@atlasauth/backend 0.9.0 → 0.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/README.md +2 -0
- package/dist/client/branding.d.ts +20 -0
- package/dist/client/branding.js.map +1 -1
- package/dist/client/diagnostics.d.ts +16 -0
- package/dist/client/diagnostics.js.map +1 -1
- package/dist/client/error.d.ts +10 -0
- package/dist/client/error.js +10 -0
- package/dist/client/error.js.map +1 -1
- package/dist/client/instance.d.ts +21 -2
- package/dist/client/instance.js.map +1 -1
- package/dist/client/platform.d.ts +11 -5
- package/dist/client/platform.js.map +1 -1
- package/dist/webhooks.js +32 -7
- package/dist/webhooks.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# @atlasauth/backend changelog
|
|
2
2
|
|
|
3
|
+
## 0.9.1
|
|
4
|
+
- **Allowed origins with an integration.** `UpdateInstanceBody.allowed_origins` and the platform app, instance and accountless-app bodies accept `AllowedOriginInput` entries: an origin string or `{ origin, integration }` (`OriginIntegration`: `redirect` | `embedded` | `auto`, or `null` to clear). `Instance`, `InstanceUpdateResult` and `PlatformApp` gain optional `allowed_origin_integrations`. New types: `AllowedOriginEntry`, `AllowedOriginInput`, `OriginIntegration`.
|
|
5
|
+
- **Login readiness.** `LoginReadiness` gains `integration` (`LoginReadinessIntegration`: `assumed`, `source`, `reason`); `LoginReadinessCheck` gains `applies`.
|
|
6
|
+
- **Branding audiences.** `Branding` accepts `audiences` (hint → `BrandingAudience` `{ heading, subheading, logoUrl, primaryColor }`, `null` deletes one); `ResolvedBranding` gains `audiences`. Start a hosted sign-in with `audienceHint` (or `audience_hint` on the URL) to use one.
|
|
7
|
+
- **Error codes.** `AtlasErrorCodes` adds `READ_ONLY_FIELD`, `DEVELOPMENT_EMAIL_NOT_ALLOWED`, `DEVELOPMENT_EMAIL_UNAVAILABLE`, `DEVELOPMENT_EMAIL_LIMIT_REACHED` and `DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED`.
|
|
8
|
+
- **Webhooks, several signatures.** `verifyWebhook` accepts an `atlas-signature` header with several space-separated `v1,<signature>` entries and verifies when any one matches (each compared in constant time). This prepares for webhook secret rotation with an overlap. A header with a single signature works as before.
|
|
9
|
+
- **Compatible.** New types, optional fields and error codes only; a single-signature webhook header verifies as before.
|
|
10
|
+
|
|
3
11
|
## 0.9.0
|
|
4
12
|
- **OIDC relying party.** New `oidc` namespace and standalone functions for the hosted-redirect sign-in: `oidcStart` (`oidc.start`), `oidcCallback` (`oidc.callback`), `oidcLogoutUrl` (`oidc.logoutUrl`), `oidcVerifyIdToken` (`oidc.verifyIdToken`), `oidcClearCookie` (`oidc.clearCookie`). `start({ issuer, clientId, redirectUri, scope?, prompt?, loginHint?, audienceHint?, extraParams?, cookieName?, secret? })` returns `{ url, cookie, state, nonce }`: a PKCE (S256) authorize URL from discovery and a `Set-Cookie` for a 10-minute, httpOnly, `SameSite=Lax`, callback-path flow cookie, AES-GCM sealed when `secret` is set. `callback({ …, clientSecret?, clientAuth?: 'client_secret_basic' | 'client_secret_post' | 'none', query, cookie, secret?, clockToleranceSec? })` returns `OidcIdentity` (`sub`, `namespacedSub` = `${issuer}#${sub}`, `email`, `emailVerified`, `name`, `idToken`, `accessToken`, `refreshToken?`, `expiresAt` in epoch ms, `claims`, `clearCookie`). The ID token is verified with RS256 pinned, exact `iss`, `aud` containing the client id (and `azp` when present or when there are several audiences), `nonce`, `exp`/`iat` with tolerance, and `at_hash`. Discovery is cached per issuer for an hour.
