@shipfox/api-auth 7.0.1 → 7.1.0

package/dist/db/refresh-tokens.js

@@ -3,6 +3,7 @@ import { db } from './db.js';
 import { refreshTokens, toRefreshToken } from './schema/refresh-tokens.js';
 export async function createRefreshToken(params) {
     const rows = await db().insert(refreshTokens).values({
+        sessionId: params.sessionId,
         userId: params.userId,
         hashedToken: params.hashedToken,
         expiresAt: params.expiresAt
@@ -22,6 +23,12 @@ export async function createRefreshToken(params) {
     if (!row) return undefined;
     return toRefreshToken(row);
 }
+export async function findActiveRefreshSession(params) {
+    const rows = await db().select().from(refreshTokens).where(and(eq(refreshTokens.sessionId, params.sessionId), eq(refreshTokens.userId, params.userId), isNull(refreshTokens.revokedAt), isNull(refreshTokens.rotatedAt), gt(refreshTokens.expiresAt, sql`now()`))).limit(1);
+    const row = rows[0];
+    if (!row) return undefined;
+    return toRefreshToken(row);
+}
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
@@ -47,6 +54,7 @@ export async function createRefreshToken(params) {
         const rotated = rotatedRows[0];
         if (!rotated) return undefined;
         const successorRows = await tx.insert(refreshTokens).values({
+            sessionId: rotated.sessionId,
             userId: rotated.userId,
             hashedToken: params.nextHashedToken,
             expiresAt: params.expiresAt
@@ -61,6 +69,12 @@ export async function revokeRefreshTokenByHash(params) {
         updatedAt: sql`now()`
     }).where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));
 }
+export async function revokeRefreshSession(params) {
+    await db().update(refreshTokens).set({
+        revokedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(refreshTokens.sessionId, params.sessionId), eq(refreshTokens.userId, params.userId), isNull(refreshTokens.revokedAt)));
+}
 export async function revokeRefreshTokensForUser(params) {
     await db().update(refreshTokens).set({
         revokedAt: sql`now()`,

