@ambasada/sdk 0.8.11 → 0.8.13

package/dist/auth.d.ts

@@ -40,7 +40,7 @@ export interface AuthConfig {
     issuer?: string;
     /** Who a shell token must be for (`aud`): your app id and origin. The request's origin is added in `shell()`. */
     audiences?: string[];
-    /** The hub, for the full profile behind a shell token (`/api/apps/profile`). */
+    /** The hub (default https://hub.ambasada.id): signs shell tokens, and has the full profile behind one (`/api/apps/profile`). */
     hubUrl?: string;
     /** Where `/v1/auth/profile` lives (the Ambasada API). */
     apiUrl: string;
@@ -110,9 +110,11 @@ export declare class AmbasadaAuth {
     /** Whoever is signed in on this request, or null (also null when sign-in is not set up). */
     user(req: WithHeaders): Promise<AmbasadaUser | null>;
     /**
-     * Verifies a shell token (Clerk JWT template `ambasada-miniapp`, RS256, 60 s) against
-     * `<AMBASADA_AUTH_ISSUER>/.well-known/jwks.json` (cached 1 h): signature, expiry, issuer, and that its `aud`
-     * is this app (its id or origin). Returns who it is, or throws `AmbasadaError("UNAUTHORIZED")`.
+     * Verifies a shell token (RS256, 60 s) from the hub (`<AMBASADA_HUB_URL>/.well-known/jwks.json`, default
+     * https://hub.ambasada.id) or Ambasada ID (`<AMBASADA_AUTH_ISSUER>/.well-known/jwks.json`, the Clerk JWT template
+     * `ambasada-miniapp`), keys cached 1 h: signature, expiry, issuer, and that its `aud` is this app (its origin or
+     * id). Returns who it is, or throws `AmbasadaError("UNAUTHORIZED")`; `NOT_CONFIGURED` (503) while the issuer
+     * publishes no keys.
      */
     verifyShellToken(token: string, options?: {
         audience?: string | string[];

package/dist/errors.d.ts

@@ -47,6 +47,8 @@ export declare const ERROR_STATUS: {
     readonly CAP_TOOLS_RATE: 429;
     readonly NETWORK: 0;
     readonly CONFIG: 0;
+    /** A platform feature this app relies on is not switched on yet (silent sign-in before the hub has keys). */
+    readonly NOT_CONFIGURED: 503;
     readonly RECEIPT_INVALID: 402;
     readonly WEBHOOK_INVALID: 400;
 };