|
|
5
13
|
- **Errors.** `AtlasOidcError` with `code` (`AtlasOidcErrorCode`: `state_mismatch`, `issuer_mismatch`, `invalid_request`, `invalid_token`, `token_exchange_failed`, `access_denied`, `discovery_failed`), `oauthError`, `description`, `status`, `clearCookie` and `cause`.
|
package/README.md
CHANGED
|
@@ -399,3 +399,5 @@ To check the route end to end, `oauthClients.testBackchannelLogout(id)` sends a
|
|
|
399
399
|
## Webhooks
|
|
400
400
|
|
|
401
401
|
`verifyWebhook` checks the signature on events Atlas sends to your webhook endpoints. You manage endpoints with `atlas.webhooks.endpoints`: create, update, reveal or rotate a secret, send a test event, and redeliver a past delivery.
|
|
402
|
+
|
|
403
|
+
The `atlas-signature` header can carry more than one signature, separated by spaces (`v1,<sig> v1,<sig>`). While an endpoint secret rotates, Atlas may sign each delivery with the old and the new secret. `verifyWebhook` accepts the delivery when any one signature matches your secret.
|
|
@@ -51,6 +51,13 @@ export interface Branding {
|
|
|
51
51
|
};
|
|
52
52
|
/** How a verification code is entered — segmented `boxes` (default) or `single`. */
|
|
53
53
|
codeInput?: 'boxes' | 'single';
|
|
54
|
+
/**
|
|
55
|
+
* Per-audience branding for the hosted pages, keyed by audience hint
|
|
56
|
+
* (`[a-z0-9_-]{1,32}`, at most 20). A sign-in started with
|
|
57
|
+
* `audience_hint=<hint>` uses that entry. An update merges per hint: an entry
|
|
58
|
+
* replaces that hint, `null` deletes it, `audiences: null` removes them all.
|
|
59
|
+
*/
|
|
60
|
+
audiences?: Record<string, BrandingAudience | null> | null;
|
|
54
61
|
card?: {
|
|
55
62
|
width?: 'narrow' | 'default' | 'wide';
|
|
56
63
|
align?: 'left' | 'center';
|
|
@@ -108,6 +115,17 @@ export interface HostedBackground {
|
|
|
108
115
|
angle?: number;
|
|
109
116
|
imageUrl?: string;
|
|
110
117
|
}
|
|
118
|
+
/** The hosted-page branding for one audience hint. */
|
|
119
|
+
export interface BrandingAudience {
|
|
120
|
+
/** Replaces the card heading (up to 120 characters). */
|
|
121
|
+
heading?: string;
|
|
122
|
+
/** Replaces the line under the heading (up to 240 characters). */
|
|
123
|
+
subheading?: string;
|
|
124
|
+
/** Replaces the logo (https). */
|
|
125
|
+
logoUrl?: string;
|
|
126
|
+
/** Replaces the primary colour (hex, rgb() or a CSS colour name). */
|
|
127
|
+
primaryColor?: string;
|
|
128
|
+
}
|
|
111
129
|
/** What the renderers actually use — everything already escaped or dropped. */
|
|
112
130
|
export interface ResolvedBranding {
|
|
113
131
|
applicationName: string;
|
|
@@ -137,6 +155,8 @@ export interface ResolvedBranding {
|
|
|
137
155
|
providerHidden?: string[];
|
|
138
156
|
socialButtons?: Record<string, unknown>;
|
|
139
157
|
codeInput?: 'boxes' | 'single';
|
|
158
|
+
/** Every audience the hosted page can theme for, as it reads them (invalid values dropped). */
|
|
159
|
+
audiences?: Record<string, BrandingAudience>;
|
|
140
160
|
card?: {
|
|
141
161
|
width: string;
|
|
142
162
|
align: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAuMA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -8,6 +8,11 @@ export interface LoginReadinessParams {
|
|
|
8
8
|
export interface LoginReadinessCheck {
|
|
9
9
|
name: string;
|
|
10
10
|
pass: boolean;
|
|
11
|
+
/**
|
|
12
|
+
* `false` when the check does not matter for the assumed integration (it
|
|
13
|
+
* then never makes `ready` false). Absent from older servers.
