@clearly-hub/browser 0.4.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -7
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -31,7 +31,7 @@ const hub = clearlyHub({
|
|
|
31
31
|
m2mClientId: process.env.CLEARLY_HUB_M2M_CLIENT_ID,
|
|
32
32
|
m2mClientSecret: process.env.CLEARLY_HUB_M2M_CLIENT_SECRET,
|
|
33
33
|
appUrl: 'https://app.example.com',
|
|
34
|
-
secret: process.env.SESSION_SECRET, // 32+ characters
|
|
34
|
+
secret: process.env.SESSION_SECRET, // 32+ random characters
|
|
35
35
|
});
|
|
36
36
|
|
|
37
37
|
const app = express();
|
|
@@ -114,7 +114,8 @@ or plugin that adds headers to each request. The key lasts an hour; `getToken()`
|
|
|
114
114
|
time, so call it again rather than keeping the value. On your server, `hub.fetchAsUser(req, url)`
|
|
115
115
|
does the same.
|
|
116
116
|
|
|
117
|
-
The key is the person's own Clearly.HUB key:
|
|
117
|
+
The key is the person's own Clearly.HUB key: send it only to resource URLs from `DATA_PICKER` (Clearly.HUB's
|
|
118
|
+
data proxy), and keep scripts you don't trust off pages that use it. `fetchAsUser` refuses other URLs.
|
|
118
119
|
|
|
119
120
|
## The Node package
|
|
120
121
|
|
|
@@ -124,7 +125,7 @@ The key is the person's own Clearly.HUB key: keep scripts you don't trust off pa
|
|
|
124
125
|
| `onSignIn(person, { request, req })` | Called after each sign-in. Return your own user id to keep it in the session, or `{ appUserId, redirectTo }` to also choose the next page |
|
|
125
126
|
| `onAnswer(result, { user, data, request, req })` | Called with each checked answer before it reaches the browser, for example to set up a workspace. `data` is what the screen was sent; what you return reaches the page as `result.app` |
|
|
126
127
|
| `hub.getUser(req)` | Who's signed in, in your own routes |
|
|
127
|
-
| `hub.fetchAsUser(req, url)` | Fetch protected or paid data (from `DATA_PICKER`) on your server, with the person's key
|
|
128
|
+
| `hub.fetchAsUser(req, url)` | Fetch protected or paid data (from `DATA_PICKER`) on your server, with the person's key. Only URLs on Clearly.HUB's data proxy |
|
|
128
129
|
| `hub.getSubscription(hubId)`, `getSubscriptions()` | A hub's subscription to your app, or all of them |
|
|
129
130
|
| `hub.reportUsage({ request or sub, hubId, quantity })` | Report billable use; Clearly.HUB bills the hub. Pass `sub` for a Clearly.HUB account you stored, without a live sign-in |
|
|
130
131
|
| `hub.getUserToken(req)`, `getAppToken()` | The person's key and your app's key, for calls of your own |
|
|
@@ -143,11 +144,19 @@ const hub = clearlyHub<express.Request>({
|
|
|
143
144
|
});
|
|
144
145
|
```
|
|
145
146
|
|
|
146
|
-
**What it checks for you:** every screen answer's Ed25519 signature,
|
|
147
|
-
opened in this browser, once (`state`)
|
|
148
|
-
|
|
147
|
+
**What it checks for you:** every screen answer's Ed25519 signature, that it answers a screen
|
|
148
|
+
opened in this browser, once (`state`), and that it was given to your app and that screen
|
|
149
|
+
(`client_id`, callback URL, action).
|
|
149
150
|
|
|
150
|
-
**
|
|
151
|
+
**What to trust in an answer:** it's a snapshot of the moment the person clicked. For access later,
|
|
152
|
+
ask `getSubscription(hubId)` when it's used, not the `status` you got then. Ignore `answer.user`:
|
|
153
|
+
Clearly.HUB doesn't check it yet. Who's signed in is the session's user.
|
|
154
|
+
|
|
155
|
+
The session is encrypted in cookies, so there's nothing to store; it's split over several cookies
|
|
156
|
+
because tokens are large. A copied cookie stays valid until its refresh token expires: signing out
|
|
157
|
+
clears only this browser's copy.
|
|
158
|
+
|
|
159
|
+
**Local Clearly.HUB:** pass `urls: { screens, api, proxy, auth, issuer }`; see
|
|
151
160
|
`examples/express/.env.example`.
|
|
152
161
|
|
|
153
162
|
## Not covered (yet)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@clearly-hub/browser",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.1",
|
|
4
4
|
"description": "Clearly.HUB in the browser: sign-in, hosted screens and the session, talking to @clearly-hub/node",
|
|
5
5
|
"license": "SEE LICENSE IN LICENSE",
|
|
6
6
|
"author": "Future Insight Group BV",
|