@shipfox/client-auth 5.0.0 → 6.0.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/client-auth",
   "license": "MIT",
-  "version": "5.0.0",
+  "version": "6.0.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -10,10 +10,6 @@
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "imports": {
-    "#*": "./dist/*",
-    "#test/*": "./test/*"
-  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -35,13 +31,13 @@
   "dependencies": {
     "@swc/helpers": "^0.5.17",
     "@tanstack/react-form": "^1.32.0",
-    "@shipfox/api-auth-dto": "7.1.0",
-    "@shipfox/client-api": "4.0.0",
-    "@shipfox/api-workspaces-dto": "6.0.0",
-    "@shipfox/client-invitations": "5.0.0",
-    "@shipfox/client-shell": "5.0.0",
-    "@shipfox/client-ui": "4.0.0",
-    "@shipfox/react-ui": "0.3.5"
+    "@shipfox/api-auth-dto": "9.0.2",
+    "@shipfox/client-api": "6.0.1",
+    "@shipfox/client-invitations": "6.0.2",
+    "@shipfox/client-shell": "6.0.2",
+    "@shipfox/api-workspaces-dto": "9.0.2",
+    "@shipfox/client-ui": "6.0.2",
+    "@shipfox/react-ui": "0.3.7"
   },
   "peerDependencies": {
     "@tanstack/react-query": "^5.101.0",
@@ -50,6 +46,9 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
+  "imports": {
+    "#*": "./dist/*"
+  },
   "scripts": {
     "build": "shipfox-swc",
     "check": "shipfox-biome-check",

package/src/components/auth-guard.tsx

@@ -1,8 +1,10 @@
+import {useRouteSearch} from '@shipfox/client-shell/runtime';
 import {FullPageLoader} from '@shipfox/react-ui/loader';
-import {Navigate, useRouter, useSearch} from '@tanstack/react-router';
+import {Navigate, useRouter} from '@tanstack/react-router';
 import {type PropsWithChildren, useEffect} from 'react';
 import {useAuthState} from '#hooks/use-auth-state.js';
 import {WorkspaceOnboardingPage} from '#pages/workspace-onboarding-page.js';
+import {validateRedirectSearch} from '../routes/inputs.js';
 import {sanitizeRedirectPath} from './redirect-target.js';
 
 export function AuthGuard({children}: PropsWithChildren) {
@@ -21,7 +23,7 @@ export function AuthGuard({children}: PropsWithChildren) {
 
 export function GuestGuard({children}: PropsWithChildren) {
   const auth = useAuthState();
-  const search = useSearch({strict: false}) as {redirect?: unknown};
+  const search = useRouteSearch(validateRedirectSearch);
   const router = useRouter();
   const target = sanitizeRedirectPath(search.redirect);
 

package/src/components/auth-provider.test.tsx

@@ -1,5 +1,5 @@
-import {configureApiClient} from '@shipfox/client-api';
-import {QueryClient, useQuery} from '@tanstack/react-query';
+import {ApiError, configureApiClient} from '@shipfox/client-api';
+import {QueryClient, useQuery, useQueryClient} from '@tanstack/react-query';
 import {render, screen, waitFor} from '@testing-library/react';
 import {useEffect, useRef} from 'react';
 import {useLoginAuth} from '#hooks/api/login-auth.js';
@@ -45,6 +45,8 @@ function StatusProbe() {
 
 function PrivateDataProbe() {
   const auth = useAuthState();
+  const queryClient = useQueryClient();
+  const seeded = useRef(false);
   const privateData = useQuery({
     queryKey: ['private-data'],
     queryFn: () => new Promise<string>(() => undefined),
@@ -52,6 +54,12 @@ function PrivateDataProbe() {
   });
   const login = useLoginAuth();
 
+  useEffect(() => {
+    if (!auth.isAuthenticated || seeded.current) return;
+    seeded.current = true;
+    queryClient.setQueryData(['private-data'], 'User A private data');
+  }, [auth.isAuthenticated, queryClient]);
+
   return (
     <div>
       <span data-testid="private-data">{privateData.data ?? 'loading'}</span>
@@ -114,6 +122,24 @@ describe('AuthProvider', () => {
     expect(queryClient.getQueryData(['private-data'])).toBeUndefined();
   });
 
