@shipfox/api-auth 9.3.0 → 10.0.0

package/src/presentation/routes/administration.test.ts

@@ -40,7 +40,7 @@ describe('Auth administration routes', () => {
   test('requires an authenticated session for bootstrap', async () => {
     const response = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants/bootstrap',
+      url: '/admin/auth/admin-grants/bootstrap',
       headers: {'idempotency-key': 'anonymous-bootstrap'},
       payload: {bootstrap_token: BOOTSTRAP_TOKEN},
     });
@@ -48,12 +48,21 @@ describe('Auth administration routes', () => {
     expect(response.statusCode).toBe(401);
   });
 
+  test('does not register the removed versioned administration namespace', async () => {
+    const response = await app.inject({
+      method: 'GET',
+      url: '/admin/v1/auth/users?user_id=00000000-0000-4000-8000-000000000000',
+    });
+
+    expect(response.statusCode).toBe(404);
+  });
+
   test('rejects an invalid bootstrap token without writing a grant or event', async () => {
     const account = await createVerifiedSession('admin-bootstrap-invalid');
 
     const response = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants/bootstrap',
+      url: '/admin/auth/admin-grants/bootstrap',
       headers: authHeaders(account.token, 'invalid-bootstrap'),
       payload: {bootstrap_token: 'wrong-token'},
     });
@@ -69,7 +78,7 @@ describe('Auth administration routes', () => {
     for (let attempt = 0; attempt < 5; attempt += 1) {
       const response = await app.inject({
         method: 'POST',
-        url: '/admin/v1/auth/admin-grants/bootstrap',
+        url: '/admin/auth/admin-grants/bootstrap',
         headers: authHeaders(account.token, `bootstrap-rate-limit-${attempt}`),
         payload: {bootstrap_token: 'wrong-token'},
       });
@@ -78,7 +87,7 @@ describe('Auth administration routes', () => {
 
     const blocked = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants/bootstrap',
+      url: '/admin/auth/admin-grants/bootstrap',
       headers: authHeaders(account.token, 'bootstrap-rate-limit-blocked'),
       payload: {bootstrap_token: 'wrong-token'},
     });
@@ -92,7 +101,7 @@ describe('Auth administration routes', () => {
 
     const response = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants/bootstrap',
+      url: '/admin/auth/admin-grants/bootstrap',
       headers: authHeaders(first.token, 'bootstrap-first'),
       payload: {bootstrap_token: BOOTSTRAP_TOKEN},
     });
@@ -102,7 +111,7 @@ describe('Auth administration routes', () => {
 
     const repeated = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants/bootstrap',
+      url: '/admin/auth/admin-grants/bootstrap',
       headers: authHeaders(first.token, 'bootstrap-first'),
       payload: {bootstrap_token: BOOTSTRAP_TOKEN},
     });
@@ -111,7 +120,7 @@ describe('Auth administration routes', () => {
 
     const secondAttempt = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants/bootstrap',
+      url: '/admin/auth/admin-grants/bootstrap',
       headers: authHeaders(second.token, 'bootstrap-second'),
       payload: {bootstrap_token: BOOTSTRAP_TOKEN},
     });
@@ -137,7 +146,7 @@ describe('Auth administration routes', () => {
 
     const bootstrap = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants/bootstrap',
+      url: '/admin/auth/admin-grants/bootstrap',
       headers: authHeaders(owner.token, 'grant-bootstrap'),
       payload: {bootstrap_token: BOOTSTRAP_TOKEN},
     });
@@ -145,7 +154,7 @@ describe('Auth administration routes', () => {
 
     const grant = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants',
+      url: '/admin/auth/admin-grants',
       headers: authHeaders(owner.token, 'grant-observer'),
       payload: {
         user_id: target.userId,
@@ -157,7 +166,7 @@ describe('Auth administration routes', () => {
 
     const repeatedGrant = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants',
+      url: '/admin/auth/admin-grants',
       headers: authHeaders(owner.token, 'grant-observer'),
       payload: {
         user_id: target.userId,
@@ -170,17 +179,19 @@ describe('Auth administration routes', () => {
 
