@shipfox/api-auth 9.1.0 → 9.2.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 52 files with swc (491.07ms)
+Successfully compiled: 59 files with swc (416.7ms)

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @shipfox/api-auth
 
+## 9.2.0
+
+### Minor Changes
+
+- bd7c46b: Thread an optional signup policy through API Auth module composition in preparation for signup enforcement.
+- 456c884: Add Auth-owned local administrator grants and server-side role evaluation.
+- 36adf25: Guards password and external-identity account creation with the signup policy.
+- f31bee6: Adds the environment-variable signup policy and its Auth-prefixed configuration.
+- 63c0e5b: Adds the signup policy port and denial error to API Auth.
+
+### Patch Changes
+
+- b321700: Default the Auth module to its environment-backed signup policy when no custom policy is provided.
+- ad36e26: Return a bounded signup-not-allowed message from the password signup route.
+- Updated dependencies [456c884]
+  - @shipfox/api-auth-dto@9.2.0
+  - @shipfox/api-email-challenges@1.1.4
+  - @shipfox/api-workspaces-dto@9.2.0
+  - @shipfox/api-auth-context@9.2.0
+
 ## 9.1.0
 
 ### Patch Changes

package/README.md

@@ -63,10 +63,21 @@ Required environment:
 | `AUTH_REFRESH_ROTATION_GRACE_SECONDS` | `30` | Grace window for accepting a just-rotated refresh token during concurrent refreshes. |
 | `AUTH_REFRESH_COOKIE_NAME` | `shipfox_refresh_token` | HTTP cookie name for refresh sessions. |
 | `AUTH_PASSWORD_ENABLED` | `true` | Enables password and email-verification routes. Set to `false` when another module provides login. Server construction fails if no login method is available. |
+| `AUTH_SIGNUP_GATE_ENABLED` | `false` | Restricts new account creation to the configured signup email allowlist. Requires `AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS` or `AUTH_SIGNUP_ALLOWED_EMAILS` to be set. |
+| `AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS` | none | Comma-separated email domains allowed to create accounts, such as `shipfox.io,acme.com`. |
+| `AUTH_SIGNUP_ALLOWED_EMAILS` | none | Comma-separated exact email addresses allowed to create accounts. |
+| `AUTH_SIGNUP_NOT_ALLOWED_MESSAGE` | none | Description returned when the signup gate blocks an account. Defaults to "This Shipfox deployment does not accept new accounts right now." |
 | `CLIENT_BASE_URL` | `http://localhost:5173` | Base URL used in email verification and password reset links. |
 
 Email delivery uses the shared `@shipfox/node-mailer` configuration.
 
+The signup gate is off by default. When it is on, provide at least one non-empty
+entry in `AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS` or `AUTH_SIGNUP_ALLOWED_EMAILS`.
+Startup fails when both lists are empty. Values are trimmed and lowercased.
+The policy matches exact email addresses or exact domains. It does not match
+subdomains or wildcards. `createAuthModule` applies these settings by default;
+pass a `signupPolicy` to replace the environment-backed policy.
+
 When `AUTH_PASSWORD_ENABLED=false`, the module does not register signup, login, password-reset, password-change, or email-verification routes. Refresh, logout, and current-session routes stay available. Another module must contribute a login method before the API server starts.
 
 ## Security model
@@ -202,7 +213,7 @@ All routes are mounted under `/auth`.
 
 | Method | Path | Auth | Result |
 | --- | --- | --- | --- |
-| `POST` | `/signup` | none | Creates a user and sends an eight-digit email verification code. |
+| `POST` | `/signup` | none | Creates a user and sends an eight-digit email verification code. A denied new signup returns `403` with error code `signup-not-allowed` and the policy message. |
 | `POST` | `/verify-email/confirm` | none | Confirms a verification code, returns an access token, and sets the refresh cookie. |
 | `POST` | `/verify-email/resend` | none | Sends a new verification code when the account is eligible. |
 | `POST` | `/login` | none | Returns an access token and sets the refresh cookie. |
@@ -244,7 +255,9 @@ application composition:
 ```ts
 import {createAuthModule} from '@shipfox/api-auth';
 
-const authModule = createAuthModule({workspaces});
+const authModule = createAuthModule({
+  workspaces,
+});
 ```
 
