@shipfox/api-auth 7.0.2 → 9.0.1

package/src/presentation/auth/jwt-auth.test.ts

@@ -1,10 +1,16 @@
 import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
+import {hashOpaqueToken} from '@shipfox/node-tokens';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';
 import {serializerCompiler, validatorCompiler} from 'fastify-type-provider-zod';
 import {signUserToken} from '#core/jwt.js';
+import {
+  createRefreshToken,
+  revokeRefreshTokenByHash,
+  rotateRefreshToken,
+} from '#db/refresh-tokens.js';
 import {createUser, findUserById} from '#db/users.js';
-import {createJwtAuthMethod, getClientContext} from './jwt-auth.js';
+import {createJwtAuthMethod, getAuthenticatedSessionContext, getClientContext} from './jwt-auth.js';
 
 const SECRET = userAccessTokenKey();
 
@@ -28,6 +34,7 @@ describe('jwt-auth', () => {
     app.get('/protected', (request) => {
       return {client: getClientContext(request)};
     });
+    app.get('/session', async (request) => await getAuthenticatedSessionContext(request));
     await app.ready();
   });
 
@@ -131,6 +138,100 @@ describe('jwt-auth', () => {
     expect(res.json().client.email).toBe(email);
   });
 
+  test('resolves the active refresh-session identity from an authenticated request', async () => {
+    const user = await createUser({email: emailFor('jwt-session'), hashedPassword: 'h'});
+    const rawRefreshToken = `refresh-${crypto.randomUUID()}`;
+    const refreshToken = await createRefreshToken({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(rawRefreshToken),
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    const initialToken = await signUserToken({
+      userId: user.id,
+      email: user.email,
+      memberships: [],
+      refreshSessionId: refreshToken.sessionId,
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+    await rotateRefreshToken({
+      id: refreshToken.id,
+      currentHashedToken: hashOpaqueToken(rawRefreshToken),
+      nextHashedToken: hashOpaqueToken(`refresh-${crypto.randomUUID()}`),
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    const refreshedToken = await signUserToken({
+      userId: user.id,
+      email: user.email,
+      memberships: [],
+      refreshSessionId: refreshToken.sessionId,
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+
+    const initial = await app.inject({
+      method: 'GET',
+      url: '/session',
+      headers: {authorization: `Bearer ${initialToken}`},
+    });
+    const refreshed = await app.inject({
+      method: 'GET',
+      url: '/session',
+      headers: {authorization: `Bearer ${refreshedToken}`},
+    });
+
+    expect(initial.statusCode).toBe(200);
+    expect(refreshed.statusCode).toBe(200);
+    expect(initial.json()).toEqual({userId: user.id, refreshSessionId: refreshToken.sessionId});
+    expect(refreshed.json()).toEqual(initial.json());
+  });
+
+  test('rejects an authenticated token after its refresh session is revoked', async () => {
+    const user = await createUser({email: emailFor('jwt-session-revoked'), hashedPassword: 'h'});
+    const rawRefreshToken = `refresh-${crypto.randomUUID()}`;
+    const refreshToken = await createRefreshToken({
+      userId: user.id,
+      hashedToken: hashOpaqueToken(rawRefreshToken),
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    const token = await signUserToken({
+      userId: user.id,
+      email: user.email,
+      memberships: [],
+      refreshSessionId: refreshToken.sessionId,
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+    await revokeRefreshTokenByHash({hashedToken: hashOpaqueToken(rawRefreshToken)});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/session',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  test('rejects an authenticated token without a refresh-session claim', async () => {
+    const user = await createUser({email: emailFor('jwt-old-format'), hashedPassword: 'h'});
+    const token = await signUserToken({
+      userId: user.id,
+      email: user.email,
+      memberships: [],
+      secret: SECRET,
+      expiresIn: '7d',
+    });
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/session',
+      headers: {authorization: `Bearer ${token}`},
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
   test('helpers remain available', () => {
     expect(typeof findUserById).toBe('function');
   });

package/src/presentation/auth/jwt-auth.ts

@@ -6,13 +6,27 @@ import {
   type UserContext,
 } from '@shipfox/api-auth-context';
 import {userAccessTokenKey} from '@shipfox/node-auth-root-key';
-import type {AuthMethod} from '@shipfox/node-fastify';
+import {type AuthMethod, ClientError} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
+import type {RefreshToken} from '#core/entities/refresh-token.js';
+import type {User} from '#core/entities/user.js';
+import type {UserTokenClaims} from '#core/jwt.js';
 import {verifyUserToken} from '#core/jwt.js';
+import {findActiveRefreshSession} from '#db/refresh-tokens.js';
 import {createBearerTokenAuthMethod} from './bearer-token-auth.js';
 
+const AUTHENTICATED_SESSION_CONTEXT_KEY = Symbol.for('@shipfox/api-auth/session');
+
 export type ClientContext = UserContext;
 