package/dist/db/refresh-tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/refresh-tokens.ts"],"sourcesContent":["import {and, eq, gt, isNull, ne, sql} from 'drizzle-orm';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport {db} from './db.js';\nimport {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';\n\nexport interface CreateRefreshTokenParams {\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport async function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken> {\n  const rows = await db()\n    .insert(refreshTokens)\n    .values({\n      userId: params.userId,\n      hashedToken: params.hashedToken,\n      expiresAt: params.expiresAt,\n    })\n    .returning();\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up the live session token by hash — one that can still authenticate as\n * the current session. Returns `undefined` for revoked, expired, or already\n * rotated tokens; rotated rows survive in the table only for the grace window\n * and are not \"active\".\n */\nexport async function findActiveRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        isNull(refreshTokens.rotatedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up a non-revoked, non-expired token by hash, including ones already\n * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to\n * rotate, honour the grace window, or reject reuse, so — unlike\n * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.\n */\nexport async function findRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Atomically claims rotation and inserts the successor token. The predecessor is\n * marked rather than deleted so later reuse of the retired token can be detected.\n * If the successor insert fails, the predecessor rotation rolls back.\n */\nexport async function rotateRefreshToken(params: {\n  id: string;\n  currentHashedToken: string;\n  nextHashedToken: string;\n  expiresAt: Date;\n}): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    const rotatedRows = await tx\n      .update(refreshTokens)\n      .set({\n        rotatedAt: sql`now()`,\n        lastUsedAt: sql`now()`,\n        updatedAt: sql`now()`,\n      })\n      .where(\n        and(\n          eq(refreshTokens.id, params.id),\n          eq(refreshTokens.hashedToken, params.currentHashedToken),\n          isNull(refreshTokens.revokedAt),\n          isNull(refreshTokens.rotatedAt),\n          gt(refreshTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning();\n\n    const rotated = rotatedRows[0];\n    if (!rotated) return undefined;\n\n    const successorRows = await tx\n      .insert(refreshTokens)\n      .values({\n        userId: rotated.userId,\n        hashedToken: params.nextHashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    if (!successorRows[0]) throw new Error('Insert returned no rows');\n\n    return toRefreshToken(rotated);\n  });\n}\n\nexport async function revokeRefreshTokenByHash(params: {hashedToken: string}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));\n}\n\nexport async function revokeRefreshTokensForUser(params: {\n  userId: string;\n  exceptRefreshTokenId?: string | undefined;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n        params.exceptRefreshTokenId ? ne(refreshTokens.id, params.exceptRefreshTokenId) : undefined,\n      ),\n    );\n}\n"],"names":["and","eq","gt","isNull","ne","sql","db","refreshTokens","toRefreshToken","createRefreshToken","params","rows","insert","values","userId","hashedToken","expiresAt","returning","row","Error","findActiveRefreshTokenByHash","select","from","where","revokedAt","rotatedAt","limit","undefined","findRefreshTokenByHash","rotateRefreshToken","transaction","tx","rotatedRows","update","set","lastUsedAt","updatedAt","id","currentHashedToken","rotated","successorRows","nextHashedToken","revokeRefreshTokenByHash","revokeRefreshTokensForUser","exceptRefreshTokenId"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEzD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,aAAa,EAAEC,cAAc,QAAO,6BAA6B;AAQzE,OAAO,eAAeC,mBAAmBC,MAAgC;IACvE,MAAMC,OAAO,MAAML,KAChBM,MAAM,CAACL,eACPM,MAAM,CAAC;QACNC,QAAQJ,OAAOI,MAAM;QACrBC,aAAaL,OAAOK,WAAW;QAC/BC,WAAWN,OAAOM,SAAS;IAC7B,GACCC,SAAS;IAEZ,MAAMC,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOX,eAAeU;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAeE,6BAA6BV,MAElD;IACC,MAAMC,OAAO,MAAML,KAChBe,MAAM,GACNC,IAAI,CAACf,eACLgB,KAAK,CACJvB,IACEC,GAAGM,cAAcQ,WAAW,EAAEL,OAAOK,WAAW,GAChDZ,OAAOI,cAAciB,SAAS,GAC9BrB,OAAOI,cAAckB,SAAS,GAC9BvB,GAAGK,cAAcS,SAAS,EAAEX,GAAG,CAAC,KAAK,CAAC,IAGzCqB,KAAK,CAAC;IAET,MAAMR,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOS;IACjB,OAAOnB,eAAeU;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAeU,uBAAuBlB,MAE5C;IACC,MAAMC,OAAO,MAAML,KAChBe,MAAM,GACNC,IAAI,CAACf,eACLgB,KAAK,CACJvB,IACEC,GAAGM,cAAcQ,WAAW,EAAEL,OAAOK,WAAW,GAChDZ,OAAOI,cAAciB,SAAS,GAC9BtB,GAAGK,cAAcS,SAAS,EAAEX,GAAG,CAAC,KAAK,CAAC,IAGzCqB,KAAK,CAAC;IAET,MAAMR,MAAMP,IAAI,CAAC,EAAE;IACnB,IAAI,CAACO,KAAK,OAAOS;IACjB,OAAOnB,eAAeU;AACxB;AAEA;;;;CAIC,GACD,OAAO,eAAeW,mBAAmBnB,MAKxC;IACC,OAAO,MAAMJ,KAAKwB,WAAW,CAAC,OAAOC;QACnC,MAAMC,cAAc,MAAMD,GACvBE,MAAM,CAAC1B,eACP2B,GAAG,CAAC;YACHT,WAAWpB,GAAG,CAAC,KAAK,CAAC;YACrB8B,YAAY9B,GAAG,CAAC,KAAK,CAAC;YACtB+B,WAAW/B,GAAG,CAAC,KAAK,CAAC;QACvB,GACCkB,KAAK,CACJvB,IACEC,GAAGM,cAAc8B,EAAE,EAAE3B,OAAO2B,EAAE,GAC9BpC,GAAGM,cAAcQ,WAAW,EAAEL,OAAO4B,kBAAkB,GACvDnC,OAAOI,cAAciB,SAAS,GAC9BrB,OAAOI,cAAckB,SAAS,GAC9BvB,GAAGK,cAAcS,SAAS,EAAEX,GAAG,CAAC,KAAK,CAAC,IAGzCY,SAAS;QAEZ,MAAMsB,UAAUP,WAAW,CAAC,EAAE;QAC9B,IAAI,CAACO,SAAS,OAAOZ;QAErB,MAAMa,gBAAgB,MAAMT,GACzBnB,MAAM,CAACL,eACPM,MAAM,CAAC;YACNC,QAAQyB,QAAQzB,MAAM;YACtBC,aAAaL,OAAO+B,eAAe;YACnCzB,WAAWN,OAAOM,SAAS;QAC7B,GACCC,SAAS;QAEZ,IAAI,CAACuB,aAAa,CAAC,EAAE,EAAE,MAAM,IAAIrB,MAAM;QAEvC,OAAOX,eAAe+B;IACxB;AACF;AAEA,OAAO,eAAeG,yBAAyBhC,MAA6B;IAC1E,MAAMJ,KACH2B,MAAM,CAAC1B,eACP2B,GAAG,CAAC;QAACV,WAAWnB,GAAG,CAAC,KAAK,CAAC;QAAE+B,WAAW/B,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDkB,KAAK,CAACvB,IAAIC,GAAGM,cAAcQ,WAAW,EAAEL,OAAOK,WAAW,GAAGZ,OAAOI,cAAciB,SAAS;AAChG;AAEA,OAAO,eAAemB,2BAA2BjC,MAGhD;IACC,MAAMJ,KACH2B,MAAM,CAAC1B,eACP2B,GAAG,CAAC;QAACV,WAAWnB,GAAG,CAAC,KAAK,CAAC;QAAE+B,WAAW/B,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDkB,KAAK,CACJvB,IACEC,GAAGM,cAAcO,MAAM,EAAEJ,OAAOI,MAAM,GACtCX,OAAOI,cAAciB,SAAS,GAC9Bd,OAAOkC,oBAAoB,GAAGxC,GAAGG,cAAc8B,EAAE,EAAE3B,OAAOkC,oBAAoB,IAAIjB;AAG1F"}
