@shipfox/api-auth 9.1.0 → 9.2.0

package/dist/presentation/inter-module.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/presentation/inter-module.ts"],"sourcesContent":["import {authInterModuleContract} from '@shipfox/api-auth-dto/inter-module';\nimport {defineInterModulePresentation, type InterModulePresentation} from '@shipfox/inter-module';\nimport {issueJobLeaseToken} from '#core/job-lease-token.js';\nimport {issueRunnerSessionToken} from '#core/runner-session-token.js';\n\nexport function createAuthInterModulePresentation(): InterModulePresentation<\n  typeof authInterModuleContract\n> {\n  return defineInterModulePresentation(authInterModuleContract, {\n    mintRunnerSessionToken: async (claims) => ({token: await issueRunnerSessionToken(claims)}),\n    mintJobLeaseToken: async (claims) => ({token: await issueJobLeaseToken(claims)}),\n  });\n}\n"],"names":["authInterModuleContract","defineInterModulePresentation","issueJobLeaseToken","issueRunnerSessionToken","createAuthInterModulePresentation","mintRunnerSessionToken","claims","token","mintJobLeaseToken"],"mappings":"AAAA,SAAQA,uBAAuB,QAAO,qCAAqC;AAC3E,SAAQC,6BAA6B,QAAqC,wBAAwB;AAClG,SAAQC,kBAAkB,QAAO,2BAA2B;AAC5D,SAAQC,uBAAuB,QAAO,gCAAgC;AAEtE,OAAO,SAASC;IAGd,OAAOH,8BAA8BD,yBAAyB;QAC5DK,wBAAwB,OAAOC,SAAY,CAAA;gBAACC,OAAO,MAAMJ,wBAAwBG;YAAO,CAAA;QACxFE,mBAAmB,OAAOF,SAAY,CAAA;gBAACC,OAAO,MAAML,mBAAmBI;YAAO,CAAA;IAChF;AACF"}
+{"version":3,"sources":["../../src/presentation/inter-module.ts"],"sourcesContent":["import {authInterModuleContract} from '@shipfox/api-auth-dto/inter-module';\nimport {\n  createInterModuleKnownError,\n  defineInterModulePresentation,\n  type InterModulePresentation,\n} from '@shipfox/inter-module';\nimport {getCurrentAdminRole, requireAdminRole} from '#core/admin-role.js';\nimport {AdminRoleRequiredError} from '#core/errors.js';\nimport {issueJobLeaseToken} from '#core/job-lease-token.js';\nimport {issueRunnerSessionToken} from '#core/runner-session-token.js';\n\nexport function createAuthInterModulePresentation(): InterModulePresentation<\n  typeof authInterModuleContract\n> {\n  return defineInterModulePresentation(authInterModuleContract, {\n    mintRunnerSessionToken: async (claims) => ({token: await issueRunnerSessionToken(claims)}),\n    mintJobLeaseToken: async (claims) => ({token: await issueJobLeaseToken(claims)}),\n    getCurrentAdminRole: async ({userId}) => ({role: await getCurrentAdminRole({userId})}),\n    requireAdminRole: async ({userId, minimumRole}) => {\n      try {\n        return {role: await requireAdminRole({userId, minimumRole})};\n      } catch (error) {\n        if (error instanceof AdminRoleRequiredError) {\n          throw createInterModuleKnownError(\n            authInterModuleContract.methods.requireAdminRole,\n            'admin-role-required',\n            {requiredRole: error.minimumRole},\n          );\n        }\n        throw error;\n      }\n    },\n  });\n}\n"],"names":["authInterModuleContract","createInterModuleKnownError","defineInterModulePresentation","getCurrentAdminRole","requireAdminRole","AdminRoleRequiredError","issueJobLeaseToken","issueRunnerSessionToken","createAuthInterModulePresentation","mintRunnerSessionToken","claims","token","mintJobLeaseToken","userId","role","minimumRole","error","methods","requiredRole"],"mappings":"AAAA,SAAQA,uBAAuB,QAAO,qCAAqC;AAC3E,SACEC,2BAA2B,EAC3BC,6BAA6B,QAExB,wBAAwB;AAC/B,SAAQC,mBAAmB,EAAEC,gBAAgB,QAAO,sBAAsB;AAC1E,SAAQC,sBAAsB,QAAO,kBAAkB;AACvD,SAAQC,kBAAkB,QAAO,2BAA2B;AAC5D,SAAQC,uBAAuB,QAAO,gCAAgC;AAEtE,OAAO,SAASC;IAGd,OAAON,8BAA8BF,yBAAyB;QAC5DS,wBAAwB,OAAOC,SAAY,CAAA;gBAACC,OAAO,MAAMJ,wBAAwBG;YAAO,CAAA;QACxFE,mBAAmB,OAAOF,SAAY,CAAA;gBAACC,OAAO,MAAML,mBAAmBI;YAAO,CAAA;QAC9EP,qBAAqB,OAAO,EAACU,MAAM,EAAC,GAAM,CAAA;gBAACC,MAAM,MAAMX,oBAAoB;oBAACU;gBAAM;YAAE,CAAA;QACpFT,kBAAkB,OAAO,EAACS,MAAM,EAAEE,WAAW,EAAC;YAC5C,IAAI;gBACF,OAAO;oBAACD,MAAM,MAAMV,iBAAiB;wBAACS;wBAAQE;oBAAW;gBAAE;YAC7D,EAAE,OAAOC,OAAO;gBACd,IAAIA,iBAAiBX,wBAAwB;oBAC3C,MAAMJ,4BACJD,wBAAwBiB,OAAO,CAACb,gBAAgB,EAChD,uBACA;wBAACc,cAAcF,MAAMD,WAAW;oBAAA;gBAEpC;gBACA,MAAMC;YACR;QACF;IACF;AACF"}

