@shipfox/api-auth 9.1.0 → 9.3.0

package/src/db/admin-grants.ts

@@ -0,0 +1,340 @@
+import type {AdminRole} from '@shipfox/api-auth-dto';
+import type {
+  AdministrationActionEvent,
+  AdministrationActionEventMap,
+} from '@shipfox/api-common-dto';
+import {writeOutboxEvent} from '@shipfox/node-outbox';
+import {and, asc, eq, isNull, sql} from 'drizzle-orm';
+import {highestAdminRole} from '#core/admin-role-model.js';
+import type {AdminGrant} from '#core/entities/admin-grant.js';
+import {
+  AdminBootstrapClosedError,
+  AdminGrantAlreadyExistsError,
+  AdminGrantNotFoundError,
+  AdminIdempotencyKeyReuseError,
+  LastAdminOwnerError,
+  UserNotFoundError,
+} from '#core/errors.js';
+import {db} from './db.js';
+import {
+  type AdminCommandResultDb,
+  adminCommandResults,
+  type StoredAdminGrant,
+} from './schema/admin-command-results.js';
+import {adminGrants, toAdminGrant} from './schema/admin-grants.js';
+import {authOutbox} from './schema/outbox.js';
+import {users} from './schema/users.js';
+
+type Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
+
+export interface CreateAdminGrantParams {
+  userId: string;
+  role: AdminRole;
+}
+
+export async function createAdminGrant(params: CreateAdminGrantParams): Promise<AdminGrant> {
+  const rows = await db()
+    .insert(adminGrants)
+    .values({userId: params.userId, role: params.role})
+    .returning();
+  const row = rows[0];
+  if (!row) throw new Error('Insert returned no rows');
+  return toAdminGrant(row);
+}
+
+export async function listAdminGrants(): Promise<AdminGrant[]> {
+  const rows = await db().select().from(adminGrants).orderBy(asc(adminGrants.createdAt));
+  return rows.map(toAdminGrant);
+}
+
+export async function findCurrentAdminRole(params: {userId: string}): Promise<AdminRole | null> {
+  const rows = await db()
+    .select({role: adminGrants.role})
+    .from(adminGrants)
+    .innerJoin(users, eq(adminGrants.userId, users.id))
+    .where(
+      and(
+        eq(adminGrants.userId, params.userId),
+        isNull(adminGrants.revokedAt),
+        eq(users.status, 'active'),
+      ),
+    );
+
+  return highestAdminRole(rows.map(({role}) => role));
+}
+
+export async function revokeAdminGrant(params: {grantId: string}): Promise<AdminGrant | undefined> {
+  return await db().transaction(async (tx) => {
+    // All owner grant changes share one lock so concurrent revocations cannot
+    // both observe the same final owner and leave the instance ownerless.
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+
+    const rows = await tx
+      .select()
+      .from(adminGrants)
+      .where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt)))
+      .limit(1);
+    const grant = rows[0];
+    if (!grant) return undefined;
+
+    if (grant.role === 'admin-owner') {
+      const activeOwners = await tx
+        .select({id: adminGrants.id})
+        .from(adminGrants)
+        .innerJoin(users, eq(adminGrants.userId, users.id))
+        .where(
+          and(
+            eq(adminGrants.role, 'admin-owner'),
+            isNull(adminGrants.revokedAt),
+            eq(users.status, 'active'),
+          ),
+        );
+      if (activeOwners.length <= 1) throw new LastAdminOwnerError();
+    }
+
+    const updated = await tx
+      .update(adminGrants)
+      .set({revokedAt: new Date(), updatedAt: new Date()})
+      .where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt)))
+      .returning();
+    const row = updated[0];
+    return row ? toAdminGrant(row) : undefined;
+  });
+}
+
+interface AuditedAdminCommandParams {
+  actorId: string;
