@shipfox/api-auth 7.0.2 → 9.0.1

package/drizzle/0000_initial.sql

@@ -35,6 +35,7 @@ CREATE TABLE "auth_rate_limits" (
 --> statement-breakpoint
 CREATE TABLE "auth_refresh_tokens" (
 	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"session_id" uuid DEFAULT uuidv7() NOT NULL,
 	"user_id" uuid NOT NULL,
 	"hashed_token" text NOT NULL,
 	"expires_at" timestamp with time zone NOT NULL,
@@ -65,5 +66,6 @@ CREATE INDEX "auth_password_resets_user_id_idx" ON "auth_password_resets" USING
 CREATE UNIQUE INDEX "auth_rate_limits_window_unique" ON "auth_rate_limits" USING btree ("action","scope","identifier_hmac","window_start");--> statement-breakpoint
 CREATE INDEX "auth_rate_limits_expires_at_idx" ON "auth_rate_limits" USING btree ("expires_at");--> statement-breakpoint
 CREATE UNIQUE INDEX "auth_refresh_tokens_hashed_token_unique" ON "auth_refresh_tokens" USING btree ("hashed_token");--> statement-breakpoint
+CREATE UNIQUE INDEX "auth_refresh_tokens_active_session_unique" ON "auth_refresh_tokens" USING btree ("user_id","session_id") WHERE "auth_refresh_tokens"."revoked_at" IS NULL AND "auth_refresh_tokens"."rotated_at" IS NULL;--> statement-breakpoint
 CREATE INDEX "auth_refresh_tokens_user_id_idx" ON "auth_refresh_tokens" USING btree ("user_id");--> statement-breakpoint
 CREATE UNIQUE INDEX "auth_users_email_unique" ON "auth_users" USING btree ("email");

package/drizzle/meta/0000_snapshot.json

@@ -143,6 +143,13 @@
           "notNull": true,
           "default": "uuidv7()"
         },
+        "session_id": {
+          "name": "session_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "uuidv7()"
+        },
         "user_id": {
           "name": "user_id",
           "type": "uuid",
@@ -415,6 +422,28 @@
           "method": "btree",
           "with": {}
         },
+        "auth_refresh_tokens_active_session_unique": {
+          "name": "auth_refresh_tokens_active_session_unique",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"auth_refresh_tokens\".\"revoked_at\" IS NULL AND \"auth_refresh_tokens\".\"rotated_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
         "auth_refresh_tokens_user_id_idx": {
           "name": "auth_refresh_tokens_user_id_idx",
           "columns": [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-auth",
   "license": "MIT",
-  "version": "7.0.2",
+  "version": "9.0.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -11,10 +11,6 @@
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "imports": {
-    "#test/*": "./test/*",
-    "#*": "./dist/*"
-  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -30,24 +26,27 @@
     "@node-rs/argon2": "^2.0.2",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "6.0.0",
-    "@shipfox/api-auth-dto": "6.0.0",
-    "@shipfox/api-email-challenges": "0.2.3",
-    "@shipfox/api-workspaces-dto": "6.0.0",
-    "@shipfox/inter-module": "0.2.0",
-    "@shipfox/config": "1.2.2",
-    "@shipfox/node-drizzle": "0.3.2",
-    "@shipfox/node-auth-root-key": "0.2.1",
-    "@shipfox/node-fastify": "0.2.4",
-    "@shipfox/node-jwt": "0.3.0",
-    "@shipfox/node-email": "0.3.1",
-    "@shipfox/node-mailer": "0.2.0",
-    "@shipfox/node-module": "0.4.0",
-    "@shipfox/node-opentelemetry": "0.5.2",
-    "@shipfox/node-outbox": "0.2.4",
-    "@shipfox/node-postgres": "0.4.2",
-    "@shipfox/node-rate-limit": "0.3.0",
-    "@shipfox/node-tokens": "0.3.0"
+    "@shipfox/api-auth-context": "9.0.1",
+    "@shipfox/api-auth-dto": "9.0.1",
+    "@shipfox/api-email-challenges": "1.1.0",
+    "@shipfox/api-workspaces-dto": "9.0.1",
+    "@shipfox/inter-module": "0.2.1",
+    "@shipfox/config": "1.2.3",
+    "@shipfox/node-drizzle": "0.3.3",
+    "@shipfox/node-auth-root-key": "0.2.2",
+    "@shipfox/node-jwt": "0.3.1",
+    "@shipfox/node-fastify": "0.3.1",
+    "@shipfox/node-email": "0.3.2",
+    "@shipfox/node-mailer": "0.2.2",
+    "@shipfox/node-module": "1.0.0",
+    "@shipfox/node-opentelemetry": "0.6.1",
+    "@shipfox/node-outbox": "0.2.5",
+    "@shipfox/node-postgres": "0.4.3",
+    "@shipfox/node-rate-limit": "0.3.1",
+    "@shipfox/node-tokens": "0.3.1"
+  },
+  "imports": {
+    "#*": "./dist/*"
   },
   "scripts": {
     "build": "shipfox-swc",