+  test('clears a hydrated private cache before accepting the first principal', async () => {
+    const queryClient = new QueryClient();
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValue(jsonResponse({token: 'other-token', user: otherUser}));
+    configureApiClient({fetchImpl});
+    queryClient.setQueryData(['private-data'], 'previous principal private data');
+
+    render(
+      <AuthProvider queryClient={queryClient}>
+        <StatusProbe />
+      </AuthProvider>,
+    );
+
+    await waitFor(() => expect(screen.getByTestId('status')).toHaveTextContent('authenticated'));
+    expect(queryClient.getQueryData(['private-data'])).toBeUndefined();
+  });
+
   test('keeps the current session when refresh fails with a server error', async () => {
     const fetchImpl = vi
       .fn()
@@ -156,21 +182,30 @@ describe('AuthProvider', () => {
       .fn()
       .mockImplementation(() => Promise.resolve(jsonResponse({token: 'access-token', user})));
     configureApiClient({fetchImpl});
-    queryClient.setQueryData(['private-data'], 'current user private data');
     const onDone = vi.fn();
+    const onReady = vi.fn();
 
     function RefreshAfterBootProbe() {
       const auth = useAuthState();
       const refresh = useRefreshAuth();
-      const didRefresh = useRef(false);
+      const queryClient = useQueryClient();
+      const didSeed = useRef(false);
 
       useEffect(() => {
-        if (auth.status !== 'authenticated' || didRefresh.current) return;
-        didRefresh.current = true;
-        void refresh().then(onDone);
-      }, [auth.status, refresh]);
+        if (auth.status !== 'authenticated' || didSeed.current) return;
+        didSeed.current = true;
+        queryClient.setQueryData(['private-data'], 'current user private data');
+        onReady();
+      }, [auth.status, queryClient]);
 
-      return <StatusProbe />;
+      return (
+        <>
+          <StatusProbe />
+          <button type="button" onClick={() => void refresh().then(onDone)}>
+            Refresh
+          </button>
+        </>
+      );
     }
 
     render(
@@ -179,6 +214,9 @@ describe('AuthProvider', () => {
       </AuthProvider>,
     );
 
+    await waitFor(() => expect(onReady).toHaveBeenCalledTimes(1));
+    cancelQueries.mockClear();
+    screen.getByRole('button', {name: 'Refresh'}).click();
     await waitFor(() => expect(onDone).toHaveBeenCalledTimes(1));
     expect(cancelQueries).not.toHaveBeenCalled();
     expect(queryClient.getQueryData(['private-data'])).toBe('current user private data');
@@ -211,6 +249,80 @@ describe('AuthProvider', () => {
     expect(fetchImpl).toHaveBeenCalledTimes(2);
   });
 