+{"version":3,"sources":["../../src/db/refresh-tokens.ts"],"sourcesContent":["import {and, eq, gt, isNull, ne, sql} from 'drizzle-orm';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport {db} from './db.js';\nimport {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';\n\nexport interface CreateRefreshTokenParams {\n  sessionId?: string | undefined;\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n}\n\nexport async function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken> {\n  const rows = await db()\n    .insert(refreshTokens)\n    .values({\n      sessionId: params.sessionId,\n      userId: params.userId,\n      hashedToken: params.hashedToken,\n      expiresAt: params.expiresAt,\n    })\n    .returning();\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up the live session token by hash — one that can still authenticate as\n * the current session. Returns `undefined` for revoked, expired, or already\n * rotated tokens; rotated rows survive in the table only for the grace window\n * and are not \"active\".\n */\nexport async function findActiveRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        isNull(refreshTokens.rotatedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\nexport async function findActiveRefreshSession(params: {\n  sessionId: string;\n  userId: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.sessionId, params.sessionId),\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n        isNull(refreshTokens.rotatedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Looks up a non-revoked, non-expired token by hash, including ones already\n * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to\n * rotate, honour the grace window, or reject reuse, so — unlike\n * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.\n */\nexport async function findRefreshTokenByHash(params: {\n  hashedToken: string;\n}): Promise<RefreshToken | undefined> {\n  const rows = await db()\n    .select()\n    .from(refreshTokens)\n    .where(\n      and(\n        eq(refreshTokens.hashedToken, params.hashedToken),\n        isNull(refreshTokens.revokedAt),\n        gt(refreshTokens.expiresAt, sql`now()`),\n      ),\n    )\n    .limit(1);\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toRefreshToken(row);\n}\n\n/**\n * Atomically claims rotation and inserts the successor token. The predecessor is\n * marked rather than deleted so later reuse of the retired token can be detected.\n * If the successor insert fails, the predecessor rotation rolls back.\n */\nexport async function rotateRefreshToken(params: {\n  id: string;\n  currentHashedToken: string;\n  nextHashedToken: string;\n  expiresAt: Date;\n}): Promise<RefreshToken | undefined> {\n  return await db().transaction(async (tx) => {\n    const rotatedRows = await tx\n      .update(refreshTokens)\n      .set({\n        rotatedAt: sql`now()`,\n        lastUsedAt: sql`now()`,\n        updatedAt: sql`now()`,\n      })\n      .where(\n        and(\n          eq(refreshTokens.id, params.id),\n          eq(refreshTokens.hashedToken, params.currentHashedToken),\n          isNull(refreshTokens.revokedAt),\n          isNull(refreshTokens.rotatedAt),\n          gt(refreshTokens.expiresAt, sql`now()`),\n        ),\n      )\n      .returning();\n\n    const rotated = rotatedRows[0];\n    if (!rotated) return undefined;\n\n    const successorRows = await tx\n      .insert(refreshTokens)\n      .values({\n        sessionId: rotated.sessionId,\n        userId: rotated.userId,\n        hashedToken: params.nextHashedToken,\n        expiresAt: params.expiresAt,\n      })\n      .returning();\n\n    if (!successorRows[0]) throw new Error('Insert returned no rows');\n\n    return toRefreshToken(rotated);\n  });\n}\n\nexport async function revokeRefreshTokenByHash(params: {hashedToken: string}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));\n}\n\nexport async function revokeRefreshSession(params: {\n  sessionId: string;\n  userId: string;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.sessionId, params.sessionId),\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n      ),\n    );\n}\n\nexport async function revokeRefreshTokensForUser(params: {\n  userId: string;\n  exceptRefreshTokenId?: string | undefined;\n}): Promise<void> {\n  await db()\n    .update(refreshTokens)\n    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})\n    .where(\n      and(\n        eq(refreshTokens.userId, params.userId),\n        isNull(refreshTokens.revokedAt),\n        params.exceptRefreshTokenId ? ne(refreshTokens.id, params.exceptRefreshTokenId) : undefined,\n      ),\n    );\n}\n"],"names":["and","eq","gt","isNull","ne","sql","db","refreshTokens","toRefreshToken","createRefreshToken","params","rows","insert","values","sessionId","userId","hashedToken","expiresAt","returning","row","Error","findActiveRefreshTokenByHash","select","from","where","revokedAt","rotatedAt","limit","undefined","findActiveRefreshSession","findRefreshTokenByHash","rotateRefreshToken","transaction","tx","rotatedRows","update","set","lastUsedAt","updatedAt","id","currentHashedToken","rotated","successorRows","nextHashedToken","revokeRefreshTokenByHash","revokeRefreshSession","revokeRefreshTokensForUser","exceptRefreshTokenId"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,EAAE,EAAEC,MAAM,EAAEC,EAAE,EAAEC,GAAG,QAAO,cAAc;AAEzD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,aAAa,EAAEC,cAAc,QAAO,6BAA6B;AASzE,OAAO,eAAeC,mBAAmBC,MAAgC;IACvE,MAAMC,OAAO,MAAML,KAChBM,MAAM,CAACL,eACPM,MAAM,CAAC;QACNC,WAAWJ,OAAOI,SAAS;QAC3BC,QAAQL,OAAOK,MAAM;QACrBC,aAAaN,OAAOM,WAAW;QAC/BC,WAAWP,OAAOO,SAAS;IAC7B,GACCC,SAAS;IAEZ,MAAMC,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOZ,eAAeW;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAeE,6BAA6BX,MAElD;IACC,MAAMC,OAAO,MAAML,KAChBgB,MAAM,GACNC,IAAI,CAAChB,eACLiB,KAAK,CACJxB,IACEC,GAAGM,cAAcS,WAAW,EAAEN,OAAOM,WAAW,GAChDb,OAAOI,cAAckB,SAAS,GAC9BtB,OAAOI,cAAcmB,SAAS,GAC9BxB,GAAGK,cAAcU,SAAS,EAAEZ,GAAG,CAAC,KAAK,CAAC,IAGzCsB,KAAK,CAAC;IAET,MAAMR,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOS;IACjB,OAAOpB,eAAeW;AACxB;AAEA,OAAO,eAAeU,yBAAyBnB,MAG9C;IACC,MAAMC,OAAO,MAAML,KAChBgB,MAAM,GACNC,IAAI,CAAChB,eACLiB,KAAK,CACJxB,IACEC,GAAGM,cAAcO,SAAS,EAAEJ,OAAOI,SAAS,GAC5Cb,GAAGM,cAAcQ,MAAM,EAAEL,OAAOK,MAAM,GACtCZ,OAAOI,cAAckB,SAAS,GAC9BtB,OAAOI,cAAcmB,SAAS,GAC9BxB,GAAGK,cAAcU,SAAS,EAAEZ,GAAG,CAAC,KAAK,CAAC,IAGzCsB,KAAK,CAAC;IAET,MAAMR,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOS;IACjB,OAAOpB,eAAeW;AACxB;AAEA;;;;;CAKC,GACD,OAAO,eAAeW,uBAAuBpB,MAE5C;IACC,MAAMC,OAAO,MAAML,KAChBgB,MAAM,GACNC,IAAI,CAAChB,eACLiB,KAAK,CACJxB,IACEC,GAAGM,cAAcS,WAAW,EAAEN,OAAOM,WAAW,GAChDb,OAAOI,cAAckB,SAAS,GAC9BvB,GAAGK,cAAcU,SAAS,EAAEZ,GAAG,CAAC,KAAK,CAAC,IAGzCsB,KAAK,CAAC;IAET,MAAMR,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOS;IACjB,OAAOpB,eAAeW;AACxB;AAEA;;;;CAIC,GACD,OAAO,eAAeY,mBAAmBrB,MAKxC;IACC,OAAO,MAAMJ,KAAK0B,WAAW,CAAC,OAAOC;QACnC,MAAMC,cAAc,MAAMD,GACvBE,MAAM,CAAC5B,eACP6B,GAAG,CAAC;YACHV,WAAWrB,GAAG,CAAC,KAAK,CAAC;YACrBgC,YAAYhC,GAAG,CAAC,KAAK,CAAC;YACtBiC,WAAWjC,GAAG,CAAC,KAAK,CAAC;QACvB,GACCmB,KAAK,CACJxB,IACEC,GAAGM,cAAcgC,EAAE,EAAE7B,OAAO6B,EAAE,GAC9BtC,GAAGM,cAAcS,WAAW,EAAEN,OAAO8B,kBAAkB,GACvDrC,OAAOI,cAAckB,SAAS,GAC9BtB,OAAOI,cAAcmB,SAAS,GAC9BxB,GAAGK,cAAcU,SAAS,EAAEZ,GAAG,CAAC,KAAK,CAAC,IAGzCa,SAAS;QAEZ,MAAMuB,UAAUP,WAAW,CAAC,EAAE;QAC9B,IAAI,CAACO,SAAS,OAAOb;QAErB,MAAMc,gBAAgB,MAAMT,GACzBrB,MAAM,CAACL,eACPM,MAAM,CAAC;YACNC,WAAW2B,QAAQ3B,SAAS;YAC5BC,QAAQ0B,QAAQ1B,MAAM;YACtBC,aAAaN,OAAOiC,eAAe;YACnC1B,WAAWP,OAAOO,SAAS;QAC7B,GACCC,SAAS;QAEZ,IAAI,CAACwB,aAAa,CAAC,EAAE,EAAE,MAAM,IAAItB,MAAM;QAEvC,OAAOZ,eAAeiC;IACxB;AACF;AAEA,OAAO,eAAeG,yBAAyBlC,MAA6B;IAC1E,MAAMJ,KACH6B,MAAM,CAAC5B,eACP6B,GAAG,CAAC;QAACX,WAAWpB,GAAG,CAAC,KAAK,CAAC;QAAEiC,WAAWjC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDmB,KAAK,CAACxB,IAAIC,GAAGM,cAAcS,WAAW,EAAEN,OAAOM,WAAW,GAAGb,OAAOI,cAAckB,SAAS;AAChG;AAEA,OAAO,eAAeoB,qBAAqBnC,MAG1C;IACC,MAAMJ,KACH6B,MAAM,CAAC5B,eACP6B,GAAG,CAAC;QAACX,WAAWpB,GAAG,CAAC,KAAK,CAAC;QAAEiC,WAAWjC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDmB,KAAK,CACJxB,IACEC,GAAGM,cAAcO,SAAS,EAAEJ,OAAOI,SAAS,GAC5Cb,GAAGM,cAAcQ,MAAM,EAAEL,OAAOK,MAAM,GACtCZ,OAAOI,cAAckB,SAAS;AAGtC;AAEA,OAAO,eAAeqB,2BAA2BpC,MAGhD;IACC,MAAMJ,KACH6B,MAAM,CAAC5B,eACP6B,GAAG,CAAC;QAACX,WAAWpB,GAAG,CAAC,KAAK,CAAC;QAAEiC,WAAWjC,GAAG,CAAC,KAAK,CAAC;IAAA,GACjDmB,KAAK,CACJxB,IACEC,GAAGM,cAAcQ,MAAM,EAAEL,OAAOK,MAAM,GACtCZ,OAAOI,cAAckB,SAAS,GAC9Bf,OAAOqC,oBAAoB,GAAG3C,GAAGG,cAAcgC,EAAE,EAAE7B,OAAOqC,oBAAoB,IAAInB;AAG1F"}