 It also exports lower-level pieces for tests and advanced integration:
@@ -256,6 +269,7 @@ It also exports lower-level pieces for tests and advanced integration:
 - `createLeaseTokenAuthMethod()`: the Fastify auth method for job lease tokens.
 - `issueRunnerSessionToken(claims)` / `verifyRunnerSessionToken(token)`: mint and verify runner session tokens.
 - `issueJobLeaseToken(claims)` / `verifyJobLeaseToken(token)`: mint and verify job lease tokens.
+- `createEnvironmentSignupPolicy()`: creates the environment-backed signup policy used by default. Pass `signupPolicy` to `createAuthModule` to replace it.
 - `getClientContext(request)`: reads the authenticated user context from a Fastify request.
 - `getAuthenticatedSessionContext(request)`: resolves an authenticated request to its user ID and active refresh-session ID.
 - `findUserByEmail({email})`: read-only lookup of the current owner of a normalized email; see below.
@@ -270,18 +284,20 @@ create a normal Shipfox session and set its refresh cookie:
 import {
   authCookiePlugin,
   createSessionForUser,
+  createEnvironmentSignupPolicy,
   provisionUser,
   setRefreshTokenCookie,
 } from '@shipfox/api-auth';
 import type {FastifyReply} from 'fastify';
 
 export const callbackRoutePlugins = [authCookiePlugin];
+const signupPolicy = createEnvironmentSignupPolicy();
 
 export async function completeProviderCallback(
   reply: FastifyReply,
   profile: {email: string; name?: string},
 ): Promise<string> {
-  const user = await provisionUser(profile);
+  const user = await provisionUser({...profile, signupPolicy});
   const session = await createSessionForUser({userId: user.id});
 
   setRefreshTokenCookie(reply, session.refreshToken);
@@ -295,6 +311,12 @@ For OAuth providers, require a verified-email claim such as `email_verified`.
 session for any active, verified account. An unverified provider email could
 otherwise sign in as an existing password account with the same address.
 
+Pass the same `signupPolicy` to `provisionUser` when signup gating is enabled.
+The function checks for an existing user before it calls the policy, so existing
+users keep signing in even when their address is no longer allowed. For a new
+user, a denied policy throws `SignupNotAllowedError`. Call
+`createSessionForUser` only after provisioning succeeds.
+
 Add `authCookiePlugin` to the callback route group before calling a cookie
 helper. `getRefreshTokenCookie`, `setRefreshTokenCookie`, and
 `clearRefreshTokenCookie` use the configured cookie name and the `/auth` path.
@@ -373,6 +395,9 @@ Passwords use Argon2id. Password reset tokens and refresh tokens are opaque toke
 ## Behavior Notes
 
 - Signup sends an eight-digit verification code and returns the new user with its challenge ID.
+- Signup gating blocks account creation only. Existing users keep signing in, even when their address is not on the current allowlist.
+- A denied password signup returns `403` with error code `signup-not-allowed`. The policy message is capped at 500 characters.
+- Invitation signup validates the invitation and bypasses the signup policy. Invitations remain a separate authorization path.
 - Login only succeeds for active users with verified email addresses and a password hash.
 - Refresh tokens rotate on each refresh.
 - Password reset tokens and email challenge proofs are consumed once.

package/dist/config.d.ts

@@ -6,6 +6,10 @@ export declare const config: Readonly<{
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: number;
     AUTH_REFRESH_COOKIE_NAME: string;
     AUTH_PASSWORD_ENABLED: boolean;
+    AUTH_SIGNUP_GATE_ENABLED: boolean;
+    AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS: string;
+    AUTH_SIGNUP_ALLOWED_EMAILS: string;
+    AUTH_SIGNUP_NOT_ALLOWED_MESSAGE: string | undefined;
     CLIENT_BASE_URL: string;
 } & import("@shipfox/config").CleanedEnvAccessors>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,MAAM;;;;;;;;;kDAiCjB,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,MAAM;;;;;;;;;;;;;kDAiDjB,CAAC"}

package/dist/config.js

@@ -28,10 +28,32 @@ export const config = createConfig({
         desc: 'Whether password login is available. Use true or false. Defaults to true. When false, password and email-verification routes are not registered, and server startup requires another module to contribute a login method.',
         default: true
     }),
+    AUTH_SIGNUP_GATE_ENABLED: bool({
+        desc: 'Whether new account creation is restricted to the configured signup email allowlist. Defaults to false, which allows every signup.',
+        default: false
+    }),
+    AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS: str({
+        desc: 'Comma-separated email domains allowed to create accounts, such as shipfox.io,acme.com. Required when AUTH_SIGNUP_GATE_ENABLED is true unless AUTH_SIGNUP_ALLOWED_EMAILS is set.',
+        default: ''
+    }),
+    AUTH_SIGNUP_ALLOWED_EMAILS: str({
+        desc: 'Comma-separated exact email addresses allowed to create accounts. Required when AUTH_SIGNUP_GATE_ENABLED is true unless AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS is set.',
+        default: ''
+    }),
+    AUTH_SIGNUP_NOT_ALLOWED_MESSAGE: str({
+        desc: 'Description returned when the signup gate blocks an account. Optional. The default is This Shipfox deployment does not accept new accounts right now.',
+        default: undefined
+    }),
     CLIENT_BASE_URL: str({
         desc: 'Base URL of the client app. Used to build links in emails such as password resets.',
         default: 'http://localhost:5173'
     })
 });
+if (config.AUTH_SIGNUP_GATE_ENABLED && !hasSignupAllowlistEntry(config.AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS) && !hasSignupAllowlistEntry(config.AUTH_SIGNUP_ALLOWED_EMAILS)) {
+    throw new Error('AUTH_SIGNUP_GATE_ENABLED requires AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS or AUTH_SIGNUP_ALLOWED_EMAILS to be set.');
+}
+function hasSignupAllowlistEntry(value) {
+    return value.split(',').some((entry)=>entry.trim().length > 0);
+}
 
