@shipfox/api-auth 7.0.1 → 7.1.0

package/src/presentation/auth/jwt-auth.ts

@@ -6,13 +6,27 @@ import {
   type UserContext,
 } from '@shipfox/api-auth-context';
 import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
-import type {AuthMethod} from '@shipfox/node-fastify';
+import {type AuthMethod, ClientError} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
+import type {RefreshToken} from '#core/entities/refresh-token.js';
+import type {User} from '#core/entities/user.js';
+import type {UserTokenClaims} from '#core/jwt.js';
 import {verifyUserToken} from '#core/jwt.js';
+import {findActiveRefreshSession} from '#db/refresh-tokens.js';
 import {createBearerTokenAuthMethod} from './bearer-token-auth.js';
 
+const AUTHENTICATED_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth/session');
+
 export type ClientContext = UserContext;
 
+export type UserId = User['id'];
+export type RefreshSessionId = RefreshToken['sessionId'];
+
+export type AuthenticatedSessionContext = {
+  userId: UserId;
+  refreshSessionId: RefreshSessionId;
+};
+
 export interface CreateJwtAuthMethodOptions {
   secret: string;
 }
@@ -21,6 +35,45 @@ export function getClientContext(request: FastifyRequest): ClientContext | null
   return getUserContext(request);
 }
 
+function setAuthenticatedSessionContext(request: FastifyRequest, claims: UserTokenClaims): void {
+  (request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] = {
+    userId: claims.sub,
+    refreshSessionId: claims.refreshSessionId,
+  };
+}
+
+function getAuthenticatedSessionTokenContext(request: FastifyRequest): {
+  userId: UserId;
+  refreshSessionId: RefreshSessionId | undefined;
+} | null {
+  return (
+    ((request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] as
+      | {userId: UserId; refreshSessionId: RefreshSessionId | undefined}
+      | undefined) ?? null
+  );
+}
+
+/**
+ * Resolves the active refresh session backing an authenticated user request.
+ * The session check intentionally happens only for consumers that need browser-session binding.
+ */
+export async function getAuthenticatedSessionContext(
+  request: FastifyRequest,
+): Promise<AuthenticatedSessionContext> {
+  const client = getClientContext(request);
+  const token = getAuthenticatedSessionTokenContext(request);
+  if (!client || !token || token.userId !== client.userId || !token.refreshSessionId)
+    throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});
+
+  const session = await findActiveRefreshSession({
+    sessionId: token.refreshSessionId,
+    userId: client.userId,
+  });
+  if (!session) throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});
+
+  return {userId: client.userId, refreshSessionId: session.sessionId};
+}
+
 export function createJwtAuthMethod(): AuthMethod {
   return createBearerTokenAuthMethod({
     name: AUTH_USER,
@@ -34,6 +87,7 @@ export function createJwtAuthMethod(): AuthMethod {
         memberships: claims.memberships,
       });
       setUserContext(request, clientContext);
+      setAuthenticatedSessionContext(request, claims);
     },
   });
 }