext: (request, claims) => {
       const clientContext: ClientContext = buildUserContext({

package/src/presentation/e2eRoutes/create-session.ts

@@ -1,39 +1,43 @@
 import {e2eCreateSessionBodySchema, e2eCreateSessionResponseSchema} from '@shipfox/api-auth-dto';
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {createSessionForUser} from '#core/auth.js';
 import {EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError} from '#core/errors.js';
 import {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';
 import {toAuthSessionDto} from '#presentation/dto/user.js';
 
-export const createE2eSessionRoute = defineRoute({
-  method: 'POST',
-  path: '/sessions',
-  description: 'Create an authenticated browser session for E2E tests.',
-  schema: {
-    body: e2eCreateSessionBodySchema,
-    response: {
-      200: e2eCreateSessionResponseSchema,
+export function createE2eSessionRoute(workspaces: WorkspacesInterModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/sessions',
+    description: 'Create an authenticated browser session for E2E tests.',
+    schema: {
+      body: e2eCreateSessionBodySchema,
+      response: {
+        200: e2eCreateSessionResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof UserNotFoundError) {
-      throw new ClientError('User not found', 'user-not-found', {status: 404});
-    }
-    if (error instanceof EmailNotVerifiedError) {
-      throw new ClientError('Email not verified', 'email-not-verified', {status: 403});
-    }
-    if (error instanceof InvalidCredentialsError) {
-      throw new ClientError('User is not active', 'user-inactive', {status: 409});
-    }
-    throw error;
-  },
-  handler: async (request, reply) => {
-    const result = await createSessionForUser({
-      ...(request.body.user_id ? {userId: request.body.user_id} : {}),
-      ...(request.body.email ? {email: request.body.email} : {}),
-    });
+    errorHandler: (error) => {
+      if (error instanceof UserNotFoundError) {
+        throw new ClientError('User not found', 'user-not-found', {status: 404});
+      }
+      if (error instanceof EmailNotVerifiedError) {
+        throw new ClientError('Email not verified', 'email-not-verified', {status: 403});
+      }
+      if (error instanceof InvalidCredentialsError) {
+        throw new ClientError('User is not active', 'user-inactive', {status: 409});
+      }
+      throw error;
+    },
+    handler: async (request, reply) => {
+      const result = await createSessionForUser({
+        ...(request.body.user_id ? {userId: request.body.user_id} : {}),
+        ...(request.body.email ? {email: request.body.email} : {}),
+        workspaces,
+      });
 
-    setRefreshTokenCookie(reply, result.refreshToken);
-    return toAuthSessionDto(result);
-  },
-});
+      setRefreshTokenCookie(reply, result.refreshToken);
+      return toAuthSessionDto(result);
+    },
+  });
+}

package/src/presentation/e2eRoutes/index.test.ts

@@ -1,17 +1,20 @@
 import {createApp} from '@shipfox/node-fastify';
 import type {FastifyInstance} from 'fastify';
-import {authE2eRoutes} from './index.js';
-
-vi.mock('@shipfox/api-workspaces', () => ({
-  listMembershipsByUser: vi.fn(() => Promise.resolve([])),
-}));
+import {createAuthE2eRoutes} from './index.js';
 
 describe('auth E2E routes', () => {
   let app: FastifyInstance;
 
   beforeAll(async () => {
     app = await createApp({
-      routes: [authE2eRoutes],
+      routes: [
+        createAuthE2eRoutes({
+          listMembershipsForTokenClaims: vi.fn(() => Promise.resolve({memberships: []})),
+          preflightInvitationAcceptance: vi.fn(),
+          acceptInvitation: vi.fn(),
+          requireActiveMembership: vi.fn(),
+        }),
+      ],
       swagger: false,
     });
   });

package/src/presentation/e2eRoutes/index.ts

@@ -1,10 +1,13 @@
 import cookie from '@fastify/cookie';
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
 import type {RouteGroup} from '@shipfox/node-fastify';
 import {createE2eSessionRoute} from './create-session.js';
 import {createE2eUserRoute} from './create-user.js';
 
