@shipfox/api-auth 9.1.0 → 9.3.0

package/dist/db/schema/admin-command-results.js

@@ -0,0 +1,21 @@
+import { uuidv7PrimaryKey } from '@shipfox/node-drizzle';
+import { jsonb, text, timestamp, uniqueIndex, uuid } from 'drizzle-orm/pg-core';
+import { pgTable } from './common.js';
+import { users } from './users.js';
+export const adminCommandResults = pgTable('admin_command_results', {
+    id: uuidv7PrimaryKey(),
+    actorId: uuid('actor_id').notNull().references(()=>users.id, {
+        onDelete: 'cascade'
+    }),
+    idempotencyKeyFingerprint: text('idempotency_key_fingerprint').notNull(),
+    command: text('command').notNull(),
+    requestFingerprint: text('request_fingerprint').notNull(),
+    result: jsonb('result').$type().notNull(),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        uniqueIndex('auth_admin_command_results_actor_key_unique').on(table.actorId, table.idempotencyKeyFingerprint)
+    ]);
+
+//# sourceMappingURL=admin-command-results.js.map

package/dist/db/schema/admin-command-results.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/admin-command-results.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {jsonb, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport {pgTable} from './common.js';\nimport {users} from './users.js';\n\nexport interface StoredAdminGrant {\n  id: string;\n  userId: string;\n  role: AdminRole;\n  revokedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport interface StoredAdminCommandResult {\n  grant: StoredAdminGrant;\n}\n\nexport const adminCommandResults = pgTable(\n  'admin_command_results',\n  {\n    id: uuidv7PrimaryKey(),\n    actorId: uuid('actor_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    idempotencyKeyFingerprint: text('idempotency_key_fingerprint').notNull(),\n    command: text('command').notNull(),\n    requestFingerprint: text('request_fingerprint').notNull(),\n    result: jsonb('result').$type<StoredAdminCommandResult>().notNull(),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_admin_command_results_actor_key_unique').on(\n      table.actorId,\n      table.idempotencyKeyFingerprint,\n    ),\n  ],\n);\n\nexport type AdminCommandResultDb = typeof adminCommandResults.$inferSelect;\n"],"names":["uuidv7PrimaryKey","jsonb","text","timestamp","uniqueIndex","uuid","pgTable","users","adminCommandResults","id","actorId","notNull","references","onDelete","idempotencyKeyFingerprint","command","requestFingerprint","result","$type","createdAt","withTimezone","defaultNow","table","on"],"mappings":"AACA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,KAAK,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AAC9E,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,KAAK,QAAO,aAAa;AAejC,OAAO,MAAMC,sBAAsBF,QACjC,yBACA;IACEG,IAAIT;IACJU,SAASL,KAAK,YACXM,OAAO,GACPC,UAAU,CAAC,IAAML,MAAME,EAAE,EAAE;QAACI,UAAU;IAAS;IAClDC,2BAA2BZ,KAAK,+BAA+BS,OAAO;IACtEI,SAASb,KAAK,WAAWS,OAAO;IAChCK,oBAAoBd,KAAK,uBAAuBS,OAAO;IACvDM,QAAQhB,MAAM,UAAUiB,KAAK,GAA6BP,OAAO;IACjEQ,WAAWhB,UAAU,cAAc;QAACiB,cAAc;IAAI,GAAGT,OAAO,GAAGU,UAAU;AAC/E,GACA,CAACC,QAAU;QACTlB,YAAY,+CAA+CmB,EAAE,CAC3DD,MAAMZ,OAAO,EACbY,MAAMR,yBAAyB;KAElC,EACD"}

package/dist/db/schema/admin-grants.d.ts

@@ -0,0 +1,115 @@
+import type { AdminGrant } from '#core/entities/admin-grant.js';
+export declare const adminRoleEnum: import("drizzle-orm/pg-core").PgEnum<["admin-observer", "admin-operator", "admin-owner"]>;
+export declare const adminGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "admin_grants";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "admin_grants";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "admin_grants";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        role: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role";
+            tableName: "admin_grants";
+            dataType: "string";
+            columnType: "PgEnumColumn";
+            data: "admin-observer" | "admin-operator" | "admin-owner";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["admin-observer", "admin-operator", "admin-owner"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked_at";
+            tableName: "admin_grants";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "admin_grants";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "admin_grants";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type AdminGrantDb = typeof adminGrants.$inferSelect;
+export type AdminGrantCreateDb = typeof adminGrants.$inferInsert;
+export declare function toAdminGrant(row: AdminGrantDb): AdminGrant;
+//# sourceMappingURL=admin-grants.d.ts.map

package/dist/db/schema/admin-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-grants.d.ts","sourceRoot":"","sources":["../../../src/db/schema/admin-grants.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAI9D,eAAO,MAAM,aAAa,2FAIxB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,OAAO,WAAW,CAAC,YAAY,CAAC;AAC3D,MAAM,MAAM,kBAAkB,GAAG,OAAO,WAAW,CAAC,YAAY,CAAC;AAEjE,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,UAAU,CAS1D"}

package/dist/db/schema/admin-grants.js

@@ -0,0 +1,42 @@
+import { uuidv7PrimaryKey } from '@shipfox/node-drizzle';
+import { sql } from 'drizzle-orm';
+import { index, pgEnum, timestamp, uniqueIndex, uuid } from 'drizzle-orm/pg-core';
+import { pgTable } from './common.js';
+import { users } from './users.js';
+export const adminRoleEnum = pgEnum('auth_admin_role', [
+    'admin-observer',
+    'admin-operator',
+    'admin-owner'
+]);
+export const adminGrants = pgTable('admin_grants', {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id').notNull().references(()=>users.id, {
+        onDelete: 'cascade'
+    }),
+    role: adminRoleEnum('role').notNull(),
+    revokedAt: timestamp('revoked_at', {
+        withTimezone: true
+    }),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        index('auth_admin_grants_user_id_idx').on(table.userId),
+        index('auth_admin_grants_active_owners_idx').on(table.userId).where(sql`${table.role} = 'admin-owner' AND ${table.revokedAt} IS NULL`),
+        uniqueIndex('auth_admin_grants_active_user_role_unique').on(table.userId, table.role).where(sql`${table.revokedAt} IS NULL`)
+    ]);
+export function toAdminGrant(row) {
+    return {
+        id: row.id,
+        userId: row.userId,
+        role: row.role,
+        revokedAt: row.revokedAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}
+
+//# sourceMappingURL=admin-grants.js.map

