@atlasauth/backend 0.9.1 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +9 -0
- package/dist/client/index.d.ts +7 -1
- package/dist/client/instance-security.d.ts +39 -2
- package/dist/client/instance-security.js +12 -0
- package/dist/client/instance-security.js.map +1 -1
- package/dist/client/messaging.d.ts +1 -1
- package/dist/client/platform.d.ts +50 -10
- package/dist/client/platform.js +23 -7
- package/dist/client/platform.js.map +1 -1
- package/dist/client/webhooks.d.ts +25 -2
- package/dist/client/webhooks.js +7 -3
- package/dist/client/webhooks.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,14 @@
|
|
|
1
1
|
# @atlasauth/backend changelog
|
|
2
2
|
|
|
3
|
+
## 0.10.0
|
|
4
|
+
- **Trusted reverse proxy secret.** `instanceSecurity.getProxySecret()` (`ProxySecret`: `set`, `created_at`, `previous_expires_at`, `secret_header`, `client_ip_header`), `instanceSecurity.createProxySecret({ overlap_seconds? })` (`ProxySecretCreated`: adds `secret`, shown once, and `rotated`; `CreateProxySecretBody`) and `instanceSecurity.deleteProxySecret()`. A proxy that serves the Frontend API from your own origin sends the secret in `X-Atlas-Proxy-Secret` and the browser's IP in `X-Atlas-Client-IP`; Atlas then uses that IP for rate limits, lockout, risk signals, geo, audit logs and session metadata.
|
|
5
|
+
- **Managed email feedback on Resend.** `ManagedEmail.feedback_webhook` is now also returned for Resend (on create and verify): Atlas registers a bounce / complaint webhook on your own Resend account, so `usage.bounces` / `usage.complaints` count for Resend domains too.
|
|
6
|
+
- **Webhook secret rotation with an overlap.** `webhooks.endpoints.rotateSecret(id, { overlap_seconds? })` (new type `RotateWebhookSecretBody`) can keep the previous signing secret signing every delivery for `overlap_seconds` (at most 604800, 7 days). The default is 0: the old secret stops at once, as before. Set an overlap only once every receiver verifies with a verifier that accepts several signatures. During the overlap the `atlas-signature` header carries two entries, `v1,<new> v1,<old>`; `verifyWebhook` (0.9.1 and later) passes with either secret. `WebhookSigningSecret` gains `overlap_seconds` and `previous_secret_expires_at` (epoch ms, or null when the old secret already stopped). `WebhookEndpoint` gains `previous_secret_expires_at` while an overlap is open.
|
|
7
|
+
- **Sign in with Atlas apps.** `atlasIdApps.rotateSecret(id, { overlap_seconds? })` (default 24 hours, `0` = now) and `atlasIdApps.rotateWebhookSecret(id, { overlap_seconds? })` (default 0, as for instance webhooks); new type `RotateAtlasIdAppSecretBody`. `AtlasIdApp` gains `previous_secret_expires_at`, `secret_issued_at` (the real time the current client secret was issued) and `webhook_previous_secret_expires_at`; `AtlasIdAppWithSecret` gains `overlap_seconds`.
|
|
8
|
+
- **Per-instance platform rotation with an overlap.** `apps.instances.rotateSecret(appId, instanceId, { overlap_seconds? }, idempotencyKey?)` keeps the prior keys valid like `apps.rotateSecret` (default 259200 = 72 hours, `0` = revoke now). The 0.9 call `rotateSecret(appId, instanceId, idempotencyKey)` still works. `PlatformInstanceSecretRotation` now types what the API returns: `app_id`, `instance_id`, `overlap_seconds`, `previous_keys_expire_at` (`id` is deprecated: it was never sent). New type `RotatePlatformSecretBody`, also used by `apps.rotateSecret`.
|
|
9
|
+
- **Behaviour change on the server.** A per-instance platform rotation without `overlap_seconds` now keeps the prior keys for 72 hours (they used to be revoked at once). Pass `overlap_seconds: 0` for the old behaviour. Webhook rotations without it behave as before.
|
|
10
|
+
- **Compatible.** New methods, optional parameters, fields and types only.
