@crowdedkingdoms/crowdyjs 7.1.1 → 8.0.0

package/dist/domains/portal.d.ts

@@ -60,6 +60,30 @@ export declare class BrowserSessionPkceStore implements PkceStore {
     set(state: string, verifier: string): void;
     remove(state: string): void;
 }
+export interface PortalConsentState {
+    appId: string;
+    appName: string | null;
+    /** True for first-party/trusted apps (consent always skipped). */
+    trusted: boolean;
+    alreadyGranted: boolean;
+    /** True if the Overworld must show a consent screen before minting a code. */
+    consentRequired: boolean;
+}
+export interface AppAuthorizationGrant {
+    grantId: string;
+    appId: string;
+    appName: string | null;
+    scopes: string[];
+    status: string;
+    grantedAt: string;
+    revokedAt: string | null;
+}
+/** Thrown by {@link PortalAPI.handleAuthorizeRequest} when the user must consent. */
+export declare class PortalConsentRequiredError extends Error {
+    readonly appId: string;
+    readonly appName: string | null;
+    constructor(appId: string, appName: string | null);
+}
 export interface BeginEntryParams {
     /** Target app id (decimal string). */
     appId: string;
@@ -105,6 +129,21 @@ export declare class PortalAPI {
      * through the Overworld. Requires the current app token on this session.
      */
     refresh(): Promise<AppTokenResponse>;
+    /** Whether portaling into an app needs a consent prompt (Overworld side). */
+    getConsent(appId: string): Promise<PortalConsentState>;
+    /** Record the user's consent for an app (call from the consent screen). */
+    authorizeApp(appId: string, scopes?: string[]): Promise<AppAuthorizationGrant>;
+    /** Revoke a prior authorization; also revokes the user's live tokens for it. */
+    revokeAppAuthorization(appId: string): Promise<boolean>;
+    /** The user's active app authorizations ("connected apps"). */
+    myAuthorizedApps(): Promise<AppAuthorizationGrant[]>;
+    /** Register/update an app's portal client settings (requires manage_apps). */
+    setAppClientSettings(input: {
+        appId: string;
+        redirectUris?: string[];
+        clientType?: string;
+        launchUrl?: string;
+    }): Promise<PortalConsentState>;
     /**
      * Destination-game side, step 1: generate a PKCE pair, persist the verifier,
      * and return the Overworld authorize URL to navigate to. The caller does
@@ -116,7 +155,10 @@ export declare class PortalAPI {
      * game's params from the URL, mints a code with the session token, and returns
      * the URL to redirect the player back to (carrying `code` + `state`).
      */
-    handleAuthorizeRequest(search?: string): Promise<string>;
+    handleAuthorizeRequest(search?: string, options?: {
+        grantConsent?: boolean;
+        scopes?: string[];
+    }): Promise<string>;
     /**
      * Destination-game side, step 3: read `code` + `state` from the callback URL,
      * load the stored verifier, exchange for an app token, and store it. Returns

package/dist/domains/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/domains/portal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,YAAW,SAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,SAAmB;IACtD,OAAO,CAAC,EAAE;IAGV,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAGjC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAG1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAG5B;AAqCD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,YAAY,EACrB,SAAS,GAAE,SAAyC;IAGvE;;;;;OAKG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO5D;;;;OAIG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQpC;;;;OAIG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAQ5B;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAQ1C;;;;OAIG;IACG,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAa3D;;;;OAIG;IACG,sBAAsB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAyB9D;;;;;OAKG;IACG,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAUvE"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/domains/portal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,YAAW,SAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,SAAmB;IACtD,OAAO,CAAC,EAAE;IAGV,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAGjC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAG1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAG5B;AAqCD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,qFAAqF;AACrF,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,KAAK,EAAE,MAAM;aACb,OAAO,EAAE,MAAM,GAAG,IAAI;gBADtB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAAG,IAAI;CAKzC;AA4CD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,UAAU,EAAE,aAAa,EACzB,OAAO,EAAE,YAAY,EACrB,SAAS,GAAE,SAAyC;IAGvE;;;;;OAKG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO5D;;;;OAIG;IACG,uBAAuB,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQpC;;;;OAIG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAQ5B;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAQ1C,6EAA6E;IACvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK5D,2EAA2E;IACrE,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAOjC,gFAAgF;IAC1E,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO7D,+DAA+D;IACzD,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAK1D,8EAA8E;IACxE,oBAAoB,CAAC,KAAK,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS/B;;;;OAIG;IACG,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAa3D;;;;OAIG;IACG,sBAAsB,CAC1B,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GACtD,OAAO,CAAC,MAAM,CAAC;IAoClB;;;;;OAKG;IACG,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;CAUvE"}

