@shipfox/client-auth 4.0.0 → 6.0.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/client-auth",
   "license": "MIT",
-  "version": "4.0.0",
+  "version": "6.0.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -10,10 +10,6 @@
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "imports": {
-    "#*": "./dist/*",
-    "#test/*": "./test/*"
-  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -35,12 +31,13 @@
   "dependencies": {
     "@swc/helpers": "^0.5.17",
     "@tanstack/react-form": "^1.32.0",
-    "@shipfox/api-auth-dto": "7.1.0",
-    "@shipfox/api-workspaces-dto": "6.0.0",
-    "@shipfox/client-api": "4.0.0",
-    "@shipfox/client-shell": "4.0.0",
-    "@shipfox/client-ui": "4.0.0",
-    "@shipfox/react-ui": "0.3.5"
+    "@shipfox/api-auth-dto": "9.0.1",
+    "@shipfox/api-workspaces-dto": "9.0.1",
+    "@shipfox/client-api": "6.0.1",
+    "@shipfox/client-invitations": "6.0.1",
+    "@shipfox/client-shell": "6.0.1",
+    "@shipfox/client-ui": "6.0.1",
+    "@shipfox/react-ui": "0.3.6"
   },
   "peerDependencies": {
     "@tanstack/react-query": "^5.101.0",
@@ -49,6 +46,9 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
+  "imports": {
+    "#*": "./dist/*"
+  },
   "scripts": {
     "build": "shipfox-swc",
     "check": "shipfox-biome-check",

package/src/components/auth-guard.tsx

@@ -1,8 +1,10 @@
+import {useRouteSearch} from '@shipfox/client-shell/runtime';
 import {FullPageLoader} from '@shipfox/react-ui/loader';
-import {Navigate, useRouter, useSearch} from '@tanstack/react-router';
+import {Navigate, useRouter} from '@tanstack/react-router';
 import {type PropsWithChildren, useEffect} from 'react';
 import {useAuthState} from '#hooks/use-auth-state.js';
 import {WorkspaceOnboardingPage} from '#pages/workspace-onboarding-page.js';
+import {validateRedirectSearch} from '../routes/inputs.js';
 import {sanitizeRedirectPath} from './redirect-target.js';
 
 export function AuthGuard({children}: PropsWithChildren) {
@@ -21,7 +23,7 @@ export function AuthGuard({children}: PropsWithChildren) {
 
 export function GuestGuard({children}: PropsWithChildren) {
   const auth = useAuthState();
-  const search = useSearch({strict: false}) as {redirect?: unknown};
+  const search = useRouteSearch(validateRedirectSearch);
   const router = useRouter();
   const target = sanitizeRedirectPath(search.redirect);
 

package/src/components/email-code-verification.tsx

@@ -1,10 +1,10 @@
+import {AuthShell} from '@shipfox/client-shell/runtime';
 import {Button} from '@shipfox/react-ui/button';
 import {Callout} from '@shipfox/react-ui/callout';
 import {FormField, FormFieldInput} from '@shipfox/react-ui/form-field';
 import type {HeaderProps} from '@shipfox/react-ui/typography';
 import type {FormEvent, ReactNode, Ref} from 'react';
 import {useCallback, useEffect, useRef, useState} from 'react';
-import {AuthShell} from './auth-shell.js';
 
 const EIGHT_DIGIT_CODE_RE = /^\d{8}$/u;
 

package/src/components/redirect-target.test.ts

@@ -1,4 +1,4 @@
-import {sanitizeRedirectPath} from './redirect-target.js';
+import {sanitizeLogoutRedirectPath, sanitizeRedirectPath} from './redirect-target.js';
 