package/dist/presentation/routes/index.d.ts

@@ -1,4 +1,5 @@
 import type { WorkspacesInterModuleClient } from '@shipfox/api-workspaces-dto/inter-module';
 import type { RouteGroup } from '@shipfox/node-fastify';
-export declare function buildAuthRoutes(passwordEnabled: boolean, workspaces: WorkspacesInterModuleClient): RouteGroup;
+import type { SignupPolicy } from '#core/ports.js';
+export declare function buildAuthRoutes(passwordEnabled: boolean, workspaces: WorkspacesInterModuleClient, signupPolicy?: SignupPolicy): RouteGroup;
 //# sourceMappingURL=index.d.ts.map

package/dist/presentation/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAC1F,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAatD,wBAAgB,eAAe,CAC7B,eAAe,EAAE,OAAO,EACxB,UAAU,EAAE,2BAA2B,GACtC,UAAU,CA2BZ"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAC1F,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAajD,wBAAgB,eAAe,CAC7B,eAAe,EAAE,OAAO,EACxB,UAAU,EAAE,2BAA2B,EACvC,YAAY,CAAC,EAAE,YAAY,GAC1B,UAAU,CA2BZ"}

package/dist/presentation/routes/index.js

@@ -9,9 +9,9 @@ import { createLoginRoute } from './session/login.js';
 import { logoutRoute } from './session/logout.js';
 import { meRoute } from './session/me.js';
 import { createRefreshRoute } from './session/refresh.js';
-export function buildAuthRoutes(passwordEnabled, workspaces) {
+export function buildAuthRoutes(passwordEnabled, workspaces, signupPolicy) {
     const passwordRoutes = passwordEnabled ? [
-        createSignupRoute(workspaces),
+        createSignupRoute(workspaces, signupPolicy),
         createVerifyEmailConfirmRoute(workspaces),
         verifyEmailResendRoute,
         createLoginRoute(workspaces)