|
|
14
|
+
*/
|
|
15
|
+
applies?: boolean;
|
|
11
16
|
observed: unknown;
|
|
12
17
|
/** What was seen, and the fix when it fails. */
|
|
13
18
|
detail: string;
|
|
@@ -17,9 +22,20 @@ export interface LoginReadiness {
|
|
|
17
22
|
origin: string;
|
|
18
23
|
live: boolean;
|
|
19
24
|
data_region?: string | null;
|
|
25
|
+
/** Every check that applies to the assumed integration passes. */
|
|
20
26
|
ready: boolean;
|
|
27
|
+
/** The integration the checks assumed for this origin, and why. */
|
|
28
|
+
integration?: LoginReadinessIntegration;
|
|
21
29
|
checks: LoginReadinessCheck[];
|
|
22
30
|
}
|
|
31
|
+
export interface LoginReadinessIntegration {
|
|
32
|
+
/** `redirect`: hosted-redirect OIDC, so the `cors` and `session_cookie` checks do not apply. */
|
|
33
|
+
assumed: 'redirect' | 'embedded';
|
|
34
|
+
/** `declared` | `embedded_traffic` | `redirect_clients` | `default`. */
|
|
35
|
+
source: 'declared' | 'embedded_traffic' | 'redirect_clients' | 'default';
|
|
36
|
+
/** A plain sentence saying why. */
|
|
37
|
+
reason: string;
|
|
38
|
+
}
|
|
23
39
|
export interface RequestInspectorParams {
|
|
24
40
|
/** The browser origin making the request. */
|
|
25
41
|
origin: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/client/diagnostics.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/client/diagnostics.ts"],"names":[],"mappings":";;AAuEA,kDAmBC;AAnBD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,yGAAyG;QACzG,cAAc,CAAC,MAA4B;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC;gBACvC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QACD,uFAAuF;QACvF,gBAAgB,CAAC,MAA8B;YAC7C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mCAAmC;gBACzC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/client/error.d.ts
CHANGED
|
@@ -47,6 +47,16 @@ export declare const AtlasErrorCodes: {
|
|
|
47
47
|
readonly CAPTCHA_IN_USE: "CAPTCHA_IN_USE";
|
|
48
48
|
/** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
|
|
49
49
|
readonly UNKNOWN_FIELD: "UNKNOWN_FIELD";
|
|
50
|
+
/** 422 — the body set a field that is not writable on this endpoint (`param` names it; the message names the call that changes it). */
|
|
51
|
+
readonly READ_ONLY_FIELD: "READ_ONLY_FIELD";
|
|
52
|
+
/** 409 — the development email sender is not available on a production instance. */
|
|
53
|
+
readonly DEVELOPMENT_EMAIL_NOT_ALLOWED: "DEVELOPMENT_EMAIL_NOT_ALLOWED";
|
|
54
|
+
/** 503 — the development email sender is not available on this deployment. */
|
|
55
|
+
readonly DEVELOPMENT_EMAIL_UNAVAILABLE: "DEVELOPMENT_EMAIL_UNAVAILABLE";
|
|
56
|
+
/** 429 — the development sender's daily or per-recipient hourly cap is spent (`meta.window`, `meta.retry_after_seconds`). */
|
|
57
|
+
readonly DEVELOPMENT_EMAIL_LIMIT_REACHED: "DEVELOPMENT_EMAIL_LIMIT_REACHED";
|
|
58
|
+
/** 422 — the development sender sends only Atlas's own sign-in emails, never custom templates. */
|
|
59
|
+
readonly DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED: "DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED";
|
|
50
60
|
/** The billing plan still has subscribers and cannot be removed. */
|
|
51
61
|
readonly PLAN_IN_USE: "PLAN_IN_USE";
|
|
52
62
|
/** The key is valid but for another API surface (e.g. a platform key on the Backend API). */
|
package/dist/client/error.js
CHANGED
|
@@ -43,6 +43,16 @@ exports.AtlasErrorCodes = {
|
|
|
43
43
|
CAPTCHA_IN_USE: 'CAPTCHA_IN_USE',
|
|
44
44
|
/** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
|
|
45
45
|
UNKNOWN_FIELD: 'UNKNOWN_FIELD',
|
|
46
|
+
/** 422 — the body set a field that is not writable on this endpoint (`param` names it; the message names the call that changes it). */
|
|
47
|
+
READ_ONLY_FIELD: 'READ_ONLY_FIELD',
|
|
48
|
+
/** 409 — the development email sender is not available on a production instance. */
|
|
49
|
