@shipfox/api-auth 9.1.0 → 9.3.0

package/dist/presentation/routes/administration.js

@@ -0,0 +1,186 @@
+import { AUTH_USER } from '@shipfox/api-auth-context';
+import { bootstrapAdminOwnerBodySchema, bootstrapAdminOwnerResponseSchema, grantAdminRoleBodySchema, grantAdminRoleResponseSchema, listAdminGrantsResponseSchema, revokeAdminGrantBodySchema, revokeAdminGrantResponseSchema } from '@shipfox/api-auth-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { z } from 'zod';
+import { bootstrapFirstAdminOwner, grantAdministratorRole, listAdministratorGrants, revokeAdministratorGrant } from '#core/administration.js';
+import { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, InvalidAdminBootstrapTokenError, LastAdminOwnerError, UserNotFoundError } from '#core/errors.js';
+import { getClientContext } from '#presentation/auth/jwt-auth.js';
+import { createAuthIpRateLimitPreHandler } from './rate-limit.js';
+const idempotencyKeyMaxLength = 256;
+function requireActorId(request) {
+    const client = getClientContext(request);
+    if (!client) {
+        throw new ClientError('Authentication required', 'unauthorized', {
+            status: 401
+        });
+    }
+    return client.userId;
+}
+function requireIdempotencyKey(request) {
+    const value = request.headers['idempotency-key'];
+    const key = Array.isArray(value) ? value[0] : value;
+    if (!key || key.trim().length === 0 || key.length > idempotencyKeyMaxLength) {
+        throw new ClientError('Idempotency-Key header is required', 'idempotency-key-required', {
+            status: 400
+        });
+    }
+    return key;
+}
+function toAdminGrantDto(grant) {
+    return {
+        id: grant.id,
+        user_id: grant.userId,
+        role: grant.role,
+        revoked_at: grant.revokedAt?.toISOString() ?? null,
+        created_at: grant.createdAt.toISOString(),
+        updated_at: grant.updatedAt.toISOString()
+    };
+}
+function translateAdministrationError(error) {
+    if (error instanceof AdminRoleRequiredError) {
+        throw new ClientError('Administrator owner role required', 'forbidden', {
+            status: 403,
+            details: {
+                required_role: error.minimumRole
+            }
+        });
+    }
+    if (error instanceof InvalidAdminBootstrapTokenError) {
+        throw new ClientError('Bootstrap token is invalid', 'bootstrap-token-invalid', {
+            status: 403
+        });
+    }
+    if (error instanceof AdminBootstrapClosedError) {
+        throw new ClientError('First administrator owner already exists', 'bootstrap-closed', {
+            status: 409
+        });
+    }
+    if (error instanceof AdminGrantAlreadyExistsError) {
+        throw new ClientError('Administrator grant already exists', 'grant-already-exists', {
+            status: 409
+        });
+    }
+    if (error instanceof AdminGrantNotFoundError) {
+        throw new ClientError('Administrator grant not found', 'not-found', {
+            status: 404
+        });
+    }
+    if (error instanceof UserNotFoundError) {
+        throw new ClientError('User not found', 'not-found', {
+            status: 404
+        });
+    }
+    if (error instanceof LastAdminOwnerError) {
+        throw new ClientError('Cannot remove the final active administrator owner', 'last-owner', {
+            status: 409
+        });
+    }
+    if (error instanceof AdminIdempotencyKeyReuseError) {
+        throw new ClientError('Idempotency-Key was already used for a different command', 'idempotency-key-reused', {
+            status: 409
+        });
+    }
+    throw error;
+}
+const bootstrapRoute = defineRoute({
+    method: 'POST',
+    path: '/bootstrap',
+    description: 'Claim the first administrator owner role with the deployment bootstrap token.',
+    schema: {
+        body: bootstrapAdminOwnerBodySchema,
+        response: {
+            201: bootstrapAdminOwnerResponseSchema
+        }
+    },
+    preHandler: createAuthIpRateLimitPreHandler('bootstrap'),
+    errorHandler: translateAdministrationError,
+    handler: async (request, reply)=>{
+        const actorId = requireActorId(request);
+        const grant = await bootstrapFirstAdminOwner({
+            actorId,
+            bootstrapToken: request.body.bootstrap_token,
+            idempotencyKey: requireIdempotencyKey(request),
+            correlationId: request.id
+        });
+        reply.code(201);
+        return toAdminGrantDto(grant);
+    }
+});
+const listRoute = defineRoute({
+    method: 'GET',
+    path: '/',
+    description: 'List local administrator grants.',
+    schema: {
+        response: {
+            200: listAdminGrantsResponseSchema
+        }
+    },
+    errorHandler: translateAdministrationError,
+    handler: async (request)=>({
+            grants: (await listAdministratorGrants({
+                actorId: requireActorId(request)
+            })).map(toAdminGrantDto)
+        })
+});
+const grantRoute = defineRoute({
+    method: 'POST',
+    path: '/',
+    description: 'Grant a local administrator role to an active user.',
+    schema: {
+        body: grantAdminRoleBodySchema,
+        response: {
+            201: grantAdminRoleResponseSchema
+        }
+    },
+    errorHandler: translateAdministrationError,
+    handler: async (request, reply)=>{
+        const actorId = requireActorId(request);
+        const grant = await grantAdministratorRole({
+            actorId,
+            userId: request.body.user_id,
+            role: request.body.role,
+            reason: request.body.reason,
+            idempotencyKey: requireIdempotencyKey(request),
+            correlationId: request.id
+        });
+        reply.code(201);
+        return toAdminGrantDto(grant);
+    }
+});
+const revokeRoute = defineRoute({
+    method: 'DELETE',
+    path: '/:grantId',
+    description: 'Revoke a local administrator grant.',
+    schema: {
+        params: z.object({
+            grantId: z.string().uuid()
+        }),
+        body: revokeAdminGrantBodySchema,
+        response: {
+            200: revokeAdminGrantResponseSchema
+        }
+    },
+    errorHandler: translateAdministrationError,
+    handler: async (request)=>{
+        const grant = await revokeAdministratorGrant({
+            actorId: requireActorId(request),
+            grantId: request.params.grantId,
+            reason: request.body.reason,
+            idempotencyKey: requireIdempotencyKey(request),
+            correlationId: request.id
+        });
+        return toAdminGrantDto(grant);
+    }
+});
+export const administrationRoutes = {
+    prefix: '/admin/v1/auth/admin-grants',
+    auth: AUTH_USER,
+    routes: [
+        bootstrapRoute,
+        listRoute,
+        grantRoute,
+        revokeRoute
+    ]
+};
+
+//# sourceMappingURL=administration.js.map