package/dist/presentation/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/index.ts"],"sourcesContent":["import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport {authCookiePlugin} from '#presentation/auth/refresh-cookie.js';\nimport {createVerifyEmailConfirmRoute} from './email-verification/verify-email-confirm.js';\nimport {verifyEmailResendRoute} from './email-verification/verify-email-resend.js';\nimport {changePasswordRoute} from './password/change-password.js';\nimport {createPasswordResetConfirmRoute} from './password/password-reset-confirm.js';\nimport {passwordResetRequestRoute} from './password/password-reset-request.js';\nimport {createSignupRoute} from './registration/signup.js';\nimport {createLoginRoute} from './session/login.js';\nimport {logoutRoute} from './session/logout.js';\nimport {meRoute} from './session/me.js';\nimport {createRefreshRoute} from './session/refresh.js';\n\nexport function buildAuthRoutes(\n  passwordEnabled: boolean,\n  workspaces: WorkspacesInterModuleClient,\n): RouteGroup {\n  const passwordRoutes = passwordEnabled\n    ? [\n        createSignupRoute(workspaces),\n        createVerifyEmailConfirmRoute(workspaces),\n        verifyEmailResendRoute,\n        createLoginRoute(workspaces),\n      ]\n    : [];\n\n  return {\n    prefix: '/auth',\n    plugins: [authCookiePlugin],\n    routes: [\n      ...passwordRoutes,\n      createRefreshRoute(workspaces),\n      logoutRoute,\n      meRoute,\n      ...(passwordEnabled\n        ? [\n            changePasswordRoute,\n            passwordResetRequestRoute,\n            createPasswordResetConfirmRoute(workspaces),\n          ]\n        : []),\n    ],\n  };\n}\n"],"names":["authCookiePlugin","createVerifyEmailConfirmRoute","verifyEmailResendRoute","changePasswordRoute","createPasswordResetConfirmRoute","passwordResetRequestRoute","createSignupRoute","createLoginRoute","logoutRoute","meRoute","createRefreshRoute","buildAuthRoutes","passwordEnabled","workspaces","passwordRoutes","prefix","plugins","routes"],"mappings":"AAEA,SAAQA,gBAAgB,QAAO,uCAAuC;AACtE,SAAQC,6BAA6B,QAAO,+CAA+C;AAC3F,SAAQC,sBAAsB,QAAO,8CAA8C;AACnF,SAAQC,mBAAmB,QAAO,gCAAgC;AAClE,SAAQC,+BAA+B,QAAO,uCAAuC;AACrF,SAAQC,yBAAyB,QAAO,uCAAuC;AAC/E,SAAQC,iBAAiB,QAAO,2BAA2B;AAC3D,SAAQC,gBAAgB,QAAO,qBAAqB;AACpD,SAAQC,WAAW,QAAO,sBAAsB;AAChD,SAAQC,OAAO,QAAO,kBAAkB;AACxC,SAAQC,kBAAkB,QAAO,uBAAuB;AAExD,OAAO,SAASC,gBACdC,eAAwB,EACxBC,UAAuC;IAEvC,MAAMC,iBAAiBF,kBACnB;QACEN,kBAAkBO;QAClBZ,8BAA8BY;QAC9BX;QACAK,iBAAiBM;KAClB,GACD,EAAE;IAEN,OAAO;QACLE,QAAQ;QACRC,SAAS;YAAChB;SAAiB;QAC3BiB,QAAQ;eACHH;YACHJ,mBAAmBG;YACnBL;YACAC;eACIG,kBACA;gBACET;gBACAE;gBACAD,gCAAgCS;aACjC,GACD,EAAE;SACP;IACH;AACF"}
+{"version":3,"sources":["../../../src/presentation/routes/index.ts"],"sourcesContent":["import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {authCookiePlugin} from '#presentation/auth/refresh-cookie.js';\nimport {createVerifyEmailConfirmRoute} from './email-verification/verify-email-confirm.js';\nimport {verifyEmailResendRoute} from './email-verification/verify-email-resend.js';\nimport {changePasswordRoute} from './password/change-password.js';\nimport {createPasswordResetConfirmRoute} from './password/password-reset-confirm.js';\nimport {passwordResetRequestRoute} from './password/password-reset-request.js';\nimport {createSignupRoute} from './registration/signup.js';\nimport {createLoginRoute} from './session/login.js';\nimport {logoutRoute} from './session/logout.js';\nimport {meRoute} from './session/me.js';\nimport {createRefreshRoute} from './session/refresh.js';\n\nexport function buildAuthRoutes(\n  passwordEnabled: boolean,\n  workspaces: WorkspacesInterModuleClient,\n  signupPolicy?: SignupPolicy,\n): RouteGroup {\n  const passwordRoutes = passwordEnabled\n    ? [\n        createSignupRoute(workspaces, signupPolicy),\n        createVerifyEmailConfirmRoute(workspaces),\n        verifyEmailResendRoute,\n        createLoginRoute(workspaces),\n      ]\n    : [];\n\n  return {\n    prefix: '/auth',\n    plugins: [authCookiePlugin],\n    routes: [\n      ...passwordRoutes,\n      createRefreshRoute(workspaces),\n      logoutRoute,\n      meRoute,\n      ...(passwordEnabled\n        ? [\n            changePasswordRoute,\n            passwordResetRequestRoute,\n            createPasswordResetConfirmRoute(workspaces),\n          ]\n        : []),\n    ],\n  };\n}\n"],"names":["authCookiePlugin","createVerifyEmailConfirmRoute","verifyEmailResendRoute","changePasswordRoute","createPasswordResetConfirmRoute","passwordResetRequestRoute","createSignupRoute","createLoginRoute","logoutRoute","meRoute","createRefreshRoute","buildAuthRoutes","passwordEnabled","workspaces","signupPolicy","passwordRoutes","prefix","plugins","routes"],"mappings":"AAGA,SAAQA,gBAAgB,QAAO,uCAAuC;AACtE,SAAQC,6BAA6B,QAAO,+CAA+C;AAC3F,SAAQC,sBAAsB,QAAO,8CAA8C;AACnF,SAAQC,mBAAmB,QAAO,gCAAgC;AAClE,SAAQC,+BAA+B,QAAO,uCAAuC;AACrF,SAAQC,yBAAyB,QAAO,uCAAuC;AAC/E,SAAQC,iBAAiB,QAAO,2BAA2B;AAC3D,SAAQC,gBAAgB,QAAO,qBAAqB;AACpD,SAAQC,WAAW,QAAO,sBAAsB;AAChD,SAAQC,OAAO,QAAO,kBAAkB;AACxC,SAAQC,kBAAkB,QAAO,uBAAuB;AAExD,OAAO,SAASC,gBACdC,eAAwB,EACxBC,UAAuC,EACvCC,YAA2B;IAE3B,MAAMC,iBAAiBH,kBACnB;QACEN,kBAAkBO,YAAYC;QAC9Bb,8BAA8BY;QAC9BX;QACAK,iBAAiBM;KAClB,GACD,EAAE;IAEN,OAAO;QACLG,QAAQ;QACRC,SAAS;YAACjB;SAAiB;QAC3BkB,QAAQ;eACHH;YACHL,mBAAmBG;YACnBL;YACAC;eACIG,kBACA;gBACET;gBACAE;gBACAD,gCAAgCS;aACjC,GACD,EAAE;SACP;IACH;AACF"}

