npm - @betterportal/auth-workos - Versions diffs - 10.1.32 → 10.1.33 - Mend

@betterportal/auth-workos 10.1.32 → 10.1.33

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/lib/bp-contracts/org.betterportal.auth.workos.json ADDED Viewed

@@ -0,0 +1,942 @@
+{
+  "manifest": {
+    "protocolVersion": 1,
+    "pluginId": "org.betterportal.auth.workos",
+    "title": "BetterPortal WorkOS",
+    "description": "WorkOS-backed auth service for BetterPortal apps.",
+    "version": "10.1.33",
+    "category": "service",
+    "deploymentModes": [
+      "self-hosted"
+    ],
+    "capabilities": [
+      "auth",
+      "auth.roles.sync",
+      "auth.roles.authority.provider",
+      "auth.roles.authority.betterportal",
+      "view.json",
+      "view.metadata",
+      "theme.bootstrap1",
+      "view.html",
+      "theme.embedded"
+    ],
+    "supportedThemes": [
+      "bootstrap1",
+      "embedded"
+    ],
+    "supportedRenderModes": [
+      "page",
+      "fragment"
+    ],
+    "views": [
+      {
+        "viewId": "workos-role-sync.index",
+        "title": "WorkOS Role Sync",
+        "description": "Synchronize BetterPortal permissions and roles with WorkOS.",
+        "path": "/.well-known/bp/config/workos-role-sync",
+        "methods": [
+          "GET"
+        ],
+        "paramsSchema": {},
+        "querySchema": {},
+        "headersSchema": {},
+        "bodySchema": {},
+        "jsonResponseSchema": {},
+        "metadataResponseSchema": {},
+        "renderable": false,
+        "raw": true,
+        "html": {
+          "themeRenderers": {}
+        },
+        "auth": {
+          "required": true,
+          "permissions": [
+            {
+              "serviceId": "org.betterportal.auth.workos",
+              "viewId": "workos-role-sync.index",
+              "permissions": [
+                "read"
+              ]
+            }
+          ]
+        },
+        "role": "auth.roles.sync",
+        "dependencies": [],
+        "apiContracts": [],
+        "demoScenarios": [],
+        "cacheHints": {
+          "ttlSeconds": 0,
+          "varyBy": []
+        }
+      },
+      {
+        "viewId": "workos-role-sync.permissions",
+        "title": "Sync WorkOS Permissions",
+        "description": "Synchronize BetterPortal permissions to WorkOS.",
+        "path": "/.well-known/bp/config/workos-role-sync/permissions",
+        "methods": [
+          "POST"
+        ],
+        "paramsSchema": {},
+        "querySchema": {},
+        "headersSchema": {},
+        "bodySchema": {},
+        "jsonResponseSchema": {},
+        "metadataResponseSchema": {},
+        "renderable": false,
+        "raw": true,
+        "html": {
+          "themeRenderers": {}
+        },
+        "auth": {
+          "required": true,
+          "permissions": [
+            {
+              "serviceId": "org.betterportal.auth.workos",
+              "viewId": "workos-role-sync.permissions",
+              "permissions": [
+                "create"
+              ]
+            }
+          ]
+        },
+        "role": "auth.roles.sync",
+        "dependencies": [],
+        "apiContracts": [],
+        "demoScenarios": [],
+        "cacheHints": {
+          "ttlSeconds": 0,
+          "varyBy": []
+        }
+      },
+      {
+        "viewId": "workos-role-sync.roles",
+        "title": "Sync WorkOS Roles",
+        "description": "Synchronize WorkOS roles into BetterPortal.",
+        "path": "/.well-known/bp/config/workos-role-sync/roles",
+        "methods": [
+          "POST"
+        ],
+        "paramsSchema": {},
+        "querySchema": {},
+        "headersSchema": {},
+        "bodySchema": {},
+        "jsonResponseSchema": {},
+        "metadataResponseSchema": {},
+        "renderable": false,
+        "raw": true,
+        "html": {
+          "themeRenderers": {}
+        },
+        "auth": {
+          "required": true,
+          "permissions": [
+            {
+              "serviceId": "org.betterportal.auth.workos",
+              "viewId": "workos-role-sync.roles",
+              "permissions": [
+                "update"
+              ]
+            }
+          ]
+        },
+        "role": "auth.roles.sync",
+        "dependencies": [],
+        "apiContracts": [],
+        "demoScenarios": [],
+        "cacheHints": {
+          "ttlSeconds": 0,
+          "varyBy": []
+        }
+      },
+      {
+        "viewId": "login.index",
+        "title": "WorkOS Login",
+        "description": "Authenticate with WorkOS AuthKit and store BetterPortal auth headers.",
+        "path": "/login",
+        "methods": [
+          "GET"
+        ],
+        "paramsSchema": {},
+        "querySchema": {
+          "anyvaliVersion": "1.0",
+          "schemaVersion": "1.1",
+          "root": {