package/dist/db/schema/admin-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/admin-grants.ts"],"sourcesContent":["import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {sql} from 'drizzle-orm';\nimport {index, pgEnum, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport {pgTable} from './common.js';\nimport {users} from './users.js';\n\nexport const adminRoleEnum = pgEnum('auth_admin_role', [\n  'admin-observer',\n  'admin-operator',\n  'admin-owner',\n]);\n\nexport const adminGrants = pgTable(\n  'admin_grants',\n  {\n    id: uuidv7PrimaryKey(),\n    userId: uuid('user_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    role: adminRoleEnum('role').notNull(),\n    revokedAt: timestamp('revoked_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    index('auth_admin_grants_user_id_idx').on(table.userId),\n    index('auth_admin_grants_active_owners_idx')\n      .on(table.userId)\n      .where(sql`${table.role} = 'admin-owner' AND ${table.revokedAt} IS NULL`),\n    uniqueIndex('auth_admin_grants_active_user_role_unique')\n      .on(table.userId, table.role)\n      .where(sql`${table.revokedAt} IS NULL`),\n  ],\n);\n\nexport type AdminGrantDb = typeof adminGrants.$inferSelect;\nexport type AdminGrantCreateDb = typeof adminGrants.$inferInsert;\n\nexport function toAdminGrant(row: AdminGrantDb): AdminGrant {\n  return {\n    id: row.id,\n    userId: row.userId,\n    role: row.role,\n    revokedAt: row.revokedAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n"],"names":["uuidv7PrimaryKey","sql","index","pgEnum","timestamp","uniqueIndex","uuid","pgTable","users","adminRoleEnum","adminGrants","id","userId","notNull","references","onDelete","role","revokedAt","withTimezone","createdAt","defaultNow","updatedAt","table","on","where","toAdminGrant","row"],"mappings":"AAAA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,GAAG,QAAO,cAAc;AAChC,SAAQC,KAAK,EAAEC,MAAM,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AAEhF,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,KAAK,QAAO,aAAa;AAEjC,OAAO,MAAMC,gBAAgBN,OAAO,mBAAmB;IACrD;IACA;IACA;CACD,EAAE;AAEH,OAAO,MAAMO,cAAcH,QACzB,gBACA;IACEI,IAAIX;IACJY,QAAQN,KAAK,WACVO,OAAO,GACPC,UAAU,CAAC,IAAMN,MAAMG,EAAE,EAAE;QAACI,UAAU;IAAS;IAClDC,MAAMP,cAAc,QAAQI,OAAO;IACnCI,WAAWb,UAAU,cAAc;QAACc,cAAc;IAAI;IACtDC,WAAWf,UAAU,cAAc;QAACc,cAAc;IAAI,GAAGL,OAAO,GAAGO,UAAU;IAC7EC,WAAWjB,UAAU,cAAc;QAACc,cAAc;IAAI,GAAGL,OAAO,GAAGO,UAAU;AAC/E,GACA,CAACE,QAAU;QACTpB,MAAM,iCAAiCqB,EAAE,CAACD,MAAMV,MAAM;QACtDV,MAAM,uCACHqB,EAAE,CAACD,MAAMV,MAAM,EACfY,KAAK,CAACvB,GAAG,CAAC,EAAEqB,MAAMN,IAAI,CAAC,qBAAqB,EAAEM,MAAML,SAAS,CAAC,QAAQ,CAAC;QAC1EZ,YAAY,6CACTkB,EAAE,CAACD,MAAMV,MAAM,EAAEU,MAAMN,IAAI,EAC3BQ,KAAK,CAACvB,GAAG,CAAC,EAAEqB,MAAML,SAAS,CAAC,QAAQ,CAAC;KACzC,EACD;AAKF,OAAO,SAASQ,aAAaC,GAAiB;IAC5C,OAAO;QACLf,IAAIe,IAAIf,EAAE;QACVC,QAAQc,IAAId,MAAM;QAClBI,MAAMU,IAAIV,IAAI;QACdC,WAAWS,IAAIT,SAAS;QACxBE,WAAWO,IAAIP,SAAS;QACxBE,WAAWK,IAAIL,SAAS;IAC1B;AACF"}

package/dist/index.d.ts

@@ -1,18 +1,26 @@
 import type { ShipfoxModule } from '@shipfox/node-module';
-export type { JobLeaseTokenClaims, RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
+import type { SignupPolicy } from '#core/ports.js';
+export type { AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
+export { ADMIN_ROLES, getCurrentAdminRole, hasMinimumAdminRole, highestAdminRole, requireAdminRole, revokeAdminGrant, } from '#core/admin-role.js';
+export { bootstrapFirstAdminOwner, grantAdministratorRole, listAdministratorGrants, revokeAdministratorGrant, } from '#core/administration.js';
 export type { CreateSessionForUserError, CreateSessionForUserParams, CreateSessionForUserResult, ProvisionUserParams, } from '#core/auth.js';
 export { createSessionForUser, provisionUser } from '#core/auth.js';
 export type { EmailOwner, FindUserByEmailParams } from '#core/email-owner.js';
 export { findUserByEmail } from '#core/email-owner.js';
+export type { AdminGrant } from '#core/entities/admin-grant.js';
 export type { User, UserStatus } from '#core/entities/user.js';
-export { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError, } from '#core/errors.js';
+export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidAdminBootstrapTokenError, InvalidCredentialsError, LastAdminOwnerError, SignupNotAllowedError, UserNotFoundError, } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken, } from '#core/job-lease-token.js';
+export type { SignupPolicy } from '#core/ports.js';
 export { issueRunnerSessionToken, verifyRunnerSessionToken, } from '#core/runner-session-token.js';
+export { createEnvironmentSignupPolicy, DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE, } from '#core/signup-policy.js';
 export { type AuthenticatedSessionContext, createJwtAuthMethod, getAuthenticatedSessionContext, type RefreshSessionId, type UserId, } from '#presentation/auth/jwt-auth.js';
 export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
 export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie, } from '#presentation/auth/refresh-cookie.js';
 export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
-export declare function createAuthModule({ workspaces, }: {
+export interface CreateAuthModuleOptions {
     workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;
-}): ShipfoxModule;
+    signupPolicy?: SignupPolicy;
+}
+export declare function createAuthModule({ workspaces, signupPolicy, }: CreateAuthModuleOptions): ShipfoxModule;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAexD,YAAY,EAAC,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACzF,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,GACX,EAAE;IACD,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;CAC5F,GAAG,aAAa,CAYhB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAiBjD,YAAY,EAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACpG,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,+BAA+B,EAC/B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,EACV,YAA8C,GAC/C,EAAE,uBAAuB,GAAG,aAAa,CAezC"}