|
|
11
|
+
|
|
3
12
|
## 0.9.1
|
|
4
13
|
- **Allowed origins with an integration.** `UpdateInstanceBody.allowed_origins` and the platform app, instance and accountless-app bodies accept `AllowedOriginInput` entries: an origin string or `{ origin, integration }` (`OriginIntegration`: `redirect` | `embedded` | `auto`, or `null` to clear). `Instance`, `InstanceUpdateResult` and `PlatformApp` gain optional `allowed_origin_integrations`. New types: `AllowedOriginEntry`, `AllowedOriginInput`, `OriginIntegration`.
|
|
5
14
|
- **Login readiness.** `LoginReadiness` gains `integration` (`LoginReadinessIntegration`: `assumed`, `source`, `reason`); `LoginReadinessCheck` gains `applies`.
|
package/dist/client/index.d.ts
CHANGED
|
@@ -479,7 +479,7 @@ declare function buildNamespaces(request: RequestFn): {
|
|
|
479
479
|
list(): Promise<import("./webhooks").WebhookEndpointList>;
|
|
480
480
|
update(id: string, body: import("./webhooks").UpdateWebhookEndpointBody): Promise<import("./webhooks").WebhookEndpoint>;
|
|
481
481
|
revealSecret(id: string): Promise<import("./webhooks").WebhookSigningSecret>;
|
|
482
|
-
rotateSecret(id: string): Promise<import("./webhooks").WebhookSigningSecret>;
|
|
482
|
+
rotateSecret(id: string, body?: import("./webhooks").RotateWebhookSecretBody): Promise<import("./webhooks").WebhookSigningSecret>;
|
|
483
483
|
test(id: string): Promise<import("./webhooks").WebhookDeliveryQueued>;
|
|
484
484
|
redeliver(id: string, deliveryId: string): Promise<import("./webhooks").WebhookDeliveryQueued>;
|
|
485
485
|
create(body: import("./webhooks").CreateWebhookEndpointBody, idempotencyKey?: string): Promise<import("./webhooks").WebhookEndpointWithSecret>;
|
|
@@ -951,6 +951,12 @@ declare function buildNamespaces(request: RequestFn): {
|
|
|
951
951
|
object: "kerberos_secret";
|
|
952
952
|
deleted: true;
|
|
953
953
|
}>;
|
|
954
|
+
getProxySecret(): Promise<import("./instance-security").ProxySecret>;
|
|
955
|
+
createProxySecret(body?: import("./instance-security").CreateProxySecretBody): Promise<import("./instance-security").ProxySecretCreated>;
|
|
956
|
+
deleteProxySecret(): Promise<{
|
|
957
|
+
object: "proxy_secret";
|
|
958
|
+
deleted: true;
|
|
959
|
+
}>;
|
|
954
960
|
setLdapBindPassword(connectionId: string, body: {
|
|
955
961
|
bind_password: string;
|
|
956
962
|
}): Promise<{
|
|
@@ -3,8 +3,8 @@ import { type RequestFn } from './request';
|
|
|
3
3
|
* §5/§11.2 instance security config — the agent mirror of the dashboard security
|
|
4
4
|
* screen. Settings that live OUTSIDE `auth_config` (so a raw `PATCH /v1/instance`
|
|
5
5
|
* cannot reach them): the per-flow kill switches, the customer IP allowlist, and
|
|
6
|
-
* the write-only provider secrets (captcha, Kerberos proxy, LDAP bind password)
|
|
7
|
-
* No secret is ever readable back.
|
|
6
|
+
* the write-only provider secrets (captcha, Kerberos proxy, LDAP bind password),
|
|
7
|
+
* and the trusted reverse proxy secret. No secret is ever readable back.
|
|
8
8
|
*/
|
|
9
9
|
export interface InstanceKillSwitches {
|
|
10
10
|
/** Refuse sign-ups for this instance only. */
|
|
@@ -31,6 +31,34 @@ export interface UpdateInstanceSecurityBody {
|
|
|
31
31
|
*/
|
|
32
32
|
confirm_lockout?: boolean;
|
|
33
33
|
}
|
|
34
|
+
/**
|
|
35
|
+
* The trusted reverse proxy secret: with it, a proxy that serves the Frontend
|
|
36
|
+
* API from your own origin sends `X-Atlas-Proxy-Secret` + `X-Atlas-Client-IP`,
|
|
37
|
+
* and Atlas uses the browser's IP for rate limits, lockout, risk signals, geo,
|
|
38
|
+
* audit logs and session metadata. Never returned after creation.