+  idempotencyKeyFingerprint: string;
+  requestFingerprint: string;
+  event: AdministrationActionEvent;
+}
+
+function toStoredAdminGrant(grant: AdminGrant): StoredAdminGrant {
+  return {
+    id: grant.id,
+    userId: grant.userId,
+    role: grant.role,
+    revokedAt: grant.revokedAt?.toISOString() ?? null,
+    createdAt: grant.createdAt.toISOString(),
+    updatedAt: grant.updatedAt.toISOString(),
+  };
+}
+
+function fromStoredAdminGrant(grant: StoredAdminGrant): AdminGrant {
+  return {
+    id: grant.id,
+    userId: grant.userId,
+    role: grant.role,
+    revokedAt: grant.revokedAt ? new Date(grant.revokedAt) : null,
+    createdAt: new Date(grant.createdAt),
+    updatedAt: new Date(grant.updatedAt),
+  };
+}
+
+async function findCommandResult(
+  tx: Tx,
+  params: Pick<
+    AuditedAdminCommandParams,
+    'actorId' | 'idempotencyKeyFingerprint' | 'requestFingerprint'
+  > & {
+    command: string;
+  },
+): Promise<AdminGrant | undefined> {
+  const rows = await tx
+    .select()
+    .from(adminCommandResults)
+    .where(
+      and(
+        eq(adminCommandResults.actorId, params.actorId),
+        eq(adminCommandResults.idempotencyKeyFingerprint, params.idempotencyKeyFingerprint),
+      ),
+    )
+    .limit(1);
+  const result: AdminCommandResultDb | undefined = rows[0];
+  if (!result) return undefined;
+  if (
+    result.command !== params.command ||
+    result.requestFingerprint !== params.requestFingerprint
+  ) {
+    throw new AdminIdempotencyKeyReuseError();
+  }
+  return fromStoredAdminGrant(result.result.grant);
+}
+
+async function storeCommandResult(
+  tx: Tx,
+  params: AuditedAdminCommandParams,
+  grant: AdminGrant,
+): Promise<void> {
+  await tx.insert(adminCommandResults).values({
+    actorId: params.actorId,
+    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+    command: params.event.command,
+    requestFingerprint: params.requestFingerprint,
+    result: {grant: toStoredAdminGrant(grant)},
+  });
+}
+
+async function writeAdminAction(tx: Tx, event: AdministrationActionEvent): Promise<void> {
+  await writeOutboxEvent<AdministrationActionEventMap>(tx, authOutbox, {
+    type: 'administration.action.performed',
+    payload: event,
+  });
+}
+
+async function lockAdminCommand(
+  tx: Tx,
+  params: {actorId: string; idempotencyKeyFingerprint: string},
+) {
+  await tx.execute(
+    sql`select pg_advisory_xact_lock(hashtext(${`auth_admin_command:${params.actorId}:${params.idempotencyKeyFingerprint}`}))`,
+  );
+}
+
+export async function bootstrapFirstAdminOwner(
+  params: AuditedAdminCommandParams & {userId: string},
+): Promise<AdminGrant> {
+  return await db().transaction(async (tx) => {
+    await lockAdminCommand(tx, params);
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+
+    const existing = await findCommandResult(tx, {
+      ...params,
+      command: params.event.command,
+    });
+    if (existing) return existing;
+
+    const activeOwners = await tx
+      .select({id: adminGrants.id})
+      .from(adminGrants)
+      .innerJoin(users, eq(adminGrants.userId, users.id))
+      .where(
+        and(
+          eq(adminGrants.role, 'admin-owner'),
+          isNull(adminGrants.revokedAt),
+          eq(users.status, 'active'),
+        ),
+      )
+      .limit(1);
+    if (activeOwners.length > 0) throw new AdminBootstrapClosedError();
+
+    const userRows = await tx
+      .select({id: users.id, status: users.status})
+      .from(users)
+      .where(eq(users.id, params.userId))
+      .limit(1);
+    const user = userRows[0];