package/dist/index.js

@@ -1,6 +1,8 @@
 import { AUTH_PASSWORD_RESET_SEND_REQUESTED, authEventSchemas } from '@shipfox/api-auth-dto';
+import { administrationActionEventSchemas } from '@shipfox/api-common-dto';
 import { subscriberFactory } from '@shipfox/node-module';
 import { config } from '#config.js';
+import { createEnvironmentSignupPolicy } from '#core/signup-policy.js';
 import { db } from '#db/db.js';
 import { migrationsPath } from '#db/migrations.js';
 import { authOutbox } from '#db/schema/outbox.js';
@@ -9,20 +11,28 @@ import { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.
 import { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
 import { createAuthE2eRoutes } from '#presentation/e2eRoutes/index.js';
 import { createAuthInterModulePresentation } from '#presentation/inter-module.js';
+import { administrationRoutes } from '#presentation/routes/administration.js';
 import { buildAuthRoutes } from '#presentation/routes/index.js';
 import { onPasswordResetSendRequested } from '#presentation/subscribers/index.js';
 import { passwordLoginMethods } from './login-methods.js';
+const authPublisherEventSchemas = {
+    ...authEventSchemas,
+    ...administrationActionEventSchemas
+};
+export { ADMIN_ROLES, getCurrentAdminRole, hasMinimumAdminRole, highestAdminRole, requireAdminRole, revokeAdminGrant } from '#core/admin-role.js';
+export { bootstrapFirstAdminOwner, grantAdministratorRole, listAdministratorGrants, revokeAdministratorGrant } from '#core/administration.js';
 export { createSessionForUser, provisionUser } from '#core/auth.js';
 export { findUserByEmail } from '#core/email-owner.js';
-export { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError } from '#core/errors.js';
+export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidAdminBootstrapTokenError, InvalidCredentialsError, LastAdminOwnerError, SignupNotAllowedError, UserNotFoundError } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken } from '#core/job-lease-token.js';
 export { issueRunnerSessionToken, verifyRunnerSessionToken } from '#core/runner-session-token.js';
+export { createEnvironmentSignupPolicy, DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE } from '#core/signup-policy.js';
 export { createJwtAuthMethod, getAuthenticatedSessionContext } from '#presentation/auth/jwt-auth.js';
 export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
 export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
 export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
 const subscriber = subscriberFactory();
-export function createAuthModule({ workspaces }) {
+export function createAuthModule({ workspaces, signupPolicy = createEnvironmentSignupPolicy() }) {
     return {
         name: 'auth',
         database: {
@@ -37,7 +47,8 @@ export function createAuthModule({ workspaces }) {
         ],
         loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),
         routes: [
-            buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces)
+            buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy),
+            administrationRoutes
         ],
         e2eRoutes: [
             createAuthE2eRoutes(workspaces)
@@ -47,7 +58,7 @@ export function createAuthModule({ workspaces }) {
                 name: 'auth',
                 table: authOutbox,
                 db,
-                eventSchemas: authEventSchemas
+                eventSchemas: authPublisherEventSchemas
             }
         ],
         subscribers: [