+  test('does not restore a stale refresh result after a principal transition', async () => {
+    let refreshRequestCount = 0;
+    let workspaceRequestCount = 0;
+    const initialWorkspaceRefresh = new Promise<Response>(() => undefined);
+    const onFreshRefresh = vi.fn();
+    const onRefreshError = vi.fn();
+    const fetchImpl = vi.fn((input: RequestInfo | URL) => {
+      const url = (input as Request).url;
+      if (url.endsWith('/auth/refresh')) {
+        refreshRequestCount += 1;
+        return refreshRequestCount === 1
+          ? Promise.resolve(jsonResponse({token: 'access-token', user}))
+          : Promise.resolve(jsonResponse({token: 'other-token-2', user: otherUser}));
+      }
+      if (url.endsWith('/auth/login'))
+        return Promise.resolve(jsonResponse({token: 'other-token', user: otherUser}));
+      if (url.endsWith('/workspaces')) {
+        workspaceRequestCount += 1;
+        return workspaceRequestCount === 1
+          ? initialWorkspaceRefresh
+          : Promise.resolve(jsonResponse({memberships: []}));
+      }
+      return Promise.resolve(jsonResponse({token: 'access-token', user}));
+    });
+    configureApiClient({fetchImpl});
+
+    function RefreshAndLoginProbe() {
+      const auth = useAuthState();
+      const login = useLoginAuth();
+      const refresh = useRefreshAuth();
+
+      useEffect(() => {
+        void refresh().catch(onRefreshError);
+      }, [refresh]);
+
+      return (
+        <div>
+          <span data-testid="email">{auth.user?.email ?? 'none'}</span>
+          <button
+            type="button"
+            onClick={() =>
+              void login.mutateAsync({email: 'other@example.com', password: 'password'})
+            }
+          >
+            Login as other user
+          </button>
+          <button type="button" onClick={() => void refresh().then(onFreshRefresh)}>
+            Refresh current principal
+          </button>
+        </div>
+      );
+    }
+
+    render(
+      <AuthProvider>
+        <RefreshAndLoginProbe />
+      </AuthProvider>,
+    );
+
+    await waitFor(() => expect(workspaceRequestCount).toBe(1));
+    screen.getByRole('button', {name: 'Login as other user'}).click();
+    await waitFor(() => expect(screen.getByTestId('email')).toHaveTextContent('other@example.com'));
+    await waitFor(() => expect(onRefreshError).toHaveBeenCalledTimes(1));
+    const refreshError = onRefreshError.mock.calls[0]?.[0];
+    expect(refreshError).toBeInstanceOf(ApiError);
+    expect(refreshError).toMatchObject({code: 'unauthorized', status: 401});
+
+    screen.getByRole('button', {name: 'Refresh current principal'}).click();
+    await waitFor(() => expect(onFreshRefresh).toHaveBeenCalledTimes(1));
+    expect(refreshRequestCount).toBe(2);
+
+    expect(screen.getByTestId('email')).toHaveTextContent('other@example.com');
+  });
+
   test('logout clears local state even when the API call fails', async () => {
     const queryClient = new QueryClient();
     const cancelQueries = vi.spyOn(queryClient, 'cancelQueries');
@@ -219,8 +331,16 @@ describe('AuthProvider', () => {
       .mockResolvedValueOnce(jsonResponse({token: 'access-token', user}))
       .mockRejectedValueOnce(new Error('offline'));
     configureApiClient({fetchImpl});
-    queryClient.setQueryData(['private-data'], 'private data');
     const onQueryAbort = vi.fn();
+
+    render(
+      <AuthProvider queryClient={queryClient}>
+        <StatusProbe />
+      </AuthProvider>,
+    );
+
+    await waitFor(() => expect(screen.getByTestId('status')).toHaveTextContent('authenticated'));
+    queryClient.setQueryData(['private-data'], 'private data');
     void queryClient
       .fetchQuery({
         queryKey: ['in-flight-private-data'],
@@ -233,14 +353,7 @@ describe('AuthProvider', () => {
           }),
       })
       .catch(() => undefined);
-
-    render(
-      <AuthProvider queryClient={queryClient}>
-        <StatusProbe />
-      </AuthProvider>,
-    );
-
-    await waitFor(() => expect(screen.getByTestId('status')).toHaveTextContent('authenticated'));
+    cancelQueries.mockClear();
     screen.getByRole('button', {name: 'Logout'}).click();
 
     await waitFor(() => expect(screen.getByTestId('status')).toHaveTextContent('guest'));
@@ -312,7 +425,6 @@ describe('AuthProvider', () => {
       return Promise.resolve(jsonResponse({token: 'access-token', user}));
     });
     configureApiClient({fetchImpl});
-    queryClient.setQueryData(['private-data'], 'User A private data');
 
     render(
       <AuthProvider queryClient={queryClient}>
@@ -323,6 +435,7 @@ describe('AuthProvider', () => {
     await waitFor(() =>
       expect(screen.getByTestId('private-data')).toHaveTextContent('User A private data'),
     );
+    cancelQueries.mockClear();
     screen.getByRole('button', {name: 'Switch user'}).click();
 
     await waitFor(() =>

package/src/components/redirect-target.test.ts

@@ -1,4 +1,4 @@
-import {sanitizeRedirectPath} from './redirect-target.js';
+import {sanitizeLogoutRedirectPath, sanitizeRedirectPath} from './redirect-target.js';
 