+    if (user?.status !== 'active') throw new UserNotFoundError(params.userId);
+
+    const rows = await tx
+      .insert(adminGrants)
+      .values({userId: params.userId, role: 'admin-owner'})
+      .returning();
+    const row = rows[0];
+    if (!row) throw new Error('Bootstrap grant insert returned no rows');
+
+    const grant = toAdminGrant(row);
+    await writeAdminAction(tx, params.event);
+    await storeCommandResult(tx, params, grant);
+    return grant;
+  });
+}
+
+export async function grantAdminRoleWithAudit(
+  params: AuditedAdminCommandParams & {userId: string; role: AdminRole},
+): Promise<AdminGrant> {
+  return await db().transaction(async (tx) => {
+    await lockAdminCommand(tx, params);
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+
+    const existing = await findCommandResult(tx, {
+      ...params,
+      command: params.event.command,
+    });
+    if (existing) return existing;
+
+    const userRows = await tx
+      .select({id: users.id, status: users.status})
+      .from(users)
+      .where(eq(users.id, params.userId))
+      .limit(1);
+    const user = userRows[0];
+    if (user?.status !== 'active') throw new UserNotFoundError(params.userId);
+
+    const activeRows = await tx
+      .select({id: adminGrants.id})
+      .from(adminGrants)
+      .where(
+        and(
+          eq(adminGrants.userId, params.userId),
+          eq(adminGrants.role, params.role),
+          isNull(adminGrants.revokedAt),
+        ),
+      )
+      .limit(1);
+    if (activeRows.length > 0) throw new AdminGrantAlreadyExistsError();
+
+    const rows = await tx
+      .insert(adminGrants)
+      .values({userId: params.userId, role: params.role})
+      .returning();
+    const row = rows[0];
+    if (!row) throw new Error('Administrator grant insert returned no rows');
+
+    const grant = toAdminGrant(row);
+    await writeAdminAction(tx, params.event);
+    await storeCommandResult(tx, params, grant);
+    return grant;
+  });
+}
+
+export async function revokeAdminGrantWithAudit(
+  params: AuditedAdminCommandParams & {grantId: string},
+): Promise<AdminGrant> {
+  return await db().transaction(async (tx) => {
+    await lockAdminCommand(tx, params);
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+
+    const existing = await findCommandResult(tx, {
+      ...params,
+      command: params.event.command,
+    });
+    if (existing) return existing;
+
+    const rows = await tx
+      .select()
+      .from(adminGrants)
+      .where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt)))
+      .limit(1);
+    const grant = rows[0];
+    if (!grant) throw new AdminGrantNotFoundError();
+
+    if (grant.role === 'admin-owner') {
+      const activeOwners = await tx
+        .select({id: adminGrants.id})
+        .from(adminGrants)
+        .innerJoin(users, eq(adminGrants.userId, users.id))
+        .where(
+          and(
+            eq(adminGrants.role, 'admin-owner'),
+            isNull(adminGrants.revokedAt),
+            eq(users.status, 'active'),
+          ),
+        );
+      if (activeOwners.length <= 1) throw new LastAdminOwnerError();
+    }
+
+    const updated = await tx
+      .update(adminGrants)
+      .set({revokedAt: new Date(), updatedAt: new Date()})
+      .where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt)))
+      .returning();
+    const updatedRow = updated[0];
+    if (!updatedRow) throw new AdminGrantNotFoundError();
+
+    const revoked = toAdminGrant(updatedRow);
+    await writeAdminAction(tx, params.event);
+    await storeCommandResult(tx, params, revoked);
+    return revoked;
+  });
+}