 describe('sanitizeRedirectPath', () => {
   describe.each([
@@ -66,3 +66,34 @@ describe('sanitizeRedirectPath', () => {
     });
   });
 });
+
+describe('sanitizeLogoutRedirectPath', () => {
+  describe.each([
+    ['explicit login fallback', '/auth/login', '/auth/login'],
+    ['same-origin workspace path', '/workspaces/abc', '/workspaces/abc'],
+    [
+      'same-origin path with search and hash',
+      '/workspaces/abc?tab=runs#header',
+      '/workspaces/abc?tab=runs#header',
+    ],
+  ])('accepts %s', (_label, input, expected) => {
+    test('returns the safe destination', () => {
+      expect(sanitizeLogoutRedirectPath(input)).toBe(expected);
+    });
+  });
+
+  describe.each([
+    ['missing redirect', undefined],
+    ['external URL', 'https://attacker.example'],
+    ['protocol-relative URL', '//attacker.example'],
+    ['auth route other than login', '/auth/reset'],
+    ['login route with a query', '/auth/login?redirect=/workspaces/abc'],
+    ['raw invitation token', '/invitations/accept?token=sf_i_raw-token'],
+    ['raw invitation token with trailing slash', '/invitations/accept/?token=sf_i_raw-token'],
+    ['malformed percent encoding', '/%E0%80%80'],
+  ])('falls back for %s', (_label, input) => {
+    test('returns login without forwarding unsafe state', () => {
+      expect(sanitizeLogoutRedirectPath(input)).toBe('/auth/login');
+    });
+  });
+});

package/src/components/redirect-target.ts

@@ -1,8 +1,10 @@
 const REDIRECT_ORIGIN = 'https://shipfox-redirect.invalid';
+const LOGIN_PATH = '/auth/login';
+const INVITATION_ACCEPT_PATH = '/invitations/accept';
+const DEFAULT_LOGOUT_REDIRECT = LOGIN_PATH;
+const TRAILING_SLASHES = /\/+$/;
 
-// Resolves and canonicalizes an internal path before returning it, so browser URL
-// parsing cannot turn a seemingly safe path into an external or auth route.
-export function sanitizeRedirectPath(value: unknown): string | undefined {
+function resolveRedirectPath(value: unknown): URL | undefined {
   if (typeof value !== 'string' || !value.startsWith('/')) return undefined;
   let decoded: string;
   try {
@@ -17,6 +19,41 @@ export function sanitizeRedirectPath(value: unknown): string | undefined {
     return undefined;
   }
   if (target.origin !== REDIRECT_ORIGIN) return undefined;
-  if (target.pathname === '/auth' || target.pathname.startsWith('/auth/')) return undefined;
+  return target;
+}
+
+function formatRedirectPath(target: URL): string {
   return `${target.pathname}${target.search}${target.hash}`;
 }
+
+function isAuthPath(pathname: string): boolean {
+  return pathname === '/auth' || pathname.startsWith('/auth/');
+}
+
+// Resolves and canonicalizes an internal path before returning it, so browser URL
+// parsing cannot turn a seemingly safe path into an external or auth route.
+export function sanitizeRedirectPath(value: unknown): string | undefined {
+  const target = resolveRedirectPath(value);
+  if (!target || isAuthPath(target.pathname)) return undefined;
+  return formatRedirectPath(target);
+}
+
+function containsInvitationToken(target: URL): boolean {
+  const normalizedPathname = target.pathname.replace(TRAILING_SLASHES, '') || '/';
+  return normalizedPathname === INVITATION_ACCEPT_PATH && target.searchParams.has('token');
+}
+
+/**
+ * Returns the destination used by the shared logout route.
+ *
+ * Login is the only auth destination allowed, and invitation tokens never
+ * survive this boundary. Invalid values fail closed to login.
+ */
+export function sanitizeLogoutRedirectPath(value: unknown): string {
+  const target = resolveRedirectPath(value);
+  if (!target) return DEFAULT_LOGOUT_REDIRECT;
+  if (isAuthPath(target.pathname) || containsInvitationToken(target)) {
+    return DEFAULT_LOGOUT_REDIRECT;
+  }
+  return formatRedirectPath(target);
+}

package/src/continuation.ts

@@ -1,4 +1,4 @@
-export {AuthActions, AuthShell, type AuthShellProps} from './components/auth-shell.js';
+export {AuthActions, AuthShell, type AuthShellProps} from '@shipfox/client-shell/runtime';
 export {
   EmailCodeVerification,
   type EmailCodeVerificationProps,