package/dist/presentation/routes/administration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/administration.ts"],"sourcesContent":["import {AUTH_USER} from '@shipfox/api-auth-context';\nimport {\n  bootstrapAdminOwnerBodySchema,\n  bootstrapAdminOwnerResponseSchema,\n  grantAdminRoleBodySchema,\n  grantAdminRoleResponseSchema,\n  listAdminGrantsResponseSchema,\n  revokeAdminGrantBodySchema,\n  revokeAdminGrantResponseSchema,\n} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport type {FastifyRequest} from 'fastify';\nimport {z} from 'zod';\nimport {\n  bootstrapFirstAdminOwner,\n  grantAdministratorRole,\n  listAdministratorGrants,\n  revokeAdministratorGrant,\n} from '#core/administration.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  InvalidAdminBootstrapTokenError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {createAuthIpRateLimitPreHandler} from './rate-limit.js';\n\nconst idempotencyKeyMaxLength = 256;\n\nfunction requireActorId(request: FastifyRequest): string {\n  const client = getClientContext(request);\n  if (!client) {\n    throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n  }\n  return client.userId;\n}\n\nfunction requireIdempotencyKey(request: FastifyRequest): string {\n  const value = request.headers['idempotency-key'];\n  const key = Array.isArray(value) ? value[0] : value;\n  if (!key || key.trim().length === 0 || key.length > idempotencyKeyMaxLength) {\n    throw new ClientError('Idempotency-Key header is required', 'idempotency-key-required', {\n      status: 400,\n    });\n  }\n  return key;\n}\n\nfunction toAdminGrantDto(grant: AdminGrant) {\n  return {\n    id: grant.id,\n    user_id: grant.userId,\n    role: grant.role,\n    revoked_at: grant.revokedAt?.toISOString() ?? null,\n    created_at: grant.createdAt.toISOString(),\n    updated_at: grant.updatedAt.toISOString(),\n  };\n}\n\nfunction translateAdministrationError(error: unknown): never {\n  if (error instanceof AdminRoleRequiredError) {\n    throw new ClientError('Administrator owner role required', 'forbidden', {\n      status: 403,\n      details: {required_role: error.minimumRole},\n    });\n  }\n  if (error instanceof InvalidAdminBootstrapTokenError) {\n    throw new ClientError('Bootstrap token is invalid', 'bootstrap-token-invalid', {\n      status: 403,\n    });\n  }\n  if (error instanceof AdminBootstrapClosedError) {\n    throw new ClientError('First administrator owner already exists', 'bootstrap-closed', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantAlreadyExistsError) {\n    throw new ClientError('Administrator grant already exists', 'grant-already-exists', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminGrantNotFoundError) {\n    throw new ClientError('Administrator grant not found', 'not-found', {status: 404});\n  }\n  if (error instanceof UserNotFoundError) {\n    throw new ClientError('User not found', 'not-found', {status: 404});\n  }\n  if (error instanceof LastAdminOwnerError) {\n    throw new ClientError('Cannot remove the final active administrator owner', 'last-owner', {\n      status: 409,\n    });\n  }\n  if (error instanceof AdminIdempotencyKeyReuseError) {\n    throw new ClientError(\n      'Idempotency-Key was already used for a different command',\n      'idempotency-key-reused',\n      {status: 409},\n    );\n  }\n  throw error;\n}\n\nconst bootstrapRoute = defineRoute({\n  method: 'POST',\n  path: '/bootstrap',\n  description: 'Claim the first administrator owner role with the deployment bootstrap token.',\n  schema: {\n    body: bootstrapAdminOwnerBodySchema,\n    response: {201: bootstrapAdminOwnerResponseSchema},\n  },\n  preHandler: createAuthIpRateLimitPreHandler('bootstrap'),\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await bootstrapFirstAdminOwner({\n      actorId,\n      bootstrapToken: request.body.bootstrap_token,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst listRoute = defineRoute({\n  method: 'GET',\n  path: '/',\n  description: 'List local administrator grants.',\n  schema: {response: {200: listAdminGrantsResponseSchema}},\n  errorHandler: translateAdministrationError,\n  handler: async (request) => ({\n    grants: (await listAdministratorGrants({actorId: requireActorId(request)})).map(\n      toAdminGrantDto,\n    ),\n  }),\n});\n\nconst grantRoute = defineRoute({\n  method: 'POST',\n  path: '/',\n  description: 'Grant a local administrator role to an active user.',\n  schema: {\n    body: grantAdminRoleBodySchema,\n    response: {201: grantAdminRoleResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request, reply) => {\n    const actorId = requireActorId(request);\n    const grant = await grantAdministratorRole({\n      actorId,\n      userId: request.body.user_id,\n      role: request.body.role,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    reply.code(201);\n    return toAdminGrantDto(grant);\n  },\n});\n\nconst revokeRoute = defineRoute({\n  method: 'DELETE',\n  path: '/:grantId',\n  description: 'Revoke a local administrator grant.',\n  schema: {\n    params: z.object({grantId: z.string().uuid()}),\n    body: revokeAdminGrantBodySchema,\n    response: {200: revokeAdminGrantResponseSchema},\n  },\n  errorHandler: translateAdministrationError,\n  handler: async (request) => {\n    const grant = await revokeAdministratorGrant({\n      actorId: requireActorId(request),\n      grantId: request.params.grantId,\n      reason: request.body.reason,\n      idempotencyKey: requireIdempotencyKey(request),\n      correlationId: request.id,\n    });\n    return toAdminGrantDto(grant);\n  },\n});\n\nexport const administrationRoutes: RouteGroup = {\n  prefix: '/admin/v1/auth/admin-grants',\n  auth: AUTH_USER,\n  routes: [bootstrapRoute, listRoute, grantRoute, revokeRoute],\n};\n"],"names":["AUTH_USER","bootstrapAdminOwnerBodySchema","bootstrapAdminOwnerResponseSchema","grantAdminRoleBodySchema","grantAdminRoleResponseSchema","listAdminGrantsResponseSchema","revokeAdminGrantBodySchema","revokeAdminGrantResponseSchema","ClientError","defineRoute","z","bootstrapFirstAdminOwner","grantAdministratorRole","listAdministratorGrants","revokeAdministratorGrant","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","InvalidAdminBootstrapTokenError","LastAdminOwnerError","UserNotFoundError","getClientContext","createAuthIpRateLimitPreHandler","idempotencyKeyMaxLength","requireActorId","request","client","status","userId","requireIdempotencyKey","value","headers","key","Array","isArray","trim","length","toAdminGrantDto","grant","id","user_id","role","revoked_at","revokedAt","toISOString","created_at","createdAt","updated_at","updatedAt","translateAdministrationError","error","details","required_role","minimumRole","bootstrapRoute","method","path","description","schema","body","response","preHandler","errorHandler","handler","reply","actorId","bootstrapToken","bootstrap_token","idempotencyKey","correlationId","code","listRoute","grants","map","grantRoute","reason","revokeRoute","params","object","grantId","string","uuid","administrationRoutes","prefix","auth","routes"],"mappings":"AAAA,SAAQA,SAAS,QAAO,4BAA4B;AACpD,SACEC,6BAA6B,EAC7BC,iCAAiC,EACjCC,wBAAwB,EACxBC,4BAA4B,EAC5BC,6BAA6B,EAC7BC,0BAA0B,EAC1BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,WAAW,EAAEC,WAAW,QAAwB,wBAAwB;AAEhF,SAAQC,CAAC,QAAO,MAAM;AACtB,SACEC,wBAAwB,EACxBC,sBAAsB,EACtBC,uBAAuB,EACvBC,wBAAwB,QACnB,0BAA0B;AAEjC,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,+BAA+B,EAC/BC,mBAAmB,EACnBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,+BAA+B,QAAO,kBAAkB;AAEhE,MAAMC,0BAA0B;AAEhC,SAASC,eAAeC,OAAuB;IAC7C,MAAMC,SAASL,iBAAiBI;IAChC,IAAI,CAACC,QAAQ;QACX,MAAM,IAAIpB,YAAY,2BAA2B,gBAAgB;YAACqB,QAAQ;QAAG;IAC/E;IACA,OAAOD,OAAOE,MAAM;AACtB;AAEA,SAASC,sBAAsBJ,OAAuB;IACpD,MAAMK,QAAQL,QAAQM,OAAO,CAAC,kBAAkB;IAChD,MAAMC,MAAMC,MAAMC,OAAO,CAACJ,SAASA,KAAK,CAAC,EAAE,GAAGA;IAC9C,IAAI,CAACE,OAAOA,IAAIG,IAAI,GAAGC,MAAM,KAAK,KAAKJ,IAAII,MAAM,GAAGb,yBAAyB;QAC3E,MAAM,IAAIjB,YAAY,sCAAsC,4BAA4B;YACtFqB,QAAQ;QACV;IACF;IACA,OAAOK;AACT;AAEA,SAASK,gBAAgBC,KAAiB;IACxC,OAAO;QACLC,IAAID,MAAMC,EAAE;QACZC,SAASF,MAAMV,MAAM;QACrBa,MAAMH,MAAMG,IAAI;QAChBC,YAAYJ,MAAMK,SAAS,EAAEC,iBAAiB;QAC9CC,YAAYP,MAAMQ,SAAS,CAACF,WAAW;QACvCG,YAAYT,MAAMU,SAAS,CAACJ,WAAW;IACzC;AACF;AAEA,SAASK,6BAA6BC,KAAc;IAClD,IAAIA,iBAAiBjC,wBAAwB;QAC3C,MAAM,IAAIX,YAAY,qCAAqC,aAAa;YACtEqB,QAAQ;YACRwB,SAAS;gBAACC,eAAeF,MAAMG,WAAW;YAAA;QAC5C;IACF;IACA,IAAIH,iBAAiBhC,iCAAiC;QACpD,MAAM,IAAIZ,YAAY,8BAA8B,2BAA2B;YAC7EqB,QAAQ;QACV;IACF;IACA,IAAIuB,iBAAiBrC,2BAA2B;QAC9C,MAAM,IAAIP,YAAY,4CAA4C,oBAAoB;YACpFqB,QAAQ;QACV;IACF;IACA,IAAIuB,iBAAiBpC,8BAA8B;QACjD,MAAM,IAAIR,YAAY,sCAAsC,wBAAwB;YAClFqB,QAAQ;QACV;IACF;IACA,IAAIuB,iBAAiBnC,yBAAyB;QAC5C,MAAM,IAAIT,YAAY,iCAAiC,aAAa;YAACqB,QAAQ;QAAG;IAClF;IACA,IAAIuB,iBAAiB9B,mBAAmB;QACtC,MAAM,IAAId,YAAY,kBAAkB,aAAa;YAACqB,QAAQ;QAAG;IACnE;IACA,IAAIuB,iBAAiB/B,qBAAqB;QACxC,MAAM,IAAIb,YAAY,sDAAsD,cAAc;YACxFqB,QAAQ;QACV;IACF;IACA,IAAIuB,iBAAiBlC,+BAA+B;QAClD,MAAM,IAAIV,YACR,4DACA,0BACA;YAACqB,QAAQ;QAAG;IAEhB;IACA,MAAMuB;AACR;AAEA,MAAMI,iBAAiB/C,YAAY;IACjCgD,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAM5D;QACN6D,UAAU;YAAC,KAAK5D;QAAiC;IACnD;IACA6D,YAAYvC,gCAAgC;IAC5CwC,cAAcb;IACdc,SAAS,OAAOtC,SAASuC;QACvB,MAAMC,UAAUzC,eAAeC;QAC/B,MAAMa,QAAQ,MAAM7B,yBAAyB;YAC3CwD;YACAC,gBAAgBzC,QAAQkC,IAAI,CAACQ,eAAe;YAC5CC,gBAAgBvC,sBAAsBJ;YACtC4C,eAAe5C,QAAQc,EAAE;QAC3B;QACAyB,MAAMM,IAAI,CAAC;QACX,OAAOjC,gBAAgBC;IACzB;AACF;AAEA,MAAMiC,YAAYhE,YAAY;IAC5BgD,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QAACE,UAAU;YAAC,KAAKzD;QAA6B;IAAC;IACvD2D,cAAcb;IACdc,SAAS,OAAOtC,UAAa,CAAA;YAC3B+C,QAAQ,AAAC,CAAA,MAAM7D,wBAAwB;gBAACsD,SAASzC,eAAeC;YAAQ,EAAC,EAAGgD,GAAG,CAC7EpC;QAEJ,CAAA;AACF;AAEA,MAAMqC,aAAanE,YAAY;IAC7BgD,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNC,MAAM1D;QACN2D,UAAU;YAAC,KAAK1D;QAA4B;IAC9C;IACA4D,cAAcb;IACdc,SAAS,OAAOtC,SAASuC;QACvB,MAAMC,UAAUzC,eAAeC;QAC/B,MAAMa,QAAQ,MAAM5B,uBAAuB;YACzCuD;YACArC,QAAQH,QAAQkC,IAAI,CAACnB,OAAO;YAC5BC,MAAMhB,QAAQkC,IAAI,CAAClB,IAAI;YACvBkC,QAAQlD,QAAQkC,IAAI,CAACgB,MAAM;YAC3BP,gBAAgBvC,sBAAsBJ;YACtC4C,eAAe5C,QAAQc,EAAE;QAC3B;QACAyB,MAAMM,IAAI,CAAC;QACX,OAAOjC,gBAAgBC;IACzB;AACF;AAEA,MAAMsC,cAAcrE,YAAY;IAC9BgD,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,QAAQ;QACNmB,QAAQrE,EAAEsE,MAAM,CAAC;YAACC,SAASvE,EAAEwE,MAAM,GAAGC,IAAI;QAAE;QAC5CtB,MAAMvD;QACNwD,UAAU;YAAC,KAAKvD;QAA8B;IAChD;IACAyD,cAAcb;IACdc,SAAS,OAAOtC;QACd,MAAMa,QAAQ,MAAM1B,yBAAyB;YAC3CqD,SAASzC,eAAeC;YACxBsD,SAAStD,QAAQoD,MAAM,CAACE,OAAO;YAC/BJ,QAAQlD,QAAQkC,IAAI,CAACgB,MAAM;YAC3BP,gBAAgBvC,sBAAsBJ;YACtC4C,eAAe5C,QAAQc,EAAE;QAC3B;QACA,OAAOF,gBAAgBC;IACzB;AACF;AAEA,OAAO,MAAM4C,uBAAmC;IAC9CC,QAAQ;IACRC,MAAMtF;IACNuF,QAAQ;QAAC/B;QAAgBiB;QAAWG;QAAYE;KAAY;AAC9D,EAAE"}