package/dist/db/schema/refresh-tokens.d.ts

@@ -20,6 +20,23 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "session_id";
+            tableName: "refresh_tokens";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         userId: import("drizzle-orm/pg-core").PgColumn<{
             name: "user_id";
             tableName: "refresh_tokens";

package/dist/db/schema/refresh-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-tokens.d.ts","sourceRoot":"","sources":["../../../src/db/schema/refresh-tokens.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,iCAAiC,CAAC;AAIlE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBzB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAC/D,MAAM,MAAM,oBAAoB,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAErE,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY,CAYhE"}
+{"version":3,"file":"refresh-tokens.d.ts","sourceRoot":"","sources":["../../../src/db/schema/refresh-tokens.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,iCAAiC,CAAC;AAIlE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBzB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAC/D,MAAM,MAAM,oBAAoB,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAErE,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,YAAY,CAahE"}

package/dist/db/schema/refresh-tokens.js

@@ -1,9 +1,11 @@
 import { uuidv7PrimaryKey } from '@shipfox/node-drizzle';
+import { sql } from 'drizzle-orm';
 import { index, text, timestamp, uniqueIndex, uuid } from 'drizzle-orm/pg-core';
 import { pgTable } from './common.js';
 import { users } from './users.js';
 export const refreshTokens = pgTable('refresh_tokens', {
     id: uuidv7PrimaryKey(),
+    sessionId: uuid('session_id').notNull().default(sql`uuidv7()`),
     userId: uuid('user_id').notNull().references(()=>users.id, {
         onDelete: 'cascade'
     }),
@@ -28,11 +30,13 @@ export const refreshTokens = pgTable('refresh_tokens', {
     }).notNull().defaultNow()
 }, (table)=>[
         uniqueIndex('auth_refresh_tokens_hashed_token_unique').on(table.hashedToken),
+        uniqueIndex('auth_refresh_tokens_active_session_unique').on(table.userId, table.sessionId).where(sql`${table.revokedAt} IS NULL AND ${table.rotatedAt} IS NULL`),
         index('auth_refresh_tokens_user_id_idx').on(table.userId)
     ]);
 export function toRefreshToken(row) {
     return {
         id: row.id,
+        sessionId: row.sessionId,
         userId: row.userId,
         hashedToken: row.hashedToken,
         expiresAt: row.expiresAt,