+
DEVELOPMENT_EMAIL_NOT_ALLOWED: 'DEVELOPMENT_EMAIL_NOT_ALLOWED',
|
|
50
|
+
/** 503 — the development email sender is not available on this deployment. */
|
|
51
|
+
DEVELOPMENT_EMAIL_UNAVAILABLE: 'DEVELOPMENT_EMAIL_UNAVAILABLE',
|
|
52
|
+
/** 429 — the development sender's daily or per-recipient hourly cap is spent (`meta.window`, `meta.retry_after_seconds`). */
|
|
53
|
+
DEVELOPMENT_EMAIL_LIMIT_REACHED: 'DEVELOPMENT_EMAIL_LIMIT_REACHED',
|
|
54
|
+
/** 422 — the development sender sends only Atlas's own sign-in emails, never custom templates. */
|
|
55
|
+
DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED: 'DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED',
|
|
46
56
|
/** The billing plan still has subscribers and cannot be removed. */
|
|
47
57
|
PLAN_IN_USE: 'PLAN_IN_USE',
|
|
48
58
|
/** The key is valid but for another API surface (e.g. a platform key on the Backend API). */
|
package/dist/client/error.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}
|
|
1
|
+
{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,uIAAuI;IACvI,eAAe,EAAE,iBAAiB;IAClC,oFAAoF;IACpF,6BAA6B,EAAE,+BAA+B;IAC9D,8EAA8E;IAC9E,6BAA6B,EAAE,+BAA+B;IAC9D,6HAA6H;IAC7H,+BAA+B,EAAE,iCAAiC;IAClE,kGAAkG;IAClG,sCAAsC,EAAE,wCAAwC;IAChF,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}
|
|
@@ -22,12 +22,30 @@ export interface Instance {
|
|
|
22
22
|
/** The JWKS holding this instance's signing keys. */
|
|
23
23
|
jwks_uri: string;
|
|
24
24
|
allowed_origins: string[];
|
|
25
|
+
/**
|
|
26
|
+
* The declared integration per allowed origin (`redirect` or `embedded`). An
|
|
27
|
+
* origin not listed is inferred by preflight and login readiness.
|
|
28
|
+
*/
|
|
29
|
+
allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
|
|
25
30
|
auth_config: Metadata;
|
|
26
31
|
created_at: number;
|
|
27
32
|
}
|
|
33
|
+
/**
|
|
34
|
+
* How an allowed origin signs in: `redirect` (hosted-redirect OIDC: the app
|
|
35
|
+
* never runs the embedded components), `embedded` (the sign-in components run
|
|
36
|
+
* on the origin), or `auto` / `null` (clear the hint; Atlas infers it).
|
|
37
|
+
*/
|
|
38
|
+
export type OriginIntegration = 'redirect' | 'embedded' | 'auto';
|
|
39
|
+
/** An `allowed_origins` entry that also declares how the origin signs in. */
|
|
40
|
+
export interface AllowedOriginEntry {
|
|
41
|
+
origin: string;
|
|
42
|
+
integration?: OriginIntegration | null;
|
|
43
|
+
}
|
|
44
|
+
/** An origin string, or `{ origin, integration }`. A plain string keeps the origin's current hint. */
|
|
45
|
+
export type AllowedOriginInput = string | AllowedOriginEntry;
|
|
28
46
|
export interface UpdateInstanceBody {
|
|
29
|
-
/** Exact origins only — a wildcard or a path is rejected (§13.1). */
|
|
30
|
-
allowed_origins?:
|
|
47
|
+
/** Exact origins only — a wildcard or a path is rejected (§13.1). The list replaces the stored one. */
|
|
48
|
+
allowed_origins?: AllowedOriginInput[];
|
|
31
49
|
auth_config?: Record<string, unknown>;
|
|
32
50
|
}
|
|
33
51
|
/** `PATCH /v1/instance` echoes only the mutable fields, not a full Instance. */
|
|
@@ -35,6 +53,7 @@ export interface InstanceUpdateResult {
|
|
|
35
53
|
object: 'instance';
|
|
36
54
|
id: string;
|
|
37
55
|
allowed_origins: string[];
|
|
56
|
+
allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
|
|
38
57
|
auth_config: Metadata;
|
|
39
58
|
}
|
|
40
59
|
/** One problem (or note) the setup check found. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAwTA,4CAiEC;AAjED,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,+CAA+C;QAC/C,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { type AtlasRequestSettings, type RequestFn, type UnknownFieldsEvent } from './request';
|
|
2
2
|
import type { ListPage } from './types';
|
|
3
3
|
import type { BackchannelDeliveriesQuery, BackchannelLogoutDeliveryPage, BackchannelLogoutTest } from './oauth-clients';