|
|
39
|
+
*/
|
|
40
|
+
export interface ProxySecret {
|
|
41
|
+
object: 'proxy_secret';
|
|
42
|
+
/** Whether a proxy secret is set. */
|
|
43
|
+
set: boolean;
|
|
44
|
+
/** When the current secret was created (epoch ms), or null. */
|
|
45
|
+
created_at: number | null;
|
|
46
|
+
/** After a rotation: when the replaced secret stops working (epoch ms), or null. */
|
|
47
|
+
previous_expires_at: number | null;
|
|
48
|
+
secret_header: 'X-Atlas-Proxy-Secret';
|
|
49
|
+
client_ip_header: 'X-Atlas-Client-IP';
|
|
50
|
+
}
|
|
51
|
+
/** Create / rotate result: the secret, shown only here. */
|
|
52
|
+
export interface ProxySecretCreated extends ProxySecret {
|
|
53
|
+
/** `aps_…`. Store it in your proxy's environment; Atlas keeps only a hash. */
|
|
54
|
+
secret: string;
|
|
55
|
+
/** true when an existing secret was replaced. */
|
|
56
|
+
rotated: boolean;
|
|
57
|
+
}
|
|
58
|
+
export interface CreateProxySecretBody {
|
|
59
|
+
/** On rotation: seconds the replaced secret keeps working. Default 86400, 0 = stop now, at most 604800. */
|
|
60
|
+
overlap_seconds?: number | null;
|
|
61
|
+
}
|
|
34
62
|
/** A confirmed self-lockout returns the config plus a plain-language `warning`. */
|
|
35
63
|
export interface InstanceSecurityResult extends InstanceSecurity {
|
|
36
64
|
warning?: string;
|
|
@@ -62,6 +90,15 @@ export declare function instanceSecurityResource(request: RequestFn): {
|
|
|
62
90
|
object: "kerberos_secret";
|
|
63
91
|
deleted: true;
|
|
64
92
|
}>;
|
|
93
|
+
/** Whether a trusted reverse proxy secret is set (never the secret). */
|
|
94
|
+
getProxySecret(): Promise<ProxySecret>;
|
|
95
|
+
/** Create, or rotate (with `overlap_seconds`), the trusted reverse proxy secret. The secret is returned once. */
|
|
96
|
+
createProxySecret(body?: CreateProxySecretBody): Promise<ProxySecretCreated>;
|
|
97
|
+
/** Remove the proxy secret: `X-Atlas-Client-IP` is ignored again. */
|
|
98
|
+
deleteProxySecret(): Promise<{
|
|
99
|
+
object: "proxy_secret";
|
|
100
|
+
deleted: true;
|
|
101
|
+
}>;
|
|
65
102
|
/** Store an LDAP connection's service-account bind password. The connection
|
|
66
103
|
* must already exist in `auth_config.ldap.connections`. */
|
|
67
104
|
setLdapBindPassword(connectionId: string, body: {
|
|
@@ -24,6 +24,18 @@ function instanceSecurityResource(request) {
|
|
|
24
24
|
deleteKerberosSecret() {
|
|
25
25
|
return request({ method: 'DELETE', path: '/v1/instance/kerberos_secret' });
|
|
26
26
|
},
|
|
27
|
+
/** Whether a trusted reverse proxy secret is set (never the secret). */
|
|
28
|
+
getProxySecret() {
|
|
29
|
+
return request({ method: 'GET', path: '/v1/instance/proxy_secret' });
|
|
30
|
+
},
|
|
31
|
+
/** Create, or rotate (with `overlap_seconds`), the trusted reverse proxy secret. The secret is returned once. */
|
|
32
|
+
createProxySecret(body = {}) {
|
|
33
|
+
return request({ method: 'POST', path: '/v1/instance/proxy_secret', body });
|
|
34
|
+
},
|
|
35
|
+
/** Remove the proxy secret: `X-Atlas-Client-IP` is ignored again. */
|
|
36
|
+
deleteProxySecret() {
|
|
37
|
+
return request({ method: 'DELETE', path: '/v1/instance/proxy_secret' });
|
|
38
|
+
},
|
|
27
39
|
/** Store an LDAP connection's service-account bind password. The connection
|
|
28
40
|
* must already exist in `auth_config.ldap.connections`. */
|
|
29
41
|
setLdapBindPassword(connectionId, body) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AA0EA,4DA6DC;AAvID,uCAAgD;AA0EhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,iHAAiH;QACjH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,qEAAqE;QACrE,iBAAiB;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -333,7 +333,7 @@ export interface ManagedEmail {
|
|
|
333
333
|
last_complaint_at: number | null;
|
|
334