package/src/core/auth.test.ts

@@ -73,6 +73,7 @@ const listMembershipsByUserMock = vi.fn(() =>
 );
 const workspaces = {
   listMembershipsForTokenClaims: listMembershipsByUserMock,
+  getWorkspaceCreator: vi.fn(),
   preflightInvitationAcceptance: vi.fn(),
   acceptInvitation: vi.fn(),
   requireActiveMembership: vi.fn(),
@@ -334,6 +335,32 @@ describe('auth core', () => {
     expect(refreshed.user.id).toBe(user.id);
   });
 
+  test('keeps the refresh-session identity stable across a token refresh', async () => {
+    const user = await userFactory.create({emailVerifiedAt: new Date()});
+    const initial = await login({email: user.email, password: user.plainPassword});
+    const refreshed = await refreshAccessToken({refreshToken: initial.refreshToken});
+    const initialClaims = await verifyUserToken({
+      token: initial.token,
+      secret: userAccessTokenKey(),
+    });
+    const refreshedClaims = await verifyUserToken({
+      token: refreshed.token,
+      secret: userAccessTokenKey(),
+    });
+
+    expect(refreshedClaims.refreshSessionId).toBe(initialClaims.refreshSessionId);
+  });
+
+  test('issues different refresh-session identities for separate sessions of one user', async () => {
+    const user = await userFactory.create({emailVerifiedAt: new Date()});
+    const first = await login({email: user.email, password: user.plainPassword});
+    const second = await login({email: user.email, password: user.plainPassword});
+    const firstClaims = await verifyUserToken({token: first.token, secret: userAccessTokenKey()});
+    const secondClaims = await verifyUserToken({token: second.token, secret: userAccessTokenKey()});
+
+    expect(secondClaims.refreshSessionId).not.toBe(firstClaims.refreshSessionId);
+  });
+
   test('refreshAccessToken tolerates a concurrent reuse within the grace window', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
     const loginResult = await login({email: user.email, password: user.plainPassword});
@@ -487,6 +514,21 @@ describe('auth core', () => {
     expect(active).toBeUndefined();
   });
 
+  test('logout revokes the active successor when presented a rotated refresh token', async () => {
+    const user = await userFactory.create({emailVerifiedAt: new Date()});
+    const loginResult = await login({email: user.email, password: user.plainPassword});
+    const refreshed = await refreshAccessToken({refreshToken: loginResult.refreshToken});
+
+    await logout({refreshToken: loginResult.refreshToken});
+
+    const successor = refreshed.refreshToken
+      ? await refreshTokenDb.findActiveRefreshTokenByHash({
+          hashedToken: hashOpaqueToken(refreshed.refreshToken),
+        })
+      : undefined;
+    expect(successor).toBeUndefined();
+  });
+
   test('getCurrentUser returns the user', async () => {
     const user = await userFactory.create({emailVerifiedAt: new Date()});
 