package/src/core/auth.ts

@@ -0,0 +1,55 @@
+export interface LoginCommand {
+  email: string;
+  password: string;
+}
+
+export interface SignupCommand extends LoginCommand {
+  name: string;
+  invitationToken?: string;
+}
+
+export interface PasswordResetRequestCommand {
+  email: string;
+}
+
+export interface PasswordResetConfirmCommand {
+  token: string;
+  newPassword: string;
+}
+
+export interface VerifyEmailCommand {
+  email: string;
+  challengeId: string;
+  code: string;
+}
+
+export interface ResendEmailVerificationCommand {
+  email: string;
+  challengeId: string;
+}
+
+export interface WorkspaceCreateCommand {
+  name: string;
+}
+
+export interface Workspace {
+  id: string;
+  name: string;
+  status: 'active' | 'suspended' | 'deleted';
+}
+
+export interface SignupResult {
+  user: {
+    id: string;
+    email: string;
+    name?: string;
+    emailVerifiedAt?: string;
+  };
+  emailChallenge?: {id: string; nextResendAvailableAt: string};
+  membership?: {id: string; userId: string; workspaceId: string};
+  acceptError?: {code: string; message: string};
+}
+
+export interface EmailVerificationResendResult {
+  nextResendAvailableAt: string;
+}

package/src/hooks/api/auth-mapper.test.ts

@@ -0,0 +1,77 @@
+import type {SignupResponseDto} from '@shipfox/api-auth-dto';
+import {toSignupResult} from './auth-mapper.js';
+
+const baseUser: SignupResponseDto['user'] = {
+  id: '11111111-1111-4111-8111-111111111111',
+  email: 'signup@example.com',
+  name: null,
+  email_verified_at: null,
+  status: 'active',
+  created_at: '2026-04-27T00:00:00.000Z',
+  updated_at: '2026-04-27T00:00:00.000Z',
+};
+
+describe('toSignupResult', () => {
+  test('maps only the user when no challenge, membership, or accept error is present', () => {
+    const result = toSignupResult({user: baseUser});
+
+    expect(result).toEqual({user: {id: baseUser.id, email: baseUser.email}});
+  });
+
+  test('maps the user name and email verification when present', () => {
+    const result = toSignupResult({
+      user: {...baseUser, name: 'Ada', email_verified_at: '2026-04-27T00:00:00.000Z'},
+    });
+
+    expect(result.user).toEqual({
+      id: baseUser.id,
+      email: baseUser.email,
+      name: 'Ada',
+      emailVerifiedAt: '2026-04-27T00:00:00.000Z',
+    });
+  });
+
+  test('maps the email challenge into camelCase fields', () => {
+    const result = toSignupResult({
+      user: baseUser,
+      email_challenge: {
+        id: '22222222-2222-4222-8222-222222222222',
+        next_resend_available_at: '2026-04-27T00:01:00.000Z',
+      },
+    });
+
+    expect(result.emailChallenge).toEqual({
+      id: '22222222-2222-4222-8222-222222222222',
+      nextResendAvailableAt: '2026-04-27T00:01:00.000Z',
+    });
+  });
+
+  test('maps the invitation membership into camelCase fields', () => {
+    const result = toSignupResult({
+      user: baseUser,
+      membership: {
+        id: '33333333-3333-4333-8333-333333333333',
+        user_id: baseUser.id,
+        workspace_id: '44444444-4444-4444-8444-444444444444',
+      },
+    });
+
+    expect(result.membership).toEqual({
+      id: '33333333-3333-4333-8333-333333333333',
+      userId: baseUser.id,
+      workspaceId: '44444444-4444-4444-8444-444444444444',
+    });
+  });
+
+  test('maps the invitation accept error as-is', () => {
+    const result = toSignupResult({
+      user: baseUser,
+      accept_error: {code: 'invitation-expired', message: 'This invitation has expired.'},
+    });
+
+    expect(result.acceptError).toEqual({
+      code: 'invitation-expired',
+      message: 'This invitation has expired.',
+    });
+  });
+});