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {bool, createConfig, num, str} from '@shipfox/config';\n\nexport const config = createConfig({\n  AUTH_JWT_EXPIRES_IN: str({\n    desc: 'How long an access token stays valid. Accepts a duration string such as 15m, 1h, or 7d.',\n    default: '15m',\n  }),\n  AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: str({\n    desc: 'How long a job lease token stays valid. Set it longer than the longest job (JOB_MAX_DURATION is 60 minutes) plus a safety margin.',\n    default: '90m',\n  }),\n  AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN: str({\n    desc: 'How long a runner session token stays valid. A revoked registration token can leave existing sessions usable until this lifetime ends.',\n    default: '1h',\n  }),\n  AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: num({\n    desc: 'How many days a refresh token stays valid before the user must sign in again.',\n    default: 14,\n  }),\n  AUTH_REFRESH_ROTATION_GRACE_SECONDS: num({\n    desc: 'Window after a refresh token is rotated during which the now-rotated token is still accepted, so concurrent refreshes from parallel tabs do not log the user out. Reuse past this window is treated as a compromise and revokes the session.',\n    default: 30,\n  }),\n  AUTH_REFRESH_COOKIE_NAME: str({\n    desc: 'Name of the browser cookie that stores the refresh token.',\n    default: 'shipfox_refresh_token',\n  }),\n  AUTH_PASSWORD_ENABLED: bool({\n    desc: 'Whether password login is available. Use true or false. Defaults to true. When false, password and email-verification routes are not registered, and server startup requires another module to contribute a login method.',\n    default: true,\n  }),\n  CLIENT_BASE_URL: str({\n    desc: 'Base URL of the client app. Used to build links in emails such as password resets.',\n    default: 'http://localhost:5173',\n  }),\n});\n"],"names":["bool","createConfig","num","str","config","AUTH_JWT_EXPIRES_IN","desc","default","AUTH_JOB_LEASE_TOKEN_EXPIRES_IN","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","AUTH_REFRESH_ROTATION_GRACE_SECONDS","AUTH_REFRESH_COOKIE_NAME","AUTH_PASSWORD_ENABLED","CLIENT_BASE_URL"],"mappings":"AAAA,SAAQA,IAAI,EAAEC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AAE7D,OAAO,MAAMC,SAASH,aAAa;IACjCI,qBAAqBF,IAAI;QACvBG,MAAM;QACNC,SAAS;IACX;IACAC,iCAAiCL,IAAI;QACnCG,MAAM;QACNC,SAAS;IACX;IACAE,sCAAsCN,IAAI;QACxCG,MAAM;QACNC,SAAS;IACX;IACAG,oCAAoCR,IAAI;QACtCI,MAAM;QACNC,SAAS;IACX;IACAI,qCAAqCT,IAAI;QACvCI,MAAM;QACNC,SAAS;IACX;IACAK,0BAA0BT,IAAI;QAC5BG,MAAM;QACNC,SAAS;IACX;IACAM,uBAAuBb,KAAK;QAC1BM,MAAM;QACNC,SAAS;IACX;IACAO,iBAAiBX,IAAI;QACnBG,MAAM;QACNC,SAAS;IACX;AACF,GAAG"}
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {bool, createConfig, num, str} from '@shipfox/config';\n\nexport const config = createConfig({\n  AUTH_JWT_EXPIRES_IN: str({\n    desc: 'How long an access token stays valid. Accepts a duration string such as 15m, 1h, or 7d.',\n    default: '15m',\n  }),\n  AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: str({\n    desc: 'How long a job lease token stays valid. Set it longer than the longest job (JOB_MAX_DURATION is 60 minutes) plus a safety margin.',\n    default: '90m',\n  }),\n  AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN: str({\n    desc: 'How long a runner session token stays valid. A revoked registration token can leave existing sessions usable until this lifetime ends.',\n    default: '1h',\n  }),\n  AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: num({\n    desc: 'How many days a refresh token stays valid before the user must sign in again.',\n    default: 14,\n  }),\n  AUTH_REFRESH_ROTATION_GRACE_SECONDS: num({\n    desc: 'Window after a refresh token is rotated during which the