package/dist/db/schema/refresh-tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/db/schema/refresh-tokens.ts"],"sourcesContent":["import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport {pgTable} from './common.js';\nimport {users} from './users.js';\n\nexport const refreshTokens = pgTable(\n  'refresh_tokens',\n  {\n    id: uuidv7PrimaryKey(),\n    userId: uuid('user_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    hashedToken: text('hashed_token').notNull(),\n    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),\n    revokedAt: timestamp('revoked_at', {withTimezone: true}),\n    rotatedAt: timestamp('rotated_at', {withTimezone: true}),\n    lastUsedAt: timestamp('last_used_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_refresh_tokens_hashed_token_unique').on(table.hashedToken),\n    index('auth_refresh_tokens_user_id_idx').on(table.userId),\n  ],\n);\n\nexport type RefreshTokenDb = typeof refreshTokens.$inferSelect;\nexport type RefreshTokenCreateDb = typeof refreshTokens.$inferInsert;\n\nexport function toRefreshToken(row: RefreshTokenDb): RefreshToken {\n  return {\n    id: row.id,\n    userId: row.userId,\n    hashedToken: row.hashedToken,\n    expiresAt: row.expiresAt,\n    revokedAt: row.revokedAt,\n    rotatedAt: row.rotatedAt,\n    lastUsedAt: row.lastUsedAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n"],"names":["uuidv7PrimaryKey","index","text","timestamp","uniqueIndex","uuid","pgTable","users","refreshTokens","id","userId","notNull","references","onDelete","hashedToken","expiresAt","withTimezone","revokedAt","rotatedAt","lastUsedAt","createdAt","defaultNow","updatedAt","table","on","toRefreshToken","row"],"mappings":"AAAA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,KAAK,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AAE9E,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,KAAK,QAAO,aAAa;AAEjC,OAAO,MAAMC,gBAAgBF,QAC3B,kBACA;IACEG,IAAIT;IACJU,QAAQL,KAAK,WACVM,OAAO,GACPC,UAAU,CAAC,IAAML,MAAME,EAAE,EAAE;QAACI,UAAU;IAAS;IAClDC,aAAaZ,KAAK,gBAAgBS,OAAO;IACzCI,WAAWZ,UAAU,cAAc;QAACa,cAAc;IAAI,GAAGL,OAAO;IAChEM,WAAWd,UAAU,cAAc;QAACa,cAAc;IAAI;IACtDE,WAAWf,UAAU,cAAc;QAACa,cAAc;IAAI;IACtDG,YAAYhB,UAAU,gBAAgB;QAACa,cAAc;IAAI;IACzDI,WAAWjB,UAAU,cAAc;QAACa,cAAc;IAAI,GAAGL,OAAO,GAAGU,UAAU;IAC7EC,WAAWnB,UAAU,cAAc;QAACa,cAAc;IAAI,GAAGL,OAAO,GAAGU,UAAU;AAC/E,GACA,CAACE,QAAU;QACTnB,YAAY,2CAA2CoB,EAAE,CAACD,MAAMT,WAAW;QAC3Eb,MAAM,mCAAmCuB,EAAE,CAACD,MAAMb,MAAM;KACzD,EACD;AAKF,OAAO,SAASe,eAAeC,GAAmB;IAChD,OAAO;QACLjB,IAAIiB,IAAIjB,EAAE;QACVC,QAAQgB,IAAIhB,MAAM;QAClBI,aAAaY,IAAIZ,WAAW;QAC5BC,WAAWW,IAAIX,SAAS;QACxBE,WAAWS,IAAIT,SAAS;QACxBC,WAAWQ,IAAIR,SAAS;QACxBC,YAAYO,IAAIP,UAAU;QAC1BC,WAAWM,IAAIN,SAAS;QACxBE,WAAWI,IAAIJ,SAAS;IAC1B;AACF"}
+{"version":3,"sources":["../../../src/db/schema/refresh-tokens.ts"],"sourcesContent":["import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {sql} from 'drizzle-orm';\nimport {index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport {pgTable} from './common.js';\nimport {users} from './users.js';\n\nexport const refreshTokens = pgTable(\n  'refresh_tokens',\n  {\n    id: uuidv7PrimaryKey(),\n    sessionId: uuid('session_id').notNull().default(sql`uuidv7()`),\n    userId: uuid('user_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    hashedToken: text('hashed_token').notNull(),\n    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),\n    revokedAt: timestamp('revoked_at', {withTimezone: true}),\n    rotatedAt: timestamp('rotated_at', {withTimezone: true}),\n    lastUsedAt: timestamp('last_used_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_refresh_tokens_hashed_token_unique').on(table.hashedToken),\n    uniqueIndex('auth_refresh_tokens_active_session_unique')\n      .on(table.userId, table.sessionId)\n      .where(sql`${table.revokedAt} IS NULL AND ${table.rotatedAt} IS NULL`),\n    index('auth_refresh_tokens_user_id_idx').on(table.userId),\n  ],\n);\n\nexport type RefreshTokenDb = typeof refreshTokens.$inferSelect;\nexport type RefreshTokenCreateDb = typeof refreshTokens.$inferInsert;\n\nexport function toRefreshToken(row: RefreshTokenDb): RefreshToken {\n  return {\n    id: row.id,\n    sessionId: row.sessionId,\n    userId: row.userId,\n    hashedToken: row.hashedToken,\n    expiresAt: row.expiresAt,\n    revokedAt: row.revokedAt,\n    rotatedAt: row.rotatedAt,\n    lastUsedAt: row.lastUsedAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n"],"names":["uuidv7PrimaryKey","sql","index","text","timestamp","uniqueIndex","uuid","pgTable","users","refreshTokens","id","sessionId","notNull","default","userId","references","onDelete","hashedToken","expiresAt","withTimezone","revokedAt","rotatedAt","lastUsedAt","createdAt","defaultNow","updatedAt","table","on","where","toRefreshToken","row"],"mappings":"AAAA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,GAAG,QAAO,cAAc;AAChC,SAAQC,KAAK,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AAE9E,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,KAAK,QAAO,aAAa;AAEjC,OAAO,MAAMC,gBAAgBF,QAC3B,kBACA;IACEG,IAAIV;IACJW,WAAWL,KAAK,cAAcM,OAAO,GAAGC,OAAO,CAACZ,GAAG,CAAC,QAAQ,CAAC;IAC7Da,QAAQR,KAAK,WACVM,OAAO,GACPG,UAAU,CAAC,IAAMP,MAAME,EAAE,EAAE;QAACM,UAAU;IAAS;IAClDC,aAAad,KAAK,gBAAgBS,OAAO;IACzCM,WAAWd,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGP,OAAO;IAChEQ,WAAWhB,UAAU,cAAc;QAACe,cAAc;IAAI;IACtDE,WAAWjB,UAAU,cAAc;QAACe,cAAc;IAAI;IACtDG,YAAYlB,UAAU,gBAAgB;QAACe,cAAc;IAAI;IACzDI,WAAWnB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGP,OAAO,GAAGY,UAAU;IAC7EC,WAAWrB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGP,OAAO,GAAGY,UAAU;AAC/E,GACA,CAACE,QAAU;QACTrB,YAAY,2CAA2CsB,EAAE,CAACD,MAAMT,WAAW;QAC3EZ,YAAY,6CACTsB,EAAE,CAACD,MAAMZ,MAAM,EAAEY,MAAMf,SAAS,EAChCiB,KAAK,CAAC3B,GAAG,CAAC,EAAEyB,MAAMN,SAAS,CAAC,aAAa,EAAEM,MAAML,SAAS,CAAC,QAAQ,CAAC;QACvEnB,MAAM,mCAAmCyB,EAAE,CAACD,MAAMZ,MAAM;KACzD,EACD;AAKF,OAAO,SAASe,eAAeC,GAAmB;IAChD,OAAO;QACLpB,IAAIoB,IAAIpB,EAAE;QACVC,WAAWmB,IAAInB,SAAS;QACxBG,QAAQgB,IAAIhB,MAAM;QAClBG,aAAaa,IAAIb,WAAW;QAC5BC,WAAWY,IAAIZ,SAAS;QACxBE,WAAWU,IAAIV,SAAS;QACxBC,WAAWS,IAAIT,SAAS;QACxBC,YAAYQ,IAAIR,UAAU;QAC1BC,WAAWO,IAAIP,SAAS;QACxBE,WAAWK,IAAIL,SAAS;IAC1B;AACF"}