334
|
};
|
|
335
335
|
reputation: 'your_provider_account';
|
|
336
|
-
/** Brevo
|
|
336
|
+
/** On create (Brevo and Resend) and verify (Resend): whether the bounce / complaint webhook was registered on your account. */
|
|
337
337
|
feedback_webhook?: 'registered' | 'not_registered';
|
|
338
338
|
/** DNS automation, when set. The token is never returned. */
|
|
339
339
|
dns: {
|
|
@@ -118,10 +118,32 @@ export interface PlatformAppSecretRotation {
|
|
|
118
118
|
}
|
|
119
119
|
export interface PlatformInstanceSecretRotation {
|
|
120
120
|
object: 'app_secret';
|
|
121
|
-
|
|
121
|
+
app_id: string;
|
|
122
|
+
instance_id: string;
|
|
123
|
+
/** @deprecated Never sent; read `instance_id`. */
|
|
124
|
+
id?: string;
|
|
125
|
+
/** The new secret key, revealed exactly once. */
|
|
122
126
|
secret: string;
|
|
127
|
+
/** The overlap applied, in seconds. */
|
|
128
|
+
overlap_seconds: number;
|
|
129
|
+
/** When the prior keys stop working (epoch ms); null on a hard cut. */
|
|
130
|
+
previous_keys_expire_at: number | null;
|
|
123
131
|
note: string;
|
|
124
132
|
}
|
|
133
|
+
/** Body of the platform app and instance rotate_secret calls. */
|
|
134
|
+
export interface RotatePlatformSecretBody {
|
|
135
|
+
/** How long the prior keys keep working, in seconds. Default 259200 (72 hours). `0` revokes them now. At most 604800 (7 days). */
|
|
136
|
+
overlap_seconds?: number;
|
|
137
|
+
}
|
|
138
|
+
/** Body of the Sign in with Atlas app rotate calls (client secret and webhook secret). */
|
|
139
|
+
export interface RotateAtlasIdAppSecretBody {
|
|
140
|
+
/**
|
|
141
|
+
* How long the previous secret keeps working, in seconds; at most 604800 (7
|
|
142
|
+
* days). Default for the client secret: 86400 (24 hours). Default for the
|
|
143
|
+
* webhook secret: 0 (it stops signing at once). `0` stops it now.
|
|
144
|
+
*/
|
|
145
|
+
overlap_seconds?: number;
|
|
146
|
+
}
|
|
125
147
|
/** Metadata of a currently-valid secret key. Never the secret itself. */
|
|
126
148
|
export interface PlatformSecretKey {
|
|
127
149
|
object: 'secret_key';
|
|
@@ -236,12 +258,20 @@ export interface AtlasIdApp {
|
|
|
236
258
|
webhook_events?: Array<'user.updated' | 'user.deleted' | 'grant.revoked'>;
|
|
237
259
|
/** false once auto-disabled after repeated failures; null without a webhook. */
|
|
238
260
|
webhook_active?: boolean | null;
|
|
261
|
+
/** While a webhook secret rotation overlap is open: when the previous secret stops signing deliveries (epoch ms); else null. */
|
|
262
|
+
webhook_previous_secret_expires_at?: number | null;
|
|
263
|
+
/** After a client secret rotation with overlap: when the previous secret stops working (epoch ms); else null. */
|
|
264
|
+
previous_secret_expires_at?: number | null;
|
|
265
|
+
/** When the current client secret was issued (epoch ms); null for a public app. */
|
|
266
|
+
secret_issued_at?: number | null;
|
|
239
267
|
}
|
|
240
268
|
/** Create / rotate response: confidential apps carry the client secret exactly once. */
|
|
241
269
|
export interface AtlasIdAppWithSecret extends AtlasIdApp {
|
|
242
270
|
client_secret?: string;
|
|
243
271
|
/** The per-app webhook signing secret, returned exactly once (first set, or rotated). */
|
|
244
272
|
webhook_secret?: string;
|
|
273
|
+
/** On a rotation: the overlap applied, in seconds. */
|
|
274
|
+
overlap_seconds?: number;
|
|
245
275
|
note?: string;
|
|
246
276
|
}
|
|
247
277
|
/** A person who has approved a Sign in with Atlas app (privacy-request lookup). */
|
|
@@ -355,17 +385,20 @@ declare function platformNamespaces(request: RequestFn): {
|
|
|
355
385
|
* Mint a new secret key while the prior keys stay valid for
|
|
356
386
|
* `overlap_seconds` (default 72h, max 7 days; 0 = immediate cut).