now-rotated token is still accepted, so concurrent refreshes from parallel tabs do not log the user out. Reuse past this window is treated as a compromise and revokes the session.',\n    default: 30,\n  }),\n  AUTH_REFRESH_COOKIE_NAME: str({\n    desc: 'Name of the browser cookie that stores the refresh token.',\n    default: 'shipfox_refresh_token',\n  }),\n  AUTH_PASSWORD_ENABLED: bool({\n    desc: 'Whether password login is available. Use true or false. Defaults to true. When false, password and email-verification routes are not registered, and server startup requires another module to contribute a login method.',\n    default: true,\n  }),\n  AUTH_SIGNUP_GATE_ENABLED: bool({\n    desc: 'Whether new account creation is restricted to the configured signup email allowlist. Defaults to false, which allows every signup.',\n    default: false,\n  }),\n  AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS: str({\n    desc: 'Comma-separated email domains allowed to create accounts, such as shipfox.io,acme.com. Required when AUTH_SIGNUP_GATE_ENABLED is true unless AUTH_SIGNUP_ALLOWED_EMAILS is set.',\n    default: '',\n  }),\n  AUTH_SIGNUP_ALLOWED_EMAILS: str({\n    desc: 'Comma-separated exact email addresses allowed to create accounts. Required when AUTH_SIGNUP_GATE_ENABLED is true unless AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS is set.',\n    default: '',\n  }),\n  AUTH_SIGNUP_NOT_ALLOWED_MESSAGE: str({\n    desc: 'Description returned when the signup gate blocks an account. Optional. The default is This Shipfox deployment does not accept new accounts right now.',\n    default: undefined,\n  }),\n  CLIENT_BASE_URL: str({\n    desc: 'Base URL of the client app. Used to build links in emails such as password resets.',\n    default: 'http://localhost:5173',\n  }),\n});\n\nif (\n  config.AUTH_SIGNUP_GATE_ENABLED &&\n  !hasSignupAllowlistEntry(config.AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS) &&\n  !hasSignupAllowlistEntry(config.AUTH_SIGNUP_ALLOWED_EMAILS)\n) {\n  throw new Error(\n    'AUTH_SIGNUP_GATE_ENABLED requires AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS or AUTH_SIGNUP_ALLOWED_EMAILS to be set.',\n  );\n}\n\nfunction hasSignupAllowlistEntry(value: string): boolean {\n  return value.split(',').some((entry) => entry.trim().length > 0);\n}\n"],"names":["bool","createConfig","num","str","config","AUTH_JWT_EXPIRES_IN","desc","default","AUTH_JOB_LEASE_TOKEN_EXPIRES_IN","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","AUTH_REFRESH_ROTATION_GRACE_SECONDS","AUTH_REFRESH_COOKIE_NAME","AUTH_PASSWORD_ENABLED","AUTH_SIGNUP_GATE_ENABLED","AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS","AUTH_SIGNUP_ALLOWED_EMAILS","AUTH_SIGNUP_NOT_ALLOWED_MESSAGE","undefined","CLIENT_BASE_URL","hasSignupAllowlistEntry","Error","value","split","some","entry","trim","length"],"mappings":"AAAA,SAAQA,IAAI,EAAEC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AAE7D,OAAO,MAAMC,SAASH,aAAa;IACjCI,qBAAqBF,IAAI;QACvBG,MAAM;QACNC,SAAS;IACX;IACAC,iCAAiCL,IAAI;QACnCG,MAAM;QACNC,SAAS;IACX;IACAE,sCAAsCN,IAAI;QACxCG,MAAM;QACNC,SAAS;IACX;IACAG,oCAAoCR,IAAI;QACtCI,MAAM;QACNC,SAAS;IACX;IACAI,qCAAqCT,IAAI;QACvCI,MAAM;QACNC,SAAS;IACX;IACAK,0BAA0BT,IAAI;QAC5BG,MAAM;QACNC,SAAS;IACX;IACAM,uBAAuBb,KAAK;QAC1BM,MAAM;QACNC,SAAS;IACX;IACAO,0BAA0Bd,KAAK;QAC7BM,MAAM;QACNC,SAAS;IACX;IACAQ,mCAAmCZ,IAAI;QACrCG,MAAM;QACNC,SAAS;IACX;IACAS,4BAA4Bb,IAAI;QAC9BG,MAAM;QACNC,SAAS;IACX;IACAU,iCAAiCd,IAAI;QACnCG,MAAM;QACNC,SAASW;IACX;IACAC,iBAAiBhB,IAAI;QACnBG,MAAM;QACNC,SAAS;IACX;AACF,GAAG;AAEH,IACEH,OAAOU,wBAAwB,IAC/B,CAACM,wBAAwBhB,OAAOW,iCAAiC,KACjE,CAACK,wBAAwBhB,OAAOY,0BAA0B,GAC1D;IACA,MAAM,IAAIK,MACR;AAEJ;AAEA,SAASD,wBAAwBE,KAAa;IAC5C,OAAOA,MAAMC,KAAK,CAAC,KAAKC,IAAI,CAAC,CAACC,QAAUA,MAAMC,IAAI,GAAGC,MAAM,GAAG;AAChE"}