package/dist/presentation/routes/index.d.ts

@@ -1,4 +1,5 @@
 import type { WorkspacesInterModuleClient } from '@shipfox/api-workspaces-dto/inter-module';
 import type { RouteGroup } from '@shipfox/node-fastify';
-export declare function buildAuthRoutes(passwordEnabled: boolean, workspaces: WorkspacesInterModuleClient): RouteGroup;
+import type { SignupPolicy } from '#core/ports.js';
+export declare function buildAuthRoutes(passwordEnabled: boolean, workspaces: WorkspacesInterModuleClient, signupPolicy?: SignupPolicy): RouteGroup;
 //# sourceMappingURL=index.d.ts.map

package/dist/presentation/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAC1F,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAatD,wBAAgB,eAAe,CAC7B,eAAe,EAAE,OAAO,EACxB,UAAU,EAAE,2BAA2B,GACtC,UAAU,CA2BZ"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAC1F,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAajD,wBAAgB,eAAe,CAC7B,eAAe,EAAE,OAAO,EACxB,UAAU,EAAE,2BAA2B,EACvC,YAAY,CAAC,EAAE,YAAY,GAC1B,UAAU,CA2BZ"}

package/dist/presentation/routes/index.js

@@ -9,9 +9,9 @@ import { createLoginRoute } from './session/login.js';
 import { logoutRoute } from './session/logout.js';
 import { meRoute } from './session/me.js';
 import { createRefreshRoute } from './session/refresh.js';
-export function buildAuthRoutes(passwordEnabled, workspaces) {
+export function buildAuthRoutes(passwordEnabled, workspaces, signupPolicy) {
     const passwordRoutes = passwordEnabled ? [
-        createSignupRoute(workspaces),
+        createSignupRoute(workspaces, signupPolicy),
         createVerifyEmailConfirmRoute(workspaces),
         verifyEmailResendRoute,
         createLoginRoute(workspaces)

