@shipfox/api-auth 9.1.0 → 9.2.0

package/src/presentation/routes/registration/signup.ts

@@ -6,14 +6,21 @@ import {signup, signupWithInvitation} from '#core/auth.js';
 import {
   EmailTakenError,
   InvitationEmailMismatchError,
+  SignupNotAllowedError,
   TokenAlreadyUsedError,
   TokenExpiredError,
   TokenInvalidError,
 } from '#core/errors.js';
+import type {SignupPolicy} from '#core/ports.js';
 import {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';
 import {toUserDto} from '#presentation/dto/user.js';
 
-export function createSignupRoute(workspaces: WorkspacesInterModuleClient) {
+const SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH = 500;
+
+export function createSignupRoute(
+  workspaces: WorkspacesInterModuleClient,
+  signupPolicy?: SignupPolicy,
+) {
   return defineRoute({
     method: 'POST',
     path: '/signup',
@@ -35,6 +42,13 @@ export function createSignupRoute(workspaces: WorkspacesInterModuleClient) {
       if (error instanceof EmailTakenError) {
         throw new ClientError('Email already registered', 'email-taken', {status: 409});
       }
+      if (error instanceof SignupNotAllowedError) {
+        const message = error.message.slice(0, SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH);
+        throw new ClientError(message, 'signup-not-allowed', {
+          status: 403,
+          details: {message},
+        });
+      }
       if (error instanceof TokenInvalidError) {
         throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {
           status: 410,
@@ -63,7 +77,13 @@ export function createSignupRoute(workspaces: WorkspacesInterModuleClient) {
       const {email, password, name, invitation_token} = request.body;
 
       if (invitation_token === undefined) {
-        const result = await signup({email, password, name, sourceIp: request.ip});
+        const result = await signup({
+          email,
+          password,
+          name,
+          sourceIp: request.ip,
+          signupPolicy,
+        });
         reply.code(201);
         return {
           user: toUserDto(result),

package/src/presentation/routes/session/login.test.ts

@@ -35,6 +35,7 @@ describe('POST /auth/login', () => {
     expect(res.statusCode).toBe(200);
     expect(res.json().token).toBeDefined();
     expect(res.json().user.email).toBe(email);
+    expect(res.json().admin_role).toBeNull();
     expect(res.headers['set-cookie']).toContain('shipfox_refresh_token=');
     expect(res.headers['set-cookie']).toContain('HttpOnly');
     expect(res.headers['set-cookie']).toContain('Secure');

package/src/presentation/routes/session/me.test.ts

@@ -1,10 +1,11 @@
 import type {FastifyInstance} from 'fastify';
 import {signUserToken} from '#core/jwt.js';
+import {createAdminGrant} from '#db/admin-grants.js';
 import {
   createAuthTestApp,
+  createVerifiedSession,
   ROUTE_TEST_SECRET,
   resetCapturedMail,
-  signupVerifyLogin,
 } from '#test/routes.js';
 
 describe('GET /auth/me', () => {
@@ -23,7 +24,7 @@ describe('GET /auth/me', () => {
   });
 
   test('returns the signed-in user', async () => {
-    const account = await signupVerifyLogin(app, 'me');
+    const account = await createVerifiedSession('me');
 
     const res = await app.inject({
       method: 'GET',
@@ -33,6 +34,21 @@ describe('GET /auth/me', () => {
 
     expect(res.statusCode).toBe(200);
     expect(res.json().user.email).toBe(account.email);
+    expect(res.json().admin_role).toBeNull();
+  });
+
+  test('returns the current Auth-owned role for dashboard presentation', async () => {
+    const account = await createVerifiedSession('me-admin');
+    await createAdminGrant({userId: account.userId, role: 'admin-observer'});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${account.token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().admin_role).toBe('admin-observer');
   });
 
   test('transforms a token for a missing user into 404', async () => {

package/src/presentation/routes/session/me.ts

@@ -1,6 +1,7 @@
 import {AUTH_USER} from '@shipfox/api-auth-context';
 import {meResponseSchema} from '@shipfox/api-auth-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {getCurrentAdminRole} from '#core/admin-role.js';
 import {getCurrentUser} from '#core/auth.js';
 import {UserNotFoundError} from '#core/errors.js';
 import {getClientContext} from '#presentation/auth/jwt-auth.js';
@@ -30,6 +31,9 @@ export const meRoute = defineRoute({
 
     const result = await getCurrentUser({userId: client.userId});
 
-    return {user: toUserDto(result.user)};
+    return {
+      user: toUserDto(result.user),
+      admin_role: await getCurrentAdminRole({userId: client.userId}),
+    };
   },
 });

package/test/globalSetup.ts

@@ -12,7 +12,7 @@ export async function setup() {
   await runMigrations(db(), migrationsPath, '__drizzle_migrations_auth');
   await initializeEmailChallengesForTests();
   await db().execute(
-    sql`TRUNCATE auth_outbox, auth_password_resets, auth_rate_limits, auth_refresh_tokens, auth_users CASCADE`,
+    sql`TRUNCATE auth_admin_grants, auth_outbox, auth_password_resets, auth_rate_limits, auth_refresh_tokens, auth_users CASCADE`,
   );
 
   closeDb();