package/src/core/auth.ts

@@ -18,7 +18,7 @@ import {
   createRefreshToken,
   findActiveRefreshTokenByHash,
   findRefreshTokenByHash,
-  revokeRefreshTokenByHash,
+  revokeRefreshSession,
   revokeRefreshTokensForUser,
   rotateRefreshToken,
 } from '#db/refresh-tokens.js';
@@ -73,6 +73,7 @@ function recordRefreshOutcome(outcome: AuthTokenRefreshOutcome): void {
 async function signAccessToken(
   user: User,
   workspaces: WorkspacesInterModuleClient,
+  refreshSessionId: string,
 ): Promise<string> {
   const memberships = await workspaces
     .listMembershipsForTokenClaims({userId: user.id})
@@ -84,6 +85,7 @@ async function signAccessToken(
     email: user.email,
     name: user.name,
     memberships: memberships.memberships,
+    refreshSessionId,
     secret: userAccessTokenKey(),
     expiresIn: config.AUTH_JWT_EXPIRES_IN,
   });
@@ -95,14 +97,28 @@ function isWithinRotationGrace(refreshToken: RefreshToken): boolean {
   return Date.now() - refreshToken.rotatedAt.getTime() <= graceMs;
 }
 
-async function createRefreshSession(user: User): Promise<string> {
+async function createRefreshSession(
+  user: User,
+  refreshSessionId: string,
+): Promise<{refreshToken: string; refreshSessionId: string}> {
   const refreshToken = generateOpaqueToken('refreshToken');
-  await createRefreshToken({
+  const session = await createRefreshToken({
+    sessionId: refreshSessionId,
     userId: user.id,
     hashedToken: hashOpaqueToken(refreshToken),
     expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),
   });
-  return refreshToken;
+  return {refreshToken, refreshSessionId: session.sessionId};
+}
+
+async function createSessionTokens(
+  user: User,
+  workspaces: WorkspacesInterModuleClient,
+): Promise<{token: string; refreshToken: string}> {
+  const refreshSessionId = crypto.randomUUID();
+  const token = await signAccessToken(user, workspaces, refreshSessionId);
+  const {refreshToken} = await createRefreshSession(user, refreshSessionId);
+  return {token, refreshToken};
 }
 
 function passwordResetLink(rawToken: string): string {
@@ -175,6 +191,7 @@ export async function signup(params: SignupParams & {sourceIp?: string}): Promis
         email: existing.email,
         purpose: PASSWORD_VERIFICATION_PURPOSE,
         continuation: existing.id,
+        idempotencyKey: existing.id,
         sourceIp: params.sourceIp ?? '0.0.0.0',
       });
       return {...existing, emailChallenge};
@@ -194,6 +211,7 @@ export async function signup(params: SignupParams & {sourceIp?: string}): Promis
     email: user.email,
     purpose: PASSWORD_VERIFICATION_PURPOSE,
     continuation: user.id,
+    idempotencyKey: user.id,
     sourceIp: params.sourceIp ?? '0.0.0.0',
   });
 
@@ -271,8 +289,7 @@ export async function signupWithInvitation(
 
   // Step 4: Issue session. signAccessToken reads memberships through the
   // workspaces module API, so a successful accept is reflected in the JWT.
-  const token = await signAccessToken(user, params.workspaces);
-  const refreshToken = await createRefreshSession(user);
+  const {token, refreshToken} = await createSessionTokens(user, params.workspaces);
 
   if (acceptError) {
     return {token, refreshToken, user, membership, acceptError};
@@ -334,8 +351,7 @@ export async function login(params: LoginParams): Promise<LoginResult> {
     throw new EmailNotVerifiedError();
   }
 
-  const token = await signAccessToken(user, params.workspaces);
-  const refreshToken = await createRefreshSession(user);
+  const {token, refreshToken} = await createSessionTokens(user, params.workspaces);
 
   return {token, refreshToken, user};
 }
@@ -377,8 +393,7 @@ export async function createSessionForUser(
     throw new InvalidCredentialsError();
   }
 