package/src/hooks/api/auth-mapper.ts

@@ -0,0 +1,29 @@
+import type {SignupResponseDto} from '@shipfox/api-auth-dto';
+import {toAuthenticatedSession, toUserIdentity} from '@shipfox/client-shell/runtime';
+import type {SignupResult} from '#core/auth.js';
+
+export {toAuthenticatedSession};
+
+export function toSignupResult(dto: SignupResponseDto): SignupResult {
+  return {
+    user: toUserIdentity(dto.user),
+    ...(dto.email_challenge
+      ? {
+          emailChallenge: {
+            id: dto.email_challenge.id,
+            nextResendAvailableAt: dto.email_challenge.next_resend_available_at,
+          },
+        }
+      : {}),
+    ...(dto.membership
+      ? {
+          membership: {
+            id: dto.membership.id,
+            userId: dto.membership.user_id,
+            workspaceId: dto.membership.workspace_id,
+          },
+        }
+      : {}),
+    ...(dto.accept_error ? {acceptError: dto.accept_error} : {}),
+  };
+}

package/src/hooks/api/login-auth.test.ts

@@ -37,7 +37,7 @@ describe('loginAuth', () => {
     const result = await loginAuth(body);
 
     const request = fetchImpl.mock.calls[0]?.[0] as Request;
-    expect(result.token).toBe('access-token');
+    expect(result.accessToken).toBe('access-token');
     expect(request.url).toBe('https://api.example.test/auth/login');
     expect(request.method).toBe('POST');
     expect(requestBody).toEqual(body);

package/src/hooks/api/login-auth.ts

@@ -1,10 +1,16 @@
-import type {LoginBodyDto, LoginResponseDto} from '@shipfox/api-auth-dto';
-import {apiRequest} from '@shipfox/client-api';
+import {loginResponseSchema} from '@shipfox/api-auth-dto';
+import {checkedApiRequest} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
+import type {LoginCommand} from '#core/auth.js';
 import {useAuthTransition} from '#state/auth.js';
+import {toAuthenticatedSession} from './auth-mapper.js';
 
-export async function loginAuth(body: LoginBodyDto) {
-  return await apiRequest<LoginResponseDto>('/auth/login', {method: 'POST', body});
+export async function loginAuth(command: LoginCommand) {
+  const response = await checkedApiRequest(loginResponseSchema, '/auth/login', {
+    method: 'POST',
+    body: command,
+  });
+  return toAuthenticatedSession(response);
 }
 
 export function useLoginAuth() {

package/src/hooks/api/logout-auth.ts

@@ -1,10 +1,10 @@
-import {apiRequest} from '@shipfox/client-api';
+import {checkedApiRequest, emptyResponseSchema} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
 import {useAuthTransition} from '#state/auth.js';
 
 async function logoutAuth() {
   try {
-    await apiRequest<void>('/auth/logout', {method: 'POST', body: {}});
+    await checkedApiRequest(emptyResponseSchema, '/auth/logout', {method: 'POST', body: {}});
   } catch {
     // Logout is best-effort: local session state must clear even if the API is offline.
   }

package/src/hooks/api/password-reset-auth.test.ts

@@ -55,14 +55,14 @@ describe('confirmPasswordReset', () => {
       });
     });
     configureApiClient({fetchImpl});
-    const body = {token: 'reset-token', new_password: 'new password is long'};
+    const body = {token: 'reset-token', newPassword: 'new password is long'};
 
     const result = await confirmPasswordReset(body);
 
     const request = fetchImpl.mock.calls[0]?.[0] as Request;
-    expect(result.token).toBe('reset-access-token');
+    expect(result.accessToken).toBe('reset-access-token');
     expect(request.url).toBe('https://api.example.test/auth/password-reset/confirm');
     expect(request.method).toBe('POST');
-    expect(requestBody).toEqual(body);
+    expect(requestBody).toEqual({token: body.token, new_password: body.newPassword});
   });
 });

package/src/hooks/api/password-reset-auth.ts

@@ -1,23 +1,29 @@
-import type {
-  PasswordResetConfirmBodyDto,
-  PasswordResetConfirmResponseDto,
-  PasswordResetRequestBodyDto,
-} from '@shipfox/api-auth-dto';
-import {apiRequest} from '@shipfox/client-api';
+import {passwordResetConfirmResponseSchema} from '@shipfox/api-auth-dto';
+import {checkedApiRequest, emptyResponseSchema} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
+import type {PasswordResetConfirmCommand, PasswordResetRequestCommand} from '#core/auth.js';
 import {useAuthTransition} from '#state/auth.js';
+import {toAuthenticatedSession} from './auth-mapper.js';
 