package/dist/core/admin-role-model.d.ts

@@ -0,0 +1,5 @@
+import type { AdminRole } from '@shipfox/api-auth-dto';
+export declare const ADMIN_ROLES: readonly AdminRole[];
+export declare function hasMinimumAdminRole(role: AdminRole, minimumRole: AdminRole): boolean;
+export declare function highestAdminRole(roles: readonly AdminRole[]): AdminRole | null;
+//# sourceMappingURL=admin-role-model.d.ts.map

package/dist/core/admin-role-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-role-model.d.ts","sourceRoot":"","sources":["../../src/core/admin-role-model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAI3C,CAAC;AAQF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,GAAG,OAAO,CAEpF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,GAAG,IAAI,CAM9E"}

package/dist/core/admin-role-model.js

@@ -0,0 +1,18 @@
+export const ADMIN_ROLES = [
+    'admin-observer',
+    'admin-operator',
+    'admin-owner'
+];
+const ADMIN_ROLE_RANK = {
+    'admin-observer': 1,
+    'admin-operator': 2,
+    'admin-owner': 3
+};
+export function hasMinimumAdminRole(role, minimumRole) {
+    return ADMIN_ROLE_RANK[role] >= ADMIN_ROLE_RANK[minimumRole];
+}
+export function highestAdminRole(roles) {
+    return roles.reduce((highest, role)=>highest === null || ADMIN_ROLE_RANK[role] > ADMIN_ROLE_RANK[highest] ? role : highest, null);
+}
+
+//# sourceMappingURL=admin-role-model.js.map

package/dist/core/admin-role-model.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/admin-role-model.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\n\nexport const ADMIN_ROLES: readonly AdminRole[] = [\n  'admin-observer',\n  'admin-operator',\n  'admin-owner',\n];\n\nconst ADMIN_ROLE_RANK: Record<AdminRole, number> = {\n  'admin-observer': 1,\n  'admin-operator': 2,\n  'admin-owner': 3,\n};\n\nexport function hasMinimumAdminRole(role: AdminRole, minimumRole: AdminRole): boolean {\n  return ADMIN_ROLE_RANK[role] >= ADMIN_ROLE_RANK[minimumRole];\n}\n\nexport function highestAdminRole(roles: readonly AdminRole[]): AdminRole | null {\n  return roles.reduce<AdminRole | null>(\n    (highest, role) =>\n      highest === null || ADMIN_ROLE_RANK[role] > ADMIN_ROLE_RANK[highest] ? role : highest,\n    null,\n  );\n}\n"],"names":["ADMIN_ROLES","ADMIN_ROLE_RANK","hasMinimumAdminRole","role","minimumRole","highestAdminRole","roles","reduce","highest"],"mappings":"AAEA,OAAO,MAAMA,cAAoC;IAC/C;IACA;IACA;CACD,CAAC;AAEF,MAAMC,kBAA6C;IACjD,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;AACjB;AAEA,OAAO,SAASC,oBAAoBC,IAAe,EAAEC,WAAsB;IACzE,OAAOH,eAAe,CAACE,KAAK,IAAIF,eAAe,CAACG,YAAY;AAC9D;AAEA,OAAO,SAASC,iBAAiBC,KAA2B;IAC1D,OAAOA,MAAMC,MAAM,CACjB,CAACC,SAASL,OACRK,YAAY,QAAQP,eAAe,CAACE,KAAK,GAAGF,eAAe,CAACO,QAAQ,GAAGL,OAAOK,SAChF;AAEJ"}

package/dist/core/admin-role.d.ts

@@ -0,0 +1,13 @@
+import type { AdminRole } from '@shipfox/api-auth-dto';
+export { ADMIN_ROLES, hasMinimumAdminRole, highestAdminRole } from './admin-role-model.js';
+export declare function getCurrentAdminRole(params: {
+    userId: string;
+}): Promise<AdminRole | null>;
+export declare function requireAdminRole(params: {
+    userId: string;
+    minimumRole: AdminRole;
+}): Promise<AdminRole>;
+export declare function revokeAdminGrant(params: {
+    grantId: string;
+}): Promise<import("./entities/admin-grant.js").AdminGrant | undefined>;
+//# sourceMappingURL=admin-role.d.ts.map

package/dist/core/admin-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-role.d.ts","sourceRoot":"","sources":["../../src/core/admin-role.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAKrD,OAAO,EAAC,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAC,MAAM,uBAAuB,CAAC;AAEzF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE7F;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,SAAS,CAAC;CACxB,GAAG,OAAO,CAAC,SAAS,CAAC,CAMrB;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,uEAE/D"}