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export type { User, UserStatus } from '#core/entities/user.js';
 export { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError, } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken, } from '#core/job-lease-token.js';
 export { issueRunnerSessionToken, verifyRunnerSessionToken, } from '#core/runner-session-token.js';
-export { createJwtAuthMethod } from '#presentation/auth/jwt-auth.js';
+export { type AuthenticatedSessionContext, createJwtAuthMethod, getAuthenticatedSessionContext, type RefreshSessionId, type UserId, } from '#presentation/auth/jwt-auth.js';
 export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
 export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie, } from '#presentation/auth/refresh-cookie.js';
 export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAexD,YAAY,EAAC,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACzF,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,mBAAmB,EAAC,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,GACX,EAAE;IACD,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;CAC5F,GAAG,aAAa,CAYhB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAexD,YAAY,EAAC,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACzF,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,GACX,EAAE;IACD,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;CAC5F,GAAG,aAAa,CAYhB"}

package/dist/index.js

@@ -17,7 +17,7 @@ export { findUserByEmail } from '#core/email-owner.js';
 export { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken } from '#core/job-lease-token.js';
 export { issueRunnerSessionToken, verifyRunnerSessionToken } from '#core/runner-session-token.js';
-export { createJwtAuthMethod } from '#presentation/auth/jwt-auth.js';
+export { createJwtAuthMethod, getAuthenticatedSessionContext } from '#presentation/auth/jwt-auth.js';
 export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
 export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
 export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nexport type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport type {\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  InvalidCredentialsError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport function createAuthModule({\n  workspaces,\n}: {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n}): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces)],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","subscriberFactory","config","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","buildAuthRoutes","onPasswordResetSendRequested","passwordLoginMethods","createSessionForUser","provisionUser","findUserByEmail","AuthDependencyUnavailableError","EmailNotVerifiedError","InvalidCredentialsError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","createAuthModule","workspaces","name","database","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","interModulePresentations"],"mappings":"AAAA,SACEA,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAE/B,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AASxD,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElE,SAAQC,eAAe,QAAO,uBAAuB;AAErD,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,uBAAuB,EACvBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAClC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SAAQnB,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SACEmB,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQrB,6BAA6B,QAAO,4CAA4C;AAExF,MAAMsB,aAAa7B;AAEnB,OAAO,SAAS8B,iBAAiB,EAC/BC,UAAU,EAGX;IACC,OAAO;QACLC,MAAM;QACNC,UAAU;YAAC/B;YAAIC;QAAc;QAC7B+B,MAAM;YAAC7B;YAAuBC;YAA8BC;SAAgC;QAC5F4B,cAAcvB,qBAAqBX,OAAOmC,qBAAqB;QAC/DC,QAAQ;YAAC3B,gBAAgBT,OAAOmC,qBAAqB,EAAEL;SAAY;QACnEO,WAAW;YAAC9B,oBAAoBuB;SAAY;QAC5CQ,YAAY;YAAC;gBAACP,MAAM;gBAAQQ,OAAOpC;gBAAYF;gBAAIuC,cAAc1C;YAAgB;SAAE;QACnF2C,aAAa;YAACb,WAAW/B,oCAAoCa;SAA8B;QAC3FgC,0BAA0B;YAAClC;SAAoC;IACjE;AACF"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nexport type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport type {\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  InvalidCredentialsError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {\n  type AuthenticatedSessionContext,\n  createJwtAuthMethod,\n  getAuthenticatedSessionContext,\n  type RefreshSessionId,\n  type UserId,\n} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport function createAuthModule({\n  workspaces,\n}: {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n}): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces)],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","subscriberFactory","config","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","buildAuthRoutes","onPasswordResetSendRequested","passwordLoginMethods","createSessionForUser","provisionUser","findUserByEmail","AuthDependencyUnavailableError","EmailNotVerifiedError","InvalidCredentialsError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","getAuthenticatedSessionContext","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","createAuthModule","workspaces","name","database","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","interModulePresentations"],"mappings":"AAAA,SACEA,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAE/B,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AASxD,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElE,SAAQC,eAAe,QAAO,uBAAuB;AAErD,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,uBAAuB,EACvBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAClC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SAEEnB,mBAAmB,EACnBoB,8BAA8B,QAGzB,iCAAiC;AACxC,SAAQnB,0BAA0B,QAAO,yCAAyC;AAClF,SACEoB,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQtB,6BAA6B,QAAO,4CAA4C;AAExF,MAAMuB,aAAa9B;AAEnB,OAAO,SAAS+B,iBAAiB,EAC/BC,UAAU,EAGX;IACC,OAAO;QACLC,MAAM;QACNC,UAAU;YAAChC;YAAIC;QAAc;QAC7BgC,MAAM;YAAC9B;YAAuBC;YAA8BC;SAAgC;QAC5F6B,cAAcxB,qBAAqBX,OAAOoC,qBAAqB;QAC/DC,QAAQ;YAAC5B,gBAAgBT,OAAOoC,qBAAqB,EAAEL;SAAY;QACnEO,WAAW;YAAC/B,oBAAoBwB;SAAY;QAC5CQ,YAAY;YAAC;gBAACP,MAAM;gBAAQQ,OAAOrC;gBAAYF;gBAAIwC,cAAc3C;YAAgB;SAAE;QACnF4C,aAAa;YAACb,WAAWhC,oCAAoCa;SAA8B;QAC3FiC,0BAA0B;YAACnC;SAAoC;IACjE;AACF"}

package/dist/presentation/auth/jwt-auth.d.ts

@@ -1,10 +1,23 @@
 import { type UserContext } from '@shipfox/api-auth-context';
-import type { AuthMethod } from '@shipfox/node-fastify';
+import { type AuthMethod } from '@shipfox/node-fastify';
 import type { FastifyRequest } from 'fastify';
+import type { RefreshToken } from '#core/entities/refresh-token.js';
+import type { User } from '#core/entities/user.js';
 export type ClientContext = UserContext;
+export type UserId = User['id'];
+export type RefreshSessionId = RefreshToken['sessionId'];
+export type AuthenticatedSessionContext = {
+    userId: UserId;
+    refreshSessionId: RefreshSessionId;
+};
 export interface CreateJwtAuthMethodOptions {
     secret: string;
 }
 export declare function getClientContext(request: FastifyRequest): ClientContext | null;
+/**
+ * Resolves the active refresh session backing an authenticated user request.
+ * The session check intentionally happens only for consumers that need browser-session binding.
+ */
+export declare function getAuthenticatedSessionContext(request: FastifyRequest): Promise<AuthenticatedSessionContext>;
 export declare function createJwtAuthMethod(): AuthMethod;
 //# sourceMappingURL=jwt-auth.d.ts.map