package/src/db/db.ts

@@ -1,5 +1,7 @@
 import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';
 import {pgClient} from '@shipfox/node-postgres';
+import {adminCommandResults} from './schema/admin-command-results.js';
+import {adminGrants} from './schema/admin-grants.js';
 import {authOutbox} from './schema/outbox.js';
 import {passwordResets} from './schema/password-resets.js';
 import {authRateLimits} from './schema/rate-limits.js';
@@ -7,6 +9,8 @@ import {refreshTokens} from './schema/refresh-tokens.js';
 import {users} from './schema/users.js';
 
 export const schema = {
+  adminGrants,
+  adminCommandResults,
   users,
   passwordResets,
   refreshTokens,

package/src/db/schema/admin-command-results.ts

@@ -0,0 +1,41 @@
+import type {AdminRole} from '@shipfox/api-auth-dto';
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {jsonb, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import {pgTable} from './common.js';
+import {users} from './users.js';
+
+export interface StoredAdminGrant {
+  id: string;
+  userId: string;
+  role: AdminRole;
+  revokedAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface StoredAdminCommandResult {
+  grant: StoredAdminGrant;
+}
+
+export const adminCommandResults = pgTable(
+  'admin_command_results',
+  {
+    id: uuidv7PrimaryKey(),
+    actorId: uuid('actor_id')
+      .notNull()
+      .references(() => users.id, {onDelete: 'cascade'}),
+    idempotencyKeyFingerprint: text('idempotency_key_fingerprint').notNull(),
+    command: text('command').notNull(),
+    requestFingerprint: text('request_fingerprint').notNull(),
+    result: jsonb('result').$type<StoredAdminCommandResult>().notNull(),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('auth_admin_command_results_actor_key_unique').on(
+      table.actorId,
+      table.idempotencyKeyFingerprint,
+    ),
+  ],
+);
+
+export type AdminCommandResultDb = typeof adminCommandResults.$inferSelect;

package/src/db/schema/admin-grants.ts

@@ -0,0 +1,49 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {sql} from 'drizzle-orm';
+import {index, pgEnum, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {AdminGrant} from '#core/entities/admin-grant.js';
+import {pgTable} from './common.js';
+import {users} from './users.js';
+
+export const adminRoleEnum = pgEnum('auth_admin_role', [
+  'admin-observer',
+  'admin-operator',
+  'admin-owner',
+]);
+
+export const adminGrants = pgTable(
+  'admin_grants',
+  {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => users.id, {onDelete: 'cascade'}),
+    role: adminRoleEnum('role').notNull(),
+    revokedAt: timestamp('revoked_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    index('auth_admin_grants_user_id_idx').on(table.userId),
+    index('auth_admin_grants_active_owners_idx')
+      .on(table.userId)
+      .where(sql`${table.role} = 'admin-owner' AND ${table.revokedAt} IS NULL`),
+    uniqueIndex('auth_admin_grants_active_user_role_unique')
+      .on(table.userId, table.role)
+      .where(sql`${table.revokedAt} IS NULL`),
+  ],
+);
+
+export type AdminGrantDb = typeof adminGrants.$inferSelect;
+export type AdminGrantCreateDb = typeof adminGrants.$inferInsert;
+
+export function toAdminGrant(row: AdminGrantDb): AdminGrant {
+  return {
+    id: row.id,
+    userId: row.userId,
+    role: row.role,
+    revokedAt: row.revokedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}

package/src/index.test.ts

@@ -3,9 +3,26 @@ import {
   AUTH_USER_SIGNED_UP,
   authEventSchemas,
 } from '@shipfox/api-auth-dto';
+import {ADMINISTRATION_ACTION_PERFORMED} from '@shipfox/api-common-dto';
 import {createAuthModule} from './index.js';
 import {passwordLoginMethods} from './login-methods.js';
 
+type SignupPolicyLike = {
+  isSignupAllowed(params: {
+    email: string;
+    emailVerified: boolean;
+    source: string;
+  }): Promise<{allowed: true} | {allowed: false; message?: string}>;
+};
+
+const buildAuthRoutes = vi.hoisted(() =>
+  vi.fn((_passwordEnabled: boolean, _workspaces: unknown, _signupPolicy?: SignupPolicyLike) => ({
+    prefix: '/auth',
+    plugins: [],
+    routes: [],
+  })),
+);
+
 vi.mock('#config.js', () => ({
   config: {
     AUTH_JWT_EXPIRES_IN: '15m',
@@ -14,15 +31,24 @@ vi.mock('#config.js', () => ({
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: 30,
     AUTH_REFRESH_COOKIE_NAME: 'shipfox_refresh_token',
     AUTH_PASSWORD_ENABLED: true,
+    AUTH_SIGNUP_GATE_ENABLED: true,
+    AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS: 'example.com',
+    AUTH_SIGNUP_ALLOWED_EMAILS: '',
+    AUTH_SIGNUP_NOT_ALLOWED_MESSAGE: undefined,
     CLIENT_BASE_URL: 'https://app.example.test',
   },
 }));
 