|
|
4
|
-
import type { OriginMove, OriginMoveRequest, PreflightFinding } from './instance';
|
|
4
|
+
import type { AllowedOriginInput, OriginMove, OriginMoveRequest, PreflightFinding } from './instance';
|
|
5
5
|
import type { ConfigChangelogEntry, ListConfigChangelogParams } from './activity';
|
|
6
6
|
import type { AtlasDesign, AtlasDesignPatch, DeletedDesignAsset, DesignAsset, DesignAssetData, DesignPreview, ResolvedAtlasDesign, UploadDesignAssetOptions } from './design';
|
|
7
7
|
/** `GET /v1/platform/atlas_id_apps/{id}/preflight`. */
|
|
@@ -52,6 +52,8 @@ export interface PlatformApp {
|
|
|
52
52
|
/** The JWKS holding this app's signing keys. */
|
|
53
53
|
jwks_uri: string;
|
|
54
54
|
allowed_origins: string[];
|
|
55
|
+
/** The declared integration per allowed origin. Write `allowed_origins` entries as `{ origin, integration }` to set one. */
|
|
56
|
+
allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
|
|
55
57
|
/** Housekeeping labels (up to 20, each up to 40 chars). */
|
|
56
58
|
tags: string[];
|
|
57
59
|
/** Hidden from the default listing. A visibility flag only: the app still serves auth. */
|
|
@@ -79,14 +81,16 @@ export interface CreatedPlatformApp extends PlatformAppWithSecret {
|
|
|
79
81
|
export interface CreatePlatformAppBody {
|
|
80
82
|
name?: string;
|
|
81
83
|
environment?: 'production' | 'development';
|
|
82
|
-
|
|
84
|
+
/** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
|
|
85
|
+
allowed_origins?: AllowedOriginInput[];
|
|
83
86
|
/** Default true: also provision a test-mode sibling instance. */
|
|
84
87
|
create_development_sibling?: boolean;
|
|
85
88
|
tags?: string[];
|
|
86
89
|
}
|
|
87
90
|
export interface UpdatePlatformAppBody {
|
|
88
91
|
name?: string;
|
|
89
|
-
|
|
92
|
+
/** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
|
|
93
|
+
allowed_origins?: AllowedOriginInput[];
|
|
90
94
|
tags?: string[];
|
|
91
95
|
}
|
|
92
96
|
export interface ListPlatformAppsParams {
|
|
@@ -99,7 +103,8 @@ export interface ListPlatformAppsParams {
|
|
|
99
103
|
}
|
|
100
104
|
export interface CreatePlatformInstanceBody {
|
|
101
105
|
environment?: 'production' | 'development';
|
|
102
|
-
|
|
106
|
+
/** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
|
|
107
|
+
allowed_origins?: AllowedOriginInput[];
|
|
103
108
|
}
|
|
104
109
|
export interface PlatformAppSecretRotation {
|
|
105
110
|
object: 'app_secret';
|
|
@@ -155,7 +160,8 @@ export interface AccountlessApp {
|
|
|
155
160
|
export interface CreateAccountlessAppBody {
|
|
156
161
|
name?: string;
|
|
157
162
|
environment?: 'production' | 'development';
|
|
158
|
-
|
|
163
|
+
/** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
|
|
164
|
+
allowed_origins?: AllowedOriginInput[];
|
|
159
165
|
}
|
|
160
166
|
/** Page text on the Sign in with Atlas page. Plain text; null or empty uses the default. */
|
|
161
167
|
export interface AtlasIdAppCopy {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;AAupBA,8DAWC;AAlqBD,uCAMmB;AAoXnB,mFAAmF;AAEnF,SAAS,kBAAkB,CAAC,OAAkB;IAC5C,OAAO;QACL,IAAI,EAAE;YACJ,+EAA+E;YAC/E,IAAI,CAAC,SAAiC,EAAE;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,iEAAiE;YACjE,MAAM,CAAC,OAA8B,EAAE,EAAE,cAAuB;gBAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA2B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,6EAA6E;YAC7E,UAAU,CAAC,GAAa;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+DAA+D;YAC/D,OAAO,CAAC,EAAU;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,CAAC;YACD;;;eAGG;YACH,YAAY,CACV,EAAU,EACV,OAAqC,EAAE,EACvC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAClD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,mDAAmD;YACnD,UAAU,CAAC,EAAU;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS,EAAE;gBACT,IAAI,CAAC,KAAa;oBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,kFAAkF;gBAClF,MAAM,CACJ,KAAa,EACb,OAAmC,EAAE,EACrC,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;wBACjD,IAAI;wBACJ,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD,0EAA0E;gBAC1E,YAAY,CACV,KAAa,EACb,UAAkB,EAClB,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;wBAClF,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;aACF;YACD,yEAAyE;YACzE,QAAQ,CAAC,EAAU,EAAE,cAAuB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,sDAAsD;YACtD,cAAc,CACZ,aAAqB,EACrB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,mCAAmC;oBACzC,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;oBACvC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,KAAK,CAAC,UAAkB,EAAE,cAAuB;gBAC/C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;oBACjC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,eAAe,EAAE;YACf,8FAA8F;YAC9F,MAAM,CAAC,OAAiC,EAAE,EAAE,cAAuB;gBACjE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,oEAAoE;QACpE,WAAW,EAAE;YACX,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,sFAAsF;YACtF,MAAM,CAAC,IAA0B,EAAE,cAAuB;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,0DAA0D;YAC1D,MAAM,CAAC,EAAU,EAAE,IAA0B;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+CAA+C;YAC/C,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,6EAA6E;YAC7E,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;iBAC5D,CAAC,CAAC;YACL,CAAC;YACD,gEAAgE;YAChE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;gBAEtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;oBACpE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,kFAAkF;YAClF,qBAAqB,CAAC,EAAU;gBAC9B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;eAGG;YACH,SAAS,CAAC,EAAU,EAAE,KAAa;gBACjC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;oBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,oGAAoG;YACpG,WAAW,CAAC,EAAU,EAAE,OAAe;gBACrC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,sFAAsF;YACtF,UAAU,CAAC,EAAU,EAAE,IAAuB;gBAC5C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;oBACzD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,mBAAmB,CAAC,EAAU;gBAC5B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB;iBACpE,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,aAAa,CAAC,MAAmB;gBAC/B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,2CAA2C;oBACjD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,gBAAgB,EAAE;YAChB,yBAAyB;YACzB,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4EAA4E;YAC5E,GAAG,CAAC,IAA6B;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,6CAA6C;YAC7C,MAAM,CAAC,IAA+B;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,mDAAmD;YACnD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,uEAAuE;QACvE,eAAe,EAAE;YACf,IAAI,CAAC,SAAoC,EAAE;gBAMzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;SACF;QACD,yFAAyF;QACzF,YAAY,EAAE;YACZ,MAAM,CAAC,IAAqB,EAAE,UAAoC,EAAE;gBAClE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,+DAA+D;YAC/D,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,yBAAyB,CAAC,MAAiC;IACzE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC9B,WAAW,CAAC,SAA+B;YACzC,OAAO,yBAAyB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/webhooks.js
CHANGED
|
@@ -11,7 +11,9 @@ const node_crypto_1 = require("node:crypto");
|
|
|
11
11
|
* and `atlas-timestamp` (epoch ms) headers. The timestamp is INSIDE the signed
|
|
12
12
|
* material — a header-only timestamp would let an attacker replay a captured
|
|
13
13
|
* body under a fresh timestamp — and a delivery older than 5 minutes is rejected
|
|
14
|
-
* so a captured request cannot be replayed later.
|
|
14
|
+
* so a captured request cannot be replayed later. The header may carry several
|
|
15
|
+
* space-separated `v1,<base64>` entries (one per secret while a secret rotates
|
|
16
|
+
* with an overlap); the delivery verifies when any one of them matches.