     const grants = await app.inject({
       method: 'GET',
-      url: '/admin/v1/auth/admin-grants',
+      url: '/admin/auth/admin-grants',
       headers: {authorization: `Bearer ${owner.token}`},
     });
     expect(grants.statusCode).toBe(200);
     expect(grants.json().grants).toEqual(
-      expect.arrayContaining([expect.objectContaining({user_id: target.userId})]),
+      expect.arrayContaining([
+        expect.objectContaining({user: expect.objectContaining({id: target.userId})}),
+      ]),
     );
 
     const revoked = await app.inject({
       method: 'DELETE',
-      url: `/admin/v1/auth/admin-grants/${grant.json().id}`,
+      url: `/admin/auth/admin-grants/${grant.json().id}`,
       headers: authHeaders(owner.token, 'revoke-observer'),
       payload: {reason: 'Support investigation complete'},
     });
@@ -189,7 +200,7 @@ describe('Auth administration routes', () => {
 
     const repeatedRevoke = await app.inject({
       method: 'DELETE',
-      url: `/admin/v1/auth/admin-grants/${grant.json().id}`,
+      url: `/admin/auth/admin-grants/${grant.json().id}`,
       headers: authHeaders(owner.token, 'revoke-observer'),
       payload: {reason: 'Support investigation complete'},
     });
@@ -203,20 +214,293 @@ describe('Auth administration routes', () => {
     );
   });
 