-  const token = await signAccessToken(user, params.workspaces);
-  const refreshToken = await createRefreshSession(user);
+  const {token, refreshToken} = await createSessionTokens(user, params.workspaces);
 
   return {token, refreshToken, user};
 }
@@ -403,7 +418,7 @@ export async function refreshAccessToken(params: {
 
   const user = await findUserById({id: current.userId});
   if (user?.status !== 'active') {
-    await revokeRefreshTokenByHash({hashedToken: currentHashedToken});
+    await revokeRefreshSession({sessionId: current.sessionId, userId: current.userId});
     recordRefreshOutcome('rejected');
     throw new TokenInvalidError('Refresh token is invalid or expired');
   }
@@ -412,7 +427,7 @@ export async function refreshAccessToken(params: {
   // second tab); past it, reuse of a retired token means a compromised session.
   if (current.rotatedAt) {
     if (isWithinRotationGrace(current)) {
-      const token = await signAccessToken(user, params.workspaces);
+      const token = await signAccessToken(user, params.workspaces, current.sessionId);
       recordRefreshOutcome('grace');
       return {token, refreshToken: undefined, user};
     }
@@ -436,12 +451,12 @@ export async function refreshAccessToken(params: {
       recordRefreshOutcome('rejected');
       throw new TokenInvalidError('Refresh token is invalid or expired');
     }
-    const token = await signAccessToken(user, params.workspaces);
+    const token = await signAccessToken(user, params.workspaces, latest.sessionId);
     recordRefreshOutcome('grace');
     return {token, refreshToken: undefined, user};
   }
 
-  const token = await signAccessToken(user, params.workspaces);
+  const token = await signAccessToken(user, params.workspaces, current.sessionId);
   recordRefreshOutcome('rotated');
   return {token, refreshToken: nextRefreshToken, user};
 }
@@ -476,8 +491,7 @@ export async function confirmEmailVerification(params: {
     throw new TokenInvalidError('Verification code is invalid or expired');
   }
 
-  const token = await signAccessToken(verifiedUser, params.workspaces);
-  const refreshToken = await createRefreshSession(verifiedUser);
+  const {token, refreshToken} = await createSessionTokens(verifiedUser, params.workspaces);
 
   return {token, refreshToken, user: verifiedUser};
 }
@@ -548,8 +562,7 @@ export async function confirmPasswordReset(params: {
 
   await revokeRefreshTokensForUser({userId: consumed.userId});
 
-  const token = await signAccessToken(user, params.workspaces);
-  const refreshToken = await createRefreshSession(user);
+  const {token, refreshToken} = await createSessionTokens(user, params.workspaces);
 
   return {token, refreshToken, user};
 }
@@ -587,7 +600,11 @@ export async function changePassword(params: {
 
 export async function logout(params: {refreshToken?: string | undefined}): Promise<void> {
   if (!params.refreshToken) return;
-  await revokeRefreshTokenByHash({hashedToken: hashOpaqueToken(params.refreshToken)});
+  const refreshToken = await findRefreshTokenByHash({
+    hashedToken: hashOpaqueToken(params.refreshToken),
+  });
+  if (!refreshToken) return;
+  await revokeRefreshSession({sessionId: refreshToken.sessionId, userId: refreshToken.userId});
 }
 
 export interface GetCurrentUserResult {

package/src/core/entities/refresh-token.ts

@@ -1,5 +1,6 @@
 export interface RefreshToken {
   id: string;
+  sessionId: string;
   userId: string;
   hashedToken: string;
   expiresAt: Date;

package/src/core/jwt.ts

@@ -12,6 +12,7 @@ export type TokenMembership = z.infer<typeof tokenMembershipSchema>;
 
 export const userTokenClaimsSchema = z.object({
   sub: z.string().uuid(),
+  refreshSessionId: z.string().uuid().optional(),
   email: z.string().email(),
   name: z.string().nullable().optional(),
   memberships: z.array(tokenMembershipSchema),
@@ -22,6 +23,7 @@ export const userTokenClaimsSchema = z.object({
 export type UserTokenClaims = z.infer<typeof userTokenClaimsSchema>;
 
 export interface SignUserTokenParams {
+  refreshSessionId?: string | undefined;
   userId: string;
   email: string;
   name?: string | null | undefined;
@@ -41,6 +43,7 @@ export async function signUserToken(params: SignUserTokenParams): Promise<string
       email: params.email,
       name: params.name ?? null,
       memberships: params.memberships,
+      refreshSessionId: params.refreshSessionId,
     },
     secret: params.secret,
     expiresIn: params.expiresIn,

