@shipfox/api-workspaces 16.0.0 → 17.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-workspaces",
   "license": "MIT",
-  "version": "16.0.0",
+  "version": "17.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -25,24 +25,24 @@
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
     "@shipfox/api-common-dto": "15.0.0",
-    "@shipfox/api-auth-dto": "15.0.0",
-    "@shipfox/api-auth-context": "15.0.0",
+    "@shipfox/api-auth-context": "17.0.0",
+    "@shipfox/api-auth-dto": "17.0.0",
     "@shipfox/api-projects-dto": "15.0.0",
-    "@shipfox/api-workspaces-dto": "15.0.0",
     "@shipfox/api-runners-dto": "16.0.0",
     "@shipfox/config": "1.2.4",
     "@shipfox/inter-module": "0.2.3",
-    "@shipfox/node-auth-root-key": "0.2.3",
-    "@shipfox/node-drizzle": "0.3.5",
     "@shipfox/node-fastify": "0.4.3",
+    "@shipfox/api-workspaces-dto": "15.0.0",
     "@shipfox/node-email": "0.3.5",
+    "@shipfox/node-drizzle": "0.3.5",
+    "@shipfox/node-auth-root-key": "0.2.3",
+    "@shipfox/node-mailer": "0.2.6",
     "@shipfox/node-module": "1.0.7",
-    "@shipfox/node-outbox": "0.2.6",
-    "@shipfox/node-postgres": "0.5.0",
     "@shipfox/node-opentelemetry": "0.6.5",
+    "@shipfox/node-outbox": "0.2.6",
+    "@shipfox/node-postgres": "0.5.1",
     "@shipfox/node-rate-limit": "0.4.0",
-    "@shipfox/node-tokens": "0.3.3",
-    "@shipfox/node-mailer": "0.2.6"
+    "@shipfox/node-tokens": "0.3.3"
   },
   "imports": {
     "#*": "./dist/*"

package/src/presentation/routes/admin-workspaces.test.ts

@@ -27,12 +27,19 @@ function adminHeaders(idempotencyKey: string) {
   };
 }
 
+let authenticatedImpersonatorId: string | undefined;
+
 const fakeUserAuth: AuthMethod = {
   name: AUTH_USER,
   authenticate: (request: FastifyRequest) => {
     setUserContext(
       request,
-      buildUserContext({userId: USER_ID, email: 'admin@example.com', memberships: []}),
+      buildUserContext({
+        userId: USER_ID,
+        email: 'admin@example.com',
+        memberships: [],
+        impersonatorId: authenticatedImpersonatorId,
+      }),
     );
     return Promise.resolve();
   },
@@ -46,6 +53,7 @@ describe('GET /admin/workspaces', () => {
 
   beforeEach(async () => {
     await closeApp();
+    authenticatedImpersonatorId = undefined;
     await db().execute(
       sql`TRUNCATE workspaces_admin_command_results, workspaces_outbox, workspaces_workspaces CASCADE`,
     );
@@ -414,6 +422,20 @@ describe('GET /admin/workspaces', () => {
     ]);
   });
 
+  test('rejects an impersonated session before consulting the administrator role', async () => {
+    authenticatedImpersonatorId = crypto.randomUUID();
+
+    const response = await app.inject({
+      method: 'GET',
+      url: '/admin/workspaces',
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json()).toEqual({code: 'admin-role-required'});
+    expect(auth.requireAdminRole).not.toHaveBeenCalled();
+  });
+
   test('maps an insufficient administrator role to forbidden', async () => {
     vi.mocked(auth.requireAdminRole).mockRejectedValue(
       createInterModuleKnownError(

package/src/presentation/routes/admin-workspaces.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, adoptAdministrationActorGuard, getUserContext} from '@shipfox/api-auth-context';
 import {
   type AuthInterModuleClient,
   authInterModuleContract,
@@ -219,5 +219,8 @@ export function createAdminWorkspacesRoutes(params: {
     execute: reactivateWorkspace,
   });
 
-  return {prefix: '/admin/workspaces', routes: [listRoute, suspendRoute, reactivateRoute]};
+  return adoptAdministrationActorGuard({
+    prefix: '/admin/workspaces',
+    routes: [listRoute, suspendRoute, reactivateRoute],
+  });
 }

package/src/presentation/routes/invitations/accept.test.ts

@@ -60,6 +60,37 @@ describe('POST /invitations/accept', () => {
     );
   });
 