|
|
357
387
|
*/
|
|
358
|
-
rotateSecret(id: string, body?:
|
|
359
|
-
overlap_seconds?: number;
|
|
360
|
-
}, idempotencyKey?: string): Promise<PlatformAppSecretRotation>;
|
|
388
|
+
rotateSecret(id: string, body?: RotatePlatformSecretBody, idempotencyKey?: string): Promise<PlatformAppSecretRotation>;
|
|
361
389
|
/** Currently-valid secret keys (metadata only). */
|
|
362
390
|
secretKeys(id: string): Promise<ListPage<PlatformSecretKey>>;
|
|
363
391
|
instances: {
|
|
364
392
|
list(appId: string): Promise<ListPage<PlatformApp>>;
|
|
365
393
|
/** Add an instance (e.g. development beside production); secret revealed once. */
|
|
366
394
|
create(appId: string, body?: CreatePlatformInstanceBody, idempotencyKey?: string): Promise<PlatformAppWithSecret>;
|
|
367
|
-
/**
|
|
368
|
-
|
|
395
|
+
/**
|
|
396
|
+
* Mint a new secret key for one instance, revealed once. The prior keys
|
|
397
|
+
* stay valid for `overlap_seconds` (default 72h, max 7 days; 0 =
|
|
398
|
+
* immediate cut), like `apps.rotateSecret`. The third argument may also
|
|
399
|
+
* be the idempotency key (the 0.9 signature).
|
|
400
|
+
*/
|
|
401
|
+
rotateSecret(appId: string, instanceId: string, bodyOrIdempotencyKey?: RotatePlatformSecretBody | string, idempotencyKey?: string): Promise<PlatformInstanceSecretRotation>;
|
|
369
402
|
};
|
|
370
403
|
/** Start a transfer: a one-time token the receiving platform accepts. */
|
|
371
404
|
transfer(id: string, idempotencyKey?: string): Promise<PlatformAppTransfer>;
|
|
@@ -394,8 +427,11 @@ declare function platformNamespaces(request: RequestFn): {
|
|
|
394
427
|
id: string;
|
|
395
428
|
deleted: true;
|
|
396
429
|
}>;
|
|
397
|
-
/**
|
|
398
|
-
|
|
430
|
+
/**
|
|
431
|
+
* New client secret, returned exactly once. The previous one keeps working
|
|
432
|
+
* for `overlap_seconds` (default 24h; 0 = revoke now). Public apps have none (409).
|
|
433
|
+
*/
|
|
434
|
+
rotateSecret(id: string, body?: RotateAtlasIdAppSecretBody): Promise<AtlasIdAppWithSecret>;
|
|
399
435
|
/** The app's back-channel logout delivery log, newest first. */
|
|
400
436
|
listBackchannelDeliveries(id: string, query?: BackchannelDeliveriesQuery): Promise<BackchannelLogoutDeliveryPage>;
|
|
401
437
|
/** Send a test back-channel logout to the app now and return what it answered. */
|
|
@@ -414,8 +450,12 @@ declare function platformNamespaces(request: RequestFn): {
|
|
|
414
450
|
revokeGrant(id: string, grantId: string): Promise<AtlasIdGrantRevocation>;
|
|
415
451
|
/** Move the app's URLs from one origin to another. `dry_run: true` writes nothing. */
|
|
416
452
|
moveOrigin(id: string, body: OriginMoveRequest): Promise<OriginMove>;
|
|
417
|
-
/**
|
|
418
|
-
|
|
453
|
+
/**
|
|
454
|
+
* New per-app webhook signing secret (`webhook_secret`), returned once. By
|
|
455
|
+
* default the previous secret stops at once; for `overlap_seconds` it signs
|
|
456
|
+
* each delivery too. 409 without a webhook.