|
|
15
17
|
*
|
|
16
18
|
* The signing logic is identical to the server's (`@atlas/core` `verifyWebhook`),
|
|
17
19
|
* reimplemented here with zero dependencies so an integrator gets a first-party
|
|
@@ -41,6 +43,24 @@ function readHeader(headers, name) {
|
|
|
41
43
|
const found = hit ? bag[hit] : undefined;
|
|
42
44
|
return Array.isArray(found) ? found[0] : found;
|
|
43
45
|
}
|
|
46
|
+
/**
|
|
47
|
+
* The `v1` signatures in an `atlas-signature` header. The header carries one
|
|
48
|
+
* `v1,<base64>` entry, or several separated by spaces (while an endpoint
|
|
49
|
+
* secret rotates, Atlas signs with the old and the new secret). Entries of
|
|
50
|
+
* another version are skipped, so a future scheme never breaks this verifier.
|
|
51
|
+
*/
|
|
52
|
+
function parseSignatures(header) {
|
|
53
|
+
const out = [];
|
|
54
|
+
for (const entry of header.trim().split(/\s+/)) {
|
|
55
|
+
const comma = entry.indexOf(',');
|
|
56
|
+
if (comma <= 0)
|
|
57
|
+
continue;
|
|
58
|
+
const value = entry.slice(comma + 1);
|
|
59
|
+
if (entry.slice(0, comma) === SIGNATURE_VERSION && value)
|
|
60
|
+
out.push(value);
|
|
61
|
+
}
|
|
62
|
+
return out;
|
|
63
|
+
}
|
|
44
64
|
/**
|
|
45
65
|
* Verify and parse an Atlas webhook. Returns `{ verified, reason?, event?,
|
|
46
66
|
* deliveryId?, timestamp? }` — it never throws on a bad signature (a thrown
|
|
@@ -67,8 +87,8 @@ function verifyWebhook(input) {
|
|
|
67
87
|
const signature = readHeader(input.headers, exports.ATLAS_WEBHOOK_HEADERS.signature);
|
|
68
88
|
if (!id || !timestampRaw || !signature)
|
|
69
89
|
return { verified: false, reason: 'missing_headers' };
|
|
70
|
-
const
|
|
71
|
-
if (
|
|
90
|
+
const provided = parseSignatures(signature);
|
|
91
|
+
if (provided.length === 0)
|
|
72
92
|
return { verified: false, reason: 'malformed_signature' };
|
|
73
93
|
const timestamp = Number(timestampRaw);
|
|
74
94
|
const now = (input.now ?? new Date()).getTime();
|
|
@@ -78,10 +98,15 @@ function verifyWebhook(input) {
|
|
|
78
98
|
if (!Number.isFinite(timestamp) || Math.abs(now - timestamp) > tolerance) {
|
|
79
99
|
return { verified: false, reason: 'stale_timestamp' };
|
|
80
100
|
}
|
|
81
|
-
const expected = (0, node_crypto_1.createHmac)('sha256', input.secret).update(`${id}.${timestamp}.${raw}`).digest('base64');
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
101
|
+
const expected = Buffer.from((0, node_crypto_1.createHmac)('sha256', input.secret).update(`${id}.${timestamp}.${raw}`).digest('base64'));
|
|
102
|
+
// Compare every entry (no early exit), each in constant time.
|
|
103
|
+
let matched = false;
|
|
104
|
+
for (const candidate of provided) {
|
|
105
|
+
const a = Buffer.from(candidate);
|
|
106
|
+
if (a.length === expected.length && (0, node_crypto_1.timingSafeEqual)(a, expected))
|
|
107
|
+
matched = true;
|
|
108
|
+
}
|
|
109
|
+
if (!matched)
|
|
85
110
|
return { verified: false, reason: 'signature_mismatch' };
|
|
86
111
|
try {
|
|
87
112
|
return { verified: true, event: JSON.parse(raw), deliveryId: id, timestamp };
|
package/dist/webhooks.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":";;;AAsHA,sCAoCC;AA1JD,6CAA0D;AAE1D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEvC,yFAAyF;AAC5E,QAAA,qBAAqB,GAAG;IACnC,EAAE,EAAE,UAAU;IACd,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;CACpB,CAAC;AAwBX,iFAAiF;AACjF,SAAS,UAAU,CAAC,OAAoB,EAAE,IAAY;IACpD,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACnD,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,iBAAiB,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,aAAa,CAAc,KAAyB;IAClE,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE9F,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAErF,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC3D,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,IAAA,wBAAU,EAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CACxF,CAAC;IACF,8DAA8D;IAC9D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEvE,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC"}
|