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nexport type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport type {\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  InvalidCredentialsError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {\n  type AuthenticatedSessionContext,\n  createJwtAuthMethod,\n  getAuthenticatedSessionContext,\n  type RefreshSessionId,\n  type UserId,\n} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport function createAuthModule({\n  workspaces,\n}: {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n}): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath, databaseNamespace: 'auth'},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces)],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","subscriberFactory","config","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","buildAuthRoutes","onPasswordResetSendRequested","passwordLoginMethods","createSessionForUser","provisionUser","findUserByEmail","AuthDependencyUnavailableError","EmailNotVerifiedError","InvalidCredentialsError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","getAuthenticatedSessionContext","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","createAuthModule","workspaces","name","database","databaseNamespace","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","interModulePresentations"],"mappings":"AAAA,SACEA,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAE/B,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AASxD,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElE,SAAQC,eAAe,QAAO,uBAAuB;AAErD,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,uBAAuB,EACvBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAClC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SAEEnB,mBAAmB,EACnBoB,8BAA8B,QAGzB,iCAAiC;AACxC,SAAQnB,0BAA0B,QAAO,yCAAyC;AAClF,SACEoB,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQtB,6BAA6B,QAAO,4CAA4C;AAExF,MAAMuB,aAAa9B;AAEnB,OAAO,SAAS+B,iBAAiB,EAC/BC,UAAU,EAGX;IACC,OAAO;QACLC,MAAM;QACNC,UAAU;YAAChC;YAAIC;YAAgBgC,mBAAmB;QAAM;QACxDC,MAAM;YAAC/B;YAAuBC;YAA8BC;SAAgC;QAC5F8B,cAAczB,qBAAqBX,OAAOqC,qBAAqB;QAC/DC,QAAQ;YAAC7B,gBAAgBT,OAAOqC,qBAAqB,EAAEN;SAAY;QACnEQ,WAAW;YAAChC,oBAAoBwB;SAAY;QAC5CS,YAAY;YAAC;gBAACR,MAAM;gBAAQS,OAAOtC;gBAAYF;gBAAIyC,cAAc5C;YAAgB;SAAE;QACnF6C,aAAa;YAACd,WAAWhC,oCAAoCa;SAA8B;QAC3FkC,0BAA0B;YAACpC;SAAoC;IACjE;AACF"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport {administrationActionEventSchemas} from '@shipfox/api-common-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {createEnvironmentSignupPolicy} from '#core/signup-policy.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {administrationRoutes} from '#presentation/routes/administration.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nconst authPublisherEventSchemas = {...authEventSchemas, ...administrationActionEventSchemas};\n\nexport type {AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport {\n  ADMIN_ROLES,\n  getCurrentAdminRole,\n  hasMinimumAdminRole,\n  highestAdminRole,\n  requireAdminRole,\n  revokeAdminGrant,\n} from '#core/admin-role.js';\nexport {\n  bootstrapFirstAdminOwner,\n  grantAdministratorRole,\n  listAdministratorGrants,\n  revokeAdministratorGrant,\n} from '#core/administration.js';\nexport type {\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {AdminGrant} from '#core/entities/admin-grant.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  InvalidAdminBootstrapTokenError,\n  InvalidCredentialsError,\n  LastAdminOwnerError,\n  SignupNotAllowedError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport type {SignupPolicy} from '#core/ports.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {\n  createEnvironmentSignupPolicy,\n  DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,\n} from '#core/signup-policy.js';\nexport {\n  type AuthenticatedSessionContext,\n  createJwtAuthMethod,\n  getAuthenticatedSessionContext,\n  type RefreshSessionId,\n  type UserId,\n} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport interface CreateAuthModuleOptions {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n  signupPolicy?: SignupPolicy;\n}\n\nexport function createAuthModule({\n  workspaces,\n  signupPolicy = createEnvironmentSignupPolicy(),\n}: CreateAuthModuleOptions): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath, databaseNamespace: 'auth'},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [\n      buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy),\n      administrationRoutes,\n    ],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authPublisherEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","administrationActionEventSchemas","subscriberFactory","config","createEnvironmentSignupPolicy","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","administrationRoutes","buildAuthRoutes","onPasswordResetSendRequested","passwordLoginMethods","authPublisherEventSchemas","ADMIN_ROLES","getCurrentAdminRole","hasMinimumAdminRole","highestAdminRole","requireAdminRole","revokeAdminGrant","bootstrapFirstAdminOwner","grantAdministratorRole","listAdministratorGrants","revokeAdministratorGrant","createSessionForUser","provisionUser","findUserByEmail","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","AuthDependencyUnavailableError","EmailNotVerifiedError","InvalidAdminBootstrapTokenError","InvalidCredentialsError","LastAdminOwnerError","SignupNotAllowedError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","getAuthenticatedSessionContext","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","createAuthModule","workspaces","signupPolicy","name","database","databaseNamespace","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","interModulePresentations"],"mappings":"AAAA,SACEA,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAC/B,SAAQC,gCAAgC,QAAO,0BAA0B;AAEzE,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAElC,SAAQC,6BAA6B,QAAO,yBAAyB;AACrE,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SAAQC,oBAAoB,QAAO,yCAAyC;AAC5E,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AAExD,MAAMC,4BAA4B;IAAC,GAAGjB,gBAAgB;IAAE,GAAGC,gCAAgC;AAAA;AAG3F,SACEiB,WAAW,EACXC,mBAAmB,EACnBC,mBAAmB,EACnBC,gBAAgB,EAChBC,gBAAgB,EAChBC,gBAAgB,QACX,sBAAsB;AAC7B,SACEC,wBAAwB,EACxBC,sBAAsB,EACtBC,uBAAuB,EACvBC,wBAAwB,QACnB,0BAA0B;AAOjC,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElE,SAAQC,eAAe,QAAO,uBAAuB;AAGrD,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,8BAA8B,EAC9BC,qBAAqB,EACrBC,+BAA+B,EAC/BC,uBAAuB,EACvBC,mBAAmB,EACnBC,qBAAqB,EACrBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAElC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SACE3C,6BAA6B,EAC7B4C,kCAAkC,QAC7B,yBAAyB;AAChC,SAEExC,mBAAmB,EACnByC,8BAA8B,QAGzB,iCAAiC;AACxC,SAAQxC,0BAA0B,QAAO,yCAAyC;AAClF,SACEyC,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQ3C,6BAA6B,QAAO,4CAA4C;AAExF,MAAM4C,aAAapD;AAOnB,OAAO,SAASqD,iBAAiB,EAC/BC,UAAU,EACVC,eAAerD,+BAA+B,EACtB;IACxB,OAAO;QACLsD,MAAM;QACNC,UAAU;YAACtD;YAAIC;YAAgBsD,mBAAmB;QAAM;QACxDC,MAAM;YAACrD;YAAuBC;YAA8BC;SAAgC;QAC5FoD,cAAc9C,qBAAqBb,OAAO4D,qBAAqB;QAC/DC,QAAQ;YACNlD,gBAAgBX,OAAO4D,qBAAqB,EAAEP,YAAYC;YAC1D5C;SACD;QACDoD,WAAW;YAACtD,oBAAoB6C;SAAY;QAC5CU,YAAY;YAAC;gBAACR,MAAM;gBAAQS,OAAO5D;gBAAYF;gBAAI+D,cAAcnD;YAAyB;SAAE;QAC5FoD,aAAa;YAACf,WAAWvD,oCAAoCgB;SAA8B;QAC3FuD,0BAA0B;YAAC1D;SAAoC;IACjE;AACF"}

package/dist/metrics/instance.d.ts

@@ -1,7 +1,7 @@
 export type AuthTokenType = 'session' | 'job_lease' | 'runner_session';
 export type AuthTokenVerificationOutcome = 'ok' | 'rejected';
 export type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';
-export type AuthRateLimitAction = 'login' | 'email-send';
+export type AuthRateLimitAction = 'login' | 'email-send' | 'bootstrap';
 export type AuthRateLimitScope = 'ip' | 'email';
 export type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';
 export declare function recordTokenIssued(tokenType: AuthTokenType): void;