+            "kind": "object",
+            "properties": {
+              "action": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "code": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "state": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "next": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "redirect": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "error": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "error_description": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              }
+            },
+            "required": [],
+            "unknownKeys": "strip"
+          },
+          "definitions": {},
+          "extensions": {}
+        },
+        "headersSchema": {
+          "anyvaliVersion": "1.0",
+          "schemaVersion": "1.1",
+          "root": {
+            "kind": "object",
+            "properties": {},
+            "required": [],
+            "unknownKeys": "strip"
+          },
+          "definitions": {},
+          "extensions": {}
+        },
+        "bodySchema": {},
+        "jsonResponseSchema": {
+          "anyvaliVersion": "1.0",
+          "schemaVersion": "1.1",
+          "root": {
+            "kind": "object",
+            "properties": {
+              "status": {
+                "kind": "enum",
+                "values": [
+                  "ok",
+                  "error"
+                ]
+              },
+              "message": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "authorizationUrl": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "loginUI": {
+                "kind": "enum",
+                "values": [
+                  "default",
+                  "clean",
+                  "redirect"
+                ],
+                "default": "default"
+              },
+              "alreadyLoggedIn": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "bool"
+                }
+              },
+              "loggedOut": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "bool"
+                }
+              },
+              "signedIn": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "bool"
+                }
+              },
+              "nextUrl": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "user": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "object",
+                  "properties": {
+                    "id": {
+                      "kind": "optional",
+                      "inner": {
+                        "kind": "string"
+                      }
+                    },
+                    "name": {
+                      "kind": "optional",
+                      "inner": {
+                        "kind": "string"
+                      }
+                    },
+                    "email": {
+                      "kind": "optional",
+                      "inner": {
+                        "kind": "string"
+                      }
+                    },
+                    "picture": {
+                      "kind": "optional",
+                      "inner": {
+                        "kind": "string"
+                      }
+                    }
+                  },
+                  "required": [],
+                  "unknownKeys": "strip"
+                }
+              }
+            },
+            "required": [
+              "status",
+              "loginUI"
+            ],
+            "unknownKeys": "strip"
+          },
+          "definitions": {},
+          "extensions": {}
+        },
+        "metadataResponseSchema": {},
+        "renderable": true,
+        "html": {
+          "themeRenderers": {
+            "bootstrap1": {
+              "defaultRenderer": "default",
+              "renderModes": [
+                "page",
+                "fragment"
+              ],
+              "slots": [
+                "main",
+                "background.monitor",
+                "nav.profile"
+              ],
+              "renderers": [
+                {
+                  "id": "default",
+                  "title": "Default Content",
+                  "slotId": "main",
+                  "renderModes": [
+                    "page",
+                    "fragment"
+                  ]
+                },
+                {
+                  "id": "background.monitor",
+                  "title": "background.monitor",
+                  "slotId": "background.monitor",
+                  "renderModes": [
+                    "fragment"
+                  ]
+                },
+                {
+                  "id": "nav.profile",
+                  "title": "nav.profile",
+                  "slotId": "nav.profile",
+                  "renderModes": [
+                    "fragment"
+                  ]
+                }
+              ]
+            },