package/dist/presentation/auth/jwt-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/jwt-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAI5C,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AAExC,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,GAAG,IAAI,CAE9E;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAehD"}
+{"version":3,"file":"jwt-auth.d.ts","sourceRoot":"","sources":["../../../src/presentation/auth/jwt-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAC,KAAK,UAAU,EAAc,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAQjD,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;AAExC,MAAM,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,MAAM,MAAM,gBAAgB,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;AAEzD,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,aAAa,GAAG,IAAI,CAE9E;AAoBD;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,2BAA2B,CAAC,CAatC;AAED,wBAAgB,mBAAmB,IAAI,UAAU,CAgBhD"}

package/dist/presentation/auth/jwt-auth.js

@@ -1,10 +1,43 @@
 import { AUTH_USER, buildUserContext, getUserContext, setUserContext } from '@shipfox/api-auth-context';
 import { userAccessTokenKey } from '@shipfox/node-auth-root-key';
+import { ClientError } from '@shipfox/node-fastify';
 import { verifyUserToken } from '#core/jwt.js';
+import { findActiveRefreshSession } from '#db/refresh-tokens.js';
 import { createBearerTokenAuthMethod } from './bearer-token-auth.js';
+const AUTHENTICATED_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth/session');
 export function getClientContext(request) {
     return getUserContext(request);
 }
+function setAuthenticatedSessionContext(request, claims) {
+    request[AUTHENTICATED_SESSION_CONTEXT_KEY] = {
+        userId: claims.sub,
+        refreshSessionId: claims.refreshSessionId
+    };
+}
+function getAuthenticatedSessionTokenContext(request) {
+    return request[AUTHENTICATED_SESSION_CONTEXT_KEY] ?? null;
+}
+/**
+ * Resolves the active refresh session backing an authenticated user request.
+ * The session check intentionally happens only for consumers that need browser-session binding.
+ */ export async function getAuthenticatedSessionContext(request) {
+    const client = getClientContext(request);
+    const token = getAuthenticatedSessionTokenContext(request);
+    if (!client || !token || token.userId !== client.userId || !token.refreshSessionId) throw new ClientError('Invalid or expired token', 'unauthorized', {
+        status: 401
+    });
+    const session = await findActiveRefreshSession({
+        sessionId: token.refreshSessionId,
+        userId: client.userId
+    });
+    if (!session) throw new ClientError('Invalid or expired token', 'unauthorized', {
+        status: 401
+    });
+    return {
+        userId: client.userId,
+        refreshSessionId: session.sessionId
+    };
+}
 export function createJwtAuthMethod() {
     return createBearerTokenAuthMethod({
         name: AUTH_USER,
@@ -24,6 +57,7 @@ export function createJwtAuthMethod() {
                 memberships: claims.memberships
             });
             setUserContext(request, clientContext);
+            setAuthenticatedSessionContext(request, claims);
         }
     });
 }