+vi.mock('#presentation/routes/index.js', () => ({buildAuthRoutes}));
+
 vi.mock('@shipfox/node-mailer', () => ({
   mailer: {send: vi.fn()},
 }));
 
 describe('authModule', () => {
+  const signupPolicy = {
+    isSignupAllowed: async () => ({allowed: true as const}),
+  };
   const authModule = createAuthModule({
     workspaces: {
       listMembershipsForTokenClaims: vi.fn(),
@@ -30,7 +56,9 @@ describe('authModule', () => {
       preflightInvitationAcceptance: vi.fn(),
       acceptInvitation: vi.fn(),
       requireActiveMembership: vi.fn(),
+      getWorkspaceOperatingState: vi.fn(),
     },
+    signupPolicy,
   });
   test('declares password login only when password login is enabled', () => {
     expect(passwordLoginMethods(true)).toEqual([{id: 'password'}]);
@@ -38,12 +66,41 @@ describe('authModule', () => {
     expect(authModule.loginMethods).toEqual([{id: 'password'}]);
   });
 
+  test('uses the environment signup policy when none is provided', async () => {
+    buildAuthRoutes.mockClear();
+    const module = createAuthModule({
+      workspaces: {
+        listMembershipsForTokenClaims: vi.fn(),
+        getWorkspaceCreator: vi.fn(),
+        preflightInvitationAcceptance: vi.fn(),
+        acceptInvitation: vi.fn(),
+        requireActiveMembership: vi.fn(),
+        getWorkspaceOperatingState: vi.fn(),
+      },
+    });
+    expect(module.routes).toHaveLength(2);
+    const signupPolicy = buildAuthRoutes.mock.calls[0]?.[2];
+
+    expect(signupPolicy).toEqual(expect.objectContaining({isSignupAllowed: expect.any(Function)}));
+    await expect(
+      signupPolicy?.isSignupAllowed({
+        email: 'person@other.example',
+        emailVerified: false,
+        source: 'password',
+      }),
+    ).resolves.toEqual({
+      allowed: false,
+      message: 'This Shipfox deployment does not accept new accounts right now.',
+    });
+  });
+
   test('registers auth email outbox publisher and subscribers', () => {
     const publisher = authModule.publishers?.find((pub) => pub.name === 'auth');
     const events = authModule.subscribers?.map((subscriber) => subscriber.event);
 
-    expect(publisher?.eventSchemas).toBe(authEventSchemas);
+    expect(publisher?.eventSchemas).not.toBe(authEventSchemas);
     expect(Object.keys(publisher?.eventSchemas ?? {}).sort()).toEqual([
+      ADMINISTRATION_ACTION_PERFORMED,
       AUTH_PASSWORD_RESET_SEND_REQUESTED,
       AUTH_USER_SIGNED_UP,
     ]);

package/src/index.ts

@@ -3,9 +3,12 @@ import {
   type AuthEventMap,
   authEventSchemas,
 } from '@shipfox/api-auth-dto';
+import {administrationActionEventSchemas} from '@shipfox/api-common-dto';
 import type {ShipfoxModule} from '@shipfox/node-module';
 import {subscriberFactory} from '@shipfox/node-module';
 import {config} from '#config.js';
+import type {SignupPolicy} from '#core/ports.js';
+import {createEnvironmentSignupPolicy} from '#core/signup-policy.js';
 import {db} from '#db/db.js';
 import {migrationsPath} from '#db/migrations.js';
 import {authOutbox} from '#db/schema/outbox.js';
@@ -14,11 +17,28 @@ import {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js
 import {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';
 import {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';
 import {createAuthInterModulePresentation} from '#presentation/inter-module.js';
+import {administrationRoutes} from '#presentation/routes/administration.js';
 import {buildAuthRoutes} from '#presentation/routes/index.js';
 import {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';
 import {passwordLoginMethods} from './login-methods.js';
 
