@shipfox/api-logs 10.2.0 → 11.0.0

package/.turbo/turbo-build.log

@@ -1,6 +1,6 @@
 $ shipfox-swc && shipfox-temporal-bundle dist/temporal/workflows/index.js
-Successfully compiled: 59 files with swc (431.26ms)
-2026-07-28T16:59:25.699Z [INFO] asset workflow-bundle-17839eee3b21fbae5b8c.js 3.18 MiB [emitted] [immutable] (name: main)
+Successfully compiled: 59 files with swc (607.05ms)
+2026-07-28T22:45:25.101Z [INFO] asset workflow-bundle-17839eee3b21fbae5b8c.js 3.18 MiB [emitted] [immutable] (name: main)
 orphan modules 33.5 KiB [orphan] 21 modules
 runtime modules 1.13 KiB 5 modules
 modules by path ../../../node_modules/.pnpm/ 970 KiB 196 modules
@@ -16,6 +16,6 @@ optional modules 30 bytes [optional]
   __temporal_custom_payload_converter (ignored) 15 bytes [optional] [built] [code generated]
   __temporal_custom_failure_converter (ignored) 15 bytes [optional] [built] [code generated]
 ../../shared/node/temporal/dist/workflow-error-interceptor.js 1.21 KiB [built] [code generated]
-webpack 5.107.2 compiled successfully in 6248 ms
-2026-07-28T16:59:25.714Z [INFO] Workflow bundle created { size: '3.18MB' }
+webpack 5.107.2 compiled successfully in 7341 ms
+2026-07-28T22:45:25.133Z [INFO] Workflow bundle created { size: '3.18MB' }
 /home/runner/work/shipfox/shipfox/libs/api/logs/dist/temporal/workflows/index.js: 3335222 bytes

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @shipfox/api-logs
 
+## 11.0.0
+
+### Major Changes
+
+- 25158c8: Carry workspace lifecycle status in JWT membership claims and enforce suspended or inactive access at the stateless workspace gate while keeping access-token verification stateless.
+
+  `getAuthenticatedSessionContext()` now reads refresh-session metadata from verified access-token claims without checking active refresh-session state; revoking a refresh session does not invalidate an already-issued access token.
+
+### Patch Changes
+
+- Updated dependencies [25158c8]
+  - @shipfox/api-auth-context@11.0.0
+
 ## 10.2.0
 
 ### Minor Changes

package/dist/presentation/routes/read-logs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-logs.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/read-logs.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,aAAa,iDA6BxB,CAAC"}
+{"version":3,"file":"read-logs.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/read-logs.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,aAAa,iDAiCxB,CAAC"}

package/dist/presentation/routes/read-logs.js

@@ -1,4 +1,4 @@
-import { requireUserContext } from '@shipfox/api-auth-context';
+import { requireWorkspaceResourceAccess } from '@shipfox/api-auth-context';
 import { readLogsQuerySchema, readLogsResponseSchema } from '@shipfox/api-logs-dto';
 import { ClientError, defineRoute } from '@shipfox/node-fastify';
 import { z } from 'zod';
@@ -20,20 +20,26 @@ export const readLogsRoute = defineRoute({
         }
     },
     handler: async (request)=>{
-        const user = requireUserContext(request);
         const { stepId, attempt } = request.params;
         const { cursor } = request.query;
         const stream = await getStreamByStepAttempt({
             stepId,
             attempt
         });
-        // 404 covers both "no such stream" and "not your workspace" so the endpoint never
-        // leaks the existence of another workspace's step.
-        if (!stream || !user.canAccess(stream.workspaceId)) {
+        // Missing streams and memberships remain 404 so the endpoint never leaks another
+        // workspace's step; lifecycle claims propagate their stable access errors.
+        if (!stream) {
             throw new ClientError('Logs not found', 'not-found', {
                 status: 404
             });
         }
+        requireWorkspaceResourceAccess({
+            request,
+            workspaceId: stream.workspaceId,
+            notFoundError: new ClientError('Logs not found', 'not-found', {
+                status: 404
+            })
+        });
         return toReadLogsDto(await buildLogReadResult(stream, cursor));
     }
 });