+  test('lets an observer find exact IDs and normalized emails without exposing user secrets', async () => {
+    const owner = await createVerifiedSession('admin-user-lookup-owner');
+    const observer = await createVerifiedSession('admin-user-lookup-observer');
+
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants/bootstrap',
+      headers: authHeaders(owner.token, 'user-lookup-bootstrap'),
+      payload: {bootstrap_token: BOOTSTRAP_TOKEN},
+    });
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants',
+      headers: authHeaders(owner.token, 'user-lookup-grant'),
+      payload: {
+        user_id: observer.userId,
+        role: 'admin-observer',
+        reason: 'Support lookup access',
+      },
+    });
+
+    const byId = await app.inject({
+      method: 'GET',
+      url: `/admin/auth/users?user_id=${observer.userId}`,
+      headers: {authorization: `Bearer ${observer.token}`},
+    });
+
+    expect(byId.statusCode).toBe(200);
+    expect(byId.json()).toEqual({
+      id: observer.userId,
+      email: observer.email,
+      name: 'admin-user-lookup-observer',
+      status: 'active',
+      email_verified_at: expect.any(String),
+      created_at: expect.any(String),
+      admin_role: 'admin-observer',
+    });
+    expect(byId.json()).not.toHaveProperty('hashed_password');
+    expect(byId.json()).not.toHaveProperty('sessions');
+    expect(byId.json()).not.toHaveProperty('provider_payload');
+
+    const byEmail = await app.inject({
+      method: 'GET',
+      url: `/admin/auth/users?email=${encodeURIComponent(` ${observer.email.toUpperCase()} `)}`,
+      headers: {authorization: `Bearer ${observer.token}`},
+    });
+
+    expect(byEmail.statusCode).toBe(200);
+    expect(byEmail.json().id).toBe(observer.userId);
+    expect(byEmail.json().email).toBe(observer.email);
+  });
+
+  test('bounds and deterministically paginates administrator grant summaries for observers', async () => {
+    const owner = await createVerifiedSession('admin-summary-owner');
+    const observer = await createVerifiedSession('admin-summary-observer');
+
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants/bootstrap',
+      headers: authHeaders(owner.token, 'summary-bootstrap'),
+      payload: {bootstrap_token: BOOTSTRAP_TOKEN},
+    });
+    const grant = await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants',
+      headers: authHeaders(owner.token, 'summary-grant'),
+      payload: {
+        user_id: observer.userId,
+        role: 'admin-observer',
+        reason: 'Read-only support access',
+      },
+    });
+
+    const firstPage = await app.inject({
+      method: 'GET',
+      url: '/admin/auth/admin-grants?limit=1',
+      headers: {authorization: `Bearer ${observer.token}`},
+    });
+
+    expect(firstPage.statusCode).toBe(200);
+    expect(firstPage.json().grants).toHaveLength(1);
+    expect(firstPage.json().grants[0]).toEqual({
+      grant_id: grant.json().id,
+      role: 'admin-observer',
+      created_at: expect.any(String),
+      revoked_at: null,
+      user: {
+        id: observer.userId,
+        email: observer.email,
+        name: 'admin-summary-observer',
+        status: 'active',
+      },
+    });
+    expect(firstPage.json().next_cursor).toEqual(expect.any(String));
+
+    const secondPage = await app.inject({
+      method: 'GET',
+      url: `/admin/auth/admin-grants?limit=1&cursor=${firstPage.json().next_cursor}`,
+      headers: {authorization: `Bearer ${observer.token}`},
+    });
+
+    expect(secondPage.statusCode).toBe(200);
+    expect(secondPage.json().grants).toHaveLength(1);
+    expect(secondPage.json().grants[0].user.id).toBe(owner.userId);
+    expect(secondPage.json().next_cursor).toBeNull();
+  });
+
+  test('rejects ordinary users and unchecked user lookup filters', async () => {
+    const ordinary = await createVerifiedSession('admin-lookup-ordinary');
+
+    const forbidden = await app.inject({
+      method: 'GET',
+      url: `/admin/auth/users?id=${ordinary.userId}`,
+      headers: {authorization: `Bearer ${ordinary.token}`},
+    });
+    expect(forbidden.statusCode).toBe(403);
+
+    const missingFilter = await app.inject({
+      method: 'GET',
+      url: '/admin/auth/users',
+      headers: {authorization: `Bearer ${ordinary.token}`},
+    });
+    expect(missingFilter.statusCode).toBe(400);
+
+    const multipleFilters = await app.inject({
+      method: 'GET',
+      url: `/admin/auth/users?id=${ordinary.userId}&email=${encodeURIComponent(ordinary.email)}`,
+      headers: {authorization: `Bearer ${ordinary.token}`},
+    });
+    expect(multipleFilters.statusCode).toBe(400);
+  });
+
+  test('returns 404 for a well-formed but unknown user lookup', async () => {
+    const owner = await createVerifiedSession('admin-lookup-unknown-owner');