package/dist/platform.js

@@ -180,6 +180,8 @@ var ERROR_STATUS = {
   // SDK-side
   NETWORK: 0,
   CONFIG: 0,
+  /** A platform feature this app relies on is not switched on yet (silent sign-in before the hub has keys). */
+  NOT_CONFIGURED: 503,
   RECEIPT_INVALID: 402,
   WEBHOOK_INVALID: 400
 };
@@ -409,13 +411,17 @@ async function jwks(issuer, doFetch, refresh = false) {
   if (cached && !refresh && Date.now() - cached.at < JWKS_TTL_MS) return cached.keys;
   if (cached && refresh && Date.now() - cached.at < 6e4) return cached.keys;
   const res = await doFetch(`${issuer}/.well-known/jwks.json`, { headers: { accept: "application/json" } });
-  if (!res.ok) throw new AmbasadaError("UPSTREAM_ERROR", `could not read the Ambasada ID keys (${res.status})`, 502);
-  const body = await res.json();
+  if (res.status === 404) throw notConfigured(`${issuer} publishes no signing keys yet`);
+  if (!res.ok) throw new AmbasadaError("UPSTREAM_ERROR", `could not read the signing keys of ${issuer} (${res.status})`, 502);
+  const body = await res.json().catch(() => ({}));
   const keys3 = (body.keys ?? []).filter((k) => k.kty === "RSA" && k.n && k.e);
+  if (!keys3.length) throw notConfigured(`${issuer} publishes no RS256 signing keys yet`);
   jwksCache.set(issuer, { at: Date.now(), keys: keys3 });
   return keys3;
 }
+var hubOf = (c) => (c.hubUrl || DEFAULT_HUB_URL).replace(/\/+$/, "");
 var shellRefused = (message) => new AmbasadaError("UNAUTHORIZED", `shell token refused: ${message}`, 401);
+var notConfigured = (message) => new AmbasadaError("NOT_CONFIGURED", `silent sign-in is not configured: ${message}`, 503);
 var AmbasadaAuth = class {
   constructor(config) {
     this.config = config;
@@ -505,14 +511,15 @@ var AmbasadaAuth = class {
     return (await verifyCookie(secret, "session", readOurCookie(req, SESSION_COOKIE)))?.user ?? null;
   }
   /**
-   * Verifies a shell token (Clerk JWT template `ambasada-miniapp`, RS256, 60 s) against
-   * `<AMBASADA_AUTH_ISSUER>/.well-known/jwks.json` (cached 1 h): signature, expiry, issuer, and that its `aud`
-   * is this app (its id or origin). Returns who it is, or throws `AmbasadaError("UNAUTHORIZED")`.
+   * Verifies a shell token (RS256, 60 s) from the hub (`<AMBASADA_HUB_URL>/.well-known/jwks.json`, default
+   * https://hub.ambasada.id) or Ambasada ID (`<AMBASADA_AUTH_ISSUER>/.well-known/jwks.json`, the Clerk JWT template
+   * `ambasada-miniapp`), keys cached 1 h: signature, expiry, issuer, and that its `aud` is this app (its origin or
+   * id). Returns who it is, or throws `AmbasadaError("UNAUTHORIZED")`; `NOT_CONFIGURED` (503) while the issuer
+   * publishes no keys.
    */
   async verifyShellToken(token, options = {}) {
     const c = this.config();
-    if (!c.issuer) throw new AmbasadaError("CONFIG", "silent sign-in needs AMBASADA_AUTH_ISSUER (injected on ambasada.dev and by `ambasada dev`)");
-    const trusted = [c.issuer, c.hubUrl].filter((v) => !!v).map((v) => v.replace(/\/+$/, ""));
+    const trusted = [...new Set([c.issuer, hubOf(c)].filter((v) => !!v).map((v) => v.replace(/\/+$/, "")))];
     const audiences = [options.audience ?? c.audiences ?? []].flat().filter(Boolean).map((a) => a.replace(/\/+$/, ""));
     if (!audiences.length) throw new AmbasadaError("CONFIG", "silent sign-in needs to know this app: set AMBASADA_APP_ORIGIN or PUBLIC_URL, or pass { audience }");
     const doFetch = c.fetch ?? ((input, init) => fetch(input, init));
@@ -557,6 +564,7 @@ var AmbasadaAuth = class {
    * Answers `{ user }`.
    */
   async shell(req) {
+    if (!this.configured) throw notConfigured("this app has no Sign in with Ambasada credentials (AMBASADA_AUTH_*: on ambasada.dev after `ambasada deploy`, and under `ambasada dev`)");
     const s = this.settings(req);
     if (req.method !== "POST") throw new AmbasadaError("INVALID_REQUEST", "POST the shell token as JSON { token }", 405);
     let token = /^Bearer\s+(.+)$/i.exec(req.headers.get("authorization") ?? "")?.[1]?.trim();
@@ -569,16 +577,13 @@ var AmbasadaAuth = class {
     const audiences = [...this.config().audiences ?? [], s.origin];
     const who = await this.verifyShellToken(token, { audience: audiences });
     let user = { id: who.user_id, name: who.name, avatar_url: who.avatar, builder: false, builder_since: null, member_since: null, pass: null };
-    const hub = this.config().hubUrl;
-    if (hub) {
-      try {
-        const res = await s.fetch(`${hub.replace(/\/+$/, "")}/api/apps/profile`, { headers: { authorization: `Bearer ${token}`, accept: "application/json" } });
-        if (res.ok) {
-          const profile = await res.json();
-          if (profile.id === who.user_id) user = { ...user, ...profile, id: who.user_id };
-        } else await res.body?.cancel();
-      } catch {
-      }
+    try {
+      const res = await s.fetch(`${hubOf(this.config())}/api/apps/profile`, { headers: { authorization: `Bearer ${token}`, accept: "application/json" } });
+      if (res.ok) {
+        const profile = await res.json();
+        if (profile.id === who.user_id) user = { ...user, ...profile, id: who.user_id };
+      } else await res.body?.cancel();
+    } catch {
     }
     const exp = Math.floor(Date.now() / 1e3) + SESSION_TTL_S;
     const session = await signCookie(s.clientSecret, "session", { user, exp });
@@ -598,6 +603,7 @@ var AmbasadaAuth = class {
 
 // src/client.ts
 var DEFAULT_API_URL = "https://api.ambasada.dev";
+var originOf = (url) => url && URL.canParse(url) ? new URL(url).origin : void 0;
 var isBinding = (v) => typeof v === "object" && v !== null && typeof v.fetch === "function";
 function processEnv() {
   const p = globalThis.process;
@@ -648,14 +654,13 @@ var Ambasada = class {
     issuer: this.options.auth?.issuer ?? this.env("AMBASADA_AUTH_ISSUER"),
     publicUrl: this.options.auth?.publicUrl ?? this.env("PUBLIC_URL"),
     apiUrl: this.apiUrl,
-    // Silent sign-in: a shell token must be for this app, by id or origin.
-    audiences: [this.appOrigin, this.options.app?.id ?? this.env("AMBASADA_APP_ID") ?? this.env("AMBASADA_COMPANY")].filter((a) => !!a),
+    // Silent sign-in: a shell token must be for this app, by origin (the deploy's and PUBLIC_URL) or id.
+    audiences: [...new Set([this.appOrigin, originOf(this.env("PUBLIC_URL")), this.options.app?.id, this.env("AMBASADA_APP_ID"), this.env("AMBASADA_COMPANY")].filter((a) => !!a))],
     hubUrl: this.hubUrl,
     fetch: this.fetcher
   }));
   get appOrigin() {
-    const url = this.options.app?.origin ?? this.env("AMBASADA_APP_ORIGIN") ?? this.options.auth?.publicUrl ?? this.env("PUBLIC_URL");
-    return url && URL.canParse(url) ? new URL(url).origin : void 0;
+    return originOf(this.options.app?.origin ?? this.env("AMBASADA_APP_ORIGIN") ?? this.options.auth?.publicUrl ?? this.env("PUBLIC_URL"));
   }
   get hubUrl() {
     return this.options.app?.hubUrl ?? this.env("AMBASADA_HUB_URL");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambasada/sdk",
-  "version": "0.8.11",
+  "version": "0.8.13",
   "description": "The Ambasada platform SDK: Sign in with Ambasada, mini-app notifications, the project store, files.",
   "type": "module",
   "license": "MIT",
@@ -27,7 +27,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@ambasada/village": "^0.8.11"
+    "@ambasada/village": "^0.8.13"
   },
   "devDependencies": {
     "@types/node": "^22.20.5",