package/dist/core/admin-role.js

@@ -0,0 +1,21 @@
+import { findCurrentAdminRole, revokeAdminGrant as revokeAdminGrantInDb } from '#db/admin-grants.js';
+import { hasMinimumAdminRole } from './admin-role-model.js';
+import { AdminRoleRequiredError } from './errors.js';
+export { ADMIN_ROLES, hasMinimumAdminRole, highestAdminRole } from './admin-role-model.js';
+export async function getCurrentAdminRole(params) {
+    return await findCurrentAdminRole(params);
+}
+export async function requireAdminRole(params) {
+    const role = await getCurrentAdminRole({
+        userId: params.userId
+    });
+    if (!role || !hasMinimumAdminRole(role, params.minimumRole)) {
+        throw new AdminRoleRequiredError(params.minimumRole);
+    }
+    return role;
+}
+export async function revokeAdminGrant(params) {
+    return await revokeAdminGrantInDb(params);
+}
+
+//# sourceMappingURL=admin-role.js.map

package/dist/core/admin-role.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/admin-role.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {findCurrentAdminRole, revokeAdminGrant as revokeAdminGrantInDb} from '#db/admin-grants.js';\nimport {hasMinimumAdminRole} from './admin-role-model.js';\nimport {AdminRoleRequiredError} from './errors.js';\n\nexport {ADMIN_ROLES, hasMinimumAdminRole, highestAdminRole} from './admin-role-model.js';\n\nexport async function getCurrentAdminRole(params: {userId: string}): Promise<AdminRole | null> {\n  return await findCurrentAdminRole(params);\n}\n\nexport async function requireAdminRole(params: {\n  userId: string;\n  minimumRole: AdminRole;\n}): Promise<AdminRole> {\n  const role = await getCurrentAdminRole({userId: params.userId});\n  if (!role || !hasMinimumAdminRole(role, params.minimumRole)) {\n    throw new AdminRoleRequiredError(params.minimumRole);\n  }\n  return role;\n}\n\nexport async function revokeAdminGrant(params: {grantId: string}) {\n  return await revokeAdminGrantInDb(params);\n}\n"],"names":["findCurrentAdminRole","revokeAdminGrant","revokeAdminGrantInDb","hasMinimumAdminRole","AdminRoleRequiredError","ADMIN_ROLES","highestAdminRole","getCurrentAdminRole","params","requireAdminRole","role","userId","minimumRole"],"mappings":"AACA,SAAQA,oBAAoB,EAAEC,oBAAoBC,oBAAoB,QAAO,sBAAsB;AACnG,SAAQC,mBAAmB,QAAO,wBAAwB;AAC1D,SAAQC,sBAAsB,QAAO,cAAc;AAEnD,SAAQC,WAAW,EAAEF,mBAAmB,EAAEG,gBAAgB,QAAO,wBAAwB;AAEzF,OAAO,eAAeC,oBAAoBC,MAAwB;IAChE,OAAO,MAAMR,qBAAqBQ;AACpC;AAEA,OAAO,eAAeC,iBAAiBD,MAGtC;IACC,MAAME,OAAO,MAAMH,oBAAoB;QAACI,QAAQH,OAAOG,MAAM;IAAA;IAC7D,IAAI,CAACD,QAAQ,CAACP,oBAAoBO,MAAMF,OAAOI,WAAW,GAAG;QAC3D,MAAM,IAAIR,uBAAuBI,OAAOI,WAAW;IACrD;IACA,OAAOF;AACT;AAEA,OAAO,eAAeT,iBAAiBO,MAAyB;IAC9D,OAAO,MAAMN,qBAAqBM;AACpC"}

package/dist/core/auth.d.ts

@@ -1,14 +1,18 @@
+import { type AdminRole } from '@shipfox/api-auth-dto';
 import { type WorkspacesInterModuleClient } from '@shipfox/api-workspaces-dto/inter-module';
 import type { User } from './entities/user.js';
 import { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError } from './errors.js';
+import type { SignupPolicy } from './ports.js';
 export interface SignupParams {
     email: string;
     password: string;
     name?: string | undefined;
+    signupPolicy?: SignupPolicy | undefined;
 }
 export interface ProvisionUserParams {
     email: string;
     name?: string | null | undefined;
+    signupPolicy?: SignupPolicy | undefined;
 }
 /**
  * Creates a verified, password-less user for an external identity provider.
@@ -53,6 +57,7 @@ export interface LoginResult {
     token: string;
     refreshToken: string;
     user: User;
+    adminRole: AdminRole | null;
 }
 export declare function login(params: LoginParams): Promise<LoginResult>;
 export interface CreateSessionForUserParams {
@@ -64,6 +69,7 @@ export interface CreateSessionForUserResult {
     token: string;
     refreshToken: string;
     user: User;
+    adminRole: AdminRole | null;
 }
 export type CreateSessionForUserError = AuthDependencyUnavailableError | EmailNotVerifiedError | InvalidCredentialsError | UserNotFoundError;
 export declare function createSessionForUser(params: CreateSessionForUserParams): Promise<CreateSessionForUserResult>;
@@ -72,6 +78,7 @@ export interface RefreshAccessTokenResult {
     /** Undefined on a grace-window hit: keep the existing cookie instead of rotating it. */
     refreshToken: string | undefined;
     user: User;
+    adminRole: AdminRole | null;
 }
 export declare function refreshAccessToken(params: {
     refreshToken: string;
@@ -81,6 +88,7 @@ export interface ConfirmEmailVerificationResult {
     token: string;
     refreshToken: string;
     user: User;
+    adminRole: AdminRole | null;
 }
 export interface ResendEmailVerificationResult {
     nextResendAvailableAt: Date;
@@ -103,6 +111,7 @@ export interface ConfirmPasswordResetResult {
     token: string;
     refreshToken: string;
     user: User;
+    adminRole: AdminRole | null;
 }
 export declare function confirmPasswordReset(params: {
     token: string;