-export const authE2eRoutes: RouteGroup = {
-  prefix: '/auth',
-  plugins: [cookie],
-  routes: [createE2eUserRoute, createE2eSessionRoute],
-};
+export function createAuthE2eRoutes(workspaces: WorkspacesInterModuleClient): RouteGroup {
+  return {
+    prefix: '/auth',
+    plugins: [cookie],
+    routes: [createE2eUserRoute, createE2eSessionRoute(workspaces)],
+  };
+}

package/src/presentation/inter-module.ts

@@ -0,0 +1,13 @@
+import {authInterModuleContract} from '@shipfox/api-auth-dto/inter-module';
+import {defineInterModulePresentation, type InterModulePresentation} from '@shipfox/inter-module';
+import {issueJobLeaseToken} from '#core/job-lease-token.js';
+import {issueRunnerSessionToken} from '#core/runner-session-token.js';
+
+export function createAuthInterModulePresentation(): InterModulePresentation<
+  typeof authInterModuleContract
+> {
+  return defineInterModulePresentation(authInterModuleContract, {
+    mintRunnerSessionToken: async (claims) => ({token: await issueRunnerSessionToken(claims)}),
+    mintJobLeaseToken: async (claims) => ({token: await issueJobLeaseToken(claims)}),
+  });
+}

package/src/presentation/routes/email-verification/verify-email-confirm.ts

@@ -2,36 +2,54 @@ import {
   verifyEmailConfirmBodySchema,
   verifyEmailConfirmResponseSchema,
 } from '@shipfox/api-auth-dto';
+import {EmailChallengeError} from '@shipfox/api-email-challenges';
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {confirmEmailVerification} from '#core/auth.js';
 import {TokenInvalidError} from '#core/errors.js';
 import {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';
 import {toAuthSessionDto} from '#presentation/dto/user.js';
 
-export const verifyEmailConfirmRoute = defineRoute({
-  method: 'POST',
-  path: '/verify-email/confirm',
-  description: 'Verify a user email address with the link sent by email.',
-  schema: {
-    body: verifyEmailConfirmBodySchema,
-    response: {
-      200: verifyEmailConfirmResponseSchema,
+export function createVerifyEmailConfirmRoute(workspaces: WorkspacesInterModuleClient) {
+  return defineRoute({
+    method: 'POST',
+    path: '/verify-email/confirm',
+    description: 'Verify a user email address with the code sent by email.',
+    schema: {
+      body: verifyEmailConfirmBodySchema,
+      response: {
+        200: verifyEmailConfirmResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof TokenInvalidError) {
-      throw new ClientError('Verification token is invalid or expired', 'token-invalid', {
-        status: 410,
-      });
-    }
-    throw error;
-  },
-  handler: async (request, reply) => {
-    const {token} = request.body;
+    errorHandler: (error) => {
+      if (error instanceof TokenInvalidError) {
+        throw new ClientError(
+          'Verification code is invalid or expired',
+          'email-challenge-invalid',
+          {
+            status: 410,
+          },
+        );
+      }
+      if (error instanceof EmailChallengeError) {
+        throw new ClientError(error.message, `email-challenge-${error.code}`, {
+          status: error.code === 'expired' || error.code === 'exhausted' ? 410 : 400,
+        });
+      }
+      throw error;
+    },
+    handler: async (request, reply) => {
+      const {email, challenge_id, code} = request.body;
 
-    const result = await confirmEmailVerification({token});
-    setRefreshTokenCookie(reply, result.refreshToken);
+      const result = await confirmEmailVerification({
+        email,
+        challengeId: challenge_id,
+        code,
+        workspaces,
+      });
+      setRefreshTokenCookie(reply, result.refreshToken);
 
-    return toAuthSessionDto(result);
-  },
-});
+      return toAuthSessionDto(result);
+    },
+  });
+}

package/src/presentation/routes/email-verification/verify-email-resend.ts

@@ -1,12 +1,13 @@
 import {verifyEmailResendBodySchema, verifyEmailResendResponseSchema} from '@shipfox/api-auth-dto';
-import {defineRoute} from '@shipfox/node-fastify';
+import {EmailChallengeError} from '@shipfox/api-email-challenges';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {resendEmailVerification} from '#core/auth.js';
 import {createAuthRateLimitPreHandler} from '#presentation/routes/rate-limit.js';
 
 export const verifyEmailResendRoute = defineRoute({
   method: 'POST',
   path: '/verify-email/resend',
-  description: 'Send a new email verification link if the account can be verified.',
+  description: 'Send a new email verification code if the account can be verified.',
   schema: {
     body: verifyEmailResendBodySchema,
     response: {
@@ -14,10 +15,23 @@ export const verifyEmailResendRoute = defineRoute({
     },
   },
   preHandler: createAuthRateLimitPreHandler('email-send'),
+  errorHandler: (error) => {
+    if (error instanceof EmailChallengeError) {
+      throw new ClientError(error.message, `email-challenge-${error.code}`, {
+        status: error.code === 'limited' ? 429 : error.code === 'expired' ? 410 : 400,
+        ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),
+      });
+    }
+    throw error;
+  },
   handler: async (request, reply) => {
-    const {email} = request.body;
+    const {email, challenge_id} = request.body;
 
