@canopy-io/node 0.6.0 → 0.7.1

package/dist/index.js

@@ -82,6 +82,15 @@ function isCanopyTokenError(error) {
   return error instanceof Error && error.name === "CanopyTokenError";
 }
 
+// src/strings.ts
+function withoutTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") {
+    end -= 1;
+  }
+  return value.slice(0, end);
+}
+
 // src/client.ts
 function isCursorPagination(pagination) {
   return "next_cursor" in pagination;
@@ -106,7 +115,7 @@ var CanopyClient = class {
         "CanopyClient requires either `apiKey` (server-to-server) or `accessToken` (a user or identity JWT)."
       );
     }
-    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.baseUrl = withoutTrailingSlashes(options.baseUrl ?? DEFAULT_BASE_URL);
     this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     this.maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
     this.maxBackoffMs = options.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS;
@@ -1107,6 +1116,7 @@ var Canopy = class {
 
 // src/authorizer.ts
 var DEFAULT_TTL_MS = 6e4;
+var MAX_TTL_MS = 3e5;
 var MAX_WALK_DEPTH = 256;
 var LocalAuthorizer = class {
   client;
@@ -1133,6 +1143,11 @@ var LocalAuthorizer = class {
   constructor(client, options = {}) {
     this.client = client;
     this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    if (!Number.isFinite(this.ttlMs) || this.ttlMs < 0 || this.ttlMs > MAX_TTL_MS) {
+      throw new RangeError(
+        `ttlMs must be between 0 and ${MAX_TTL_MS} (five minutes); got ${String(this.ttlMs)}. It is how long a revoked user keeps access, so it is capped.`
+      );
+    }
     this.now = options.now ?? (() => Date.now());
     this.readOptions = {
       ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs },
@@ -1308,8 +1323,16 @@ var LocalAuthorizer = class {
     }
     const parents = /* @__PURE__ */ new Map();
     if (result.modified) {
+      const ids = /* @__PURE__ */ new Map();
       for (const edge of result.data.items) {
-        parents.set(edge.id, edge.parent_node_id ?? null);
+        ids.set(edge.id, edge.id);
+      }
+      for (const edge of result.data.items) {
+        const parent = edge.parent_node_id ?? null;
+        parents.set(
+          edge.id,
+          parent === null ? null : ids.get(parent) ?? parent
+        );
       }
     }
     this.tree = {
@@ -1322,12 +1345,29 @@ var LocalAuthorizer = class {
 };
 
 // src/verify.ts
-var DEFAULT_ISSUER = "https://auth.canopy-io.com";
+var HOSTED_ORIGIN = "https://auth.canopy-io.com";
 var DEFAULT_JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1e3;
 var DEFAULT_JWKS_MIN_REFETCH_INTERVAL_MS = 30 * 1e3;
 var DEFAULT_JWKS_TIMEOUT_MS = 5e3;
 var PRINCIPAL_TYPES = /* @__PURE__ */ new Set(["user", "identity", "api_key", "platform"]);
 var DEFAULT_CLOCK_TOLERANCE_SEC = 60;
+function resolveIssuer(options) {
+  const { environmentId, issuer } = options;
+  if (environmentId && issuer) {
+    throw new TypeError(
+      "TokenVerifier takes environmentId or issuer, not both."
+    );
+  }
+  if (issuer) {
+    return withoutTrailingSlashes(issuer);
+  }
+  if (environmentId) {
+    return `${HOSTED_ORIGIN}/environments/${environmentId}`;
+  }
+  throw new TypeError(
+    "TokenVerifier needs environmentId (the Environment your tokens come from) or, on a custom auth domain or self-hosted instance, issuer."
+  );
+}
 function orgContext(claims) {
   const { org_id, org_role } = claims;
   if (typeof org_id !== "string" || org_id === "" || typeof org_role !== "string" || org_role === "") {
@@ -1372,7 +1412,7 @@ var TokenVerifier = class {
   /** In-flight fetch, so a burst of requests triggers one call, not N. */
   inFlight = null;
   constructor(options = {}) {
-    this.issuer = (options.issuer ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+    this.issuer = resolveIssuer(options);
     this.audience = options.audience;
     this.jwksUri = options.jwksUri ?? `${this.issuer}/.well-known/jwks.json`;
     this.jwksCacheMaxAgeMs = options.jwksCacheMaxAgeMs ?? DEFAULT_JWKS_CACHE_MAX_AGE_MS;
@@ -1650,6 +1690,6 @@ function isWebhookEvent(delivery, name) {
   return delivery.event === name;
 }
 
-export { Assignments, Canopy, CanopyAuthorizerError, CanopyClient, CanopyConnectionError, CanopyError, CanopyTokenError, Identities, LocalAuthorizer, Organizations, Paginator, Permissions, Roles, TokenVerifier, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, isWebhookEvent, orgContext, paginate, withConcurrency };
+export { Assignments, Canopy, CanopyAuthorizerError, CanopyClient, CanopyConnectionError, CanopyError, CanopyTokenError, Identities, LocalAuthorizer, MAX_TTL_MS, Organizations, Paginator, Permissions, Roles, TokenVerifier, isCanopyAuthorizerError, isCanopyConnectionError, isCanopyError, isCanopyTokenError, isCursorPagination, isWebhookEvent, orgContext, paginate, withConcurrency };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map