package/dist/metrics/instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,gBAAgB,CAAC;AACvE,MAAM,MAAM,4BAA4B,GAAG,IAAI,GAAG,UAAU,CAAC;AAC7D,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,YAAY,CAAC;AACzD,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAsCzE,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAEhE;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,4BAA4B,GACpC,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAE3E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,GAAG,IAAI,CAQP;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,gBAAgB,CAAC;AACvE,MAAM,MAAM,4BAA4B,GAAG,IAAI,GAAG,UAAU,CAAC;AAC7D,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AAsCzE,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAEhE;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,4BAA4B,GACpC,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAE3E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,GAAG,IAAI,CAQP;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}

package/dist/metrics/instance.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/metrics/instance.ts"],"sourcesContent":["import {instanceMetrics} from '@shipfox/node-opentelemetry';\n\nexport type AuthTokenType = 'session' | 'job_lease' | 'runner_session';\nexport type AuthTokenVerificationOutcome = 'ok' | 'rejected';\nexport type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';\nexport type AuthRateLimitAction = 'login' | 'email-send';\nexport type AuthRateLimitScope = 'ip' | 'email';\nexport type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';\n\nconst meter = instanceMetrics.getMeter('auth');\n\nconst tokenIssuedCount = meter.createCounter<{token_type: AuthTokenType}>('auth_token_issued', {\n  description: 'Tokens issued by token type',\n});\n\nconst tokenVerifiedCount = meter.createCounter<{\n  token_type: AuthTokenType;\n  outcome: AuthTokenVerificationOutcome;\n}>('auth_token_verified', {description: 'Token verification attempts by token type and outcome'});\n\nconst tokenRefreshedCount = meter.createCounter<{outcome: AuthTokenRefreshOutcome}>(\n  'auth_token_refreshed',\n  {description: 'Refresh-token exchanges by outcome'},\n);\n\nconst rateLimitCheckCount = meter.createCounter<{\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}>('auth_rate_limit_checks', {\n  description: 'Authentication rate limit checks by action, scope, and outcome',\n});\n\nconst rateLimitPruneFailureCount = meter.createCounter('auth_rate_limit_prune_failures', {\n  description: 'Authentication rate limit prune failures',\n});\n\nfunction recordMetric(record: () => void): void {\n  try {\n    record();\n  } catch {\n    // Metrics must not affect authentication outcomes.\n  }\n}\n\nexport function recordTokenIssued(tokenType: AuthTokenType): void {\n  recordMetric(() => tokenIssuedCount.add(1, {token_type: tokenType}));\n}\n\nexport function recordTokenVerified(\n  tokenType: AuthTokenType,\n  outcome: AuthTokenVerificationOutcome,\n): void {\n  recordMetric(() => tokenVerifiedCount.add(1, {token_type: tokenType, outcome}));\n}\n\nexport function recordTokenRefreshed(outcome: AuthTokenRefreshOutcome): void {\n  recordMetric(() => tokenRefreshedCount.add(1, {outcome}));\n}\n\nexport function recordAuthRateLimitCheck(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}): void {\n  recordMetric(() =>\n    rateLimitCheckCount.add(1, {\n      action: params.action,\n      scope: params.scope,\n      outcome: params.outcome,\n    }),\n  );\n}\n\nexport function recordAuthRateLimitPruneFailure(): void {\n  recordMetric(() => rateLimitPruneFailureCount.add(1));\n}\n"],"names":["instanceMetrics","meter","getMeter","tokenIssuedCount","createCounter","description","tokenVerifiedCount","tokenRefreshedCount","rateLimitCheckCount","rateLimitPruneFailureCount","recordMetric","record","recordTokenIssued","tokenType","add","token_type","recordTokenVerified","outcome","recordTokenRefreshed","recordAuthRateLimitCheck","params","action","scope","recordAuthRateLimitPruneFailure"],"mappings":"AAAA,SAAQA,eAAe,QAAO,8BAA8B;AAS5D,MAAMC,QAAQD,gBAAgBE,QAAQ,CAAC;AAEvC,MAAMC,mBAAmBF,MAAMG,aAAa,CAA8B,qBAAqB;IAC7FC,aAAa;AACf;AAEA,MAAMC,qBAAqBL,MAAMG,aAAa,CAG3C,uBAAuB;IAACC,aAAa;AAAuD;AAE/F,MAAME,sBAAsBN,MAAMG,aAAa,CAC7C,wBACA;IAACC,aAAa;AAAoC;AAGpD,MAAMG,sBAAsBP,MAAMG,aAAa,CAI5C,0BAA0B;IAC3BC,aAAa;AACf;AAEA,MAAMI,6BAA6BR,MAAMG,aAAa,CAAC,kCAAkC;IACvFC,aAAa;AACf;AAEA,SAASK,aAAaC,MAAkB;IACtC,IAAI;QACFA;IACF,EAAE,OAAM;IACN,mDAAmD;IACrD;AACF;AAEA,OAAO,SAASC,kBAAkBC,SAAwB;IACxDH,aAAa,IAAMP,iBAAiBW,GAAG,CAAC,GAAG;YAACC,YAAYF;QAAS;AACnE;AAEA,OAAO,SAASG,oBACdH,SAAwB,EACxBI,OAAqC;IAErCP,aAAa,IAAMJ,mBAAmBQ,GAAG,CAAC,GAAG;YAACC,YAAYF;YAAWI;QAAO;AAC9E;AAEA,OAAO,SAASC,qBAAqBD,OAAgC;IACnEP,aAAa,IAAMH,oBAAoBO,GAAG,CAAC,GAAG;YAACG;QAAO;AACxD;AAEA,OAAO,SAASE,yBAAyBC,MAIxC;IACCV,aAAa,IACXF,oBAAoBM,GAAG,CAAC,GAAG;YACzBO,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBL,SAASG,OAAOH,OAAO;QACzB;AAEJ;AAEA,OAAO,SAASM;IACdb,aAAa,IAAMD,2BAA2BK,GAAG,CAAC;AACpD"}