-    const result = await resendEmailVerification({email});
+    const result = await resendEmailVerification({
+      email,
+      challengeId: challenge_id,
+      sourceIp: request.ip,
+    });
 
     reply.code(200).send({
       next_resend_available_at: result.nextResendAvailableAt.toISOString(),

package/src/presentation/routes/index.test.ts

@@ -2,6 +2,13 @@ import {createApp} from '@shipfox/node-fastify';
 import {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';
 import {buildAuthRoutes} from './index.js';
 
+const workspaces = {
+  listMembershipsForTokenClaims: vi.fn(() => Promise.resolve({memberships: []})),
+  preflightInvitationAcceptance: vi.fn(),
+  acceptInvitation: vi.fn(),
+  requireActiveMembership: vi.fn(),
+};
+
 const disabledPasswordPaths = [
   '/auth/signup',
   '/auth/verify-email/confirm',
@@ -14,7 +21,7 @@ const disabledPasswordPaths = [
 
 describe('buildAuthRoutes', () => {
   test('preserves the default route table when password login is enabled', () => {
-    const routes = buildAuthRoutes(true);
+    const routes = buildAuthRoutes(true, workspaces);
 
     expect(routes.routes.map((route) => ('path' in route ? route.path : route.prefix))).toEqual([
       '/signup',
@@ -31,7 +38,7 @@ describe('buildAuthRoutes', () => {
   });
 
   test('keeps only session lifecycle routes when password login is disabled', () => {
-    const routes = buildAuthRoutes(false);
+    const routes = buildAuthRoutes(false, workspaces);
 
     expect(routes.routes.map((route) => ('path' in route ? route.path : route.prefix))).toEqual([
       '/refresh',
@@ -43,7 +50,7 @@ describe('buildAuthRoutes', () => {
   test('does not register password or email-verification routes when password login is disabled', async () => {
     const app = await createApp({
       auth: [createJwtAuthMethod()],
-      routes: [buildAuthRoutes(false)],
+      routes: [buildAuthRoutes(false, workspaces)],
       swagger: false,
     });
 

package/src/presentation/routes/index.ts

@@ -1,20 +1,28 @@
+import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';
 import type {RouteGroup} from '@shipfox/node-fastify';
-import {config} from '#config.js';
 import {authCookiePlugin} from '#presentation/auth/refresh-cookie.js';
-import {verifyEmailConfirmRoute} from './email-verification/verify-email-confirm.js';
+import {createVerifyEmailConfirmRoute} from './email-verification/verify-email-confirm.js';
 import {verifyEmailResendRoute} from './email-verification/verify-email-resend.js';
 import {changePasswordRoute} from './password/change-password.js';
-import {passwordResetConfirmRoute} from './password/password-reset-confirm.js';
+import {createPasswordResetConfirmRoute} from './password/password-reset-confirm.js';
 import {passwordResetRequestRoute} from './password/password-reset-request.js';
-import {signupRoute} from './registration/signup.js';
-import {loginRoute} from './session/login.js';
+import {createSignupRoute} from './registration/signup.js';
+import {createLoginRoute} from './session/login.js';
 import {logoutRoute} from './session/logout.js';
 import {meRoute} from './session/me.js';
-import {refreshRoute} from './session/refresh.js';
+import {createRefreshRoute} from './session/refresh.js';
 
-export function buildAuthRoutes(passwordEnabled: boolean): RouteGroup {
+export function buildAuthRoutes(
+  passwordEnabled: boolean,
+  workspaces: WorkspacesInterModuleClient,
+): RouteGroup {
   const passwordRoutes = passwordEnabled
-    ? [signupRoute, verifyEmailConfirmRoute, verifyEmailResendRoute, loginRoute]
+    ? [
+        createSignupRoute(workspaces),
+        createVerifyEmailConfirmRoute(workspaces),
+        verifyEmailResendRoute,
+        createLoginRoute(workspaces),
+      ]
     : [];
 
   return {
@@ -22,14 +30,16 @@ export function buildAuthRoutes(passwordEnabled: boolean): RouteGroup {
     plugins: [authCookiePlugin],
     routes: [
       ...passwordRoutes,
-      refreshRoute,
+      createRefreshRoute(workspaces),
       logoutRoute,
       meRoute,
       ...(passwordEnabled
-        ? [changePasswordRoute, passwordResetRequestRoute, passwordResetConfirmRoute]
+        ? [
+            changePasswordRoute,
+            passwordResetRequestRoute,
+            createPasswordResetConfirmRoute(workspaces),
+          ]
         : []),
     ],
   };
 }
-
-export const authRoutes = buildAuthRoutes(config.AUTH_PASSWORD_ENABLED);