 describe('sanitizeRedirectPath', () => {
   describe.each([
@@ -66,3 +66,34 @@ describe('sanitizeRedirectPath', () => {
     });
   });
 });
+
+describe('sanitizeLogoutRedirectPath', () => {
+  describe.each([
+    ['explicit login fallback', '/auth/login', '/auth/login'],
+    ['same-origin workspace path', '/workspaces/abc', '/workspaces/abc'],
+    [
+      'same-origin path with search and hash',
+      '/workspaces/abc?tab=runs#header',
+      '/workspaces/abc?tab=runs#header',
+    ],
+  ])('accepts %s', (_label, input, expected) => {
+    test('returns the safe destination', () => {
+      expect(sanitizeLogoutRedirectPath(input)).toBe(expected);
+    });
+  });
+
+  describe.each([
+    ['missing redirect', undefined],
+    ['external URL', 'https://attacker.example'],
+    ['protocol-relative URL', '//attacker.example'],
+    ['auth route other than login', '/auth/reset'],
+    ['login route with a query', '/auth/login?redirect=/workspaces/abc'],
+    ['raw invitation token', '/invitations/accept?token=sf_i_raw-token'],
+    ['raw invitation token with trailing slash', '/invitations/accept/?token=sf_i_raw-token'],
+    ['malformed percent encoding', '/%E0%80%80'],
+  ])('falls back for %s', (_label, input) => {
+    test('returns login without forwarding unsafe state', () => {
+      expect(sanitizeLogoutRedirectPath(input)).toBe('/auth/login');
+    });
+  });
+});

package/src/components/redirect-target.ts

@@ -1,8 +1,10 @@
 const REDIRECT_ORIGIN = 'https://shipfox-redirect.invalid';
+const LOGIN_PATH = '/auth/login';
+const INVITATION_ACCEPT_PATH = '/invitations/accept';
+const DEFAULT_LOGOUT_REDIRECT = LOGIN_PATH;
+const TRAILING_SLASHES = /\/+$/;
 
-// Resolves and canonicalizes an internal path before returning it, so browser URL
-// parsing cannot turn a seemingly safe path into an external or auth route.
-export function sanitizeRedirectPath(value: unknown): string | undefined {
+function resolveRedirectPath(value: unknown): URL | undefined {
   if (typeof value !== 'string' || !value.startsWith('/')) return undefined;
   let decoded: string;
   try {
@@ -17,6 +19,41 @@ export function sanitizeRedirectPath(value: unknown): string | undefined {
     return undefined;
   }
   if (target.origin !== REDIRECT_ORIGIN) return undefined;
-  if (target.pathname === '/auth' || target.pathname.startsWith('/auth/')) return undefined;
+  return target;
+}
+
+function formatRedirectPath(target: URL): string {
   return `${target.pathname}${target.search}${target.hash}`;
 }
+
+function isAuthPath(pathname: string): boolean {
+  return pathname === '/auth' || pathname.startsWith('/auth/');
+}
+
+// Resolves and canonicalizes an internal path before returning it, so browser URL
+// parsing cannot turn a seemingly safe path into an external or auth route.
+export function sanitizeRedirectPath(value: unknown): string | undefined {
+  const target = resolveRedirectPath(value);
+  if (!target || isAuthPath(target.pathname)) return undefined;
+  return formatRedirectPath(target);
+}
+
+function containsInvitationToken(target: URL): boolean {
+  const normalizedPathname = target.pathname.replace(TRAILING_SLASHES, '') || '/';
+  return normalizedPathname === INVITATION_ACCEPT_PATH && target.searchParams.has('token');
+}
+
+/**
+ * Returns the destination used by the shared logout route.
+ *
+ * Login is the only auth destination allowed, and invitation tokens never
+ * survive this boundary. Invalid values fail closed to login.
+ */
+export function sanitizeLogoutRedirectPath(value: unknown): string {
+  const target = resolveRedirectPath(value);
+  if (!target) return DEFAULT_LOGOUT_REDIRECT;
+  if (isAuthPath(target.pathname) || containsInvitationToken(target)) {
+    return DEFAULT_LOGOUT_REDIRECT;
+  }
+  return formatRedirectPath(target);
+}

package/src/components/workspace-switcher.tsx

@@ -11,7 +11,7 @@ import {Icon} from '@shipfox/react-ui/icon';
 import {useNavigate} from '@tanstack/react-router';
 import {useSetAtom} from 'jotai';
 import {useAuthState} from '#hooks/use-auth-state.js';
-import {lastWorkspaceIdAtom} from '#state/last-workspace.js';
+import {lastWorkspaceIdAtom, rememberLastWorkspaceId} from '#state/last-workspace.js';
 