package/dist/presentation/routes/registration/signup.d.ts

@@ -1,3 +1,4 @@
 import type { WorkspacesInterModuleClient } from '@shipfox/api-workspaces-dto/inter-module';
-export declare function createSignupRoute(workspaces: WorkspacesInterModuleClient): import("@shipfox/node-fastify").RouteDefinition;
+import type { SignupPolicy } from '#core/ports.js';
+export declare function createSignupRoute(workspaces: WorkspacesInterModuleClient, signupPolicy?: SignupPolicy): import("@shipfox/node-fastify").RouteDefinition;
 //# sourceMappingURL=signup.d.ts.map

package/dist/presentation/routes/registration/signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/registration/signup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAa1F,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,2BAA2B,mDAoFxE"}
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/registration/signup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAW1F,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAMjD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,2BAA2B,EACvC,YAAY,CAAC,EAAE,YAAY,mDAkG5B"}

package/dist/presentation/routes/registration/signup.js

@@ -2,10 +2,11 @@ import { signupBodySchema, signupResponseSchema } from '@shipfox/api-auth-dto';
 import { EmailChallengeError } from '@shipfox/api-email-challenges';
 import { ClientError, defineRoute } from '@shipfox/node-fastify';
 import { signup, signupWithInvitation } from '#core/auth.js';
-import { EmailTakenError, InvitationEmailMismatchError, TokenAlreadyUsedError, TokenExpiredError, TokenInvalidError } from '#core/errors.js';
+import { EmailTakenError, InvitationEmailMismatchError, SignupNotAllowedError, TokenAlreadyUsedError, TokenExpiredError, TokenInvalidError } from '#core/errors.js';
 import { setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
 import { toUserDto } from '#presentation/dto/user.js';
-export function createSignupRoute(workspaces) {
+const SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH = 500;
+export function createSignupRoute(workspaces, signupPolicy) {
     return defineRoute({
         method: 'POST',
         path: '/signup',
@@ -32,6 +33,15 @@ export function createSignupRoute(workspaces) {
                     status: 409
                 });
             }
+            if (error instanceof SignupNotAllowedError) {
+                const message = error.message.slice(0, SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH);
+                throw new ClientError(message, 'signup-not-allowed', {
+                    status: 403,
+                    details: {
+                        message
+                    }
+                });
+            }
             if (error instanceof TokenInvalidError) {
                 throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {
                     status: 410
@@ -61,7 +71,8 @@ export function createSignupRoute(workspaces) {
                     email,
                     password,
                     name,
-                    sourceIp: request.ip
+                    sourceIp: request.ip,
+                    signupPolicy
                 });
                 reply.code(201);
                 return {