+            "embedded": {
+              "defaultRenderer": "default",
+              "renderModes": [
+                "fragment"
+              ],
+              "slots": [
+                "background.monitor"
+              ],
+              "renderers": [
+                {
+                  "id": "background.monitor",
+                  "title": "background.monitor",
+                  "slotId": "background.monitor",
+                  "renderModes": [
+                    "fragment"
+                  ]
+                }
+              ]
+            }
+          }
+        },
+        "auth": {
+          "required": false,
+          "permissions": []
+        },
+        "role": "auth.login",
+        "dependencies": [
+          "logout.index",
+          "refresh.index"
+        ],
+        "chrome": {
+          "fullScreen": true
+        },
+        "apiContracts": [],
+        "demoScenarios": [],
+        "cacheHints": {
+          "ttlSeconds": 0,
+          "varyBy": []
+        }
+      },
+      {
+        "viewId": "logout.index",
+        "title": "WorkOS Logout",
+        "description": "Clear the stored WorkOS bearer token.",
+        "path": "/logout",
+        "methods": [
+          "GET"
+        ],
+        "paramsSchema": {},
+        "querySchema": {
+          "anyvaliVersion": "1.0",
+          "schemaVersion": "1.1",
+          "root": {
+            "kind": "object",
+            "properties": {
+              "next": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "redirect": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              }
+            },
+            "required": [],
+            "unknownKeys": "strip"
+          },
+          "definitions": {},
+          "extensions": {}
+        },
+        "headersSchema": {},
+        "bodySchema": {},
+        "jsonResponseSchema": {
+          "anyvaliVersion": "1.0",
+          "schemaVersion": "1.1",
+          "root": {
+            "kind": "object",
+            "properties": {
+              "status": {
+                "kind": "enum",
+                "values": [
+                  "ok"
+                ]
+              },
+              "message": {
+                "kind": "string"
+              },
+              "nextUrl": {
+                "kind": "string"
+              }
+            },
+            "required": [
+              "status",
+              "message",
+              "nextUrl"
+            ],
+            "unknownKeys": "strip"
+          },
+          "definitions": {},
+          "extensions": {}
+        },
+        "metadataResponseSchema": {},
+        "renderable": false,
+        "html": {
+          "themeRenderers": {}
+        },
+        "auth": {
+          "required": false,
+          "permissions": []
+        },
+        "role": "auth.logout",
+        "dependencies": [],
+        "apiContracts": [],
+        "demoScenarios": [],
+        "cacheHints": {
+          "ttlSeconds": 0,
+          "varyBy": []
+        }
+      },
+      {
+        "viewId": "refresh.index",
+        "title": "WorkOS Refresh",
+        "description": "Refresh BetterPortal tokens using a WorkOS-backed BP refresh token.",
+        "path": "/refresh",
+        "methods": [
+          "POST"
+        ],
+        "paramsSchema": {},
+        "querySchema": {},
+        "headersSchema": {},
+        "bodySchema": {
+          "anyvaliVersion": "1.0",
+          "schemaVersion": "1.1",
+          "root": {
+            "kind": "object",
+            "properties": {
+              "refreshToken": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string",
+                  "minLength": 1
+                }
+              }
+            },
+            "required": [],
+            "unknownKeys": "strip"
+          },
+          "definitions": {},
+          "extensions": {}
+        },
+        "jsonResponseSchema": {
+          "anyvaliVersion": "1.0",
+          "schemaVersion": "1.1",
+          "root": {
+            "kind": "object",
+            "properties": {
+              "status": {
+                "kind": "enum",
+                "values": [
+                  "ok",
+                  "error"
+                ]
+              },
+              "message": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "accessToken": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "string"
+                }
+              },
+              "expiresInSeconds": {
+                "kind": "optional",
+                "inner": {
+                  "kind": "int",
+                  "min": 1
+                }
+              }
+            },
+            "required": [
+              "status"
+            ],
+            "unknownKeys": "strip"
+          },
+          "definitions": {},
+          "extensions": {}