package/dist/presentation/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/index.ts"],"sourcesContent":["import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport {authCookiePlugin} from '#presentation/auth/refresh-cookie.js';\nimport {createVerifyEmailConfirmRoute} from './email-verification/verify-email-confirm.js';\nimport {verifyEmailResendRoute} from './email-verification/verify-email-resend.js';\nimport {changePasswordRoute} from './password/change-password.js';\nimport {createPasswordResetConfirmRoute} from './password/password-reset-confirm.js';\nimport {passwordResetRequestRoute} from './password/password-reset-request.js';\nimport {createSignupRoute} from './registration/signup.js';\nimport {createLoginRoute} from './session/login.js';\nimport {logoutRoute} from './session/logout.js';\nimport {meRoute} from './session/me.js';\nimport {createRefreshRoute} from './session/refresh.js';\n\nexport function buildAuthRoutes(\n  passwordEnabled: boolean,\n  workspaces: WorkspacesInterModuleClient,\n): RouteGroup {\n  const passwordRoutes = passwordEnabled\n    ? [\n        createSignupRoute(workspaces),\n        createVerifyEmailConfirmRoute(workspaces),\n        verifyEmailResendRoute,\n        createLoginRoute(workspaces),\n      ]\n    : [];\n\n  return {\n    prefix: '/auth',\n    plugins: [authCookiePlugin],\n    routes: [\n      ...passwordRoutes,\n      createRefreshRoute(workspaces),\n      logoutRoute,\n      meRoute,\n      ...(passwordEnabled\n        ? [\n            changePasswordRoute,\n            passwordResetRequestRoute,\n            createPasswordResetConfirmRoute(workspaces),\n          ]\n        : []),\n    ],\n  };\n}\n"],"names":["authCookiePlugin","createVerifyEmailConfirmRoute","verifyEmailResendRoute","changePasswordRoute","createPasswordResetConfirmRoute","passwordResetRequestRoute","createSignupRoute","createLoginRoute","logoutRoute","meRoute","createRefreshRoute","buildAuthRoutes","passwordEnabled","workspaces","passwordRoutes","prefix","plugins","routes"],"mappings":"AAEA,SAAQA,gBAAgB,QAAO,uCAAuC;AACtE,SAAQC,6BAA6B,QAAO,+CAA+C;AAC3F,SAAQC,sBAAsB,QAAO,8CAA8C;AACnF,SAAQC,mBAAmB,QAAO,gCAAgC;AAClE,SAAQC,+BAA+B,QAAO,uCAAuC;AACrF,SAAQC,yBAAyB,QAAO,uCAAuC;AAC/E,SAAQC,iBAAiB,QAAO,2BAA2B;AAC3D,SAAQC,gBAAgB,QAAO,qBAAqB;AACpD,SAAQC,WAAW,QAAO,sBAAsB;AAChD,SAAQC,OAAO,QAAO,kBAAkB;AACxC,SAAQC,kBAAkB,QAAO,uBAAuB;AAExD,OAAO,SAASC,gBACdC,eAAwB,EACxBC,UAAuC;IAEvC,MAAMC,iBAAiBF,kBACnB;QACEN,kBAAkBO;QAClBZ,8BAA8BY;QAC9BX;QACAK,iBAAiBM;KAClB,GACD,EAAE;IAEN,OAAO;QACLE,QAAQ;QACRC,SAAS;YAAChB;SAAiB;QAC3BiB,QAAQ;eACHH;YACHJ,mBAAmBG;YACnBL;YACAC;eACIG,kBACA;gBACET;gBACAE;gBACAD,gCAAgCS;aACjC,GACD,EAAE;SACP;IACH;AACF"}
+{"version":3,"sources":["../../../src/presentation/routes/index.ts"],"sourcesContent":["import type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport type {RouteGroup} from '@shipfox/node-fastify';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {authCookiePlugin} from '#presentation/auth/refresh-cookie.js';\nimport {createVerifyEmailConfirmRoute} from './email-verification/verify-email-confirm.js';\nimport {verifyEmailResendRoute} from './email-verification/verify-email-resend.js';\nimport {changePasswordRoute} from './password/change-password.js';\nimport {createPasswordResetConfirmRoute} from './password/password-reset-confirm.js';\nimport {passwordResetRequestRoute} from './password/password-reset-request.js';\nimport {createSignupRoute} from './registration/signup.js';\nimport {createLoginRoute} from './session/login.js';\nimport {logoutRoute} from './session/logout.js';\nimport {meRoute} from './session/me.js';\nimport {createRefreshRoute} from './session/refresh.js';\n\nexport function buildAuthRoutes(\n  passwordEnabled: boolean,\n  workspaces: WorkspacesInterModuleClient,\n  signupPolicy?: SignupPolicy,\n): RouteGroup {\n  const passwordRoutes = passwordEnabled\n    ? [\n        createSignupRoute(workspaces, signupPolicy),\n        createVerifyEmailConfirmRoute(workspaces),\n        verifyEmailResendRoute,\n        createLoginRoute(workspaces),\n      ]\n    : [];\n\n  return {\n    prefix: '/auth',\n    plugins: [authCookiePlugin],\n    routes: [\n      ...passwordRoutes,\n      createRefreshRoute(workspaces),\n      logoutRoute,\n      meRoute,\n      ...(passwordEnabled\n        ? [\n            changePasswordRoute,\n            passwordResetRequestRoute,\n            createPasswordResetConfirmRoute(workspaces),\n          ]\n        : []),\n    ],\n  };\n}\n"],"names":["authCookiePlugin","createVerifyEmailConfirmRoute","verifyEmailResendRoute","changePasswordRoute","createPasswordResetConfirmRoute","passwordResetRequestRoute","createSignupRoute","createLoginRoute","logoutRoute","meRoute","createRefreshRoute","buildAuthRoutes","passwordEnabled","workspaces","signupPolicy","passwordRoutes","prefix","plugins","routes"],"mappings":"AAGA,SAAQA,gBAAgB,QAAO,uCAAuC;AACtE,SAAQC,6BAA6B,QAAO,+CAA+C;AAC3F,SAAQC,sBAAsB,QAAO,8CAA8C;AACnF,SAAQC,mBAAmB,QAAO,gCAAgC;AAClE,SAAQC,+BAA+B,QAAO,uCAAuC;AACrF,SAAQC,yBAAyB,QAAO,uCAAuC;AAC/E,SAAQC,iBAAiB,QAAO,2BAA2B;AAC3D,SAAQC,gBAAgB,QAAO,qBAAqB;AACpD,SAAQC,WAAW,QAAO,sBAAsB;AAChD,SAAQC,OAAO,QAAO,kBAAkB;AACxC,SAAQC,kBAAkB,QAAO,uBAAuB;AAExD,OAAO,SAASC,gBACdC,eAAwB,EACxBC,UAAuC,EACvCC,YAA2B;IAE3B,MAAMC,iBAAiBH,kBACnB;QACEN,kBAAkBO,YAAYC;QAC9Bb,8BAA8BY;QAC9BX;QACAK,iBAAiBM;KAClB,GACD,EAAE;IAEN,OAAO;QACLG,QAAQ;QACRC,SAAS;YAACjB;SAAiB;QAC3BkB,QAAQ;eACHH;YACHL,mBAAmBG;YACnBL;YACAC;eACIG,kBACA;gBACET;gBACAE;gBACAD,gCAAgCS;aACjC,GACD,EAAE;SACP;IACH;AACF"}

package/dist/presentation/routes/rate-limit.d.ts

@@ -6,5 +6,6 @@ interface EmailBody {
 export declare function createAuthRateLimitPreHandler(action: AuthRateLimitAction): (request: FastifyRequest<{
     Body: EmailBody;
 }>, reply: FastifyReply) => Promise<void>;
+export declare function createAuthIpRateLimitPreHandler(action: AuthRateLimitAction): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
 export {};
 //# sourceMappingURL=rate-limit.d.ts.map

package/dist/presentation/routes/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACL,KAAK,mBAAmB,EAMzB,MAAM,qBAAqB,CAAC;AAa7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AA6ED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,IACzD,SAAS,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACL,KAAK,mBAAmB,EAMzB,MAAM,qBAAqB,CAAC;AAmB7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAgFD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,IACzD,SAAS,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,IAC3D,SAAS,cAAc,EAAE,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS3E"}

package/dist/presentation/routes/rate-limit.js

@@ -20,18 +20,26 @@ const policies = {
             limit: 3,
             windowSeconds: 60 * 60
         }
+    },
+    bootstrap: {
+        ip: {
+            limit: 5,
+            windowSeconds: 15 * 60
+        }
     }
 };
 function routeName(request) {
     return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';
 }
 async function enforceRateLimit(params) {
+    const policy = policies[params.action][params.scope];
+    if (!policy) return;
     try {
         await checkAuthRateLimit({
             action: params.action,
             scope: params.scope,
             identifier: params.identifier,
-            ...policies[params.action][params.scope]
+            ...policy
         });
     } catch (error) {
         if (error instanceof AuthRateLimitExceededError) {
@@ -97,5 +105,16 @@ export function createAuthRateLimitPreHandler(action) {
         });
     };
 }
+export function createAuthIpRateLimitPreHandler(action) {
+    return async (request, reply)=>{
+        await enforceRateLimit({
+            request,
+            reply,
+            action,
+            scope: 'ip',
+            identifier: request.ip
+        });
+    };
+}
 