+    const observer = await createVerifiedSession('admin-lookup-unknown-observer');
+
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants/bootstrap',
+      headers: authHeaders(owner.token, 'unknown-lookup-bootstrap'),
+      payload: {bootstrap_token: BOOTSTRAP_TOKEN},
+    });
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants',
+      headers: authHeaders(owner.token, 'unknown-lookup-grant'),
+      payload: {
+        user_id: observer.userId,
+        role: 'admin-observer',
+        reason: 'Support lookup access',
+      },
+    });
+
+    const response = await app.inject({
+      method: 'GET',
+      url: '/admin/auth/users?user_id=00000000-0000-4000-8000-000000000000',
+      headers: {authorization: `Bearer ${observer.token}`},
+    });
+
+    expect(response.statusCode).toBe(404);
+    expect(response.json().code).toBe('not-found');
+  });
+
+  test('rejects a malformed pagination cursor', async () => {
+    const owner = await createVerifiedSession('admin-grants-bad-cursor-owner');
+    const observer = await createVerifiedSession('admin-grants-bad-cursor-observer');
+
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants/bootstrap',
+      headers: authHeaders(owner.token, 'bad-cursor-bootstrap'),
+      payload: {bootstrap_token: BOOTSTRAP_TOKEN},
+    });
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants',
+      headers: authHeaders(owner.token, 'bad-cursor-grant'),
+      payload: {
+        user_id: observer.userId,
+        role: 'admin-observer',
+        reason: 'Support lookup access',
+      },
+    });
+
+    const response = await app.inject({
+      method: 'GET',
+      url: '/admin/auth/admin-grants?cursor=not-a-real-cursor',
+      headers: {authorization: `Bearer ${observer.token}`},
+    });
+
+    expect(response.statusCode).toBe(400);
+    expect(response.json().code).toBe('invalid-cursor');
+  });
+
+  test('rate-limits repeated user lookups by source IP', async () => {
+    const owner = await createVerifiedSession('admin-lookup-rate-limit-owner');
+    const observer = await createVerifiedSession('admin-lookup-rate-limit-observer');
+
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants/bootstrap',
+      headers: authHeaders(owner.token, 'lookup-rate-limit-bootstrap'),
+      payload: {bootstrap_token: BOOTSTRAP_TOKEN},
+    });
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants',
+      headers: authHeaders(owner.token, 'lookup-rate-limit-grant'),
+      payload: {
+        user_id: observer.userId,
+        role: 'admin-observer',
+        reason: 'Support lookup access',
+      },
+    });
+
+    for (let attempt = 0; attempt < 60; attempt += 1) {
+      const response = await app.inject({
+        method: 'GET',
+        url: `/admin/auth/users?user_id=${observer.userId}`,
+        headers: {authorization: `Bearer ${observer.token}`},
+      });
+      expect(response.statusCode).toBe(200);
+    }
+
+    const blocked = await app.inject({
+      method: 'GET',
+      url: `/admin/auth/users?user_id=${observer.userId}`,
+      headers: {authorization: `Bearer ${observer.token}`},
+    });
+
+    expect(blocked.statusCode).toBe(429);
+    expect(blocked.json().code).toBe('rate-limited');
+  });
+
+  test('checks the administrator role before consuming the lookup IP bucket', async () => {
+    const owner = await createVerifiedSession('admin-lookup-authz-order-owner');
+    const observer = await createVerifiedSession('admin-lookup-authz-order-observer');
+    const ordinary = await createVerifiedSession('admin-lookup-authz-order-ordinary');
+
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants/bootstrap',
+      headers: authHeaders(owner.token, 'authz-order-bootstrap'),
+      payload: {bootstrap_token: BOOTSTRAP_TOKEN},
+    });
+    await app.inject({
+      method: 'POST',
+      url: '/admin/auth/admin-grants',
+      headers: authHeaders(owner.token, 'authz-order-grant'),
+      payload: {
+        user_id: observer.userId,
+        role: 'admin-observer',
+        reason: 'Support lookup access',
+      },
+    });
+
+    for (let attempt = 0; attempt < 60; attempt += 1) {
+      const response = await app.inject({
+        method: 'GET',
+        url: `/admin/auth/users?user_id=${ordinary.userId}`,
+        headers: {authorization: `Bearer ${ordinary.token}`},
+      });
+      expect(response.statusCode).toBe(403);
+    }
+
+    const observerResponse = await app.inject({
+      method: 'GET',
+      url: `/admin/auth/users?user_id=${observer.userId}`,
+      headers: {authorization: `Bearer ${observer.token}`},
+    });
+    expect(observerResponse.statusCode).toBe(200);
+  });
+
   test('protects the final active owner and rejects idempotency-key reuse', async () => {
     const owner = await createVerifiedSession('admin-final-owner');
     const target = await createVerifiedSession('admin-final-target');
 