+        },
+        "metadataResponseSchema": {},
+        "renderable": false,
+        "html": {
+          "themeRenderers": {}
+        },
+        "auth": {
+          "required": false,
+          "permissions": []
+        },
+        "role": "auth.refresh",
+        "dependencies": [],
+        "apiContracts": [],
+        "demoScenarios": [],
+        "cacheHints": {
+          "ttlSeconds": 0,
+          "varyBy": []
+        }
+      }
+    ],
+    "configSchemas": [
+      {
+        "id": "workos.app",
+        "title": "WorkOS App Config",
+        "description": "App-scoped WorkOS AuthKit settings.",
+        "scope": "app",
+        "jsonSchema": {
+          "clientId": "string",
+          "apiKey": "string",
+          "provider": "string",
+          "connectionId": "string",
+          "organizationId": "string",
+          "domainHint": "string",
+          "scopes": "string",
+          "loginUI": "string",
+          "loginRedirectPath": "string",
+          "logoutRedirectPath": "string",
+          "roleClaimPath": "string",
+          "webhookSecret": "string"
+        },
+        "groups": [
+          {
+            "id": "connection",
+            "title": "Connection",
+            "description": "WorkOS AuthKit application credentials.",
+            "order": 10,
+            "optional": false
+          },
+          {
+            "id": "login",
+            "title": "Login",
+            "description": "Provider routing and post-login routes.",
+            "order": 20,
+            "optional": true
+          },
+          {
+            "id": "claims",
+            "title": "Claims",
+            "description": "WorkOS access-token claim paths mapped into BP roles.",
+            "order": 30,
+            "optional": true
+          },
+          {
+            "id": "sync",
+            "title": "Role Sync",
+            "description": "WorkOS webhook + BP role sync settings.",
+            "order": 40,
+            "optional": true
+          }
+        ],
+        "fields": [
+          {
+            "key": "clientId",
+            "title": "Client ID",
+            "description": "WorkOS client ID for this BP app.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "connection",
+            "order": 10,
+            "required": true
+          },
+          {
+            "key": "apiKey",
+            "title": "API Key",
+            "description": "WorkOS API key used server-side for code exchange and refresh.",
+            "scope": "app",
+            "visibility": "secret",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "connection",
+            "order": 20,
+            "required": true
+          },
+          {
+            "key": "provider",
+            "title": "Provider",
+            "description": "WorkOS provider, usually authkit.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "login",
+            "order": 10,
+            "defaultValue": "authkit",
+            "required": false
+          },
+          {
+            "key": "connectionId",
+            "title": "Connection ID",
+            "description": "Optional WorkOS connection to force.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "login",
+            "order": 20,
+            "required": false
+          },
+          {
+            "key": "organizationId",
+            "title": "Organization ID",
+            "description": "Optional WorkOS organization to force.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "login",
+            "order": 30,
+            "required": false
+          },
+          {
+            "key": "domainHint",
+            "title": "Domain Hint",
+            "description": "Optional WorkOS domain hint.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "login",
+            "order": 40,
+            "required": false
+          },
+          {
+            "key": "scopes",
+            "title": "Scopes",
+            "description": "Space-separated provider scopes.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "login",
+            "order": 50,
+            "defaultValue": "openid profile email",
+            "required": false
+          },
+          {
+            "key": "loginUI",
+            "title": "Login UI",
+            "description": "Default provider UI, clean button UI, or clean UI with automatic redirect.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "login",
+            "order": 60,
+            "defaultValue": "default",
+            "ui": {
+              "control": "select",
+              "options": [
+                {
+                  "value": "default",
+                  "label": "Default"
+                },
+                {
+                  "value": "clean",
+                  "label": "Clean"
+                },
+                {