package/dist/presentation/routes/read-logs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/read-logs.ts"],"sourcesContent":["import {requireUserContext} from '@shipfox/api-auth-context';\nimport {readLogsQuerySchema, readLogsResponseSchema} from '@shipfox/api-logs-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {buildLogReadResult} from '#core/read-logs.js';\nimport {getStreamByStepAttempt} from '#db/streams.js';\nimport {toReadLogsDto} from '#presentation/dto/read-logs.js';\n\nexport const readLogsRoute = defineRoute({\n  method: 'GET',\n  path: '/:stepId/attempts/:attempt/logs',\n  description:\n    'Read a page of logs for a step attempt: inline NDJSON while the stream is hot, a presigned object URL once it is compacted.',\n  schema: {\n    params: z.object({\n      stepId: z.string().uuid(),\n      attempt: z.coerce.number().int().min(1),\n    }),\n    querystring: readLogsQuerySchema,\n    response: {\n      200: readLogsResponseSchema,\n    },\n  },\n  handler: async (request) => {\n    const user = requireUserContext(request);\n    const {stepId, attempt} = request.params;\n    const {cursor} = request.query;\n\n    const stream = await getStreamByStepAttempt({stepId, attempt});\n    // 404 covers both \"no such stream\" and \"not your workspace\" so the endpoint never\n    // leaks the existence of another workspace's step.\n    if (!stream || !user.canAccess(stream.workspaceId)) {\n      throw new ClientError('Logs not found', 'not-found', {status: 404});\n    }\n\n    return toReadLogsDto(await buildLogReadResult(stream, cursor));\n  },\n});\n"],"names":["requireUserContext","readLogsQuerySchema","readLogsResponseSchema","ClientError","defineRoute","z","buildLogReadResult","getStreamByStepAttempt","toReadLogsDto","readLogsRoute","method","path","description","schema","params","object","stepId","string","uuid","attempt","coerce","number","int","min","querystring","response","handler","request","user","cursor","query","stream","canAccess","workspaceId","status"],"mappings":"AAAA,SAAQA,kBAAkB,QAAO,4BAA4B;AAC7D,SAAQC,mBAAmB,EAAEC,sBAAsB,QAAO,wBAAwB;AAClF,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,kBAAkB,QAAO,qBAAqB;AACtD,SAAQC,sBAAsB,QAAO,iBAAiB;AACtD,SAAQC,aAAa,QAAO,iCAAiC;AAE7D,OAAO,MAAMC,gBAAgBL,YAAY;IACvCM,QAAQ;IACRC,MAAM;IACNC,aACE;IACFC,QAAQ;QACNC,QAAQT,EAAEU,MAAM,CAAC;YACfC,QAAQX,EAAEY,MAAM,GAAGC,IAAI;YACvBC,SAASd,EAAEe,MAAM,CAACC,MAAM,GAAGC,GAAG,GAAGC,GAAG,CAAC;QACvC;QACAC,aAAavB;QACbwB,UAAU;YACR,KAAKvB;QACP;IACF;IACAwB,SAAS,OAAOC;QACd,MAAMC,OAAO5B,mBAAmB2B;QAChC,MAAM,EAACX,MAAM,EAAEG,OAAO,EAAC,GAAGQ,QAAQb,MAAM;QACxC,MAAM,EAACe,MAAM,EAAC,GAAGF,QAAQG,KAAK;QAE9B,MAAMC,SAAS,MAAMxB,uBAAuB;YAACS;YAAQG;QAAO;QAC5D,kFAAkF;QAClF,mDAAmD;QACnD,IAAI,CAACY,UAAU,CAACH,KAAKI,SAAS,CAACD,OAAOE,WAAW,GAAG;YAClD,MAAM,IAAI9B,YAAY,kBAAkB,aAAa;gBAAC+B,QAAQ;YAAG;QACnE;QAEA,OAAO1B,cAAc,MAAMF,mBAAmByB,QAAQF;IACxD;AACF,GAAG"}