+{"version":3,"sources":["../../src/metrics/instance.ts"],"sourcesContent":["import {instanceMetrics} from '@shipfox/node-opentelemetry';\n\nexport type AuthTokenType = 'session' | 'job_lease' | 'runner_session';\nexport type AuthTokenVerificationOutcome = 'ok' | 'rejected';\nexport type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';\nexport type AuthRateLimitAction = 'login' | 'email-send' | 'bootstrap';\nexport type AuthRateLimitScope = 'ip' | 'email';\nexport type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';\n\nconst meter = instanceMetrics.getMeter('auth');\n\nconst tokenIssuedCount = meter.createCounter<{token_type: AuthTokenType}>('auth_token_issued', {\n  description: 'Tokens issued by token type',\n});\n\nconst tokenVerifiedCount = meter.createCounter<{\n  token_type: AuthTokenType;\n  outcome: AuthTokenVerificationOutcome;\n}>('auth_token_verified', {description: 'Token verification attempts by token type and outcome'});\n\nconst tokenRefreshedCount = meter.createCounter<{outcome: AuthTokenRefreshOutcome}>(\n  'auth_token_refreshed',\n  {description: 'Refresh-token exchanges by outcome'},\n);\n\nconst rateLimitCheckCount = meter.createCounter<{\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}>('auth_rate_limit_checks', {\n  description: 'Authentication rate limit checks by action, scope, and outcome',\n});\n\nconst rateLimitPruneFailureCount = meter.createCounter('auth_rate_limit_prune_failures', {\n  description: 'Authentication rate limit prune failures',\n});\n\nfunction recordMetric(record: () => void): void {\n  try {\n    record();\n  } catch {\n    // Metrics must not affect authentication outcomes.\n  }\n}\n\nexport function recordTokenIssued(tokenType: AuthTokenType): void {\n  recordMetric(() => tokenIssuedCount.add(1, {token_type: tokenType}));\n}\n\nexport function recordTokenVerified(\n  tokenType: AuthTokenType,\n  outcome: AuthTokenVerificationOutcome,\n): void {\n  recordMetric(() => tokenVerifiedCount.add(1, {token_type: tokenType, outcome}));\n}\n\nexport function recordTokenRefreshed(outcome: AuthTokenRefreshOutcome): void {\n  recordMetric(() => tokenRefreshedCount.add(1, {outcome}));\n}\n\nexport function recordAuthRateLimitCheck(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}): void {\n  recordMetric(() =>\n    rateLimitCheckCount.add(1, {\n      action: params.action,\n      scope: params.scope,\n      outcome: params.outcome,\n    }),\n  );\n}\n\nexport function recordAuthRateLimitPruneFailure(): void {\n  recordMetric(() => rateLimitPruneFailureCount.add(1));\n}\n"],"names":["instanceMetrics","meter","getMeter","tokenIssuedCount","createCounter","description","tokenVerifiedCount","tokenRefreshedCount","rateLimitCheckCount","rateLimitPruneFailureCount","recordMetric","record","recordTokenIssued","tokenType","add","token_type","recordTokenVerified","outcome","recordTokenRefreshed","recordAuthRateLimitCheck","params","action","scope","recordAuthRateLimitPruneFailure"],"mappings":"AAAA,SAAQA,eAAe,QAAO,8BAA8B;AAS5D,MAAMC,QAAQD,gBAAgBE,QAAQ,CAAC;AAEvC,MAAMC,mBAAmBF,MAAMG,aAAa,CAA8B,qBAAqB;IAC7FC,aAAa;AACf;AAEA,MAAMC,qBAAqBL,MAAMG,aAAa,CAG3C,uBAAuB;IAACC,aAAa;AAAuD;AAE/F,MAAME,sBAAsBN,MAAMG,aAAa,CAC7C,wBACA;IAACC,aAAa;AAAoC;AAGpD,MAAMG,sBAAsBP,MAAMG,aAAa,CAI5C,0BAA0B;IAC3BC,aAAa;AACf;AAEA,MAAMI,6BAA6BR,MAAMG,aAAa,CAAC,kCAAkC;IACvFC,aAAa;AACf;AAEA,SAASK,aAAaC,MAAkB;IACtC,IAAI;QACFA;IACF,EAAE,OAAM;IACN,mDAAmD;IACrD;AACF;AAEA,OAAO,SAASC,kBAAkBC,SAAwB;IACxDH,aAAa,IAAMP,iBAAiBW,GAAG,CAAC,GAAG;YAACC,YAAYF;QAAS;AACnE;AAEA,OAAO,SAASG,oBACdH,SAAwB,EACxBI,OAAqC;IAErCP,aAAa,IAAMJ,mBAAmBQ,GAAG,CAAC,GAAG;YAACC,YAAYF;YAAWI;QAAO;AAC9E;AAEA,OAAO,SAASC,qBAAqBD,OAAgC;IACnEP,aAAa,IAAMH,oBAAoBO,GAAG,CAAC,GAAG;YAACG;QAAO;AACxD;AAEA,OAAO,SAASE,yBAAyBC,MAIxC;IACCV,aAAa,IACXF,oBAAoBM,GAAG,CAAC,GAAG;YACzBO,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBL,SAASG,OAAOH,OAAO;QACzB;AAEJ;AAEA,OAAO,SAASM;IACdb,aAAa,IAAMD,2BAA2BK,GAAG,CAAC;AACpD"}

