@astralbeam/sdk 0.7.0 → 0.10.1

package/dist/server.d.ts

@@ -25,18 +25,32 @@ interface TenantUser {
   readonly admin?: boolean | undefined;
   readonly metadata?: JsonMetadata | undefined;
 }
-interface CreateChatAuthTokenOptions<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant> {
+interface CreateAstralBeamTokenOptions<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant> {
   readonly apiKey: string;
   readonly user: TTenantUser;
   readonly tenant: TTenant;
   readonly expiresInSeconds?: number | undefined;
 }
+interface CreateAstralBeamOrganizationTokenOptions {
+  readonly apiKey: string;
+  /** Host-authenticated email of an existing organization member, never browser-supplied identity. */
+  readonly email: string;
+  readonly organizationId: string;
+  readonly expiresInSeconds?: number | undefined;
+}
+/** Delegates a member's current database permissions. Does not restrict the API-key holder's authority. */
+declare function createAstralBeamOrganizationToken({
+  apiKey,
+  email,
+  organizationId,
+  expiresInSeconds
+}: CreateAstralBeamOrganizationTokenOptions): Promise<string>;
 /** Creates the short-lived bearer token returned by an application's server auth endpoint. */
-declare function createChatAuthToken<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant>({
+declare function createAstralBeamToken<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant>({
   apiKey,
   user,
   tenant,
   expiresInSeconds
-}: CreateChatAuthTokenOptions<TTenantUser, TTenant>): Promise<string>;
+}: CreateAstralBeamTokenOptions<TTenantUser, TTenant>): Promise<string>;
 //#endregion
-export { CHAT_AUTH_TOKEN_AUDIENCE, CHAT_AUTH_TOKEN_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_MAX_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_TYPE, CHAT_AUTH_TOKEN_VERSION, CreateChatAuthTokenOptions, JsonMetadata, JsonValue, Tenant, TenantUser, createChatAuthToken };
+export { CHAT_AUTH_TOKEN_AUDIENCE, CHAT_AUTH_TOKEN_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_MAX_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_TYPE, CHAT_AUTH_TOKEN_VERSION, CreateAstralBeamOrganizationTokenOptions, CreateAstralBeamTokenOptions, JsonMetadata, JsonValue, Tenant, TenantUser, createAstralBeamOrganizationToken, createAstralBeamToken };

package/dist/server.js

@@ -645,7 +645,7 @@ const CHAT_AUTH_TOKEN_MAX_LIFETIME_SECONDS = 600;
 const CHAT_AUTH_TOKEN_MAX_BYTES = 16384;
 const IDENTITY_MAX_BYTES = 8192;
 const EXTERNAL_ID_MAX_LENGTH = 255;
-const API_KEY_PATTERN = /^key_[0-9a-z-]{1,63}_[0-9a-z-]{1,63}_abo_[A-Za-z]{64}$/;
+const API_KEY_PATTERN = /^key_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}_abo_[A-Za-z]{64}$/;
 const TENANT_FIELDS = [
 	"id",
 	"name",
@@ -659,13 +659,13 @@ const TENANT_USER_FIELDS = [
 ];
 const textEncoder = new TextEncoder();
 function parseApiKey(apiKey) {
-	if (!API_KEY_PATTERN.test(apiKey)) throw new Error("apiKey must match key_<organization>_<key>_abo_<secret>");
+	if (!API_KEY_PATTERN.test(apiKey)) throw new Error("apiKey must match key_<organizationId>_<id>_abo_<secret>");
 	const separator = apiKey.lastIndexOf("_abo_");
 	const keyId = apiKey.slice(0, separator);
 	const keySecret = apiKey.slice(separator + 1);
 	return {
 		keyId,
-		organizationSlug: keyId.slice(4, keyId.indexOf("_", 4)),
+		organizationId: keyId.slice(4, keyId.indexOf("_", 4)),
 		keySecret
 	};
 }
@@ -704,10 +704,27 @@ async function signingKey(secret) {
 	const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(secret));
 	return textEncoder.encode(encode(new Uint8Array(digest)));
 }
+/** Delegates a member's current database permissions. Does not restrict the API-key holder's authority. */
+async function createAstralBeamOrganizationToken({ apiKey, email, organizationId, expiresInSeconds = 300 }) {
+	if (typeof email !== "string" || email.length > 320 || email.includes("\0") || !/^[^\s@]+@[^\s@]+$/.test(email)) throw new Error("email must be an email address of at most 320 characters");
+	if (!Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > 600) throw new Error("organization auth tokens must live for 60-600 seconds");
+	const { keyId, organizationId: keyOrganizationId, keySecret } = parseApiKey(apiKey);
+	if (organizationId !== keyOrganizationId) throw new Error("organizationId must match the API key organization");
+	const now = Math.floor(Date.now() / 1e3);
+	return await new SignJWT({
+		ver: 1,
+		email,
+		organization_id: organizationId
+	}).setProtectedHeader({
+		alg: "HS256",
+		typ: "astralbeam-organization+jwt",
+		kid: keyId
+	}).setIssuer(organizationId).setAudience(CHAT_AUTH_TOKEN_AUDIENCE).setIssuedAt(now).setExpirationTime(now + expiresInSeconds).sign(await signingKey(keySecret));
+}
 /** Creates the short-lived bearer token returned by an application's server auth endpoint. */
-async function createChatAuthToken({ apiKey, user, tenant, expiresInSeconds = 300 }) {
+async function createAstralBeamToken({ apiKey, user, tenant, expiresInSeconds = 300 }) {
 	if (!Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > 600) throw new Error("chat auth tokens must live for 60-600 seconds");
-	const { keyId, organizationSlug, keySecret } = parseApiKey(apiKey);
+	const { keyId, organizationId, keySecret } = parseApiKey(apiKey);
 	const identity = validatedIdentity(user, tenant);
 	const now = Math.floor(Date.now() / 1e3);
 	const token = await new SignJWT({
@@ -718,9 +735,9 @@ async function createChatAuthToken({ apiKey, user, tenant, expiresInSeconds = 30
 		alg: "HS256",
 		typ: CHAT_AUTH_TOKEN_TYPE,
 		kid: keyId
-	}).setIssuer(organizationSlug).setAudience(CHAT_AUTH_TOKEN_AUDIENCE).setIssuedAt(now).setExpirationTime(now + expiresInSeconds).sign(await signingKey(keySecret));
+	}).setIssuer(organizationId).setAudience(CHAT_AUTH_TOKEN_AUDIENCE).setIssuedAt(now).setExpirationTime(now + expiresInSeconds).sign(await signingKey(keySecret));
 	if (textEncoder.encode(token).byteLength > CHAT_AUTH_TOKEN_MAX_BYTES) throw new Error(`chat auth tokens must not exceed ${CHAT_AUTH_TOKEN_MAX_BYTES} bytes`);
 	return token;
 }
 //#endregion
-export { CHAT_AUTH_TOKEN_AUDIENCE, CHAT_AUTH_TOKEN_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_MAX_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_TYPE, CHAT_AUTH_TOKEN_VERSION, createChatAuthToken };
+export { CHAT_AUTH_TOKEN_AUDIENCE, CHAT_AUTH_TOKEN_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_MAX_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_TYPE, CHAT_AUTH_TOKEN_VERSION, createAstralBeamOrganizationToken, createAstralBeamToken };