 export interface WorkspaceSwitcherProps {
   activeWorkspaceId: string | undefined;
@@ -19,13 +19,14 @@ export interface WorkspaceSwitcherProps {
 }
 
 export function WorkspaceSwitcher({activeWorkspaceId, onSelect}: WorkspaceSwitcherProps) {
-  const {workspaces} = useAuthState();
+  const {user, workspaces} = useAuthState();
   const navigate = useNavigate();
   const setLastWorkspaceId = useSetAtom(lastWorkspaceIdAtom);
 
   const handleSelect = (workspaceId: string) => {
     try {
       setLastWorkspaceId(workspaceId);
+      if (user?.id) rememberLastWorkspaceId(user.id, workspaceId);
     } catch {
       // localStorage may throw in private browsing or quota-exceeded; persistence is best-effort.
     }

package/src/core/auth.ts

@@ -0,0 +1,55 @@
+export interface LoginCommand {
+  email: string;
+  password: string;
+}
+
+export interface SignupCommand extends LoginCommand {
+  name: string;
+  invitationToken?: string;
+}
+
+export interface PasswordResetRequestCommand {
+  email: string;
+}
+
+export interface PasswordResetConfirmCommand {
+  token: string;
+  newPassword: string;
+}
+
+export interface VerifyEmailCommand {
+  email: string;
+  challengeId: string;
+  code: string;
+}
+
+export interface ResendEmailVerificationCommand {
+  email: string;
+  challengeId: string;
+}
+
+export interface WorkspaceCreateCommand {
+  name: string;
+}
+
+export interface Workspace {
+  id: string;
+  name: string;
+  status: 'active' | 'suspended' | 'deleted';
+}
+
+export interface SignupResult {
+  user: {
+    id: string;
+    email: string;
+    name?: string;
+    emailVerifiedAt?: string;
+  };
+  emailChallenge?: {id: string; nextResendAvailableAt: string};
+  membership?: {id: string; userId: string; workspaceId: string};
+  acceptError?: {code: string; message: string};
+}
+
+export interface EmailVerificationResendResult {
+  nextResendAvailableAt: string;
+}

package/src/hooks/api/auth-mapper.ts

@@ -1,19 +1,9 @@
 import type {SignupResponseDto} from '@shipfox/api-auth-dto';
-import {
-  toAuthenticatedSession,
-  toUserIdentity,
-  type UserIdentity,
-} from '@shipfox/client-shell/runtime';
+import {toAuthenticatedSession, toUserIdentity} from '@shipfox/client-shell/runtime';
+import type {SignupResult} from '#core/auth.js';
 
 export {toAuthenticatedSession};
 
-export interface SignupResult {
-  user: UserIdentity;
-  emailChallenge?: {id: string; nextResendAvailableAt: string};
-  membership?: {id: string; userId: string; workspaceId: string};
-  acceptError?: {code: string; message: string};
-}
-
 export function toSignupResult(dto: SignupResponseDto): SignupResult {
   return {
     user: toUserIdentity(dto.user),

package/src/hooks/api/login-auth.ts

@@ -1,13 +1,14 @@
-import {type LoginBodyDto, loginResponseSchema} from '@shipfox/api-auth-dto';
+import {loginResponseSchema} from '@shipfox/api-auth-dto';
 import {checkedApiRequest} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
+import type {LoginCommand} from '#core/auth.js';
 import {useAuthTransition} from '#state/auth.js';
 import {toAuthenticatedSession} from './auth-mapper.js';
 
-export async function loginAuth(body: LoginBodyDto) {
+export async function loginAuth(command: LoginCommand) {
   const response = await checkedApiRequest(loginResponseSchema, '/auth/login', {
     method: 'POST',
-    body,
+    body: command,
   });
   return toAuthenticatedSession(response);
 }
@@ -17,6 +18,6 @@ export function useLoginAuth() {
 
   return useMutation({
     mutationFn: loginAuth,
-    onSuccess: enterAuthenticated,
+    onSuccess: (session) => enterAuthenticated(session),
   });
 }

package/src/hooks/api/logout-auth.ts

@@ -1,10 +1,10 @@
-import {apiRequest} from '@shipfox/client-api';
+import {checkedApiRequest, emptyResponseSchema} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
 import {useAuthTransition} from '#state/auth.js';
 