package/dist/core/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,0CAA0C,CAAC;AAwBlD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EAErB,uBAAuB,EAKvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AA6GrB,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9E;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAChC,cAAc,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,IAAI,CAAA;KAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAsC9F;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA2B,SAAQ,WAAW;IAC7D,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IACrE,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAiErC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAwBrE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAoBrC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAmDpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAkB1C;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBtC;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAO5F"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,KAAK,SAAS,EAAc,MAAM,uBAAuB,CAAC;AAOlE,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,0CAA0C,CAAC;AAyBlD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EAErB,uBAAuB,EAMvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,YAAY,CAAC;AAmI7C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9E;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG;IAChC,cAAc,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,IAAI,CAAA;KAAC,CAAC;CAC3D,CAAC;AAEF,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CA8C9F;AAED,MAAM,WAAW,0BAA2B,SAAQ,YAAY;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA2B,SAAQ,WAAW;IAC7D,UAAU,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC;IACrE,WAAW,CAAC,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAC,CAAC;CAC/C;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAiErC;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAwBrE;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GACjC,8BAA8B,GAC9B,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAoBrC;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoDpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAqB1C;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjF;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,2BAA2B,CAAC;CACzC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBtC;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvF;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAO5F"}

package/dist/core/auth.js

@@ -9,11 +9,28 @@ import { consumePasswordReset, createPasswordReset } from '#db/password-resets.j
 import { createRefreshToken, findActiveRefreshTokenByHash, findRefreshTokenByHash, revokeRefreshSession, revokeRefreshTokensForUser, rotateRefreshToken } from '#db/refresh-tokens.js';
 import { createUser as createDbUser, findUserByEmail, findUserById, markEmailVerified, provisionUser as provisionDbUser, updateUserPassword } from '#db/users.js';
 import { recordTokenRefreshed } from '#metrics/index.js';
-import { AuthDependencyUnavailableError, EmailNotVerifiedError, EmailTakenError, InvalidCredentialsError, InvitationEmailMismatchError, TokenAlreadyUsedError, TokenExpiredError, TokenInvalidError, UserNotFoundError } from './errors.js';
+import { getCurrentAdminRole } from './admin-role.js';
+import { AuthDependencyUnavailableError, EmailNotVerifiedError, EmailTakenError, InvalidCredentialsError, InvitationEmailMismatchError, SignupNotAllowedError, TokenAlreadyUsedError, TokenExpiredError, TokenInvalidError, UserNotFoundError } from './errors.js';
 import { signUserToken } from './jwt.js';
 import { hashPassword, verifyPassword } from './password.js';
 const RESET_TTL_HOURS = 1;
 const PASSWORD_VERIFICATION_PURPOSE = 'password-verification';
+const DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE = 'This Shipfox deployment does not accept new accounts right now.';
+const defaultSignupPolicy = {
+    isSignupAllowed: async ()=>({
+            allowed: true
+        })
+};
+async function assertSignupAllowed(params) {
+    const result = await (params.signupPolicy ?? defaultSignupPolicy).isSignupAllowed({
+        email: params.email,
+        emailVerified: params.emailVerified,
+        source: params.source
+    });
+    if (!result.allowed) {
+        throw new SignupNotAllowedError(result.message ?? DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE);
+    }
+}
 let dummyHashCache;
 async function getDummyHash() {
     if (!dummyHashCache) {
@@ -69,10 +86,14 @@ async function createRefreshSession(user, refreshSessionId) {
 async function createSessionTokens(user, workspaces) {
     const refreshSessionId = crypto.randomUUID();
     const token = await signAccessToken(user, workspaces, refreshSessionId);
+    const adminRole = await getCurrentAdminRole({
+        userId: user.id
+    });
     const { refreshToken } = await createRefreshSession(user, refreshSessionId);
     return {
         token,
-        refreshToken
+        refreshToken,
+        adminRole
     };
 }
 function passwordResetLink(rawToken) {
@@ -96,14 +117,26 @@ function invitationErrorMessage(code) {
  * Creates a verified, password-less user for an external identity provider.
  * Existing users are returned unchanged, including their password and profile.
  */ export async function provisionUser(params) {
+    const email = emailSchema.parse(params.email);
+    const existing = await findUserByEmail({
+        email
+    });
+    if (existing) return existing;
+    await assertSignupAllowed({
+        signupPolicy: params.signupPolicy,
