@beacon-build/sdk 1.46.1 → 1.46.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# @beacon-build/sdk Changelog
|
|
2
2
|
|
|
3
|
+
## 1.46.2
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- b6df5ec: B499: narrow the GitHub proxy mounts to vendor-only and refuse write verbs. Both /api/github/_ and /api/v1/github/_ forward under the server GitHub PAT with a caller-chosen path, so any portal admin of any org could drive that token against any reachable repository. The audience drops from admin+vendor to vendor, and the proxy now forwards read verbs (GET/HEAD) only — the SDK's proxy() method type is narrowed to match.
|
|
8
|
+
- Updated dependencies [1ebd19a]
|
|
9
|
+
- @beacon-build/core@1.46.2
|
|
10
|
+
|
|
3
11
|
## 1.46.1
|
|
4
12
|
|
|
5
13
|
### Patch Changes
|
|
@@ -4,9 +4,18 @@ export interface GithubProxyResponse {
|
|
|
4
4
|
status: number;
|
|
5
5
|
headers: Record<string, string>;
|
|
6
6
|
}
|
|
7
|
+
/**
|
|
8
|
+
* B499: `method` is narrowed to the read verbs the API actually forwards. The server
|
|
9
|
+
* refuses anything else with 403 METHOD_NOT_ALLOWED (`services/api/src/routes/github.ts`),
|
|
10
|
+
* because every proxied call travels under the server's GitHub PAT — a write verb here is
|
|
11
|
+
* an arbitrary write against any repository that token can reach. The wider
|
|
12
|
+
* `POST | PATCH | PUT | DELETE` union this type used to advertise had no caller: the
|
|
13
|
+
* portal's `GitHubServiceImpl` is the sole consumer and only ever issues `GET`.
|
|
14
|
+
*/
|
|
15
|
+
export type GithubProxyMethod = 'GET' | 'HEAD';
|
|
7
16
|
export declare class AdminGithubProxyClient {
|
|
8
17
|
private readonly http;
|
|
9
18
|
constructor(http: HttpClient);
|
|
10
|
-
proxy(method:
|
|
19
|
+
proxy(method: GithubProxyMethod, path: string, body?: unknown): Promise<GithubProxyResponse>;
|
|
11
20
|
}
|
|
12
21
|
//# sourceMappingURL=github-proxy.client.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"github-proxy.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/github-proxy.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAED,qBAAa,sBAAsB;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,KAAK,CACP,MAAM,EAAE,
|
|
1
|
+
{"version":3,"file":"github-proxy.client.d.ts","sourceRoot":"","sources":["../../../src/clients/admin/github-proxy.client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAEhE,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,MAAM,CAAA;AAE9C,qBAAa,sBAAsB;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,KAAK,CACP,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,mBAAmB,CAAC;CAGlC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"github-proxy.client.js","sourceRoot":"","sources":["../../../src/clients/admin/github-proxy.client.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"github-proxy.client.js","sourceRoot":"","sources":["../../../src/clients/admin/github-proxy.client.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,sBAAsB;IACF;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,KAAK,CACP,MAAyB,EACzB,IAAY,EACZ,IAAc;QAEd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,eAAe,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACvF,CAAC;CACJ"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@beacon-build/sdk",
|
|
3
|
-
"version": "1.46.
|
|
3
|
+
"version": "1.46.2",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -26,7 +26,7 @@
|
|
|
26
26
|
"@types/react": "^19.2.0",
|
|
27
27
|
"@types/react-dom": "^19.2.0",
|
|
28
28
|
"event-source-polyfill": "^1.0.31",
|
|
29
|
-
"@beacon-build/core": "1.46.
|
|
29
|
+
"@beacon-build/core": "1.46.2"
|
|
30
30
|
},
|
|
31
31
|
"devDependencies": {
|
|
32
32
|
"@testing-library/react": "^16.3.2",
|