package/dist/presentation/dto/user.d.ts

@@ -1,8 +1,9 @@
-import type { LoginResponseDto, UserDto } from '@shipfox/api-auth-dto';
+import type { AdminRole, LoginResponseDto, UserDto } from '@shipfox/api-auth-dto';
 import type { User } from '#core/entities/user.js';
 export declare function toUserDto(user: User): UserDto;
 export declare function toAuthSessionDto(result: {
     token: string;
     user: User;
+    adminRole?: AdminRole | null;
 }): LoginResponseDto;
 //# sourceMappingURL=user.d.ts.map

package/dist/presentation/dto/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/presentation/dto/user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,gBAAgB,EAAE,OAAO,EAAC,MAAM,uBAAuB,CAAC;AACrE,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAU7C;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAC,GAAG,gBAAgB,CAKtF"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/presentation/dto/user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAC,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAU7C;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CAC9B,GAAG,gBAAgB,CAMnB"}

package/dist/presentation/dto/user.js

@@ -12,7 +12,8 @@ export function toUserDto(user) {
 export function toAuthSessionDto(result) {
     return {
         token: result.token,
-        user: toUserDto(result.user)
+        user: toUserDto(result.user),
+        admin_role: result.adminRole ?? null
     };
 }
 

package/dist/presentation/dto/user.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/dto/user.ts"],"sourcesContent":["import type {LoginResponseDto, UserDto} from '@shipfox/api-auth-dto';\nimport type {User} from '#core/entities/user.js';\n\nexport function toUserDto(user: User): UserDto {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    email_verified_at: user.emailVerifiedAt ? user.emailVerifiedAt.toISOString() : null,\n    status: user.status,\n    created_at: user.createdAt.toISOString(),\n    updated_at: user.updatedAt.toISOString(),\n  };\n}\n\nexport function toAuthSessionDto(result: {token: string; user: User}): LoginResponseDto {\n  return {\n    token: result.token,\n    user: toUserDto(result.user),\n  };\n}\n"],"names":["toUserDto","user","id","email","name","email_verified_at","emailVerifiedAt","toISOString","status","created_at","createdAt","updated_at","updatedAt","toAuthSessionDto","result","token"],"mappings":"AAGA,OAAO,SAASA,UAAUC,IAAU;IAClC,OAAO;QACLC,IAAID,KAAKC,EAAE;QACXC,OAAOF,KAAKE,KAAK;QACjBC,MAAMH,KAAKG,IAAI;QACfC,mBAAmBJ,KAAKK,eAAe,GAAGL,KAAKK,eAAe,CAACC,WAAW,KAAK;QAC/EC,QAAQP,KAAKO,MAAM;QACnBC,YAAYR,KAAKS,SAAS,CAACH,WAAW;QACtCI,YAAYV,KAAKW,SAAS,CAACL,WAAW;IACxC;AACF;AAEA,OAAO,SAASM,iBAAiBC,MAAmC;IAClE,OAAO;QACLC,OAAOD,OAAOC,KAAK;QACnBd,MAAMD,UAAUc,OAAOb,IAAI;IAC7B;AACF"}
+{"version":3,"sources":["../../../src/presentation/dto/user.ts"],"sourcesContent":["import type {AdminRole, LoginResponseDto, UserDto} from '@shipfox/api-auth-dto';\nimport type {User} from '#core/entities/user.js';\n\nexport function toUserDto(user: User): UserDto {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    email_verified_at: user.emailVerifiedAt ? user.emailVerifiedAt.toISOString() : null,\n    status: user.status,\n    created_at: user.createdAt.toISOString(),\n    updated_at: user.updatedAt.toISOString(),\n  };\n}\n\nexport function toAuthSessionDto(result: {\n  token: string;\n  user: User;\n  adminRole?: AdminRole | null;\n}): LoginResponseDto {\n  return {\n    token: result.token,\n    user: toUserDto(result.user),\n    admin_role: result.adminRole ?? null,\n  };\n}\n"],"names":["toUserDto","user","id","email","name","email_verified_at","emailVerifiedAt","toISOString","status","created_at","createdAt","updated_at","updatedAt","toAuthSessionDto","result","token","admin_role","adminRole"],"mappings":"AAGA,OAAO,SAASA,UAAUC,IAAU;IAClC,OAAO;QACLC,IAAID,KAAKC,EAAE;QACXC,OAAOF,KAAKE,KAAK;QACjBC,MAAMH,KAAKG,IAAI;QACfC,mBAAmBJ,KAAKK,eAAe,GAAGL,KAAKK,eAAe,CAACC,WAAW,KAAK;QAC/EC,QAAQP,KAAKO,MAAM;QACnBC,YAAYR,KAAKS,SAAS,CAACH,WAAW;QACtCI,YAAYV,KAAKW,SAAS,CAACL,WAAW;IACxC;AACF;AAEA,OAAO,SAASM,iBAAiBC,MAIhC;IACC,OAAO;QACLC,OAAOD,OAAOC,KAAK;QACnBd,MAAMD,UAAUc,OAAOb,IAAI;QAC3Be,YAAYF,OAAOG,SAAS,IAAI;IAClC;AACF"}

package/dist/presentation/inter-module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inter-module.d.ts","sourceRoot":"","sources":["../../src/presentation/inter-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,uBAAuB,EAAC,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAgC,KAAK,uBAAuB,EAAC,MAAM,uBAAuB,CAAC;AAIlG,wBAAgB,iCAAiC,IAAI,uBAAuB,CAC1E,OAAO,uBAAuB,CAC/B,CAKA"}
+{"version":3,"file":"inter-module.d.ts","sourceRoot":"","sources":["../../src/presentation/inter-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,uBAAuB,EAAC,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,wBAAgB,iCAAiC,IAAI,uBAAuB,CAC1E,OAAO,uBAAuB,CAC/B,CAoBA"}

package/dist/presentation/inter-module.js

@@ -1,5 +1,7 @@
 import { authInterModuleContract } from '@shipfox/api-auth-dto/inter-module';
-import { defineInterModulePresentation } from '@shipfox/inter-module';
+import { createInterModuleKnownError, defineInterModulePresentation } from '@shipfox/inter-module';
+import { getCurrentAdminRole, requireAdminRole } from '#core/admin-role.js';
+import { AdminRoleRequiredError } from '#core/errors.js';
 import { issueJobLeaseToken } from '#core/job-lease-token.js';
 import { issueRunnerSessionToken } from '#core/runner-session-token.js';
 export function createAuthInterModulePresentation() {
@@ -9,7 +11,29 @@ export function createAuthInterModulePresentation() {
             }),
         mintJobLeaseToken: async (claims)=>({
                 token: await issueJobLeaseToken(claims)
-            })
+            }),
+        getCurrentAdminRole: async ({ userId })=>({
+                role: await getCurrentAdminRole({
+                    userId
+                })
+            }),
+        requireAdminRole: async ({ userId, minimumRole })=>{
+            try {
+                return {
+                    role: await requireAdminRole({
+                        userId,
+                        minimumRole
+                    })
+                };
+            } catch (error) {
+                if (error instanceof AdminRoleRequiredError) {
+                    throw createInterModuleKnownError(authInterModuleContract.methods.requireAdminRole, 'admin-role-required', {
+                        requiredRole: error.minimumRole
+                    });
+                }
+                throw error;
+            }
+        }
     });
 }
 