+        email,
+        emailVerified: true,
+        source: 'external-identity'
+    });
     return await provisionDbUser({
-        email: emailSchema.parse(params.email),
+        email,
         name: params.name ?? null
     });
 }
 export async function signup(params) {
+    const email = emailSchema.parse(params.email);
     const existing = await findUserByEmail({
-        email: params.email
+        email
     });
     if (existing) {
         const canResumeVerification = existing.status === 'active' && existing.emailVerifiedAt === null && existing.hashedPassword !== null && await verifyPassword({
@@ -123,13 +156,19 @@ export async function signup(params) {
                 emailChallenge
             };
         }
-        throw new EmailTakenError(params.email);
+        throw new EmailTakenError(email);
     }
+    await assertSignupAllowed({
+        signupPolicy: params.signupPolicy,
+        email,
+        emailVerified: false,
+        source: 'password'
+    });
     const hashedPassword = await hashPassword({
         password: params.password
     });
     const user = await createDbUser({
-        email: params.email,
+        email,
         hashedPassword,
         name: params.name ?? null,
         signedUp: {
@@ -213,21 +252,23 @@ export async function signupWithInvitation(params) {
     }
     // Step 4: Issue session. signAccessToken reads memberships through the
     // workspaces module API, so a successful accept is reflected in the JWT.
-    const { token, refreshToken } = await createSessionTokens(user, params.workspaces);
+    const { token, refreshToken, adminRole } = await createSessionTokens(user, params.workspaces);
     if (acceptError) {
         return {
             token,
             refreshToken,
             user,
             membership,
-            acceptError
+            acceptError,
+            adminRole
         };
     }
     return {
         token,
         refreshToken,
         user,
-        membership
+        membership,
+        adminRole
     };
 }
 export async function createUser(params) {
@@ -270,11 +311,12 @@ export async function login(params) {
     if (user.emailVerifiedAt === null) {
         throw new EmailNotVerifiedError();
     }
-    const { token, refreshToken } = await createSessionTokens(user, params.workspaces);
+    const { token, refreshToken, adminRole } = await createSessionTokens(user, params.workspaces);
     return {
         token,
         refreshToken,
-        user
+        user,
+        adminRole
     };
 }
 export async function createSessionForUser(params) {
@@ -292,11 +334,12 @@ export async function createSessionForUser(params) {
     if (user.status !== 'active') {
         throw new InvalidCredentialsError();
     }
-    const { token, refreshToken } = await createSessionTokens(user, params.workspaces);
+    const { token, refreshToken, adminRole } = await createSessionTokens(user, params.workspaces);
     return {
         token,
         refreshToken,
-        user
+        user,
+        adminRole
     };
 }
 export async function refreshAccessToken(params) {
@@ -319,6 +362,9 @@ export async function refreshAccessToken(params) {
         recordRefreshOutcome('rejected');
         throw new TokenInvalidError('Refresh token is invalid or expired');
     }
+    const adminRole = await getCurrentAdminRole({
+        userId: user.id
+    });
     // Within the grace window a rotated token means a concurrent refresh (e.g. a
     // second tab); past it, reuse of a retired token means a compromised session.
     if (current.rotatedAt) {
@@ -328,7 +374,8 @@ export async function refreshAccessToken(params) {
             return {
                 token,
                 refreshToken: undefined,
-                user
+                user,
+                adminRole
             };
         }
         await revokeRefreshTokensForUser({
@@ -359,7 +406,8 @@ export async function refreshAccessToken(params) {
         return {
             token,
             refreshToken: undefined,
-            user
+            user,
+            adminRole
         };
     }
     const token = await signAccessToken(user, params.workspaces, current.sessionId);
@@ -367,7 +415,8 @@ export async function refreshAccessToken(params) {
     return {
         token,
         refreshToken: nextRefreshToken,
-        user
+        user,
+        adminRole
     };
 }
 export async function confirmEmailVerification(params) {
@@ -391,11 +440,12 @@ export async function confirmEmailVerification(params) {
     if (verifiedUser?.status !== 'active') {
         throw new TokenInvalidError('Verification code is invalid or expired');
     }
-    const { token, refreshToken } = await createSessionTokens(verifiedUser, params.workspaces);
+    const { token, refreshToken, adminRole } = await createSessionTokens(verifiedUser, params.workspaces);
     return {
         token,
         refreshToken,
-        user: verifiedUser
+        user: verifiedUser,
+        adminRole
     };
 }
 export async function resendEmailVerification(params) {
@@ -461,11 +511,12 @@ export async function confirmPasswordReset(params) {
     await revokeRefreshTokensForUser({
         userId: consumed.userId
     });
-    const { token, refreshToken } = await createSessionTokens(user, params.workspaces);
+    const { token, refreshToken, adminRole } = await createSessionTokens(user, params.workspaces);
     return {
         token,
         refreshToken,
-        user
+        user,
+        adminRole
     };
 }
 export async function changePassword(params) {