@shipfox/api-auth 9.1.0 → 9.3.0

package/src/presentation/routes/registration/signup.ts

@@ -6,14 +6,21 @@ import {signup, signupWithInvitation} from '#core/auth.js';
 import {
   EmailTakenError,
   InvitationEmailMismatchError,
+  SignupNotAllowedError,
   TokenAlreadyUsedError,
   TokenExpiredError,
   TokenInvalidError,
 } from '#core/errors.js';
+import type {SignupPolicy} from '#core/ports.js';
 import {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';
 import {toUserDto} from '#presentation/dto/user.js';
 
-export function createSignupRoute(workspaces: WorkspacesInterModuleClient) {
+const SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH = 500;
+
+export function createSignupRoute(
+  workspaces: WorkspacesInterModuleClient,
+  signupPolicy?: SignupPolicy,
+) {
   return defineRoute({
     method: 'POST',
     path: '/signup',
@@ -35,6 +42,13 @@ export function createSignupRoute(workspaces: WorkspacesInterModuleClient) {
       if (error instanceof EmailTakenError) {
         throw new ClientError('Email already registered', 'email-taken', {status: 409});
       }
+      if (error instanceof SignupNotAllowedError) {
+        const message = error.message.slice(0, SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH);
+        throw new ClientError(message, 'signup-not-allowed', {
+          status: 403,
+          details: {message},
+        });
+      }
       if (error instanceof TokenInvalidError) {
         throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {
           status: 410,
@@ -63,7 +77,13 @@ export function createSignupRoute(workspaces: WorkspacesInterModuleClient) {
       const {email, password, name, invitation_token} = request.body;
 
       if (invitation_token === undefined) {
-        const result = await signup({email, password, name, sourceIp: request.ip});
+        const result = await signup({
+          email,
+          password,
+          name,
+          sourceIp: request.ip,
+          signupPolicy,
+        });
         reply.code(201);
         return {
           user: toUserDto(result),

package/src/presentation/routes/session/login.test.ts

@@ -35,6 +35,7 @@ describe('POST /auth/login', () => {
     expect(res.statusCode).toBe(200);
     expect(res.json().token).toBeDefined();
     expect(res.json().user.email).toBe(email);
+    expect(res.json().admin_role).toBeNull();
     expect(res.headers['set-cookie']).toContain('shipfox_refresh_token=');
     expect(res.headers['set-cookie']).toContain('HttpOnly');
     expect(res.headers['set-cookie']).toContain('Secure');

package/src/presentation/routes/session/me.test.ts

@@ -1,10 +1,11 @@
 import type {FastifyInstance} from 'fastify';
 import {signUserToken} from '#core/jwt.js';
+import {createAdminGrant} from '#db/admin-grants.js';
 import {
   createAuthTestApp,
+  createVerifiedSession,
   ROUTE_TEST_SECRET,
   resetCapturedMail,
-  signupVerifyLogin,
 } from '#test/routes.js';
 
 describe('GET /auth/me', () => {
@@ -23,7 +24,7 @@ describe('GET /auth/me', () => {
   });
 
   test('returns the signed-in user', async () => {
-    const account = await signupVerifyLogin(app, 'me');
+    const account = await createVerifiedSession('me');
 
     const res = await app.inject({
       method: 'GET',
@@ -33,6 +34,21 @@ describe('GET /auth/me', () => {
 
     expect(res.statusCode).toBe(200);
     expect(res.json().user.email).toBe(account.email);
+    expect(res.json().admin_role).toBeNull();
+  });
+
+  test('returns the current Auth-owned role for dashboard presentation', async () => {
+    const account = await createVerifiedSession('me-admin');
+    await createAdminGrant({userId: account.userId, role: 'admin-observer'});
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/auth/me',
+      headers: {authorization: `Bearer ${account.token}`},
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().admin_role).toBe('admin-observer');
   });
 
   test('transforms a token for a missing user into 404', async () => {

package/src/presentation/routes/session/me.ts

@@ -1,6 +1,7 @@
 import {AUTH_USER} from '@shipfox/api-auth-context';
 import {meResponseSchema} from '@shipfox/api-auth-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {getCurrentAdminRole} from '#core/admin-role.js';
 import {getCurrentUser} from '#core/auth.js';
 import {UserNotFoundError} from '#core/errors.js';
 import {getClientContext} from '#presentation/auth/jwt-auth.js';
@@ -30,6 +31,9 @@ export const meRoute = defineRoute({
 
     const result = await getCurrentUser({userId: client.userId});
 
-    return {user: toUserDto(result.user)};
+    return {
+      user: toUserDto(result.user),
+      admin_role: await getCurrentAdminRole({userId: client.userId}),
+    };
   },
 });

package/test/globalSetup.ts

@@ -1,5 +1,8 @@
 import './env.js';
-import {initializeEmailChallengesForTests} from '@shipfox/api-email-challenges/test';
+import {
+  initializeEmailChallengesForTests,
+  resetEmailChallengesForTests,
+} from '@shipfox/api-email-challenges/test';
 import {runMigrations} from '@shipfox/node-drizzle';
 import {closePostgresClient, createPostgresClient} from '@shipfox/node-postgres';
 import {sql} from 'drizzle-orm';
@@ -11,8 +14,9 @@ export async function setup() {
 
   await runMigrations(db(), migrationsPath, '__drizzle_migrations_auth');
   await initializeEmailChallengesForTests();
+  await resetEmailChallengesForTests();
   await db().execute(
-    sql`TRUNCATE auth_outbox, auth_password_resets, auth_rate_limits, auth_refresh_tokens, auth_users CASCADE`,
+    sql`TRUNCATE auth_admin_command_results, auth_admin_grants, auth_outbox, auth_password_resets, auth_rate_limits, auth_refresh_tokens, auth_users CASCADE`,
   );
 
   closeDb();

package/test/routes.ts

@@ -8,6 +8,7 @@ import {and, desc, eq, sql} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {authOutbox} from '#db/schema/outbox.js';
 import {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';
+import {administrationRoutes} from '#presentation/routes/administration.js';
 import {buildAuthRoutes} from '#presentation/routes/index.js';
 
 const testConfig = vi.hoisted(
@@ -48,11 +49,16 @@ const workspaces = workspaceTestDoubles as unknown as WorkspacesInterModuleClien
 
 vi.mock('#config.js', () => ({
   config: {
+    ADMIN_BOOTSTRAP_TOKEN: 'test-bootstrap-token',
     AUTH_JWT_EXPIRES_IN: '15m',
     AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
     AUTH_REFRESH_ROTATION_GRACE_SECONDS: 30,
     AUTH_REFRESH_COOKIE_NAME: 'shipfox_refresh_token',
     AUTH_PASSWORD_ENABLED: true,
+    AUTH_SIGNUP_GATE_ENABLED: false,
+    AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS: '',
+    AUTH_SIGNUP_ALLOWED_EMAILS: '',
+    AUTH_SIGNUP_NOT_ALLOWED_MESSAGE: undefined,
     CLIENT_BASE_URL: testConfig.clientBaseUrl,
   },
   mailer: testConfig.mailer,
@@ -147,7 +153,7 @@ export async function createAuthTestApp(params?: {
 }): Promise<FastifyInstance> {
   const appConfig: AppConfig = {
     auth: [createJwtAuthMethod()],
-    routes: [buildAuthRoutes(true, workspaces)],
+    routes: [buildAuthRoutes(true, workspaces), administrationRoutes],
     swagger: false,
   };
   if (params?.fastifyOptions) appConfig.fastifyOptions = params.fastifyOptions;