 //# sourceMappingURL=rate-limit.js.map

package/dist/presentation/routes/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {\n  type AuthRateLimitAction,\n  AuthRateLimitExceededError,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  AuthRateLimitUnavailableError,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<AuthRateLimitAction, Record<AuthRateLimitScope, AuthRateLimitPolicy>> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  try {\n    await checkAuthRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      ...policies[params.action][params.scope],\n    });\n  } catch (error) {\n    if (error instanceof AuthRateLimitExceededError) {\n      params.request.log.warn(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          retryAfterSeconds: error.retryAfterSeconds,\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        'Auth rate limit blocked request',\n      );\n      params.reply.header('Retry-After', String(error.retryAfterSeconds));\n      throw new ClientError('Rate limit exceeded', 'rate-limited', {\n        status: 429,\n        details: {retry_after_seconds: error.retryAfterSeconds},\n        data: {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        cause: error,\n      });\n    }\n\n    if (error instanceof AuthRateLimitUnavailableError) {\n      params.request.log.error(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n          err: error,\n        },\n        'Auth rate limiter unavailable',\n      );\n      throw new ClientError(\n        'Authentication rate limiter unavailable',\n        'auth-rate-limit-unavailable',\n        {\n          status: 503,\n          data: {\n            action: error.action,\n            scope: error.scope,\n            route: routeName(params.request),\n            identifierHmacPrefix: error.identifierHmacPrefix,\n          },\n          cause: error,\n        },\n      );\n    }\n\n    throw error;\n  }\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n"],"names":["ClientError","AuthRateLimitExceededError","AuthRateLimitUnavailableError","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","routeName","request","routeOptions","url","split","enforceRateLimit","params","action","scope","identifier","error","log","warn","route","retryAfterSeconds","identifierHmacPrefix","reply","header","String","status","details","retry_after_seconds","data","cause","err","createAuthRateLimitPreHandler","body"],"mappings":"AAAA,SAAQA,WAAW,QAA+C,wBAAwB;AAC1F,SAEEC,0BAA0B,EAG1BC,6BAA6B,EAC7BC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAAyF;IAC7FC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;AACF;AAMA,SAASE,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAeC,iBAAiBC,MAM/B;IACC,IAAI;QACF,MAAMb,mBAAmB;YACvBc,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBC,YAAYH,OAAOG,UAAU;YAC7B,GAAGf,QAAQ,CAACY,OAAOC,MAAM,CAAC,CAACD,OAAOE,KAAK,CAAC;QAC1C;IACF,EAAE,OAAOE,OAAO;QACd,IAAIA,iBAAiBnB,4BAA4B;YAC/Ce,OAAOL,OAAO,CAACU,GAAG,CAACC,IAAI,CACrB;gBACEL,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOb,UAAUM,OAAOL,OAAO;gBAC/Ba,mBAAmBJ,MAAMI,iBAAiB;gBAC1CC,sBAAsBL,MAAMK,oBAAoB;YAClD,GACA;YAEFT,OAAOU,KAAK,CAACC,MAAM,CAAC,eAAeC,OAAOR,MAAMI,iBAAiB;YACjE,MAAM,IAAIxB,YAAY,uBAAuB,gBAAgB;gBAC3D6B,QAAQ;gBACRC,SAAS;oBAACC,qBAAqBX,MAAMI,iBAAiB;gBAAA;gBACtDQ,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOb,UAAUM,OAAOL,OAAO;oBAC/Bc,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QACF;QAEA,IAAIA,iBAAiBlB,+BAA+B;YAClDc,OAAOL,OAAO,CAACU,GAAG,CAACD,KAAK,CACtB;gBACEH,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOb,UAAUM,OAAOL,OAAO;gBAC/Bc,sBAAsBL,MAAMK,oBAAoB;gBAChDS,KAAKd;YACP,GACA;YAEF,MAAM,IAAIpB,YACR,2CACA,+BACA;gBACE6B,QAAQ;gBACRG,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOb,UAAUM,OAAOL,OAAO;oBAC/Bc,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QAEJ;QAEA,MAAMA;IACR;AACF;AAEA,OAAO,SAASe,8BAA8BlB,MAA2B;IACvE,OAAO,OAAON,SAA4Ce;QACxD,MAAMX,iBAAiB;YACrBJ;YACAe;YACAT;YACAC,OAAO;YACPC,YAAYR,QAAQL,EAAE;QACxB;QAEA,MAAMS,iBAAiB;YACrBJ;YACAe;YACAT;YACAC,OAAO;YACPC,YAAYR,QAAQyB,IAAI,CAAC3B,KAAK;QAChC;IACF;AACF"}
+{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {\n  type AuthRateLimitAction,\n  AuthRateLimitExceededError,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  AuthRateLimitUnavailableError,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<\n  AuthRateLimitAction,\n  Partial<Record<AuthRateLimitScope, AuthRateLimitPolicy>>\n> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n  bootstrap: {\n    ip: {limit: 5, windowSeconds: 15 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  const policy = policies[params.action][params.scope];\n  if (!policy) return;\n\n  try {\n    await checkAuthRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      ...policy,\n    });\n  } catch (error) {\n    if (error instanceof AuthRateLimitExceededError) {\n      params.request.log.warn(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          retryAfterSeconds: error.retryAfterSeconds,\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        'Auth rate limit blocked request',\n      );\n      params.reply.header('Retry-After', String(error.retryAfterSeconds));\n      throw new ClientError('Rate limit exceeded', 'rate-limited', {\n        status: 429,\n        details: {retry_after_seconds: error.retryAfterSeconds},\n        data: {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n        },\n        cause: error,\n      });\n    }\n\n    if (error instanceof AuthRateLimitUnavailableError) {\n      params.request.log.error(\n        {\n          action: error.action,\n          scope: error.scope,\n          route: routeName(params.request),\n          identifierHmacPrefix: error.identifierHmacPrefix,\n          err: error,\n        },\n        'Auth rate limiter unavailable',\n      );\n      throw new ClientError(\n        'Authentication rate limiter unavailable',\n        'auth-rate-limit-unavailable',\n        {\n          status: 503,\n          data: {\n            action: error.action,\n            scope: error.scope,\n            route: routeName(params.request),\n            identifierHmacPrefix: error.identifierHmacPrefix,\n          },\n          cause: error,\n        },\n      );\n    }\n\n    throw error;\n  }\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n\nexport function createAuthIpRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n  };\n}\n"],"names":["ClientError","AuthRateLimitExceededError","AuthRateLimitUnavailableError","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","bootstrap","routeName","request","routeOptions","url","split","enforceRateLimit","params","policy","action","scope","identifier","error","log","warn","route","retryAfterSeconds","identifierHmacPrefix","reply","header","String","status","details","retry_after_seconds","data","cause","err","createAuthRateLimitPreHandler","body","createAuthIpRateLimitPreHandler"],"mappings":"AAAA,SAAQA,WAAW,QAA+C,wBAAwB;AAC1F,SAEEC,0BAA0B,EAG1BC,6BAA6B,EAC7BC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAGF;IACFC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;IACAE,WAAW;QACTJ,IAAI;YAACC,OAAO;YAAGC,eAAe,KAAK;QAAE;IACvC;AACF;AAMA,SAASG,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAeC,iBAAiBC,MAM/B;IACC,MAAMC,SAASd,QAAQ,CAACa,OAAOE,MAAM,CAAC,CAACF,OAAOG,KAAK,CAAC;IACpD,IAAI,CAACF,QAAQ;IAEb,IAAI;QACF,MAAMf,mBAAmB;YACvBgB,QAAQF,OAAOE,MAAM;YACrBC,OAAOH,OAAOG,KAAK;YACnBC,YAAYJ,OAAOI,UAAU;YAC7B,GAAGH,MAAM;QACX;IACF,EAAE,OAAOI,OAAO;QACd,IAAIA,iBAAiBrB,4BAA4B;YAC/CgB,OAAOL,OAAO,CAACW,GAAG,CAACC,IAAI,CACrB;gBACEL,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOd,UAAUM,OAAOL,OAAO;gBAC/Bc,mBAAmBJ,MAAMI,iBAAiB;gBAC1CC,sBAAsBL,MAAMK,oBAAoB;YAClD,GACA;YAEFV,OAAOW,KAAK,CAACC,MAAM,CAAC,eAAeC,OAAOR,MAAMI,iBAAiB;YACjE,MAAM,IAAI1B,YAAY,uBAAuB,gBAAgB;gBAC3D+B,QAAQ;gBACRC,SAAS;oBAACC,qBAAqBX,MAAMI,iBAAiB;gBAAA;gBACtDQ,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOd,UAAUM,OAAOL,OAAO;oBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QACF;QAEA,IAAIA,iBAAiBpB,+BAA+B;YAClDe,OAAOL,OAAO,CAACW,GAAG,CAACD,KAAK,CACtB;gBACEH,QAAQG,MAAMH,MAAM;gBACpBC,OAAOE,MAAMF,KAAK;gBAClBK,OAAOd,UAAUM,OAAOL,OAAO;gBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAChDS,KAAKd;YACP,GACA;YAEF,MAAM,IAAItB,YACR,2CACA,+BACA;gBACE+B,QAAQ;gBACRG,MAAM;oBACJf,QAAQG,MAAMH,MAAM;oBACpBC,OAAOE,MAAMF,KAAK;oBAClBK,OAAOd,UAAUM,OAAOL,OAAO;oBAC/Be,sBAAsBL,MAAMK,oBAAoB;gBAClD;gBACAQ,OAAOb;YACT;QAEJ;QAEA,MAAMA;IACR;AACF;AAEA,OAAO,SAASe,8BAA8BlB,MAA2B;IACvE,OAAO,OAAOP,SAA4CgB;QACxD,MAAMZ,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQN,EAAE;QACxB;QAEA,MAAMU,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQ0B,IAAI,CAAC7B,KAAK;QAChC;IACF;AACF;AAEA,OAAO,SAAS8B,gCAAgCpB,MAA2B;IACzE,OAAO,OAAOP,SAAyBgB;QACrC,MAAMZ,iBAAiB;YACrBJ;YACAgB;YACAT;YACAC,OAAO;YACPC,YAAYT,QAAQN,EAAE;QACxB;IACF;AACF"}