+{"version":3,"sources":["../../../src/presentation/routes/read-logs.ts"],"sourcesContent":["import {requireWorkspaceResourceAccess} from '@shipfox/api-auth-context';\nimport {readLogsQuerySchema, readLogsResponseSchema} from '@shipfox/api-logs-dto';\nimport {ClientError, defineRoute} from '@shipfox/node-fastify';\nimport {z} from 'zod';\nimport {buildLogReadResult} from '#core/read-logs.js';\nimport {getStreamByStepAttempt} from '#db/streams.js';\nimport {toReadLogsDto} from '#presentation/dto/read-logs.js';\n\nexport const readLogsRoute = defineRoute({\n  method: 'GET',\n  path: '/:stepId/attempts/:attempt/logs',\n  description:\n    'Read a page of logs for a step attempt: inline NDJSON while the stream is hot, a presigned object URL once it is compacted.',\n  schema: {\n    params: z.object({\n      stepId: z.string().uuid(),\n      attempt: z.coerce.number().int().min(1),\n    }),\n    querystring: readLogsQuerySchema,\n    response: {\n      200: readLogsResponseSchema,\n    },\n  },\n  handler: async (request) => {\n    const {stepId, attempt} = request.params;\n    const {cursor} = request.query;\n\n    const stream = await getStreamByStepAttempt({stepId, attempt});\n    // Missing streams and memberships remain 404 so the endpoint never leaks another\n    // workspace's step; lifecycle claims propagate their stable access errors.\n    if (!stream) {\n      throw new ClientError('Logs not found', 'not-found', {status: 404});\n    }\n    requireWorkspaceResourceAccess({\n      request,\n      workspaceId: stream.workspaceId,\n      notFoundError: new ClientError('Logs not found', 'not-found', {status: 404}),\n    });\n\n    return toReadLogsDto(await buildLogReadResult(stream, cursor));\n  },\n});\n"],"names":["requireWorkspaceResourceAccess","readLogsQuerySchema","readLogsResponseSchema","ClientError","defineRoute","z","buildLogReadResult","getStreamByStepAttempt","toReadLogsDto","readLogsRoute","method","path","description","schema","params","object","stepId","string","uuid","attempt","coerce","number","int","min","querystring","response","handler","request","cursor","query","stream","status","workspaceId","notFoundError"],"mappings":"AAAA,SAAQA,8BAA8B,QAAO,4BAA4B;AACzE,SAAQC,mBAAmB,EAAEC,sBAAsB,QAAO,wBAAwB;AAClF,SAAQC,WAAW,EAAEC,WAAW,QAAO,wBAAwB;AAC/D,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,kBAAkB,QAAO,qBAAqB;AACtD,SAAQC,sBAAsB,QAAO,iBAAiB;AACtD,SAAQC,aAAa,QAAO,iCAAiC;AAE7D,OAAO,MAAMC,gBAAgBL,YAAY;IACvCM,QAAQ;IACRC,MAAM;IACNC,aACE;IACFC,QAAQ;QACNC,QAAQT,EAAEU,MAAM,CAAC;YACfC,QAAQX,EAAEY,MAAM,GAAGC,IAAI;YACvBC,SAASd,EAAEe,MAAM,CAACC,MAAM,GAAGC,GAAG,GAAGC,GAAG,CAAC;QACvC;QACAC,aAAavB;QACbwB,UAAU;YACR,KAAKvB;QACP;IACF;IACAwB,SAAS,OAAOC;QACd,MAAM,EAACX,MAAM,EAAEG,OAAO,EAAC,GAAGQ,QAAQb,MAAM;QACxC,MAAM,EAACc,MAAM,EAAC,GAAGD,QAAQE,KAAK;QAE9B,MAAMC,SAAS,MAAMvB,uBAAuB;YAACS;YAAQG;QAAO;QAC5D,iFAAiF;QACjF,2EAA2E;QAC3E,IAAI,CAACW,QAAQ;YACX,MAAM,IAAI3B,YAAY,kBAAkB,aAAa;gBAAC4B,QAAQ;YAAG;QACnE;QACA/B,+BAA+B;YAC7B2B;YACAK,aAAaF,OAAOE,WAAW;YAC/BC,eAAe,IAAI9B,YAAY,kBAAkB,aAAa;gBAAC4B,QAAQ;YAAG;QAC5E;QAEA,OAAOvB,cAAc,MAAMF,mBAAmBwB,QAAQF;IACxD;AACF,GAAG"}