package/dist/presentation/auth/jwt-auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/auth/jwt-auth.ts"],"sourcesContent":["import {\n  AUTH_USER,\n  buildUserContext,\n  getUserContext,\n  setUserContext,\n  type UserContext,\n} from '@shipfox/api-auth-context';\nimport {userAccessTokenKey} from '@shipfox/node-auth-root-key';\nimport type {AuthMethod} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport {verifyUserToken} from '#core/jwt.js';\nimport {createBearerTokenAuthMethod} from './bearer-token-auth.js';\n\nexport type ClientContext = UserContext;\n\nexport interface CreateJwtAuthMethodOptions {\n  secret: string;\n}\n\nexport function getClientContext(request: FastifyRequest): ClientContext | null {\n  return getUserContext(request);\n}\n\nexport function createJwtAuthMethod(): AuthMethod {\n  return createBearerTokenAuthMethod({\n    name: AUTH_USER,\n    verifyToken: (token) => verifyUserToken({token, secret: userAccessTokenKey()}),\n    invalidTokenError: {message: 'Invalid or expired token', code: 'unauthorized'},\n    setContext: (request, claims) => {\n      const clientContext: ClientContext = buildUserContext({\n        userId: claims.sub,\n        email: claims.email,\n        name: claims.name ?? null,\n        memberships: claims.memberships,\n      });\n      setUserContext(request, clientContext);\n    },\n  });\n}\n"],"names":["AUTH_USER","buildUserContext","getUserContext","setUserContext","userAccessTokenKey","verifyUserToken","createBearerTokenAuthMethod","getClientContext","request","createJwtAuthMethod","name","verifyToken","token","secret","invalidTokenError","message","code","setContext","claims","clientContext","userId","sub","email","memberships"],"mappings":"AAAA,SACEA,SAAS,EACTC,gBAAgB,EAChBC,cAAc,EACdC,cAAc,QAET,4BAA4B;AACnC,SAAQC,kBAAkB,QAAO,8BAA8B;AAG/D,SAAQC,eAAe,QAAO,eAAe;AAC7C,SAAQC,2BAA2B,QAAO,yBAAyB;AAQnE,OAAO,SAASC,iBAAiBC,OAAuB;IACtD,OAAON,eAAeM;AACxB;AAEA,OAAO,SAASC;IACd,OAAOH,4BAA4B;QACjCI,MAAMV;QACNW,aAAa,CAACC,QAAUP,gBAAgB;gBAACO;gBAAOC,QAAQT;YAAoB;QAC5EU,mBAAmB;YAACC,SAAS;YAA4BC,MAAM;QAAc;QAC7EC,YAAY,CAACT,SAASU;YACpB,MAAMC,gBAA+BlB,iBAAiB;gBACpDmB,QAAQF,OAAOG,GAAG;gBAClBC,OAAOJ,OAAOI,KAAK;gBACnBZ,MAAMQ,OAAOR,IAAI,IAAI;gBACrBa,aAAaL,OAAOK,WAAW;YACjC;YACApB,eAAeK,SAASW;QAC1B;IACF;AACF"}
+{"version":3,"sources":["../../../src/presentation/auth/jwt-auth.ts"],"sourcesContent":["import {\n  AUTH_USER,\n  buildUserContext,\n  getUserContext,\n  setUserContext,\n  type UserContext,\n} from '@shipfox/api-auth-context';\nimport {userAccessTokenKey} from '@shipfox/node-auth-root-key';\nimport {type AuthMethod, ClientError} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport type {RefreshToken} from '#core/entities/refresh-token.js';\nimport type {User} from '#core/entities/user.js';\nimport type {UserTokenClaims} from '#core/jwt.js';\nimport {verifyUserToken} from '#core/jwt.js';\nimport {findActiveRefreshSession} from '#db/refresh-tokens.js';\nimport {createBearerTokenAuthMethod} from './bearer-token-auth.js';\n\nconst AUTHENTICATED_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth/session');\n\nexport type ClientContext = UserContext;\n\nexport type UserId = User['id'];\nexport type RefreshSessionId = RefreshToken['sessionId'];\n\nexport type AuthenticatedSessionContext = {\n  userId: UserId;\n  refreshSessionId: RefreshSessionId;\n};\n\nexport interface CreateJwtAuthMethodOptions {\n  secret: string;\n}\n\nexport function getClientContext(request: FastifyRequest): ClientContext | null {\n  return getUserContext(request);\n}\n\nfunction setAuthenticatedSessionContext(request: FastifyRequest, claims: UserTokenClaims): void {\n  (request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] = {\n    userId: claims.sub,\n    refreshSessionId: claims.refreshSessionId,\n  };\n}\n\nfunction getAuthenticatedSessionTokenContext(request: FastifyRequest): {\n  userId: UserId;\n  refreshSessionId: RefreshSessionId | undefined;\n} | null {\n  return (\n    ((request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] as\n      | {userId: UserId; refreshSessionId: RefreshSessionId | undefined}\n      | undefined) ?? null\n  );\n}\n\n/**\n * Resolves the active refresh session backing an authenticated user request.\n * The session check intentionally happens only for consumers that need browser-session binding.\n */\nexport async function getAuthenticatedSessionContext(\n  request: FastifyRequest,\n): Promise<AuthenticatedSessionContext> {\n  const client = getClientContext(request);\n  const token = getAuthenticatedSessionTokenContext(request);\n  if (!client || !token || token.userId !== client.userId || !token.refreshSessionId)\n    throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});\n\n  const session = await findActiveRefreshSession({\n    sessionId: token.refreshSessionId,\n    userId: client.userId,\n  });\n  if (!session) throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});\n\n  return {userId: client.userId, refreshSessionId: session.sessionId};\n}\n\nexport function createJwtAuthMethod(): AuthMethod {\n  return createBearerTokenAuthMethod({\n    name: AUTH_USER,\n    verifyToken: (token) => verifyUserToken({token, secret: userAccessTokenKey()}),\n    invalidTokenError: {message: 'Invalid or expired token', code: 'unauthorized'},\n    setContext: (request, claims) => {\n      const clientContext: ClientContext = buildUserContext({\n        userId: claims.sub,\n        email: claims.email,\n        name: claims.name ?? null,\n        memberships: claims.memberships,\n      });\n      setUserContext(request, clientContext);\n      setAuthenticatedSessionContext(request, claims);\n    },\n  });\n}\n"],"names":["AUTH_USER","buildUserContext","getUserContext","setUserContext","userAccessTokenKey","ClientError","verifyUserToken","findActiveRefreshSession","createBearerTokenAuthMethod","AUTHENTICATED_SESSION_CONTEXT_KEY","Symbol","for","getClientContext","request","setAuthenticatedSessionContext","claims","userId","sub","refreshSessionId","getAuthenticatedSessionTokenContext","getAuthenticatedSessionContext","client","token","status","session","sessionId","createJwtAuthMethod","name","verifyToken","secret","invalidTokenError","message","code","setContext","clientContext","email","memberships"],"mappings":"AAAA,SACEA,SAAS,EACTC,gBAAgB,EAChBC,cAAc,EACdC,cAAc,QAET,4BAA4B;AACnC,SAAQC,kBAAkB,QAAO,8BAA8B;AAC/D,SAAyBC,WAAW,QAAO,wBAAwB;AAKnE,SAAQC,eAAe,QAAO,eAAe;AAC7C,SAAQC,wBAAwB,QAAO,wBAAwB;AAC/D,SAAQC,2BAA2B,QAAO,yBAAyB;AAEnE,MAAMC,oCAAoCC,OAAOC,GAAG,CAAC;AAgBrD,OAAO,SAASC,iBAAiBC,OAAuB;IACtD,OAAOX,eAAeW;AACxB;AAEA,SAASC,+BAA+BD,OAAuB,EAAEE,MAAuB;IACrFF,OAA8C,CAACJ,kCAAkC,GAAG;QACnFO,QAAQD,OAAOE,GAAG;QAClBC,kBAAkBH,OAAOG,gBAAgB;IAC3C;AACF;AAEA,SAASC,oCAAoCN,OAAuB;IAIlE,OACE,AAAC,AAACA,OAA8C,CAACJ,kCAAkC,IAEjE;AAEtB;AAEA;;;CAGC,GACD,OAAO,eAAeW,+BACpBP,OAAuB;IAEvB,MAAMQ,SAAST,iBAAiBC;IAChC,MAAMS,QAAQH,oCAAoCN;IAClD,IAAI,CAACQ,UAAU,CAACC,SAASA,MAAMN,MAAM,KAAKK,OAAOL,MAAM,IAAI,CAACM,MAAMJ,gBAAgB,EAChF,MAAM,IAAIb,YAAY,4BAA4B,gBAAgB;QAACkB,QAAQ;IAAG;IAEhF,MAAMC,UAAU,MAAMjB,yBAAyB;QAC7CkB,WAAWH,MAAMJ,gBAAgB;QACjCF,QAAQK,OAAOL,MAAM;IACvB;IACA,IAAI,CAACQ,SAAS,MAAM,IAAInB,YAAY,4BAA4B,gBAAgB;QAACkB,QAAQ;IAAG;IAE5F,OAAO;QAACP,QAAQK,OAAOL,MAAM;QAAEE,kBAAkBM,QAAQC,SAAS;IAAA;AACpE;AAEA,OAAO,SAASC;IACd,OAAOlB,4BAA4B;QACjCmB,MAAM3B;QACN4B,aAAa,CAACN,QAAUhB,gBAAgB;gBAACgB;gBAAOO,QAAQzB;YAAoB;QAC5E0B,mBAAmB;YAACC,SAAS;YAA4BC,MAAM;QAAc;QAC7EC,YAAY,CAACpB,SAASE;YACpB,MAAMmB,gBAA+BjC,iBAAiB;gBACpDe,QAAQD,OAAOE,GAAG;gBAClBkB,OAAOpB,OAAOoB,KAAK;gBACnBR,MAAMZ,OAAOY,IAAI,IAAI;gBACrBS,aAAarB,OAAOqB,WAAW;YACjC;YACAjC,eAAeU,SAASqB;YACxBpB,+BAA+BD,SAASE;QAC1C;IACF;AACF"}