package/dist/presentation/routes/registration/signup.d.ts

@@ -1,3 +1,4 @@
 import type { WorkspacesInterModuleClient } from '@shipfox/api-workspaces-dto/inter-module';
-export declare function createSignupRoute(workspaces: WorkspacesInterModuleClient): import("@shipfox/node-fastify").RouteDefinition;
+import type { SignupPolicy } from '#core/ports.js';
+export declare function createSignupRoute(workspaces: WorkspacesInterModuleClient, signupPolicy?: SignupPolicy): import("@shipfox/node-fastify").RouteDefinition;
 //# sourceMappingURL=signup.d.ts.map

package/dist/presentation/routes/registration/signup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/registration/signup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAa1F,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,2BAA2B,mDAoFxE"}
+{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/registration/signup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAW1F,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAMjD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,2BAA2B,EACvC,YAAY,CAAC,EAAE,YAAY,mDAkG5B"}

package/dist/presentation/routes/registration/signup.js

@@ -2,10 +2,11 @@ import { signupBodySchema, signupResponseSchema } from '@shipfox/api-auth-dto';
 import { EmailChallengeError } from '@shipfox/api-email-challenges';
 import { ClientError, defineRoute } from '@shipfox/node-fastify';
 import { signup, signupWithInvitation } from '#core/auth.js';
-import { EmailTakenError, InvitationEmailMismatchError, TokenAlreadyUsedError, TokenExpiredError, TokenInvalidError } from '#core/errors.js';
+import { EmailTakenError, InvitationEmailMismatchError, SignupNotAllowedError, TokenAlreadyUsedError, TokenExpiredError, TokenInvalidError } from '#core/errors.js';
 import { setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
 import { toUserDto } from '#presentation/dto/user.js';
-export function createSignupRoute(workspaces) {
+const SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH = 500;
+export function createSignupRoute(workspaces, signupPolicy) {
     return defineRoute({
         method: 'POST',
         path: '/signup',
@@ -32,6 +33,15 @@ export function createSignupRoute(workspaces) {
                     status: 409
                 });
             }
+            if (error instanceof SignupNotAllowedError) {
+                const message = error.message.slice(0, SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH);
+                throw new ClientError(message, 'signup-not-allowed', {
+                    status: 403,
+                    details: {
+                        message
+                    }
+                });
+            }
             if (error instanceof TokenInvalidError) {
                 throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {
                     status: 410
@@ -61,7 +71,8 @@ export function createSignupRoute(workspaces) {
                     email,
                     password,
                     name,
-                    sourceIp: request.ip
+                    sourceIp: request.ip,
+                    signupPolicy
                 });
                 reply.code(201);
                 return {