-export async function requestPasswordReset(body: PasswordResetRequestBodyDto) {
-  await apiRequest<void>('/auth/password-reset', {method: 'POST', body});
-}
-
-export async function confirmPasswordReset(body: PasswordResetConfirmBodyDto) {
-  return await apiRequest<PasswordResetConfirmResponseDto>('/auth/password-reset/confirm', {
+export async function requestPasswordReset(command: PasswordResetRequestCommand) {
+  await checkedApiRequest(emptyResponseSchema, '/auth/password-reset', {
     method: 'POST',
-    body,
+    body: command,
   });
 }
 
+export async function confirmPasswordReset(command: PasswordResetConfirmCommand) {
+  const response = await checkedApiRequest(
+    passwordResetConfirmResponseSchema,
+    '/auth/password-reset/confirm',
+    {
+      method: 'POST',
+      body: {token: command.token, new_password: command.newPassword},
+    },
+  );
+  return toAuthenticatedSession(response);
+}
+
 export function useRequestPasswordResetAuth() {
   return useMutation({mutationFn: requestPasswordReset});
 }

package/src/hooks/api/refresh-auth.ts

@@ -1,5 +1,6 @@
 export {
   authRefreshQueryKey,
+  authRefreshQueryOptions,
   getAuthRefreshDelayMs,
   useRefreshAuth,
 } from '@shipfox/client-shell/runtime';

package/src/hooks/api/signup-auth.ts

@@ -1,9 +1,20 @@
-import type {SignupBodyDto, SignupResponseDto} from '@shipfox/api-auth-dto';
-import {apiRequest} from '@shipfox/client-api';
+import {signupResponseSchema} from '@shipfox/api-auth-dto';
+import {checkedApiRequest} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
+import type {SignupCommand} from '#core/auth.js';
+import {toSignupResult} from './auth-mapper.js';
 
-async function signupAuth(body: SignupBodyDto) {
-  return await apiRequest<SignupResponseDto>('/auth/signup', {method: 'POST', body});
+async function signupAuth(command: SignupCommand) {
+  const response = await checkedApiRequest(signupResponseSchema, '/auth/signup', {
+    method: 'POST',
+    body: {
+      email: command.email,
+      password: command.password,
+      name: command.name,
+      ...(command.invitationToken ? {invitation_token: command.invitationToken} : {}),
+    },
+  });
+  return toSignupResult(response);
 }
 
 export function useSignupAuth() {

package/src/hooks/api/verify-email-auth.ts

@@ -1,25 +1,41 @@
-import type {
-  VerifyEmailConfirmBodyDto,
-  VerifyEmailConfirmResponseDto,
-  VerifyEmailResendBodyDto,
-  VerifyEmailResendResponseDto,
+import {
+  verifyEmailConfirmResponseSchema,
+  verifyEmailResendResponseSchema,
 } from '@shipfox/api-auth-dto';
-import {apiRequest} from '@shipfox/client-api';
+import {checkedApiRequest} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
+import type {
+  EmailVerificationResendResult,
+  ResendEmailVerificationCommand,
+  VerifyEmailCommand,
+} from '#core/auth.js';
 import {useAuthTransition} from '#state/auth.js';
+import {toAuthenticatedSession} from './auth-mapper.js';
 
-async function verifyEmailAuth(body: VerifyEmailConfirmBodyDto) {
-  return await apiRequest<VerifyEmailConfirmResponseDto>('/auth/verify-email/confirm', {
-    method: 'POST',
-    body,
-  });
+async function verifyEmailAuth(command: VerifyEmailCommand) {
+  const response = await checkedApiRequest(
+    verifyEmailConfirmResponseSchema,
+    '/auth/verify-email/confirm',
+    {
+      method: 'POST',
+      body: {email: command.email, challenge_id: command.challengeId, code: command.code},
+    },
+  );
+  return toAuthenticatedSession(response);
 }
 