-export type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';
+const authPublisherEventSchemas = {...authEventSchemas, ...administrationActionEventSchemas};
+
+export type {AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';
+export {
+  ADMIN_ROLES,
+  getCurrentAdminRole,
+  hasMinimumAdminRole,
+  highestAdminRole,
+  requireAdminRole,
+  revokeAdminGrant,
+} from '#core/admin-role.js';
+export {
+  bootstrapFirstAdminOwner,
+  grantAdministratorRole,
+  listAdministratorGrants,
+  revokeAdministratorGrant,
+} from '#core/administration.js';
 export type {
   CreateSessionForUserError,
   CreateSessionForUserParams,
@@ -28,11 +48,20 @@ export type {
 export {createSessionForUser, provisionUser} from '#core/auth.js';
 export type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';
 export {findUserByEmail} from '#core/email-owner.js';
+export type {AdminGrant} from '#core/entities/admin-grant.js';
 export type {User, UserStatus} from '#core/entities/user.js';
 export {
+  AdminBootstrapClosedError,
+  AdminGrantAlreadyExistsError,
+  AdminGrantNotFoundError,
+  AdminIdempotencyKeyReuseError,
+  AdminRoleRequiredError,
   AuthDependencyUnavailableError,
   EmailNotVerifiedError,
+  InvalidAdminBootstrapTokenError,
   InvalidCredentialsError,
+  LastAdminOwnerError,
+  SignupNotAllowedError,
   UserNotFoundError,
 } from '#core/errors.js';
 export {
@@ -40,10 +69,15 @@ export {
   jobLeaseParamsFrom,
   verifyJobLeaseToken,
 } from '#core/job-lease-token.js';
+export type {SignupPolicy} from '#core/ports.js';
 export {
   issueRunnerSessionToken,
   verifyRunnerSessionToken,
 } from '#core/runner-session-token.js';
+export {
+  createEnvironmentSignupPolicy,
+  DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,
+} from '#core/signup-policy.js';
 export {
   type AuthenticatedSessionContext,
   createJwtAuthMethod,
@@ -62,19 +96,26 @@ export {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-a
 
 const subscriber = subscriberFactory<AuthEventMap>();
 
+export interface CreateAuthModuleOptions {
+  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;
+  signupPolicy?: SignupPolicy;
+}
+
 export function createAuthModule({
   workspaces,
-}: {
-  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;
-}): ShipfoxModule {
+  signupPolicy = createEnvironmentSignupPolicy(),
+}: CreateAuthModuleOptions): ShipfoxModule {
   return {
     name: 'auth',
     database: {db, migrationsPath, databaseNamespace: 'auth'},
     auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],
     loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),
-    routes: [buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces)],
+    routes: [
+      buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy),
+      administrationRoutes,
+    ],
     e2eRoutes: [createAuthE2eRoutes(workspaces)],
-    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],
+    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authPublisherEventSchemas}],
     subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],
     interModulePresentations: [createAuthInterModulePresentation()],
   };

package/src/metrics/instance.ts

@@ -3,7 +3,7 @@ import {instanceMetrics} from '@shipfox/node-opentelemetry';
 export type AuthTokenType = 'session' | 'job_lease' | 'runner_session';
 export type AuthTokenVerificationOutcome = 'ok' | 'rejected';
 export type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';
-export type AuthRateLimitAction = 'login' | 'email-send';
+export type AuthRateLimitAction = 'login' | 'email-send' | 'bootstrap';
 export type AuthRateLimitScope = 'ip' | 'email';
 export type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';
 

package/src/presentation/auth/refresh-cookie.test.ts

@@ -6,6 +6,10 @@ vi.mock('#config.js', () => ({
     AUTH_REFRESH_COOKIE_NAME: 'shipfox_refresh_token',
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
     AUTH_PASSWORD_ENABLED: true,
+    AUTH_SIGNUP_GATE_ENABLED: false,
+    AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS: '',
+    AUTH_SIGNUP_ALLOWED_EMAILS: '',
+    AUTH_SIGNUP_NOT_ALLOWED_MESSAGE: undefined,
   },
 }));