package/dist/presentation/routes/registration/signup.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/presentation/routes/registration/signup.ts"],"sourcesContent":["import {signupBodySchema, signupResponseSchema} from '@shipfox/api-auth-dto';\nimport {EmailChallengeError} from '@shipfox/api-email-challenges';\nimport type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {signup, signupWithInvitation} from '#core/auth.js';\nimport {\n  EmailTakenError,\n  InvitationEmailMismatchError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n} from '#core/errors.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nexport function createSignupRoute(workspaces: WorkspacesInterModuleClient) {\n  return defineRoute({\n    method: 'POST',\n    path: '/signup',\n    description:\n      'Create a user account. Sends a verification email unless an invitation token is supplied.',\n    schema: {\n      body: signupBodySchema,\n      response: {\n        201: signupResponseSchema,\n      },\n    },\n    errorHandler: (error) => {\n      if (error instanceof EmailChallengeError) {\n        throw new ClientError(error.message, `email-challenge-${error.code}`, {\n          status: error.code === 'limited' ? 429 : 400,\n          ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),\n        });\n      }\n      if (error instanceof EmailTakenError) {\n        throw new ClientError('Email already registered', 'email-taken', {status: 409});\n      }\n      if (error instanceof TokenInvalidError) {\n        throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenAlreadyUsedError) {\n        throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenExpiredError) {\n        throw new ClientError('Invitation has expired', 'invitation-token-expired', {\n          status: 410,\n        });\n      }\n      if (error instanceof InvitationEmailMismatchError) {\n        throw new ClientError(\n          'Signup email does not match the invitation',\n          'invitation-email-mismatch',\n          {status: 403},\n        );\n      }\n      throw error;\n    },\n    handler: async (request, reply) => {\n      const {email, password, name, invitation_token} = request.body;\n\n      if (invitation_token === undefined) {\n        const result = await signup({email, password, name, sourceIp: request.ip});\n        reply.code(201);\n        return {\n          user: toUserDto(result),\n          email_challenge: {\n            id: result.emailChallenge.id,\n            next_resend_available_at: result.emailChallenge.nextResendAvailableAt.toISOString(),\n          },\n        };\n      }\n\n      const result = await signupWithInvitation({\n        email,\n        password,\n        name,\n        invitationToken: invitation_token,\n        workspaces,\n      });\n      setRefreshTokenCookie(reply, result.refreshToken);\n      reply.code(201);\n      return {\n        user: toUserDto(result.user),\n        token: result.token,\n        membership: result.membership\n          ? {\n              id: result.membership.id,\n              user_id: result.membership.userId,\n              workspace_id: result.membership.workspaceId,\n            }\n          : null,\n        ...(result.acceptError ? {accept_error: result.acceptError} : {}),\n      };\n    },\n  });\n}\n"],"names":["signupBodySchema","signupResponseSchema","EmailChallengeError","ClientError","defineRoute","signup","signupWithInvitation","EmailTakenError","InvitationEmailMismatchError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","setRefreshTokenCookie","toUserDto","createSignupRoute","workspaces","method","path","description","schema","body","response","errorHandler","error","message","code","status","retryAt","details","retry_at","toISOString","handler","request","reply","email","password","name","invitation_token","undefined","result","sourceIp","ip","user","email_challenge","id","emailChallenge","next_resend_available_at","nextResendAvailableAt","invitationToken","refreshToken","token","membership","user_id","userId","workspace_id","workspaceId","acceptError","accept_error"],"mappings":"AAAA,SAAQA,gBAAgB,EAAEC,oBAAoB,QAAO,wBAAwB;AAC7E,SAAQC,mBAAmB,QAAO,gCAAgC;AAElE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,gBAAgB;AAC3D,SACEC,eAAe,EACfC,4BAA4B,EAC5BC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,OAAO,SAASC,kBAAkBC,UAAuC;IACvE,OAAOX,YAAY;QACjBY,QAAQ;QACRC,MAAM;QACNC,aACE;QACFC,QAAQ;YACNC,MAAMpB;YACNqB,UAAU;gBACR,KAAKpB;YACP;QACF;QACAqB,cAAc,CAACC;YACb,IAAIA,iBAAiBrB,qBAAqB;gBACxC,MAAM,IAAIC,YAAYoB,MAAMC,OAAO,EAAE,CAAC,gBAAgB,EAAED,MAAME,IAAI,EAAE,EAAE;oBACpEC,QAAQH,MAAME,IAAI,KAAK,YAAY,MAAM;oBACzC,GAAIF,MAAMI,OAAO,GAAG;wBAACC,SAAS;4BAACC,UAAUN,MAAMI,OAAO,CAACG,WAAW;wBAAE;oBAAC,IAAI,CAAC,CAAC;gBAC7E;YACF;YACA,IAAIP,iBAAiBhB,iBAAiB;gBACpC,MAAM,IAAIJ,YAAY,4BAA4B,eAAe;oBAACuB,QAAQ;gBAAG;YAC/E;YACA,IAAIH,iBAAiBZ,mBAAmB;gBACtC,MAAM,IAAIR,YAAY,+BAA+B,4BAA4B;oBAC/EuB,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBd,uBAAuB;gBAC1C,MAAM,IAAIN,YAAY,wCAAwC,yBAAyB;oBACrFuB,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBb,mBAAmB;gBACtC,MAAM,IAAIP,YAAY,0BAA0B,4BAA4B;oBAC1EuB,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBf,8BAA8B;gBACjD,MAAM,IAAIL,YACR,8CACA,6BACA;oBAACuB,QAAQ;gBAAG;YAEhB;YACA,MAAMH;QACR;QACAQ,SAAS,OAAOC,SAASC;YACvB,MAAM,EAACC,KAAK,EAAEC,QAAQ,EAAEC,IAAI,EAAEC,gBAAgB,EAAC,GAAGL,QAAQZ,IAAI;YAE9D,IAAIiB,qBAAqBC,WAAW;gBAClC,MAAMC,SAAS,MAAMlC,OAAO;oBAAC6B;oBAAOC;oBAAUC;oBAAMI,UAAUR,QAAQS,EAAE;gBAAA;gBACxER,MAAMR,IAAI,CAAC;gBACX,OAAO;oBACLiB,MAAM7B,UAAU0B;oBAChBI,iBAAiB;wBACfC,IAAIL,OAAOM,cAAc,CAACD,EAAE;wBAC5BE,0BAA0BP,OAAOM,cAAc,CAACE,qBAAqB,CAACjB,WAAW;oBACnF;gBACF;YACF;YAEA,MAAMS,SAAS,MAAMjC,qBAAqB;gBACxC4B;gBACAC;gBACAC;gBACAY,iBAAiBX;gBACjBtB;YACF;YACAH,sBAAsBqB,OAAOM,OAAOU,YAAY;YAChDhB,MAAMR,IAAI,CAAC;YACX,OAAO;gBACLiB,MAAM7B,UAAU0B,OAAOG,IAAI;gBAC3BQ,OAAOX,OAAOW,KAAK;gBACnBC,YAAYZ,OAAOY,UAAU,GACzB;oBACEP,IAAIL,OAAOY,UAAU,CAACP,EAAE;oBACxBQ,SAASb,OAAOY,UAAU,CAACE,MAAM;oBACjCC,cAAcf,OAAOY,UAAU,CAACI,WAAW;gBAC7C,IACA;gBACJ,GAAIhB,OAAOiB,WAAW,GAAG;oBAACC,cAAclB,OAAOiB,WAAW;gBAAA,IAAI,CAAC,CAAC;YAClE;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../../src/presentation/routes/registration/signup.ts"],"sourcesContent":["import {signupBodySchema, signupResponseSchema} from '@shipfox/api-auth-dto';\nimport {EmailChallengeError} from '@shipfox/api-email-challenges';\nimport type {WorkspacesInterModuleClient} from '@shipfox/api-workspaces-dto/inter-module';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {signup, signupWithInvitation} from '#core/auth.js';\nimport {\n  EmailTakenError,\n  InvitationEmailMismatchError,\n  SignupNotAllowedError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n} from '#core/errors.js';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {setRefreshTokenCookie} from '#presentation/auth/refresh-cookie.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nconst SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH = 500;\n\nexport function createSignupRoute(\n  workspaces: WorkspacesInterModuleClient,\n  signupPolicy?: SignupPolicy,\n) {\n  return defineRoute({\n    method: 'POST',\n    path: '/signup',\n    description:\n      'Create a user account. Sends a verification email unless an invitation token is supplied.',\n    schema: {\n      body: signupBodySchema,\n      response: {\n        201: signupResponseSchema,\n      },\n    },\n    errorHandler: (error) => {\n      if (error instanceof EmailChallengeError) {\n        throw new ClientError(error.message, `email-challenge-${error.code}`, {\n          status: error.code === 'limited' ? 429 : 400,\n          ...(error.retryAt ? {details: {retry_at: error.retryAt.toISOString()}} : {}),\n        });\n      }\n      if (error instanceof EmailTakenError) {\n        throw new ClientError('Email already registered', 'email-taken', {status: 409});\n      }\n      if (error instanceof SignupNotAllowedError) {\n        const message = error.message.slice(0, SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH);\n        throw new ClientError(message, 'signup-not-allowed', {\n          status: 403,\n          details: {message},\n        });\n      }\n      if (error instanceof TokenInvalidError) {\n        throw new ClientError('Invitation token is invalid', 'invitation-token-invalid', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenAlreadyUsedError) {\n        throw new ClientError('Invitation has already been accepted', 'invitation-token-used', {\n          status: 410,\n        });\n      }\n      if (error instanceof TokenExpiredError) {\n        throw new ClientError('Invitation has expired', 'invitation-token-expired', {\n          status: 410,\n        });\n      }\n      if (error instanceof InvitationEmailMismatchError) {\n        throw new ClientError(\n          'Signup email does not match the invitation',\n          'invitation-email-mismatch',\n          {status: 403},\n        );\n      }\n      throw error;\n    },\n    handler: async (request, reply) => {\n      const {email, password, name, invitation_token} = request.body;\n\n      if (invitation_token === undefined) {\n        const result = await signup({\n          email,\n          password,\n          name,\n          sourceIp: request.ip,\n          signupPolicy,\n        });\n        reply.code(201);\n        return {\n          user: toUserDto(result),\n          email_challenge: {\n            id: result.emailChallenge.id,\n            next_resend_available_at: result.emailChallenge.nextResendAvailableAt.toISOString(),\n          },\n        };\n      }\n\n      const result = await signupWithInvitation({\n        email,\n        password,\n        name,\n        invitationToken: invitation_token,\n        workspaces,\n      });\n      setRefreshTokenCookie(reply, result.refreshToken);\n      reply.code(201);\n      return {\n        user: toUserDto(result.user),\n        token: result.token,\n        membership: result.membership\n          ? {\n              id: result.membership.id,\n              user_id: result.membership.userId,\n              workspace_id: result.membership.workspaceId,\n            }\n          : null,\n        ...(result.acceptError ? {accept_error: result.acceptError} : {}),\n      };\n    },\n  });\n}\n"],"names":["signupBodySchema","signupResponseSchema","EmailChallengeError","ClientError","defineRoute","signup","signupWithInvitation","EmailTakenError","InvitationEmailMismatchError","SignupNotAllowedError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","setRefreshTokenCookie","toUserDto","SIGNUP_NOT_ALLOWED_MESSAGE_MAX_LENGTH","createSignupRoute","workspaces","signupPolicy","method","path","description","schema","body","response","errorHandler","error","message","code","status","retryAt","details","retry_at","toISOString","slice","handler","request","reply","email","password","name","invitation_token","undefined","result","sourceIp","ip","user","email_challenge","id","emailChallenge","next_resend_available_at","nextResendAvailableAt","invitationToken","refreshToken","token","membership","user_id","userId","workspace_id","workspaceId","acceptError","accept_error"],"mappings":"AAAA,SAAQA,gBAAgB,EAAEC,oBAAoB,QAAO,wBAAwB;AAC7E,SAAQC,mBAAmB,QAAO,gCAAgC;AAElE,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,MAAM,EAAEC,oBAAoB,QAAO,gBAAgB;AAC3D,SACEC,eAAe,EACfC,4BAA4B,EAC5BC,qBAAqB,EACrBC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,QACZ,kBAAkB;AAEzB,SAAQC,qBAAqB,QAAO,uCAAuC;AAC3E,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,MAAMC,wCAAwC;AAE9C,OAAO,SAASC,kBACdC,UAAuC,EACvCC,YAA2B;IAE3B,OAAOd,YAAY;QACjBe,QAAQ;QACRC,MAAM;QACNC,aACE;QACFC,QAAQ;YACNC,MAAMvB;YACNwB,UAAU;gBACR,KAAKvB;YACP;QACF;QACAwB,cAAc,CAACC;YACb,IAAIA,iBAAiBxB,qBAAqB;gBACxC,MAAM,IAAIC,YAAYuB,MAAMC,OAAO,EAAE,CAAC,gBAAgB,EAAED,MAAME,IAAI,EAAE,EAAE;oBACpEC,QAAQH,MAAME,IAAI,KAAK,YAAY,MAAM;oBACzC,GAAIF,MAAMI,OAAO,GAAG;wBAACC,SAAS;4BAACC,UAAUN,MAAMI,OAAO,CAACG,WAAW;wBAAE;oBAAC,IAAI,CAAC,CAAC;gBAC7E;YACF;YACA,IAAIP,iBAAiBnB,iBAAiB;gBACpC,MAAM,IAAIJ,YAAY,4BAA4B,eAAe;oBAAC0B,QAAQ;gBAAG;YAC/E;YACA,IAAIH,iBAAiBjB,uBAAuB;gBAC1C,MAAMkB,UAAUD,MAAMC,OAAO,CAACO,KAAK,CAAC,GAAGnB;gBACvC,MAAM,IAAIZ,YAAYwB,SAAS,sBAAsB;oBACnDE,QAAQ;oBACRE,SAAS;wBAACJ;oBAAO;gBACnB;YACF;YACA,IAAID,iBAAiBd,mBAAmB;gBACtC,MAAM,IAAIT,YAAY,+BAA+B,4BAA4B;oBAC/E0B,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBhB,uBAAuB;gBAC1C,MAAM,IAAIP,YAAY,wCAAwC,yBAAyB;oBACrF0B,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBf,mBAAmB;gBACtC,MAAM,IAAIR,YAAY,0BAA0B,4BAA4B;oBAC1E0B,QAAQ;gBACV;YACF;YACA,IAAIH,iBAAiBlB,8BAA8B;gBACjD,MAAM,IAAIL,YACR,8CACA,6BACA;oBAAC0B,QAAQ;gBAAG;YAEhB;YACA,MAAMH;QACR;QACAS,SAAS,OAAOC,SAASC;YACvB,MAAM,EAACC,KAAK,EAAEC,QAAQ,EAAEC,IAAI,EAAEC,gBAAgB,EAAC,GAAGL,QAAQb,IAAI;YAE9D,IAAIkB,qBAAqBC,WAAW;gBAClC,MAAMC,SAAS,MAAMtC,OAAO;oBAC1BiC;oBACAC;oBACAC;oBACAI,UAAUR,QAAQS,EAAE;oBACpB3B;gBACF;gBACAmB,MAAMT,IAAI,CAAC;gBACX,OAAO;oBACLkB,MAAMhC,UAAU6B;oBAChBI,iBAAiB;wBACfC,IAAIL,OAAOM,cAAc,CAACD,EAAE;wBAC5BE,0BAA0BP,OAAOM,cAAc,CAACE,qBAAqB,CAAClB,WAAW;oBACnF;gBACF;YACF;YAEA,MAAMU,SAAS,MAAMrC,qBAAqB;gBACxCgC;gBACAC;gBACAC;gBACAY,iBAAiBX;gBACjBxB;YACF;YACAJ,sBAAsBwB,OAAOM,OAAOU,YAAY;YAChDhB,MAAMT,IAAI,CAAC;YACX,OAAO;gBACLkB,MAAMhC,UAAU6B,OAAOG,IAAI;gBAC3BQ,OAAOX,OAAOW,KAAK;gBACnBC,YAAYZ,OAAOY,UAAU,GACzB;oBACEP,IAAIL,OAAOY,UAAU,CAACP,EAAE;oBACxBQ,SAASb,OAAOY,UAAU,CAACE,MAAM;oBACjCC,cAAcf,OAAOY,UAAU,CAACI,WAAW;gBAC7C,IACA;gBACJ,GAAIhB,OAAOiB,WAAW,GAAG;oBAACC,cAAclB,OAAOiB,WAAW;gBAAA,IAAI,CAAC,CAAC;YAClE;QACF;IACF;AACF"}