     await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants/bootstrap',
+      url: '/admin/auth/admin-grants/bootstrap',
       headers: authHeaders(owner.token, 'final-bootstrap'),
       payload: {bootstrap_token: BOOTSTRAP_TOKEN},
     });
 
     const firstGrant = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants',
+      url: '/admin/auth/admin-grants',
       headers: authHeaders(owner.token, 'role-key'),
       payload: {user_id: target.userId, role: 'admin-observer', reason: 'Initial review'},
     });
@@ -224,7 +508,7 @@ describe('Auth administration routes', () => {
 
     const reusedKey = await app.inject({
       method: 'POST',
-      url: '/admin/v1/auth/admin-grants',
+      url: '/admin/auth/admin-grants',
       headers: authHeaders(owner.token, 'role-key'),
       payload: {user_id: target.userId, role: 'admin-operator', reason: 'Different command'},
     });
@@ -233,16 +517,16 @@ describe('Auth administration routes', () => {
 
     const finalOwnerRevoke = await app.inject({
       method: 'DELETE',
-      url: `/admin/v1/auth/admin-grants/${
+      url: `/admin/auth/admin-grants/${
         (
           await app.inject({
             method: 'GET',
-            url: '/admin/v1/auth/admin-grants',
+            url: '/admin/auth/admin-grants',
             headers: {authorization: `Bearer ${owner.token}`},
           })
         )
           .json()
-          .grants.find((grant: {user_id: string}) => grant.user_id === owner.userId).id
+          .grants.find((grant: {user: {id: string}}) => grant.user.id === owner.userId).grant_id
       }`,
       headers: authHeaders(owner.token, 'revoke-final-owner'),
       payload: {reason: 'Attempt to remove final owner'},

package/src/presentation/routes/administration.ts

@@ -1,23 +1,33 @@
 import {AUTH_USER} from '@shipfox/api-auth-context';
 import {
+  administratorUserLookupQuerySchema,
+  administratorUserSummarySchema,
   bootstrapAdminOwnerBodySchema,
   bootstrapAdminOwnerResponseSchema,
   grantAdminRoleBodySchema,
   grantAdminRoleResponseSchema,
+  listAdminGrantsQuerySchema,
   listAdminGrantsResponseSchema,
   revokeAdminGrantBodySchema,
   revokeAdminGrantResponseSchema,
 } from '@shipfox/api-auth-dto';
+import {decodeTimestampIdCursor, encodeTimestampIdCursor} from '@shipfox/node-drizzle';
 import {ClientError, defineRoute, type RouteGroup} from '@shipfox/node-fastify';
 import type {FastifyRequest} from 'fastify';
 import {z} from 'zod';
+import {requireAdminRole} from '#core/admin-role.js';
 import {
   bootstrapFirstAdminOwner,
+  findAdministratorUserSummary,
   grantAdministratorRole,
-  listAdministratorGrants,
+  listAdministratorGrantSummaries,
   revokeAdministratorGrant,
 } from '#core/administration.js';
 import type {AdminGrant} from '#core/entities/admin-grant.js';
+import type {
+  AdministratorGrantSummary,
+  AdministratorUserSummary,
+} from '#core/entities/administrator-read-model.js';
 import {
   AdminBootstrapClosedError,
   AdminGrantAlreadyExistsError,
@@ -52,6 +62,10 @@ function requireIdempotencyKey(request: FastifyRequest): string {
   return key;
 }
 
+async function requireAdministratorObserver(request: FastifyRequest): Promise<void> {
+  await requireAdminRole({userId: requireActorId(request), minimumRole: 'admin-observer'});
+}
+
 function toAdminGrantDto(grant: AdminGrant) {
   return {
     id: grant.id,
@@ -63,9 +77,31 @@ function toAdminGrantDto(grant: AdminGrant) {
   };
 }
 