-async function resendEmailVerificationAuth(body: VerifyEmailResendBodyDto) {
-  return await apiRequest<VerifyEmailResendResponseDto>('/auth/verify-email/resend', {
-    method: 'POST',
-    body,
-  });
+async function resendEmailVerificationAuth(command: ResendEmailVerificationCommand) {
+  const response = await checkedApiRequest(
+    verifyEmailResendResponseSchema,
+    '/auth/verify-email/resend',
+    {
+      method: 'POST',
+      body: {email: command.email, challenge_id: command.challengeId},
+    },
+  );
+  return {
+    nextResendAvailableAt: response.next_resend_available_at,
+  } satisfies EmailVerificationResendResult;
 }
 
 export function useResendEmailVerificationAuth() {

package/src/hooks/api/workspace-auth.ts

@@ -1,14 +1,24 @@
-import type {CreateWorkspaceBodyDto, WorkspaceResponseDto} from '@shipfox/api-workspaces-dto';
-import {apiRequest} from '@shipfox/client-api';
-import {listUserWorkspaces, userWorkspacesQueryKey} from '@shipfox/client-shell/runtime';
+import {workspaceResponseSchema} from '@shipfox/api-workspaces-dto';
+import {checkedApiRequest} from '@shipfox/client-api';
+import {
+  listUserWorkspaces,
+  userWorkspacesQueryKey,
+  userWorkspacesQueryOptions,
+} from '@shipfox/client-shell/runtime';
 import {useMutation} from '@tanstack/react-query';
+import type {WorkspaceCreateCommand} from '#core/auth.js';
 import {useRefreshAuth} from './refresh-auth.js';
+import {toWorkspace} from './workspace-mapper.js';
 
-export async function createWorkspace(body: CreateWorkspaceBodyDto) {
-  return await apiRequest<WorkspaceResponseDto>('/workspaces', {method: 'POST', body});
+export async function createWorkspace(command: WorkspaceCreateCommand) {
+  const response = await checkedApiRequest(workspaceResponseSchema, '/workspaces', {
+    method: 'POST',
+    body: {name: command.name},
+  });
+  return toWorkspace(response);
 }
 
-export {listUserWorkspaces, userWorkspacesQueryKey};
+export {listUserWorkspaces, userWorkspacesQueryKey, userWorkspacesQueryOptions};
 
 export function useCreateWorkspaceAuth() {
   const refreshAuth = useRefreshAuth();

package/src/hooks/api/workspace-mapper.test.ts

@@ -0,0 +1,21 @@
+import type {WorkspaceResponseDto} from '@shipfox/api-workspaces-dto';
+import {toWorkspace} from './workspace-mapper.js';
+
+describe('toWorkspace', () => {
+  test.each([
+    'active',
+    'suspended',
+    'deleted',
+  ] as const)('maps a %s workspace to its domain shape', (status) => {
+    const dto: WorkspaceResponseDto = {
+      id: '11111111-1111-4111-8111-111111111111',
+      name: 'Acme',
+      status,
+      settings: {},
+      created_at: '2026-04-27T00:00:00.000Z',
+      updated_at: '2026-04-27T00:00:00.000Z',
+    };
+
+    expect(toWorkspace(dto)).toEqual({id: dto.id, name: dto.name, status});
+  });
+});

package/src/hooks/api/workspace-mapper.ts

@@ -0,0 +1,6 @@
+import type {WorkspaceResponseDto} from '@shipfox/api-workspaces-dto';
+import type {Workspace} from '#core/auth.js';
+
+export function toWorkspace(dto: WorkspaceResponseDto): Workspace {
+  return {id: dto.id, name: dto.name, status: dto.status};
+}

package/src/index.ts

@@ -1,6 +1,5 @@
 export * from './components/auth-guard.js';
 export * from './components/auth-provider.js';
-export * from './components/auth-shell.js';
 export {WorkspaceCrumb, type WorkspaceCrumbProps} from './components/workspace-crumb.js';
 export {WorkspaceSwitcher, type WorkspaceSwitcherProps} from './components/workspace-switcher.js';
 export * from './hooks/index.js';