package/dist/presentation/inter-module.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/presentation/inter-module.ts"],"sourcesContent":["import {authInterModuleContract} from '@shipfox/api-auth-dto/inter-module';\nimport {defineInterModulePresentation, type InterModulePresentation} from '@shipfox/inter-module';\nimport {issueJobLeaseToken} from '#core/job-lease-token.js';\nimport {issueRunnerSessionToken} from '#core/runner-session-token.js';\n\nexport function createAuthInterModulePresentation(): InterModulePresentation<\n  typeof authInterModuleContract\n> {\n  return defineInterModulePresentation(authInterModuleContract, {\n    mintRunnerSessionToken: async (claims) => ({token: await issueRunnerSessionToken(claims)}),\n    mintJobLeaseToken: async (claims) => ({token: await issueJobLeaseToken(claims)}),\n  });\n}\n"],"names":["authInterModuleContract","defineInterModulePresentation","issueJobLeaseToken","issueRunnerSessionToken","createAuthInterModulePresentation","mintRunnerSessionToken","claims","token","mintJobLeaseToken"],"mappings":"AAAA,SAAQA,uBAAuB,QAAO,qCAAqC;AAC3E,SAAQC,6BAA6B,QAAqC,wBAAwB;AAClG,SAAQC,kBAAkB,QAAO,2BAA2B;AAC5D,SAAQC,uBAAuB,QAAO,gCAAgC;AAEtE,OAAO,SAASC;IAGd,OAAOH,8BAA8BD,yBAAyB;QAC5DK,wBAAwB,OAAOC,SAAY,CAAA;gBAACC,OAAO,MAAMJ,wBAAwBG;YAAO,CAAA;QACxFE,mBAAmB,OAAOF,SAAY,CAAA;gBAACC,OAAO,MAAML,mBAAmBI;YAAO,CAAA;IAChF;AACF"}
+{"version":3,"sources":["../../src/presentation/inter-module.ts"],"sourcesContent":["import {authInterModuleContract} from '@shipfox/api-auth-dto/inter-module';\nimport {\n  createInterModuleKnownError,\n  defineInterModulePresentation,\n  type InterModulePresentation,\n} from '@shipfox/inter-module';\nimport {getCurrentAdminRole, requireAdminRole} from '#core/admin-role.js';\nimport {AdminRoleRequiredError} from '#core/errors.js';\nimport {issueJobLeaseToken} from '#core/job-lease-token.js';\nimport {issueRunnerSessionToken} from '#core/runner-session-token.js';\n\nexport function createAuthInterModulePresentation(): InterModulePresentation<\n  typeof authInterModuleContract\n> {\n  return defineInterModulePresentation(authInterModuleContract, {\n    mintRunnerSessionToken: async (claims) => ({token: await issueRunnerSessionToken(claims)}),\n    mintJobLeaseToken: async (claims) => ({token: await issueJobLeaseToken(claims)}),\n    getCurrentAdminRole: async ({userId}) => ({role: await getCurrentAdminRole({userId})}),\n    requireAdminRole: async ({userId, minimumRole}) => {\n      try {\n        return {role: await requireAdminRole({userId, minimumRole})};\n      } catch (error) {\n        if (error instanceof AdminRoleRequiredError) {\n          throw createInterModuleKnownError(\n            authInterModuleContract.methods.requireAdminRole,\n            'admin-role-required',\n            {requiredRole: error.minimumRole},\n          );\n        }\n        throw error;\n      }\n    },\n  });\n}\n"],"names":["authInterModuleContract","createInterModuleKnownError","defineInterModulePresentation","getCurrentAdminRole","requireAdminRole","AdminRoleRequiredError","issueJobLeaseToken","issueRunnerSessionToken","createAuthInterModulePresentation","mintRunnerSessionToken","claims","token","mintJobLeaseToken","userId","role","minimumRole","error","methods","requiredRole"],"mappings":"AAAA,SAAQA,uBAAuB,QAAO,qCAAqC;AAC3E,SACEC,2BAA2B,EAC3BC,6BAA6B,QAExB,wBAAwB;AAC/B,SAAQC,mBAAmB,EAAEC,gBAAgB,QAAO,sBAAsB;AAC1E,SAAQC,sBAAsB,QAAO,kBAAkB;AACvD,SAAQC,kBAAkB,QAAO,2BAA2B;AAC5D,SAAQC,uBAAuB,QAAO,gCAAgC;AAEtE,OAAO,SAASC;IAGd,OAAON,8BAA8BF,yBAAyB;QAC5DS,wBAAwB,OAAOC,SAAY,CAAA;gBAACC,OAAO,MAAMJ,wBAAwBG;YAAO,CAAA;QACxFE,mBAAmB,OAAOF,SAAY,CAAA;gBAACC,OAAO,MAAML,mBAAmBI;YAAO,CAAA;QAC9EP,qBAAqB,OAAO,EAACU,MAAM,EAAC,GAAM,CAAA;gBAACC,MAAM,MAAMX,oBAAoB;oBAACU;gBAAM;YAAE,CAAA;QACpFT,kBAAkB,OAAO,EAACS,MAAM,EAAEE,WAAW,EAAC;YAC5C,IAAI;gBACF,OAAO;oBAACD,MAAM,MAAMV,iBAAiB;wBAACS;wBAAQE;oBAAW;gBAAE;YAC7D,EAAE,OAAOC,OAAO;gBACd,IAAIA,iBAAiBX,wBAAwB;oBAC3C,MAAMJ,4BACJD,wBAAwBiB,OAAO,CAACb,gBAAgB,EAChD,uBACA;wBAACc,cAAcF,MAAMD,WAAW;oBAAA;gBAEpC;gBACA,MAAMC;YACR;QACF;IACF;AACF"}

package/dist/presentation/routes/administration.d.ts

@@ -0,0 +1,3 @@
+import { type RouteGroup } from '@shipfox/node-fastify';
+export declare const administrationRoutes: RouteGroup;
+//# sourceMappingURL=administration.d.ts.map

package/dist/presentation/routes/administration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"administration.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/administration.ts"],"names":[],"mappings":"AAUA,OAAO,EAA2B,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAoLhF,eAAO,MAAM,oBAAoB,EAAE,UAIlC,CAAC"}