+function toAdministratorUserSummaryDto(user: AdministratorUserSummary) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    status: user.status,
+    email_verified_at: user.emailVerifiedAt?.toISOString() ?? null,
+    created_at: user.createdAt.toISOString(),
+    admin_role: user.adminRole,
+  };
+}
+
+function toAdministratorGrantSummaryDto(grant: AdministratorGrantSummary) {
+  return {
+    grant_id: grant.grantId,
+    role: grant.role,
+    created_at: grant.createdAt.toISOString(),
+    revoked_at: grant.revokedAt?.toISOString() ?? null,
+    user: grant.user,
+  };
+}
+
 function translateAdministrationError(error: unknown): never {
   if (error instanceof AdminRoleRequiredError) {
-    throw new ClientError('Administrator owner role required', 'forbidden', {
+    throw new ClientError('Administrator role required', 'forbidden', {
       status: 403,
       details: {required_role: error.minimumRole},
     });
@@ -132,14 +168,53 @@ const bootstrapRoute = defineRoute({
 const listRoute = defineRoute({
   method: 'GET',
   path: '/',
-  description: 'List local administrator grants.',
-  schema: {response: {200: listAdminGrantsResponseSchema}},
+  description: 'List bounded local administrator grant summaries.',
+  schema: {
+    querystring: listAdminGrantsQuerySchema,
+    response: {200: listAdminGrantsResponseSchema},
+  },
   errorHandler: translateAdministrationError,
-  handler: async (request) => ({
-    grants: (await listAdministratorGrants({actorId: requireActorId(request)})).map(
-      toAdminGrantDto,
-    ),
-  }),
+  handler: async (request) => {
+    const {limit, cursor} = request.query;
+    const decodedCursor = decodeTimestampIdCursor(cursor);
+    if (cursor && !decodedCursor) {
+      throw new ClientError('Invalid cursor', 'invalid-cursor', {status: 400});
+    }
+
+    const result = await listAdministratorGrantSummaries({
+      actorId: requireActorId(request),
+      limit,
+      ...(decodedCursor ? {cursor: decodedCursor} : {}),
+    });
+    return {
+      grants: result.grants.map(toAdministratorGrantSummaryDto),
+      next_cursor: result.nextCursor ? encodeTimestampIdCursor(result.nextCursor) : null,
+    };
+  },
+});
+
+const userLookupRoute = defineRoute({
+  method: 'GET',
+  path: '/',
+  description: 'Find one administrator-safe user summary by exact ID or email.',
+  schema: {
+    querystring: administratorUserLookupQuerySchema,
+    response: {200: administratorUserSummarySchema},
+  },
+  preHandler: [requireAdministratorObserver, createAuthIpRateLimitPreHandler('lookup')],
+  errorHandler: translateAdministrationError,
+  handler: async (request) => {
+    const {id, user_id: userId, email} = request.query;
+    const lookupId = id ?? userId;
+    const actorId = requireActorId(request);
+    const user = lookupId
+      ? await findAdministratorUserSummary({actorId, id: lookupId})
+      : email
+        ? await findAdministratorUserSummary({actorId, email})
+        : undefined;
+    if (!user) throw new UserNotFoundError(lookupId ?? email ?? 'unknown');
+    return toAdministratorUserSummaryDto(user);
+  },
 });
 
 const grantRoute = defineRoute({
@@ -189,7 +264,13 @@ const revokeRoute = defineRoute({
 });
 
 export const administrationRoutes: RouteGroup = {
-  prefix: '/admin/v1/auth/admin-grants',
+  prefix: '/admin/auth/admin-grants',
   auth: AUTH_USER,
   routes: [bootstrapRoute, listRoute, grantRoute, revokeRoute],
 };
+
+export const administrationUserRoutes: RouteGroup = {
+  prefix: '/admin/auth/users',
+  auth: AUTH_USER,
+  routes: [userLookupRoute],
+};

package/src/presentation/routes/rate-limit.ts

@@ -23,6 +23,9 @@ const policies: Record<
   bootstrap: {
     ip: {limit: 5, windowSeconds: 15 * 60},
   },
+  lookup: {
+    ip: {limit: 60, windowSeconds: 5 * 60},
+  },
 };
 
 interface EmailBody {

package/test/routes.ts

@@ -8,7 +8,10 @@ import {and, desc, eq, sql} from 'drizzle-orm';
 import {db} from '#db/db.js';
 import {authOutbox} from '#db/schema/outbox.js';
 import {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';
-import {administrationRoutes} from '#presentation/routes/administration.js';
+import {
+  administrationRoutes,
+  administrationUserRoutes,
+} from '#presentation/routes/administration.js';
 import {buildAuthRoutes} from '#presentation/routes/index.js';
 
 const testConfig = vi.hoisted(
@@ -153,7 +156,7 @@ export async function createAuthTestApp(params?: {
 }): Promise<FastifyInstance> {
   const appConfig: AppConfig = {
     auth: [createJwtAuthMethod()],
-    routes: [buildAuthRoutes(true, workspaces), administrationRoutes],
+    routes: [buildAuthRoutes(true, workspaces), administrationRoutes, administrationUserRoutes],
     swagger: false,
   };
   if (params?.fastifyOptions) appConfig.fastifyOptions = params.fastifyOptions;