package/src/db/refresh-tokens.test.ts

@@ -1,8 +1,10 @@
 import {hashOpaqueToken} from '@shipfox/node-tokens';
 import {
   createRefreshToken,
+  findActiveRefreshSession,
   findActiveRefreshTokenByHash,
   findRefreshTokenByHash,
+  revokeRefreshSession,
   revokeRefreshTokenByHash,
   revokeRefreshTokensForUser,
   rotateRefreshToken,
@@ -43,6 +45,24 @@ describe('refresh-tokens db', () => {
     expect(found).toBeUndefined();
   });
 
+  test('finds only the active session owned by the requested user', async () => {
+    const user = await createUser({email: emailFor('rt-session'), hashedPassword: 'h'});
+    const otherUser = await createUser({email: emailFor('rt-session-other'), hashedPassword: 'h'});
+    const sessionId = crypto.randomUUID();
+    await createRefreshToken({
+      userId: user.id,
+      sessionId,
+      hashedToken: hashOpaqueToken(`active-${crypto.randomUUID()}`),
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+
+    const found = await findActiveRefreshSession({sessionId, userId: user.id});
+    const otherUserFound = await findActiveRefreshSession({sessionId, userId: otherUser.id});
+
+    expect(found?.sessionId).toBe(sessionId);
+    expect(otherUserFound).toBeUndefined();
+  });
+
   test('rotates a token once, creates the successor, and only the first caller wins', async () => {
     const user = await createUser({email: emailFor('rt-rotate'), hashedPassword: 'h'});
     const currentHashedToken = hashOpaqueToken(`current-${crypto.randomUUID()}`);
@@ -139,6 +159,28 @@ describe('refresh-tokens db', () => {
     expect(found).toBeUndefined();
   });
 
+  test('revokes every token in one refresh-session lineage', async () => {
+    const user = await createUser({email: emailFor('rt-revoke-session'), hashedPassword: 'h'});
+    const currentHashedToken = hashOpaqueToken(`current-${crypto.randomUUID()}`);
+    const nextHashedToken = hashOpaqueToken(`next-${crypto.randomUUID()}`);
+    const created = await createRefreshToken({
+      userId: user.id,
+      hashedToken: currentHashedToken,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    await rotateRefreshToken({
+      id: created.id,
+      currentHashedToken,
+      nextHashedToken,
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+
+    await revokeRefreshSession({sessionId: created.sessionId, userId: user.id});
+
+    expect(await findRefreshTokenByHash({hashedToken: currentHashedToken})).toBeUndefined();
+    expect(await findActiveRefreshTokenByHash({hashedToken: nextHashedToken})).toBeUndefined();
+  });
+
   test('revokes all user refresh tokens except the selected session', async () => {
     const user = await createUser({email: emailFor('rt-revoke-user'), hashedPassword: 'h'});
     const keepHash = hashOpaqueToken(`keep-${crypto.randomUUID()}`);

package/src/db/refresh-tokens.ts

@@ -4,6 +4,7 @@ import {db} from './db.js';
 import {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';
 
 export interface CreateRefreshTokenParams {
+  sessionId?: string | undefined;
   userId: string;
   hashedToken: string;
   expiresAt: Date;
@@ -13,6 +14,7 @@ export async function createRefreshToken(params: CreateRefreshTokenParams): Prom
   const rows = await db()
     .insert(refreshTokens)
     .values({
+      sessionId: params.sessionId,
       userId: params.userId,
       hashedToken: params.hashedToken,
       expiresAt: params.expiresAt,
@@ -51,6 +53,29 @@ export async function findActiveRefreshTokenByHash(params: {
   return toRefreshToken(row);
 }
 