 async function logoutAuth() {
   try {
-    await apiRequest<void>('/auth/logout', {method: 'POST', body: {}});
+    await checkedApiRequest(emptyResponseSchema, '/auth/logout', {method: 'POST', body: {}});
   } catch {
     // Logout is best-effort: local session state must clear even if the API is offline.
   }
@@ -15,6 +15,6 @@ export function useLogoutAuth() {
 
   return useMutation({
     mutationFn: logoutAuth,
-    onSettled: enterGuest,
+    onSettled: () => enterGuest(),
   });
 }

package/src/hooks/api/password-reset-auth.test.ts

@@ -55,7 +55,7 @@ describe('confirmPasswordReset', () => {
       });
     });
     configureApiClient({fetchImpl});
-    const body = {token: 'reset-token', new_password: 'new password is long'};
+    const body = {token: 'reset-token', newPassword: 'new password is long'};
 
     const result = await confirmPasswordReset(body);
 
@@ -63,6 +63,6 @@ describe('confirmPasswordReset', () => {
     expect(result.accessToken).toBe('reset-access-token');
     expect(request.url).toBe('https://api.example.test/auth/password-reset/confirm');
     expect(request.method).toBe('POST');
-    expect(requestBody).toEqual(body);
+    expect(requestBody).toEqual({token: body.token, new_password: body.newPassword});
   });
 });

package/src/hooks/api/password-reset-auth.ts

@@ -1,24 +1,24 @@
-import {
-  type PasswordResetConfirmBodyDto,
-  type PasswordResetRequestBodyDto,
-  passwordResetConfirmResponseSchema,
-} from '@shipfox/api-auth-dto';
-import {apiRequest, checkedApiRequest} from '@shipfox/client-api';
+import {passwordResetConfirmResponseSchema} from '@shipfox/api-auth-dto';
+import {checkedApiRequest, emptyResponseSchema} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
+import type {PasswordResetConfirmCommand, PasswordResetRequestCommand} from '#core/auth.js';
 import {useAuthTransition} from '#state/auth.js';
 import {toAuthenticatedSession} from './auth-mapper.js';
 
-export async function requestPasswordReset(body: PasswordResetRequestBodyDto) {
-  await apiRequest<void>('/auth/password-reset', {method: 'POST', body});
+export async function requestPasswordReset(command: PasswordResetRequestCommand) {
+  await checkedApiRequest(emptyResponseSchema, '/auth/password-reset', {
+    method: 'POST',
+    body: command,
+  });
 }
 
-export async function confirmPasswordReset(body: PasswordResetConfirmBodyDto) {
+export async function confirmPasswordReset(command: PasswordResetConfirmCommand) {
   const response = await checkedApiRequest(
     passwordResetConfirmResponseSchema,
     '/auth/password-reset/confirm',
     {
       method: 'POST',
-      body,
+      body: {token: command.token, new_password: command.newPassword},
     },
   );
   return toAuthenticatedSession(response);
@@ -33,6 +33,6 @@ export function useConfirmPasswordResetAuth() {
 
   return useMutation({
     mutationFn: confirmPasswordReset,
-    onSuccess: enterAuthenticated,
+    onSuccess: (session) => enterAuthenticated(session),
   });
 }

package/src/hooks/api/refresh-auth.ts

@@ -1,5 +1,6 @@
 export {
   authRefreshQueryKey,
+  authRefreshQueryOptions,
   getAuthRefreshDelayMs,
   useRefreshAuth,
 } from '@shipfox/client-shell/runtime';

package/src/hooks/api/signup-auth.ts

@@ -1,12 +1,18 @@
-import {type SignupBodyDto, signupResponseSchema} from '@shipfox/api-auth-dto';
+import {signupResponseSchema} from '@shipfox/api-auth-dto';
 import {checkedApiRequest} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
+import type {SignupCommand} from '#core/auth.js';
 import {toSignupResult} from './auth-mapper.js';
 
-async function signupAuth(body: SignupBodyDto) {
+async function signupAuth(command: SignupCommand) {
   const response = await checkedApiRequest(signupResponseSchema, '/auth/signup', {
     method: 'POST',
-    body,
+    body: {
+      email: command.email,
+      password: command.password,
+      name: command.name,
+      ...(command.invitationToken ? {invitation_token: command.invitationToken} : {}),
+    },
   });
   return toSignupResult(response);
 }