package/dist/presentation/routes/registration/signup.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/presentation/routes/registration/signup.ts"],"sourcesContent":["import {signupBodySchema, signupResponseSchema} from '@shipfox/api-auth-dto';\nimport {EmailChallengeError} from '@shipfox/api-email-challenges';\nimport type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {signup, signupWithInvitation} from '#core/auth.js';\nimport {\n  EmailTakenError,\n  InvitationEmailMismatchError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n} from '#core/errors.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nexport function createSignupRoute(workspaces: WorkspacesInterModuleClient) {\n  return defineRoute({\n    method: 'POST',\n    path: '/signup',\n    description:\n      'Create a user account. Sends a verification email unless an invitation token is supplied.',\n    schema: {\n      body: signupBodySchema,\n      response: {\n        201: signupResponseSchema,\n      },\n    },\n    errorHandler: (error) => {\n      if (error instanceof EmailChallengeError) {\n        throw new ClientError(error.message, `email-challenge-${error.code}`, {\n          status: error.code === 'limited' ? 429 : 400,\n          ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),\n        });\n      }\n      if (error instanceof EmailTakenError) {\n        throw new ClientError('Email already registered', 'email-taken', {status: 409});\n      }\n      if (error instanceof TokenInvalidError) {\n        throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenAlreadyUsedError) {\n        throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenExpiredError) {\n        throw new ClientError('Invitation has expired', 'invitation-token-expired', {\n          status: 410,\n        });\n      }\n      if (error instanceof InvitationEmailMismatchError) {\n        throw new ClientError(\n          'Signup email does not match the invitation',\n          'invitation-email-mismatch',\n          {status: 403},\n        );\n      }\n      throw error;\n    },\n    handler: async (request, reply) => {\n      const {email, password, name, invitation_token} = request.body;\n\n      if (invitation_token === undefined) {\n        const result = await signup({email, password, name, sourceIp: request.ip});\n        reply.code(201);\n        return {\n          user: toUserDto(result),\n          email_challenge: {\n            id: result.emailChallenge.id,\n            next_resend_available_at: result.emailChallenge.nextResendAvailableAt.toISOString(),\n          },\n        };\n      }\n\n      const result = await signupWithInvitation({\n        email,\n        password,\n        name,\n        invitationToken: invitation_token,\n        workspaces,\n      });\n      setRefreshTokenCookie(reply, result.refreshToken);\n      reply.code(201);\n      return {\n        user: toUserDto(result.user),\n        token: result.token,\n        membership: result.membership\n          ? {\n              id: result.membership.id,\n              user_id: result.membership.userId,\n              workspace_id: result.membership.workspaceId,\n            }\n          : null,\n        ...(result.acceptError ? {accept_error: result.acceptError} : {}),\n      };\n    },\n  });\n}\n"],"names":["signupBodySchema","signupResponseSchema","EmailChallengeError","ClientError","defineRoute","signup","signupWithInvitation","EmailTakenError","InvitationEmailMismatchError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","setRefreshTokenCookie","toUserDto","createSignupRoute","workspaces","method","path","description","schema","body","response","errorHandler","error","message","code","status","retryAt","details","retry_at","toISOString","handler","request","reply","email","password","name","invitation_token","undefined","result","sourceIp","ip","user","email_challenge","id","emailChallenge","next_resend_available_at","nextResendAvailableAt","invitationToken","refreshToken","token","membership","user_id","userId","workspace_id","workspaceId","acceptError","accept_error"],"mappings":"AAAA,SAAQA,gBAAgB,EAAEC,oBAAoB,QAAO,wBAAwB;AAC7E,SAAQC,mBAAmB,QAAO,gCAAgC;AAElE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,gBAAgB;AAC3D,SACEC,eAAe,EACfC,4BAA4B,EAC5BC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,OAAO,SAASC,kBAAkBC,UAAuC