+export async function findActiveRefreshSession(params: {
+  sessionId: string;
+  userId: string;
+}): Promise<RefreshToken | undefined> {
+  const rows = await db()
+    .select()
+    .from(refreshTokens)
+    .where(
+      and(
+        eq(refreshTokens.sessionId, params.sessionId),
+        eq(refreshTokens.userId, params.userId),
+        isNull(refreshTokens.revokedAt),
+        isNull(refreshTokens.rotatedAt),
+        gt(refreshTokens.expiresAt, sql`now()`),
+      ),
+    )
+    .limit(1);
+
+  const row = rows[0];
+  if (!row) return undefined;
+  return toRefreshToken(row);
+}
+
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
@@ -113,6 +138,7 @@ export async function rotateRefreshToken(params: {
     const successorRows = await tx
       .insert(refreshTokens)
       .values({
+        sessionId: rotated.sessionId,
         userId: rotated.userId,
         hashedToken: params.nextHashedToken,
         expiresAt: params.expiresAt,
@@ -132,6 +158,22 @@ export async function revokeRefreshTokenByHash(params: {hashedToken: string}): P
     .where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));
 }
 
+export async function revokeRefreshSession(params: {
+  sessionId: string;
+  userId: string;
+}): Promise<void> {
+  await db()
+    .update(refreshTokens)
+    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})
+    .where(
+      and(
+        eq(refreshTokens.sessionId, params.sessionId),
+        eq(refreshTokens.userId, params.userId),
+        isNull(refreshTokens.revokedAt),
+      ),
+    );
+}
+
 export async function revokeRefreshTokensForUser(params: {
   userId: string;
   exceptRefreshTokenId?: string | undefined;

package/src/db/schema/refresh-tokens.ts

@@ -1,4 +1,5 @@
 import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {sql} from 'drizzle-orm';
 import {index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
 import type {RefreshToken} from '#core/entities/refresh-token.js';
 import {pgTable} from './common.js';
@@ -8,6 +9,7 @@ export const refreshTokens = pgTable(
   'refresh_tokens',
   {
     id: uuidv7PrimaryKey(),
+    sessionId: uuid('session_id').notNull().default(sql`uuidv7()`),
     userId: uuid('user_id')
       .notNull()
       .references(() => users.id, {onDelete: 'cascade'}),
@@ -21,6 +23,9 @@ export const refreshTokens = pgTable(
   },
   (table) => [
     uniqueIndex('auth_refresh_tokens_hashed_token_unique').on(table.hashedToken),
+    uniqueIndex('auth_refresh_tokens_active_session_unique')
+      .on(table.userId, table.sessionId)
+      .where(sql`${table.revokedAt} IS NULL AND ${table.rotatedAt} IS NULL`),
     index('auth_refresh_tokens_user_id_idx').on(table.userId),
   ],
 );
@@ -31,6 +36,7 @@ export type RefreshTokenCreateDb = typeof refreshTokens.$inferInsert;
 export function toRefreshToken(row: RefreshTokenDb): RefreshToken {
   return {
     id: row.id,
+    sessionId: row.sessionId,
     userId: row.userId,
     hashedToken: row.hashedToken,
     expiresAt: row.expiresAt,

package/src/index.test.ts

@@ -26,6 +26,7 @@ describe('authModule', () => {
   const authModule = createAuthModule({
     workspaces: {
       listMembershipsForTokenClaims: vi.fn(),
+      getWorkspaceCreator: vi.fn(),
       preflightInvitationAcceptance: vi.fn(),
       acceptInvitation: vi.fn(),
       requireActiveMembership: vi.fn(),

package/src/index.ts

@@ -44,7 +44,13 @@ export {
   issueRunnerSessionToken,
   verifyRunnerSessionToken,
 } from '#core/runner-session-token.js';
-export {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';
+export {
+  type AuthenticatedSessionContext,
+  createJwtAuthMethod,
+  getAuthenticatedSessionContext,
+  type RefreshSessionId,
+  type UserId,
+} from '#presentation/auth/jwt-auth.js';
 export {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';
 export {
   authCookiePlugin,
@@ -63,7 +69,7 @@ export function createAuthModule({
 }): ShipfoxModule {
   return {
     name: 'auth',
-    database: {db, migrationsPath},
+    database: {db, migrationsPath, databaseNamespace: 'auth'},
     auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],
     loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),
     routes: [buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces)],