package/dist/presentation/routes/session/me.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/session/me.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,OAAO,iDA0BlB,CAAC"}
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../../src/presentation/routes/session/me.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,OAAO,iDA6BlB,CAAC"}

package/dist/presentation/routes/session/me.js

@@ -1,6 +1,7 @@
 import { AUTH_USER } from '@shipfox/api-auth-context';
 import { meResponseSchema } from '@shipfox/api-auth-dto';
 import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { getCurrentAdminRole } from '#core/admin-role.js';
 import { getCurrentUser } from '#core/auth.js';
 import { UserNotFoundError } from '#core/errors.js';
 import { getClientContext } from '#presentation/auth/jwt-auth.js';
@@ -34,7 +35,10 @@ export const meRoute = defineRoute({
             userId: client.userId
         });
         return {
-            user: toUserDto(result.user)
+            user: toUserDto(result.user),
+            admin_role: await getCurrentAdminRole({
+                userId: client.userId
+            })
         };
     }
 });

package/dist/presentation/routes/session/me.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/presentation/routes/session/me.ts"],"sourcesContent":["import {AUTH_USER} from '@shipfox/api-auth-context';\nimport {meResponseSchema} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {getCurrentUser} from '#core/auth.js';\nimport {UserNotFoundError} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nexport const meRoute = defineRoute({\n  method: 'GET',\n  path: '/me',\n  description: 'Get the signed-in user.',\n  auth: AUTH_USER,\n  schema: {\n    response: {\n      200: meResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof UserNotFoundError) {\n      throw new ClientError('User not found', 'not-found', {status: 404});\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const client = getClientContext(request);\n    if (!client) {\n      throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n    }\n\n    const result = await getCurrentUser({userId: client.userId});\n\n    return {user: toUserDto(result.user)};\n  },\n});\n"],"names":["AUTH_USER","meResponseSchema","ClientError","defineRoute","getCurrentUser","UserNotFoundError","getClientContext","toUserDto","meRoute","method","path","description","auth","schema","response","errorHandler","error","status","handler","request","client","result","userId","user"],"mappings":"AAAA,SAAQA,SAAS,QAAO,4BAA4B;AACpD,SAAQC,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,cAAc,QAAO,gBAAgB;AAC7C,SAAQC,iBAAiB,QAAO,kBAAkB;AAClD,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,OAAO,MAAMC,UAAUL,YAAY;IACjCM,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,MAAMZ;IACNa,QAAQ;QACNC,UAAU;YACR,KAAKb;QACP;IACF;IACAc,cAAc,CAACC;QACb,IAAIA,iBAAiBX,mBAAmB;YACtC,MAAM,IAAIH,YAAY,kBAAkB,aAAa;gBAACe,QAAQ;YAAG;QACnE;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC;QACd,MAAMC,SAASd,iBAAiBa;QAChC,IAAI,CAACC,QAAQ;YACX,MAAM,IAAIlB,YAAY,2BAA2B,gBAAgB;gBAACe,QAAQ;YAAG;QAC/E;QAEA,MAAMI,SAAS,MAAMjB,eAAe;YAACkB,QAAQF,OAAOE,MAAM;QAAA;QAE1D,OAAO;YAACC,MAAMhB,UAAUc,OAAOE,IAAI;QAAC;IACtC;AACF,GAAG"}
+{"version":3,"sources":["../../../../src/presentation/routes/session/me.ts"],"sourcesContent":["import {AUTH_USER} from '@shipfox/api-auth-context';\nimport {meResponseSchema} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {getCurrentAdminRole} from '#core/admin-role.js';\nimport {getCurrentUser} from '#core/auth.js';\nimport {UserNotFoundError} from '#core/errors.js';\nimport {getClientContext} from '#presentation/auth/jwt-auth.js';\nimport {toUserDto} from '#presentation/dto/user.js';\n\nexport const meRoute = defineRoute({\n  method: 'GET',\n  path: '/me',\n  description: 'Get the signed-in user.',\n  auth: AUTH_USER,\n  schema: {\n    response: {\n      200: meResponseSchema,\n    },\n  },\n  errorHandler: (error) => {\n    if (error instanceof UserNotFoundError) {\n      throw new ClientError('User not found', 'not-found', {status: 404});\n    }\n    throw error;\n  },\n  handler: async (request) => {\n    const client = getClientContext(request);\n    if (!client) {\n      throw new ClientError('Authentication required', 'unauthorized', {status: 401});\n    }\n\n    const result = await getCurrentUser({userId: client.userId});\n\n    return {\n      user: toUserDto(result.user),\n      admin_role: await getCurrentAdminRole({userId: client.userId}),\n    };\n  },\n});\n"],"names":["AUTH_USER","meResponseSchema","ClientError","defineRoute","getCurrentAdminRole","getCurrentUser","UserNotFoundError","getClientContext","toUserDto","meRoute","method","path","description","auth","schema","response","errorHandler","error","status","handler","request","client","result","userId","user","admin_role"],"mappings":"AAAA,SAAQA,SAAS,QAAO,4BAA4B;AACpD,SAAQC,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,mBAAmB,QAAO,sBAAsB;AACxD,SAAQC,cAAc,QAAO,gBAAgB;AAC7C,SAAQC,iBAAiB,QAAO,kBAAkB;AAClD,SAAQC,gBAAgB,QAAO,iCAAiC;AAChE,SAAQC,SAAS,QAAO,4BAA4B;AAEpD,OAAO,MAAMC,UAAUN,YAAY;IACjCO,QAAQ;IACRC,MAAM;IACNC,aAAa;IACbC,MAAMb;IACNc,QAAQ;QACNC,UAAU;YACR,KAAKd;QACP;IACF;IACAe,cAAc,CAACC;QACb,IAAIA,iBAAiBX,mBAAmB;YACtC,MAAM,IAAIJ,YAAY,kBAAkB,aAAa;gBAACgB,QAAQ;YAAG;QACnE;QACA,MAAMD;IACR;IACAE,SAAS,OAAOC;QACd,MAAMC,SAASd,iBAAiBa;QAChC,IAAI,CAACC,QAAQ;YACX,MAAM,IAAInB,YAAY,2BAA2B,gBAAgB;gBAACgB,QAAQ;YAAG;QAC/E;QAEA,MAAMI,SAAS,MAAMjB,eAAe;YAACkB,QAAQF,OAAOE,MAAM;QAAA;QAE1D,OAAO;YACLC,MAAMhB,UAAUc,OAAOE,IAAI;YAC3BC,YAAY,MAAMrB,oBAAoB;gBAACmB,QAAQF,OAAOE,MAAM;YAAA;QAC9D;IACF;AACF,GAAG"}