@ambasada/sdk 0.7.1 → 0.7.2

package/dist/index.js

@@ -679,7 +679,7 @@ var AmbasadaAuth = class {
   async verifyShellToken(token, options = {}) {
     const c = this.config();
     if (!c.issuer) throw new VillageError("CONFIG", "silent sign-in needs AMBASADA_AUTH_ISSUER (injected on ambasada.dev and by `ambasada dev`)");
-    const issuer = c.issuer.replace(/\/+$/, "");
+    const trusted = [c.issuer, c.hubUrl].filter((v) => !!v).map((v) => v.replace(/\/+$/, ""));
     const audiences = [options.audience ?? c.audiences ?? []].flat().filter(Boolean).map((a) => a.replace(/\/+$/, ""));
     if (!audiences.length) throw new VillageError("CONFIG", "silent sign-in needs to know this app: set AMBASADA_APP_ORIGIN or PUBLIC_URL, or pass { audience }");
     const doFetch = c.fetch ?? ((input, init) => fetch(input, init));
@@ -694,6 +694,9 @@ var AmbasadaAuth = class {
       throw shellRefused("not a JWT");
     }
     if (header3.alg !== "RS256") throw shellRefused(`alg ${String(header3.alg)} (only RS256)`);
+    const iss = typeof claims.iss === "string" ? claims.iss.replace(/\/+$/, "") : null;
+    if (iss && !trusted.includes(iss)) throw shellRefused(`issuer ${claims.iss}`);
+    const issuer = iss ?? trusted[0];
     let keys3 = await jwks(issuer, doFetch);
     let jwk = keys3.find((k) => k.kid === header3.kid) ?? (!header3.kid && keys3.length === 1 ? keys3[0] : void 0);
     if (!jwk) {
@@ -708,7 +711,6 @@ var AmbasadaAuth = class {
     if (typeof claims.exp !== "number" || claims.exp + LEEWAY_S < now) throw shellRefused("expired");
     if (typeof claims.nbf === "number" && claims.nbf - LEEWAY_S > now) throw shellRefused("not valid yet");
     if (typeof claims.iat === "number" && claims.iat - LEEWAY_S > now) throw shellRefused("issued in the future");
-    if (typeof claims.iss === "string" && claims.iss.replace(/\/+$/, "") !== issuer) throw shellRefused(`issuer ${claims.iss}`);
     const aud = [claims.aud].flat().filter((a) => typeof a === "string").map((a) => a.replace(/\/+$/, ""));
     if (!aud.some((a) => audiences.includes(a))) throw shellRefused(`it is for ${aud.join(", ") || "no app"}, not this one`);
     if (typeof claims.sub !== "string" || !claims.sub) throw shellRefused("no subject");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambasada/sdk",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "TypeScript SDK for the Hack A Ton village: Checkout, webhooks, receipts, Pay, needs, LLM, images, tools, files, listings, wallet.",
   "type": "module",
   "license": "MIT",