|
|
457
|
+
*/
|
|
458
|
+
rotateWebhookSecret(id: string, body?: RotateAtlasIdAppSecretBody): Promise<AtlasIdAppWithSecret>;
|
|
419
459
|
/** Preview a design on the Sign in with Atlas page without saving it. */
|
|
420
460
|
previewDesign(design: AtlasDesign): Promise<DesignPreview>;
|
|
421
461
|
};
|
package/dist/client/platform.js
CHANGED
|
@@ -64,12 +64,19 @@ function platformNamespaces(request) {
|
|
|
64
64
|
idempotencyKey,
|
|
65
65
|
});
|
|
66
66
|
},
|
|
67
|
-
/**
|
|
68
|
-
|
|
67
|
+
/**
|
|
68
|
+
* Mint a new secret key for one instance, revealed once. The prior keys
|
|
69
|
+
* stay valid for `overlap_seconds` (default 72h, max 7 days; 0 =
|
|
70
|
+
* immediate cut), like `apps.rotateSecret`. The third argument may also
|
|
71
|
+
* be the idempotency key (the 0.9 signature).
|
|
72
|
+
*/
|
|
73
|
+
rotateSecret(appId, instanceId, bodyOrIdempotencyKey, idempotencyKey) {
|
|
74
|
+
const legacyKey = typeof bodyOrIdempotencyKey === 'string';
|
|
69
75
|
return request({
|
|
70
76
|
method: 'POST',
|
|
71
77
|
path: `/v1/platform/apps/${(0, request_1.enc)(appId)}/instances/${(0, request_1.enc)(instanceId)}/rotate_secret`,
|
|
72
|
-
|
|
78
|
+
body: legacyKey ? undefined : bodyOrIdempotencyKey,
|
|
79
|
+
idempotencyKey: legacyKey ? bodyOrIdempotencyKey : idempotencyKey,
|
|
73
80
|
});
|
|
74
81
|
},
|
|
75
82
|
},
|
|
@@ -136,11 +143,15 @@ function platformNamespaces(request) {
|
|
|
136
143
|
delete(id) {
|
|
137
144
|
return request({ method: 'DELETE', path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}` });
|
|
138
145
|
},
|
|
139
|
-
/**
|
|
140
|
-
|
|
146
|
+
/**
|
|
147
|
+
* New client secret, returned exactly once. The previous one keeps working
|
|
148
|
+
* for `overlap_seconds` (default 24h; 0 = revoke now). Public apps have none (409).
|
|
149
|
+
*/
|
|
150
|
+
rotateSecret(id, body) {
|
|
141
151
|
return request({
|
|
142
152
|
method: 'POST',
|
|
143
153
|
path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}/rotate_secret`,
|
|
154
|
+
body,
|
|
144
155
|
});
|
|
145
156
|
},
|
|
146
157
|
/** The app's back-channel logout delivery log, newest first. */
|
|
@@ -188,11 +199,16 @@ function platformNamespaces(request) {
|
|
|
188
199
|
body,
|
|
189
200
|
});
|
|
190
201
|
},
|
|
191
|
-
/**
|
|
192
|
-
|
|
202
|
+
/**
|
|
203
|
+
* New per-app webhook signing secret (`webhook_secret`), returned once. By
|
|
204
|
+
* default the previous secret stops at once; for `overlap_seconds` it signs
|
|
205
|
+
* each delivery too. 409 without a webhook.