;IACvE,OAAOX,YAAY;QACjBY,QAAQ;QACRC,MAAM;QACNC,aACE;QACFC,QAAQ;YACNC,MAAMpB;YACNqB,UAAU;gBACR,KAAKpB;YACP;QACF;QACAqB,cAAc,CAACC;YACb,IAAIA,iBAAiBrB,qBAAqB;gBACxC,MAAM,IAAIC,YAAYoB,MAAMC,OAAO,EAAE,CAAC,gBAAgB,EAAED,MAAME,IAAI,EAAE,EAAE;oBACpEC,QAAQH,MAAME,IAAI,KAAK,YAAY,MAAM;oBACzC,GAAIF,MAAMI,OAAO,GAAG;wBAACC,SAAS;4BAACC,UAAUN,MAAMI,OAAO,CAACG,WAAW;wBAAE;oBAAC,IAAI,CAAC,CAAC;gBAC7E;YACF;YACA,IAAIP,iBAAiBhB,iBAAiB;gBACpC,MAAM,IAAIJ,YAAY,4BAA4B,eAAe;oBAACuB,QAAQ;gBAAG;YAC/E;YACA,IAAIH,iBAAiBZ,mBAAmB;gBACtC,MAAM,IAAIR,YAAY,+BAA+B,4BAA4B;oBAC/EuB,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBd,uBAAuB;gBAC1C,MAAM,IAAIN,YAAY,wCAAwC,yBAAyB;oBACrFuB,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBb,mBAAmB;gBACtC,MAAM,IAAIP,YAAY,0BAA0B,4BAA4B;oBAC1EuB,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBf,8BAA8B;gBACjD,MAAM,IAAIL,YACR,8CACA,6BACA;oBAACuB,QAAQ;gBAAG;YAEhB;YACA,MAAMH;QACR;QACAQ,SAAS,OAAOC,SAASC;YACvB,MAAM,EAACC,KAAK,EAAEC,QAAQ,EAAEC,IAAI,EAAEC,gBAAgB,EAAC,GAAGL,QAAQZ,IAAI;YAE9D,IAAIiB,qBAAqBC,WAAW;gBAClC,MAAMC,SAAS,MAAMlC,OAAO;oBAAC6B;oBAAOC;oBAAUC;oBAAMI,UAAUR,QAAQS,EAAE;gBAAA;gBACxER,MAAMR,IAAI,CAAC;gBACX,OAAO;oBACLiB,MAAM7B,UAAU0B;oBAChBI,iBAAiB;wBACfC,IAAIL,OAAOM,cAAc,CAACD,EAAE;wBAC5BE,0BAA0BP,OAAOM,cAAc,CAACE,qBAAqB,CAACjB,WAAW;oBACnF;gBACF;YACF;YAEA,MAAMS,SAAS,MAAMjC,qBAAqB;gBACxC4B;gBACAC;gBACAC;gBACAY,iBAAiBX;gBACjBtB;YACF;YACAH,sBAAsBqB,OAAOM,OAAOU,YAAY;YAChDhB,MAAMR,IAAI,CAAC;YACX,OAAO;gBACLiB,MAAM7B,UAAU0B,OAAOG,IAAI;gBAC3BQ,OAAOX,OAAOW,KAAK;gBACnBC,YAAYZ,OAAOY,UAAU,GACzB;oBACEP,IAAIL,OAAOY,UAAU,CAACP,EAAE;oBACxBQ,SAASb,OAAOY,UAAU,CAACE,MAAM;oBACjCC,cAAcf,OAAOY,UAAU,CAACI,WAAW;gBAC7C,IACA;gBACJ,GAAIhB,OAAOiB,WAAW,GAAG;oBAACC,cAAclB,OAAOiB,WAAW;gBAAA,IAAI,CAAC,CAAC;YAClE;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../../src/presentation/routes/registration/signup.ts"],"sourcesContent":["import {signupBodySchema, signupResponseSchema} from '@shipfox/api-auth-dto';\nimport {EmailChallengeError} from '@shipfox/api-email-challenges';\nimport type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {signup, signupWithInvitation} from '#core/auth.js';\nimport {\n  EmailTakenError,\n  InvitationEmailMismatchError,\n  SignupNotAllowedError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n} from '#core/errors.js';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nconst SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH = 500;\n\nexport function createSignupRoute(\n  workspaces: WorkspacesInterModuleClient,\n  signupPolicy?: SignupPolicy,\n) {\n  return defineRoute({\n    method: 'POST',\n    path: '/signup',\n    description:\n      'Create a user account. Sends a verification email unless an invitation token is supplied.',\n    schema: {\n      body: signupBodySchema,\n      response: {\n        201: signupResponseSchema,\n      },\n    },\n    errorHandler: (error) => {\n      if (error instanceof EmailChallengeError) {\n        throw new ClientError(error.message, `email-challenge-${error.code}`, {\n          status: error.code === 'limited' ? 429 : 400,\n          ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),\n        });\n      }\n      if (error instanceof EmailTakenError) {\n        throw new ClientError('Email already registered', 'email-taken', {status: 409});\n      }\n      if (error instanceof SignupNotAllowedError) {\n        const message = error.message.slice(0, SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH);\n        throw new ClientError(message, 'signup-not-allowed', {\n          status: 403,\n          details: {message},\n        });\n      }\n      if (error instanceof TokenInvalidError) {\n        throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenAlreadyUsedError) {\n        throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenExpiredError) {\n        throw new ClientError('Invitation has expired', 'invitation-token-expired', {\n          status: 410,\n        });\n      }\n      if (error instanceof InvitationEmailMismatchError) {\n        throw new ClientError(\n          'Signup email does not match the invitation',\n          'invitation-email-mismatch',\n          {status: 403},\n        );\n      }\n      throw error;\n    },\n    handler: async (request, reply) => {\n      const {email, password, name, invitation_token} = request.body;\n\n      if (invitation_token === undefined) {\n        const result = await signup({\n          email,\n          password,\n          name,\n          sourceIp: request.ip,\n          signupPolicy,\n        });\n        reply.code(201);\n        return {\n          user: toUserDto(result),\n          email_challenge: {\n            id: result.emailChallenge.id,\n            next_resend_available_at: result.emailChallenge.nextResendAvailableAt.toISOString(),\n          },\n        };\n      }\n\n      const result = await signupWithInvitation({\n        email,\n        password,\n        name,\n        invitationToken: invitation_token,\n        workspaces,\n      });\n      setRefreshTokenCookie(reply, result.refreshToken);\n      reply.code(201);\n      return {\n        user: toUserDto(result.user),\n        token: result.token,\n        membership: result.membership\n          ? {\n              id: result.membership.id,\n              user_id: result.membership.userId,\n              workspace_id: result.membership.workspaceId,\n            }\n          : null,\n        ...(result.acceptError ? {accept_error: result.acceptError} : {}),\n      };\n    },\n  });\n}\n"],"names":["signupBodySchema","signupResponseSchema","EmailChallengeError","ClientError","defineRoute","signup","signupWithInvitation","EmailTakenError","InvitationEmailMismatchError","SignupNotAllowedError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","setRefreshTokenCookie","toUserDto","SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH","createSignupRoute","workspaces","signupPolicy","method","path","description","schema","body","response","errorHandler","error","message","code","status","retryAt","details","retry_at","toISOString","slice","handler","request","reply","email","password","name","invitation_token","undefined","result","sourceIp","ip","user","email_challenge","id","emailChallenge","next_resend_available_at","nextResendAvailableAt","invitationToken","refreshToken","token","membership","user_id","userId","workspace_id","workspaceId","acceptError","accept_error"],"mappings":"AAAA,SAAQA,gBAAgB,EAAEC,oBAAoB,QAAO,wBAAwB;AAC7E,SAAQC,mBAAmB,QAAO,gCAAgC;AAElE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,gBAAgB;AAC3D,SACEC,eAAe,EACfC,4BAA4B,EAC5BC,qBAAqB,EACrBC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,QACZ,kBAAkB;AAEzB,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,MAAMC,wCAAwC;AAE9C,OAAO,SAASC,kBACdC,UAAuC,EACvCC,YAA2B;IAE3B,OAAOd,YAAY;QACjBe,QAAQ;QACRC,MAAM;QACNC,aACE;QACFC,QAAQ;YACNC,MAAMvB;YACNwB,UAAU;gBACR,KAAKvB;YACP;QACF;QACAwB,cAAc,CAACC;YACb,IAAIA,iBAAiBxB,qBAAqB;gBACxC,MAAM,IAAIC,YAAYuB,MAAMC,OAAO,EAAE,CAAC,gBAAgB,EAAED,MAAME,IAAI,EAAE,EAAE;oBACpEC,QAAQH,MAAME,IAAI,KAAK,YAAY,MAAM;oBACzC,GAAIF,MAAMI,OAAO,GAAG;wBAACC,SAAS;4BAACC,UAAUN,MAAMI,OAAO,CAACG,WAAW;wBAAE;oBAAC,IAAI,CAAC,CAAC;gBAC7E;YACF;YACA,IAAIP,iBAAiBnB,iBAAiB;gBACpC,MAAM,IAAIJ,YAAY,4BAA4B,eAAe;oBAAC0B,QAAQ;gBAAG;YAC/E;YACA,IAAIH,iBAAiBjB,uBAAuB;gBAC1C,MAAMkB,UAAUD,MAAMC,OAAO,CAACO,KAAK,CAAC,GAAGnB;gBACvC,MAAM,IAAIZ,YAAYwB,SAAS,sBAAsB;oBACnDE,QAAQ;oBACRE,SAAS;wBAACJ;oBAAO;gBACnB;YACF;YACA,IAAID,iBAAiBd,mBAAmB;gBACtC,MAAM,IAAIT,YAAY,+BAA+B,4BAA4B;oBAC/E0B,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBhB,uBAAuB;gBAC1C,MAAM,IAAIP,YAAY,wCAAwC,yBAAyB;oBACrF0B,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBf,mBAAmB;gBACtC,MAAM,IAAIR,YAAY,0BAA0B,4BAA4B;oBAC1E0B,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBlB,8BAA8B;gBACjD,MAAM,IAAIL,YACR,8CACA,6BACA;oBAAC0B,QAAQ;gBAAG;YAEhB;YACA,MAAMH;QACR;QACAS,SAAS,OAAOC,SAASC;YACvB,MAAM,EAACC,KAAK,EAAEC,QAAQ,EAAEC,IAAI,EAAEC,gBAAgB,EAAC,GAAGL,QAAQb,IAAI;YAE9D,IAAIkB,qBAAqBC,WAAW;gBAClC,MAAMC,SAAS,MAAMtC,OAAO;oBAC1BiC;oBACAC;oBACAC;oBACAI,UAAUR,QAAQS,EAAE;oBACpB3B;gBACF;gBACAmB,MAAMT,IAAI,CAAC;gBACX,OAAO;oBACLkB,MAAMhC,UAAU6B;oBAChBI,iBAAiB;wBACfC,IAAIL,OAAOM,cAAc,CAACD,EAAE;wBAC5BE,0BAA0BP,OAAOM,cAAc,CAACE,qBAAqB,CAAClB,WAAW;oBACnF;gBACF;YACF;YAEA,MAAMU,SAAS,MAAMrC,qBAAqB;gBACxCgC;gBACAC;gBACAC;gBACAY,iBAAiBX;gBACjBxB;YACF;YACAJ,sBAAsBwB,OAAOM,OAAOU,YAAY;YAChDhB,MAAMT,IAAI,CAAC;YACX,OAAO;gBACLkB,MAAMhC,UAAU6B,OAAOG,IAAI;gBAC3BQ,OAAOX,OAAOW,KAAK;gBACnBC,YAAYZ,OAAOY,UAAU,GACzB;oBACEP,IAAIL,OAAOY,UAAU,CAACP,EAAE;oBACxBQ,SAASb,OAAOY,UAAU,CAACE,MAAM;oBACjCC,cAAcf,OAAOY,UAAU,CAACI,WAAW;gBAC7C,IACA;gBACJ,GAAIhB,OAAOiB,WAAW,GAAG;oBAACC,cAAclB,OAAOiB,WAAW;gBAAA,IAAI,CAAC,CAAC;YAClE;QACF;IACF;AACF"}