+                  "value": "redirect",
+                  "label": "Redirect"
+                }
+              ]
+            },
+            "required": false
+          },
+          {
+            "key": "loginRedirectPath",
+            "title": "Logged In Route",
+            "description": "Tenant route shown after signing in when no next path is supplied.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "login",
+            "order": 70,
+            "defaultValue": "/",
+            "ui": {
+              "control": "select",
+              "optionsSource": "app.routes"
+            },
+            "required": false
+          },
+          {
+            "key": "logoutRedirectPath",
+            "title": "Logged Out Route",
+            "description": "Tenant route shown after signing out.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "login",
+            "order": 80,
+            "defaultValue": "/",
+            "ui": {
+              "control": "select",
+              "optionsSource": "app.routes"
+            },
+            "required": false
+          },
+          {
+            "key": "roleClaimPath",
+            "title": "Role Claim Path",
+            "description": "Dot path to roles in the WorkOS access token.",
+            "scope": "app",
+            "visibility": "protected",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "claims",
+            "order": 10,
+            "defaultValue": "roles",
+            "required": false
+          },
+          {
+            "key": "webhookSecret",
+            "title": "Webhook Secret",
+            "description": "WorkOS webhook signing secret for role sync events.",
+            "scope": "app",
+            "visibility": "secret",
+            "ownership": "bp",
+            "sourceOfTruth": "bp",
+            "groupId": "sync",
+            "order": 10,
+            "required": false
+          }
+        ]
+      }
+    ],
+    "permissions": [],
+    "adminApis": [
+      {
+        "id": "config.schema",
+        "title": "Config Schema",
+        "description": "BetterPortal-managed config schemas for this service.",
+        "path": "/.well-known/bp/config/schema",
+        "methods": [
+          "GET"
+        ],
+        "supportsCustomUi": false
+      },
+      {
+        "id": "config.values",
+        "title": "Config Values",
+        "description": "Read and write BetterPortal-managed config values.",
+        "path": "/.well-known/bp/config",
+        "methods": [
+          "GET",
+          "POST"
+        ],
+        "supportsCustomUi": false
+      }
+    ],
+    "webhooks": [],
+    "apiContracts": [],
+    "m2mRequests": [],
+    "developerResources": [],
+    "cacheHints": {
+      "metadataTtlSeconds": 1800
+    }
+  },
+  "routes": [
+    {
+      "viewId": "workos-role-sync.index",
+      "path": "/.well-known/bp/config/workos-role-sync",
+      "methods": [
+        "GET"
+      ],
+      "paramNames": [],
+      "themes": [],
+      "hasFragments": false,
+      "fragments": [],
+      "components": []
+    },
+    {
+      "viewId": "workos-role-sync.permissions",
+      "path": "/.well-known/bp/config/workos-role-sync/permissions",
+      "methods": [
+        "POST"
+      ],
+      "paramNames": [],
+      "themes": [],
+      "hasFragments": false,
+      "fragments": [],
+      "components": []
+    },
+    {
+      "viewId": "workos-role-sync.roles",
+      "path": "/.well-known/bp/config/workos-role-sync/roles",
+      "methods": [
+        "POST"
+      ],
+      "paramNames": [],
+      "themes": [],
+      "hasFragments": false,
+      "fragments": [],
+      "components": []
+    },
+    {
+      "viewId": "login.index",
+      "path": "/login",
+      "methods": [
+        "GET"
+      ],
+      "paramNames": [],
+      "themes": [
+        "bootstrap1",
+        "embedded"
+      ],
+      "hasFragments": true,
+      "fragments": [
+        {
+          "fragmentLocation": "background",
+          "fragmentId": "monitor",
+          "themes": [
+            "bootstrap1",
+            "embedded"
+          ]
+        },
+        {
+          "fragmentLocation": "nav",
+          "fragmentId": "profile",
+          "themes": [
+            "bootstrap1"
+          ]
+        }
+      ],
+      "components": []
+    },
+    {
+      "viewId": "logout.index",
+      "path": "/logout",
+      "methods": [
+        "GET"
+      ],
+      "paramNames": [],
+      "themes": [],
+      "hasFragments": false,
+      "fragments": [],
+      "components": []
+    },
+    {
+      "viewId": "refresh.index",
+      "path": "/refresh",
+      "methods": [
+        "POST"
+      ],
+      "paramNames": [],
+      "themes": [],
+      "hasFragments": false,
+      "fragments": [],
+      "components": []
+    }
+  ]
+}