|
|
206
|
+
*/
|
|
207
|
+
rotateWebhookSecret(id, body) {
|
|
193
208
|
return request({
|
|
194
209
|
method: 'POST',
|
|
195
210
|
path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}/webhook/rotate_secret`,
|
|
211
|
+
body,
|
|
196
212
|
});
|
|
197
213
|
},
|
|
198
214
|
/** Preview a design on the Sign in with Atlas page without saving it. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;AAwsBA,8DAWC;AAntBD,uCAMmB;AAoZnB,mFAAmF;AAEnF,SAAS,kBAAkB,CAAC,OAAkB;IAC5C,OAAO;QACL,IAAI,EAAE;YACJ,+EAA+E;YAC/E,IAAI,CAAC,SAAiC,EAAE;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,iEAAiE;YACjE,MAAM,CAAC,OAA8B,EAAE,EAAE,cAAuB;gBAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA2B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,6EAA6E;YAC7E,UAAU,CAAC,GAAa;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+DAA+D;YAC/D,OAAO,CAAC,EAAU;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,CAAC;YACD;;;eAGG;YACH,YAAY,CACV,EAAU,EACV,OAAiC,EAAE,EACnC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAClD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,mDAAmD;YACnD,UAAU,CAAC,EAAU;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS,EAAE;gBACT,IAAI,CAAC,KAAa;oBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,kFAAkF;gBAClF,MAAM,CACJ,KAAa,EACb,OAAmC,EAAE,EACrC,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;wBACjD,IAAI;wBACJ,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD;;;;;mBAKG;gBACH,YAAY,CACV,KAAa,EACb,UAAkB,EAClB,oBAAwD,EACxD,cAAuB;oBAEvB,MAAM,SAAS,GAAG,OAAO,oBAAoB,KAAK,QAAQ,CAAC;oBAC3D,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;wBAClF,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;wBAClD,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc;qBAClE,CAAC,CAAC;gBACL,CAAC;aACF;YACD,yEAAyE;YACzE,QAAQ,CAAC,EAAU,EAAE,cAAuB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,sDAAsD;YACtD,cAAc,CACZ,aAAqB,EACrB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,mCAAmC;oBACzC,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;oBACvC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,KAAK,CAAC,UAAkB,EAAE,cAAuB;gBAC/C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;oBACjC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,eAAe,EAAE;YACf,8FAA8F;YAC9F,MAAM,CAAC,OAAiC,EAAE,EAAE,cAAuB;gBACjE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,oEAAoE;QACpE,WAAW,EAAE;YACX,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,sFAAsF;YACtF,MAAM,CAAC,IAA0B,EAAE,cAAuB;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,0DAA0D;YAC1D,MAAM,CAAC,EAAU,EAAE,IAA0B;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+CAA+C;YAC/C,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD;;;eAGG;YACH,YAAY,CAAC,EAAU,EAAE,IAAiC;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAC3D,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,gEAAgE;YAChE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;gBAEtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;oBACpE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,kFAAkF;YAClF,qBAAqB,CAAC,EAAU;gBAC9B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;eAGG;YACH,SAAS,CAAC,EAAU,EAAE,KAAa;gBACjC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;oBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,oGAAoG;YACpG,WAAW,CAAC,EAAU,EAAE,OAAe;gBACrC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,sFAAsF;YACtF,UAAU,CAAC,EAAU,EAAE,IAAuB;gBAC5C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;oBACzD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD;;;;eAIG;YACH,mBAAmB,CAAC,EAAU,EAAE,IAAiC;gBAC/D,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB;oBACnE,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,aAAa,CAAC,MAAmB;gBAC/B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,2CAA2C;oBACjD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,gBAAgB,EAAE;YAChB,yBAAyB;YACzB,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4EAA4E;YAC5E,GAAG,CAAC,IAA6B;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,6CAA6C;YAC7C,MAAM,CAAC,IAA+B;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,mDAAmD;YACnD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,uEAAuE;QACvE,eAAe,EAAE;YACf,IAAI,CAAC,SAAoC,EAAE;gBAMzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;SACF;QACD,yFAAyF;QACzF,YAAY,EAAE;YACZ,MAAM,CAAC,IAAqB,EAAE,UAAoC,EAAE;gBAClE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,+DAA+D;YAC/D,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,yBAAyB,CAAC,MAAiC;IACzE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC9B,WAAW,CAAC,SAA+B;YACzC,OAAO,yBAAyB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -8,6 +8,12 @@ export interface WebhookEndpoint {
|
|
|
8
8
|
/** Start of the current failure streak (epoch ms), or null when the last delivery succeeded. */
|
|
9
9
|
failing_since?: number | null;
|
|
10
10
|
disabled_at: number | null;
|
|
11
|
+
/**
|
|
12
|
+
* While a secret rotation overlap is open: when the previous secret stops
|
|
13
|
+
* signing deliveries (epoch ms). Until then every delivery carries two
|
|
14
|
+
* signatures, one per secret. Null otherwise.