package/dist/presentation/routes/session/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/session/me.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,OAAO,iDA0BlB,CAAC"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/session/me.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,OAAO,iDA6BlB,CAAC"}

package/dist/presentation/routes/session/me.js

@@ -1,6 +1,7 @@
 import { AUTH_USER } from '@shipfox/api-auth-context';
 import { meResponseSchema } from '@shipfox/api-auth-dto';
 import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { getCurrentAdminRole } from '#core/admin-role.js';
 import { getCurrentUser } from '#core/auth.js';
 import { UserNotFoundError } from '#core/errors.js';
 import { getClientContext } from '#presentation/auth/jwt-auth.js';
@@ -34,7 +35,10 @@ export const meRoute = defineRoute({
             userId: client.userId
         });
         return {
-            user: toUserDto(result.user)
+            user: toUserDto(result.user),
+            admin_role: await getCurrentAdminRole({
+                userId: client.userId
+            })
         };
     }
 });

package/dist/presentation/routes/session/me.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/presentation/routes/session/me.ts"],"sourcesContent":["import {AUTH_USER} from '@shipfox/api-auth-context';\nimport {meResponseSchema} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {getCurrentUser} from '#core/auth.js';\nimport {UserNotFoundError} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nexport const meRoute = defineRoute({\n  method: 'GET',\n  path: '/me',\n  description: 'Get the signed-in user.',\n  auth: AUTH_USER,\n  schema: {\n    response: {\n      200: meResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof UserNotFoundError) {\n      throw new ClientError('User not found', 'not-found', {status: 404});\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const client = getClientContext(request);\n    if (!client) {\n      throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n    }\n\n    const result = await getCurrentUser({userId: client.userId});\n\n    return {user: toUserDto(result.user)};\n  },\n});\n"],"names":["AUTH_USER","meResponseSchema","ClientError","defineRoute","getCurrentUser","UserNotFoundError","getClientContext","toUserDto","meRoute","method","path","description","auth","schema","response","errorHandler","error","status","handler","request","client","result","userId","user"],"mappings":"AAAA,SAAQA,SAAS,QAAO,4BAA4B;AACpD,SAAQC,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,cAAc,QAAO,gBAAgB;AAC7C,SAAQC,iBAAiB,QAAO,kBAAkB;AAClD,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,OAAO,MAAMC,UAAUL,YAAY;IACjCM,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,MAAMZ;IACNa,QAAQ;QACNC,UAAU;YACR,KAAKb;QACP;IACF;IACAc,cAAc,CAACC;QACb,IAAIA,iBAAiBX,mBAAmB;YACtC,MAAM,IAAIH,YAAY,kBAAkB,aAAa;gBAACe,QAAQ;YAAG;QACnE;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC;QACd,MAAMC,SAASd,iBAAiBa;QAChC,IAAI,CAACC,QAAQ;YACX,MAAM,IAAIlB,YAAY,2BAA2B,gBAAgB;gBAACe,QAAQ;YAAG;QAC/E;QAEA,MAAMI,SAAS,MAAMjB,eAAe;YAACkB,QAAQF,OAAOE,MAAM;QAAA;QAE1D,OAAO;YAACC,MAAMhB,UAAUc,OAAOE,IAAI;QAAC;IACtC;AACF,GAAG"}
+{"version":3,"sources":["../../../../src/presentation/routes/session/me.ts"],"sourcesContent":["import {AUTH_USER} from '@shipfox/api-auth-context';\nimport {meResponseSchema} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {getCurrentAdminRole} from '#core/admin-role.js';\nimport {getCurrentUser} from '#core/auth.js';\nimport {UserNotFoundError} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nexport const meRoute = defineRoute({\n  method: 'GET',\n  path: '/me',\n  description: 'Get the signed-in user.',\n  auth: AUTH_USER,\n  schema: {\n    response: {\n      200: meResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof UserNotFoundError) {\n      throw new ClientError('User not found', 'not-found', {status: 404});\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const client = getClientContext(request);\n    if (!client) {\n      throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n    }\n\n    const result = await getCurrentUser({userId: client.userId});\n\n    return {\n      user: toUserDto(result.user),\n      admin_role: await getCurrentAdminRole({userId: client.userId}),\n    };\n  },\n});\n"],"names":["AUTH_USER","meResponseSchema","ClientError","defineRoute","getCurrentAdminRole","getCurrentUser","UserNotFoundError","getClientContext","toUserDto","meRoute","method","path","description","auth","schema","response","errorHandler","error","status","handler","request","client","result","userId","user","admin_role"],"mappings":"AAAA,SAAQA,SAAS,QAAO,4BAA4B;AACpD,SAAQC,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,mBAAmB,QAAO,sBAAsB;AACxD,SAAQC,cAAc,QAAO,gBAAgB;AAC7C,SAAQC,iBAAiB,QAAO,kBAAkB;AAClD,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,OAAO,MAAMC,UAAUN,YAAY;IACjCO,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,MAAMb;IACNc,QAAQ;QACNC,UAAU;YACR,KAAKd;QACP;IACF;IACAe,cAAc,CAACC;QACb,IAAIA,iBAAiBX,mBAAmB;YACtC,MAAM,IAAIJ,YAAY,kBAAkB,aAAa;gBAACgB,QAAQ;YAAG;QACnE;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC;QACd,MAAMC,SAASd,iBAAiBa;QAChC,IAAI,CAACC,QAAQ;YACX,MAAM,IAAInB,YAAY,2BAA2B,gBAAgB;gBAACgB,QAAQ;YAAG;QAC/E;QAEA,MAAMI,SAAS,MAAMjB,eAAe;YAACkB,QAAQF,OAAOE,MAAM;QAAA;QAE1D,OAAO;YACLC,MAAMhB,UAAUc,OAAOE,IAAI;YAC3BC,YAAY,MAAMrB,oBAAoB;gBAACmB,QAAQF,OAAOE,MAAM;YAAA;QAC9D;IACF;AACF,GAAG"}