package/dist/domains/portal.js

@@ -48,6 +48,20 @@ const MintAppTokenDocument = parse(`mutation MintAppToken($input: MintAppTokenIn
 const CreatePortalAuthorizationCodeDocument = parse(`mutation CreatePortalAuthorizationCode($input: CreatePortalAuthorizationCodeInput!) { createPortalAuthorizationCode(input: $input) { code redirectUri expiresAt } }`);
 const ExchangePortalCodeDocument = parse(`mutation ExchangePortalCode($input: ExchangePortalCodeInput!) { exchangePortalCode(input: $input) { ${APP_TOKEN_FIELDS} } }`);
 const RefreshAppTokenDocument = parse(`mutation RefreshAppToken { refreshAppToken { ${APP_TOKEN_FIELDS} } }`);
+/** Thrown by {@link PortalAPI.handleAuthorizeRequest} when the user must consent. */
+export class PortalConsentRequiredError extends Error {
+    constructor(appId, appName) {
+        super(`Consent required for app ${appId}`);
+        this.appId = appId;
+        this.appName = appName;
+        this.name = 'PortalConsentRequiredError';
+    }
+}
+const PortalConsentDocument = parse(`query PortalConsent($appId: BigInt!) { portalConsent(appId: $appId) { appId appName trusted alreadyGranted consentRequired } }`);
+const AuthorizeAppDocument = parse(`mutation AuthorizeApp($input: AuthorizeAppInput!) { authorizeApp(input: $input) { grantId appId status scopes } }`);
+const RevokeAppAuthorizationDocument = parse(`mutation RevokeAppAuthorization($appId: BigInt!) { revokeAppAuthorization(appId: $appId) }`);
+const MyAuthorizedAppsDocument = parse(`query MyAuthorizedApps { myAuthorizedApps { grantId appId appName scopes status grantedAt revokedAt } }`);
+const SetAppClientSettingsDocument = parse(`mutation SetAppClientSettings($input: SetAppClientSettingsInput!) { setAppClientSettings(input: $input) { appId appName trusted consentRequired } }`);
 export class PortalAPI {
     constructor(management, session, pkceStore = new BrowserSessionPkceStore()) {
         this.management = management;
@@ -97,6 +111,38 @@ export class PortalAPI {
         this.session.setToken(data.refreshAppToken.token);
         return data.refreshAppToken;
     }
+    // ----- Consent + connected apps ------------------------------------------
+    /** Whether portaling into an app needs a consent prompt (Overworld side). */
+    async getConsent(appId) {
+        const data = await this.management.request(PortalConsentDocument, { appId });
+        return data.portalConsent;
+    }
+    /** Record the user's consent for an app (call from the consent screen). */
+    async authorizeApp(appId, scopes) {
+        const data = await this.management.request(AuthorizeAppDocument, {
+            input: { appId, scopes },
+        });
+        return data.authorizeApp;
+    }
+    /** Revoke a prior authorization; also revokes the user's live tokens for it. */
+    async revokeAppAuthorization(appId) {
+        const data = await this.management.request(RevokeAppAuthorizationDocument, {
+            appId,
+        });
+        return data.revokeAppAuthorization;
+    }
+    /** The user's active app authorizations ("connected apps"). */
+    async myAuthorizedApps() {
+        const data = await this.management.request(MyAuthorizedAppsDocument);
+        return data.myAuthorizedApps;
+    }
+    /** Register/update an app's portal client settings (requires manage_apps). */
+    async setAppClientSettings(input) {
+        const data = await this.management.request(SetAppClientSettingsDocument, {
+            input,
+        });
+        return data.setAppClientSettings;
+    }
     // ----- Browser PKCE redirect helpers -------------------------------------
     /**
      * Destination-game side, step 1: generate a PKCE pair, persist the verifier,
@@ -120,7 +166,7 @@ export class PortalAPI {
      * game's params from the URL, mints a code with the session token, and returns
      * the URL to redirect the player back to (carrying `code` + `state`).
      */
-    async handleAuthorizeRequest(search) {
+    async handleAuthorizeRequest(search, options) {
         const params = new URLSearchParams(search ?? defaultSearch());
         const appId = params.get('app_id');
         const codeChallenge = params.get('code_challenge');
@@ -130,6 +176,18 @@ export class PortalAPI {
         if (!appId || !codeChallenge || !redirectUri) {
             throw new Error('authorize request missing app_id, code_challenge, or redirect_uri');
         }
+        // Consent gate: trusted apps + already-granted apps proceed silently. For an
+        // untrusted, not-yet-granted app, either record consent (when the user
+        // approved on the consent screen) or signal the caller to show one.
+        const consent = await this.getConsent(appId);
+        if (consent.consentRequired) {
+            if (options?.grantConsent) {
+                await this.authorizeApp(appId, options.scopes);
+            }
+            else {
+                throw new PortalConsentRequiredError(appId, consent.appName);
+            }
+        }
         const result = await this.createAuthorizationCode({
             appId,
             codeChallenge,