|
|
15
|
+
*/
|
|
16
|
+
previous_secret_expires_at?: number | null;
|
|
11
17
|
created_at: number;
|
|
12
18
|
}
|
|
13
19
|
/** Create reveals the signing secret (`whsec_...`) exactly once. */
|
|
@@ -80,8 +86,21 @@ export interface WebhookSigningSecret {
|
|
|
80
86
|
object: 'webhook_secret';
|
|
81
87
|
/** The `whsec_...` signing secret. */
|
|
82
88
|
secret: string;
|
|
89
|
+
/** On a rotation: the overlap applied, in seconds. */
|
|
90
|
+
overlap_seconds?: number;
|
|
91
|
+
/** On a rotation: when the previous secret stops signing deliveries (epoch ms), or null when it already has. */
|
|
92
|
+
previous_secret_expires_at?: number | null;
|
|
83
93
|
warning?: string;
|
|
84
94
|
}
|
|
95
|
+
export interface RotateWebhookSecretBody {
|
|
96
|
+
/**
|
|
97
|
+
* How long the previous secret keeps signing deliveries (as a second
|
|
98
|
+
* `atlas-signature` entry), in seconds. Default 0: it stops at once. At most
|
|
99
|
+
* 604800 (7 days). Set it only once every receiver verifies with a verifier
|
|
100
|
+
* that accepts several signatures (this package 0.9.1+).
|
|
101
|
+
*/
|
|
102
|
+
overlap_seconds?: number;
|
|
103
|
+
}
|
|
85
104
|
/** A queued delivery (from `test` or `redeliver`). */
|
|
86
105
|
export interface WebhookDeliveryQueued {
|
|
87
106
|
object: 'webhook_delivery';
|
|
@@ -101,8 +120,12 @@ export declare function webhooksResource(request: RequestFn): {
|
|
|
101
120
|
update(id: string, body: UpdateWebhookEndpointBody): Promise<WebhookEndpoint>;
|
|
102
121
|
/** Show the current signing secret again. Audited. */
|
|
103
122
|
revealSecret(id: string): Promise<WebhookSigningSecret>;
|
|
104
|
-
/**
|
|
105
|
-
|
|
123
|
+
/**
|
|
124
|
+
* Rotate the signing secret; the new one is revealed exactly once. By
|
|
125
|
+
* default the old secret stops signing at once; for `overlap_seconds`
|
|
126
|
+
* every delivery is signed with both, so a verifier holding either passes.
|
|
127
|
+
*/
|
|
128
|
+
rotateSecret(id: string, body?: RotateWebhookSecretBody): Promise<WebhookSigningSecret>;
|
|
106
129
|
/** Send a synthetic `webhook.test` event to this endpoint only. */
|
|
107
130
|
test(id: string): Promise<WebhookDeliveryQueued>;
|
|
108
131
|
/** Redeliver a past event as a fresh attempt (409 once past its retention). */
|
package/dist/client/webhooks.js
CHANGED
|
@@ -16,9 +16,13 @@ function webhooksResource(request) {
|
|
|
16
16
|
revealSecret(id) {
|
|
17
17
|
return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/reveal_secret` });
|
|
18
18
|
},
|
|
19
|
-
/**
|
|
20
|
-
|
|
21
|
-
|
|
19
|
+
/**
|
|
20
|
+
* Rotate the signing secret; the new one is revealed exactly once. By
|
|
21
|
+
* default the old secret stops signing at once; for `overlap_seconds`
|
|
22
|
+
* every delivery is signed with both, so a verifier holding either passes.
|
|
23
|
+
*/
|
|
24
|
+
rotateSecret(id, body) {
|
|
25
|
+
return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/rotate_secret`, body });
|
|
22
26
|
},
|
|
23
27
|
/** Send a synthetic `webhook.test` event to this endpoint only. */
|
|
24
28
|
test(id) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AA+HA,4CAgEC;AA/LD,uCAAgD;AA+HhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;;eAIG;YACH,YAAY,CAAC,EAAU,EAAE,IAA8B;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,mEAAmE;YACnE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
|