+  test('rejects an impersonated session with impersonation-not-permitted', async () => {
+    const owner = await signupVerifyLogin(app, 'accept-impersonated-owner');
+    const guest = await signupVerifyLogin(app, 'accept-impersonated-guest');
+    const workspaceId = await createWorkspace(app, owner.token);
+    const invite = await createInvite(app, {
+      token: owner.token,
+      workspaceId,
+      email: guest.email,
+    });
+    const impersonatorId = crypto.randomUUID();
+    const token = `claim:${guest.userId}:${guest.email}:${workspaceId}:active:${impersonatorId}`;
+
+    const res = await app.inject({
+      method: 'POST',
+      url: '/invitations/accept',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {token: invite.rawToken},
+    });
+    const members = await app.inject({
+      method: 'GET',
+      url: `/workspaces/${workspaceId}/members`,
+      headers: {authorization: `Bearer ${owner.token}`},
+    });
+
+    expect(res.statusCode).toBe(403);
+    expect(res.json().code).toBe('impersonation-not-permitted');
+    expect(
+      members.json().members.map((member: {user_email: string}) => member.user_email),
+    ).not.toContain(guest.email);
+  });
+
   test('returns 200 when the invitee is already a member', async () => {
     const owner = await signupVerifyLogin(app, 'accept-existing-owner');
     const workspaceId = await createWorkspace(app, owner.token);

package/src/presentation/routes/invitations/accept.ts

@@ -1,4 +1,4 @@
-import {AUTH_USER, getUserContext} from '@shipfox/api-auth-context';
+import {AUTH_USER, getUserContext, rejectImpersonatedSession} from '@shipfox/api-auth-context';
 import {
   acceptInvitationBodySchema,
   acceptInvitationResponseSchema,
@@ -48,6 +48,7 @@ export const acceptInvitationRoute = defineRoute({
     if (!client) {
       throw new ClientError('Authentication required', 'unauthorized', {status: 401});
     }
+    rejectImpersonatedSession(request);
 
     const {token} = request.body;
     const result = await acceptWorkspaceInvitation({

package/src/presentation/routes/invitations/create.test.ts

@@ -81,6 +81,23 @@ describe('POST /workspaces/:workspaceId/invitations', () => {
     expect(res.json().code).toBe('workspace-suspended');
   });
 
+  test('rejects an impersonated session with impersonation-not-permitted', async () => {
+    const workspaceId = crypto.randomUUID();
+    const inviteeEmail = uniqueEmail('impersonated-invite');
+    const token = `claim:${crypto.randomUUID()}:impersonated-invite-create@example.com:${workspaceId}:active:${crypto.randomUUID()}`;
+
+    const res = await app.inject({
+      method: 'POST',
+      url: `/workspaces/${workspaceId}/invitations`,
+      headers: {authorization: `Bearer ${token}`},
+      payload: {email: inviteeEmail},
+    });
+
+    expect(res.statusCode).toBe(403);
+    expect(res.json().code).toBe('impersonation-not-permitted');
+    expect(await invitationOutboxEventsTo(inviteeEmail)).toHaveLength(0);
+  });
+
   test('transforms a whitespace/case-equivalent duplicate open invitation into 409', async () => {
     const owner = await signupVerifyLogin(app, 'invite-create-duplicate-equivalent');
     const workspaceId = await createWorkspace(app, owner.token);

package/src/presentation/routes/invitations/create.ts

@@ -1,4 +1,9 @@
-import {AUTH_USER, getUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';
+import {
+  AUTH_USER,
+  getUserContext,
+  rejectImpersonatedSession,
+  requireWorkspaceAccess,
+} from '@shipfox/api-auth-context';
 import {createInvitationBodySchema, invitationDtoSchema} from '@shipfox/api-workspaces-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -45,6 +50,7 @@ export const createInvitationRoute = defineRoute({
     }
 
     const {workspaceId} = request.params;
+    rejectImpersonatedSession(request);
     requireWorkspaceAccess({request, workspaceId});
     const {email} = request.body;
     const invitation = await createWorkspaceInvitation({

package/test/routes.ts

@@ -57,7 +57,7 @@ const fakeUserAuth: AuthMethod = {
       throw new ClientError('Authentication required', 'unauthorized', {status: 401});
     }
     if (raw?.startsWith('claim:')) {
-      const [, userId, email, workspaceId, status] = raw.split(':');
+      const [, userId, email, workspaceId, status, impersonatorId] = raw.split(':');
       if (!userId || !email || !workspaceId) throw new Error('Invalid test user claim token');
       const workspaceStatus = status === 'suspended' || status === 'deleted' ? status : 'active';
       setUserContext(
@@ -66,6 +66,7 @@ const fakeUserAuth: AuthMethod = {
           userId,
           email,
           memberships: [{workspaceId, role: 'admin', workspaceStatus}],
+          impersonatorId: impersonatorId || undefined,
         }),
       );
       return;