+export type UserId = User['id'];
+export type RefreshSessionId = RefreshToken['sessionId'];
+
+export type AuthenticatedSessionContext = {
+  userId: UserId;
+  refreshSessionId: RefreshSessionId;
+};
+
 export interface CreateJwtAuthMethodOptions {
   secret: string;
 }
@@ -21,6 +35,45 @@ export function getClientContext(request: FastifyRequest): ClientContext | null
   return getUserContext(request);
 }
 
+function setAuthenticatedSessionContext(request: FastifyRequest, claims: UserTokenClaims): void {
+  (request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] = {
+    userId: claims.sub,
+    refreshSessionId: claims.refreshSessionId,
+  };
+}
+
+function getAuthenticatedSessionTokenContext(request: FastifyRequest): {
+  userId: UserId;
+  refreshSessionId: RefreshSessionId | undefined;
+} | null {
+  return (
+    ((request as unknown as Record<symbol, unknown>)[AUTHENTICATED_SESSION_CONTEXT_KEY] as
+      | {userId: UserId; refreshSessionId: RefreshSessionId | undefined}
+      | undefined) ?? null
+  );
+}
+
+/**
+ * Resolves the active refresh session backing an authenticated user request.
+ * The session check intentionally happens only for consumers that need browser-session binding.
+ */
+export async function getAuthenticatedSessionContext(
+  request: FastifyRequest,
+): Promise<AuthenticatedSessionContext> {
+  const client = getClientContext(request);
+  const token = getAuthenticatedSessionTokenContext(request);
+  if (!client || !token || token.userId !== client.userId || !token.refreshSessionId)
+    throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});
+
+  const session = await findActiveRefreshSession({
+    sessionId: token.refreshSessionId,
+    userId: client.userId,
+  });
+  if (!session) throw new ClientError('Invalid or expired token', 'unauthorized', {status: 401});
+
+  return {userId: client.userId, refreshSessionId: session.sessionId};
+}
+
 export function createJwtAuthMethod(): AuthMethod {
   return createBearerTokenAuthMethod({
     name: AUTH_USER,
@@ -34,6 +87,7 @@ export function createJwtAuthMethod(): AuthMethod {
         memberships: claims.memberships,
       });
       setUserContext(request, clientContext);
+      setAuthenticatedSessionContext(request, claims);
     },
   });
 }

package/src/presentation/e2eRoutes/index.test.ts

@@ -10,6 +10,7 @@ describe('auth E2E routes', () => {
       routes: [
         createAuthE2eRoutes({
           listMembershipsForTokenClaims: vi.fn(() => Promise.resolve({memberships: []})),
+          getWorkspaceCreator: vi.fn(),
           preflightInvitationAcceptance: vi.fn(),
           acceptInvitation: vi.fn(),
           requireActiveMembership: vi.fn(),

package/src/presentation/routes/index.test.ts

@@ -4,6 +4,7 @@ import {buildAuthRoutes} from './index.js';
 
 const workspaces = {
   listMembershipsForTokenClaims: vi.fn(() => Promise.resolve({memberships: []})),
+  getWorkspaceCreator: vi.fn(),
   preflightInvitationAcceptance: vi.fn(),
   acceptInvitation: vi.fn(),
   requireActiveMembership: vi.fn(),

package/test/globalSetup.ts

@@ -1,5 +1,5 @@
 import './env.js';
-import {emailChallengesModule} from '@shipfox/api-email-challenges';
+import {initializeEmailChallengesForTests} from '@shipfox/api-email-challenges/test';
 import {runMigrations} from '@shipfox/node-drizzle';
 import {closePostgresClient, createPostgresClient} from '@shipfox/node-postgres';
 import {sql} from 'drizzle-orm';
@@ -10,16 +10,9 @@ export async function setup() {
   createPostgresClient();
 
   await runMigrations(db(), migrationsPath, '__drizzle_migrations_auth');
-  const emailChallengesDatabase = emailChallengesModule.database;
-  const emailChallengesMigrations =
-    emailChallengesDatabase && !Array.isArray(emailChallengesDatabase)
-      ? emailChallengesDatabase.migrationsPath
-      : undefined;
-  if (!emailChallengesMigrations)
-    throw new Error('Email challenges module has no database migrations');
-  await runMigrations(db(), emailChallengesMigrations, '__drizzle_migrations_email_challenges');
+  await initializeEmailChallengesForTests();
   await db().execute(
-    sql`TRUNCATE email_challenges_challenges, email_challenges_send_limits, auth_outbox, auth_password_resets, auth_rate_limits, auth_refresh_tokens, auth_users CASCADE`,
+    sql`TRUNCATE auth_outbox, auth_password_resets, auth_rate_limits, auth_refresh_tokens, auth_users CASCADE`,
   );
 
   closeDb();

package/test/routes.ts

@@ -36,6 +36,7 @@ const testConfig = vi.hoisted(
 const workspaceTestDoubles = vi.hoisted(() => {
   return {
     acceptInvitation: vi.fn(),
+    getWorkspaceCreator: vi.fn(),
     preflightInvitationAcceptance: vi.fn(),
     listMembershipsForTokenClaims: vi.fn(() => Promise.resolve({memberships: []})),
     requireActiveMembership: vi.fn(),