@dakkitor/api-contracts 1.5.0 → 1.7.0

package/dist/relay-pods/relay-pod-sessions.contract.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.relayPodSessionsContract = exports.RevokeRelayPodSessionResponseSchema = exports.ExchangeRelayPodSessionBodySchema = exports.RelayPodSessionValidationSchema = exports.RelayPodSessionExchangeSchema = void 0;
+const core_1 = require("@ts-rest/core");
+const zod_1 = require("zod");
+const error_schemas_1 = require("../common/error-schemas");
+const relay_pods_schemas_1 = require("./relay-pods.schemas");
+var relay_pods_schemas_2 = require("./relay-pods.schemas");
+Object.defineProperty(exports, "RelayPodSessionExchangeSchema", { enumerable: true, get: function () { return relay_pods_schemas_2.RelayPodSessionExchangeSchema; } });
+Object.defineProperty(exports, "RelayPodSessionValidationSchema", { enumerable: true, get: function () { return relay_pods_schemas_2.RelayPodSessionValidationSchema; } });
+const c = (0, core_1.initContract)();
+exports.ExchangeRelayPodSessionBodySchema = zod_1.z
+    .object({
+    code: zod_1.z.string().min(1),
+})
+    .strict();
+exports.RevokeRelayPodSessionResponseSchema = zod_1.z
+    .object({
+    revoked: zod_1.z.literal(true),
+})
+    .strict();
+const sessionPathParams = zod_1.z.object({ id: zod_1.z.string().uuid() }).strict();
+exports.relayPodSessionsContract = c.router({
+    exchange: {
+        method: 'POST',
+        path: '/relay-pod-sessions/exchange',
+        body: exports.ExchangeRelayPodSessionBodySchema,
+        responses: {
+            200: relay_pods_schemas_1.RelayPodSessionExchangeSchema,
+            404: error_schemas_1.ErrorResponseSchema,
+        },
+        summary: 'Exchange a one-time Relay pod login code',
+        metadata: { tags: ['Relay Pod Sessions'] },
+    },
+    validate: {
+        method: 'POST',
+        path: '/relay-pod-sessions/:id/validate',
+        pathParams: sessionPathParams,
+        body: zod_1.z.object({}).strict(),
+        responses: {
+            200: relay_pods_schemas_1.RelayPodSessionValidationSchema,
+            404: error_schemas_1.ErrorResponseSchema,
+        },
+        summary: 'Validate and refresh a Relay pod session',
+        metadata: { tags: ['Relay Pod Sessions'] },
+    },
+    revoke: {
+        method: 'POST',
+        path: '/relay-pod-sessions/:id/revoke',
+        pathParams: sessionPathParams,
+        body: zod_1.z.object({}).strict(),
+        responses: {
+            200: exports.RevokeRelayPodSessionResponseSchema,
+            404: error_schemas_1.ErrorResponseSchema,
+        },
+        summary: 'Revoke a Relay pod session',
+        metadata: { tags: ['Relay Pod Sessions'] },
+    },
+}, {
+    pathPrefix: '/v2',
+    commonResponses: {
+        400: error_schemas_1.ErrorResponseSchema,
+        401: error_schemas_1.ErrorResponseSchema,
+        403: error_schemas_1.ErrorResponseSchema,
+        500: error_schemas_1.ErrorResponseSchema,
+    },
+});

package/dist/relay-pods/relay-pod-sessions.contract.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=relay-pod-sessions.contract.spec.d.ts.map

package/dist/relay-pods/relay-pod-sessions.contract.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-pod-sessions.contract.spec.d.ts","sourceRoot":"","sources":["../../contracts/relay-pods/relay-pod-sessions.contract.spec.ts"],"names":[],"mappings":""}

package/dist/relay-pods/relay-pod-sessions.contract.spec.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const bun_test_1 = require("bun:test");
+const index_1 = require("../index");
+const relay_pod_sessions_contract_1 = require("./relay-pod-sessions.contract");
+const exchange = {
+    sessionId: '11111111-1111-4111-8111-111111111111',
+    expiresAt: '2026-08-01T17:00:00.000Z',
+    accessType: 'OWNER',
+    user: {
+        id: '22222222-2222-4222-8222-222222222222',
+        email: 'owner@example.com',
+        displayName: 'Relay Owner',
+        impersonatedBy: null,
+    },
+    pod: {
+        id: '33333333-3333-4333-8333-333333333333',
+        slug: 'pod-01',
+        displayName: 'Pod 01',
+        ownerUserId: '22222222-2222-4222-8222-222222222222',
+        ownerName: 'Relay Owner',
+        publicBaseUrl: 'https://pod.test',
+        status: 'ACTIVE',
+    },
+    rules: [
+        {
+            action: 'manage',
+            subject: 'RelayPod',
+            conditions: { id: '33333333-3333-4333-8333-333333333333' },
+        },
+    ],
+};
+(0, bun_test_1.describe)('relay pod session schemas', () => {
+    (0, bun_test_1.it)('accepts a non-empty opaque login code', () => {
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.ExchangeRelayPodSessionBodySchema.parse({ code: 'opaque.login-code' })
+            .code).toBe('opaque.login-code');
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.ExchangeRelayPodSessionBodySchema.safeParse({ code: '' }).success).toBe(false);
+    });
+    (0, bun_test_1.it)('returns resolved ability rules without central role data or code hashes', () => {
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.RelayPodSessionExchangeSchema.parse(exchange).rules).toEqual(exchange.rules);
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.RelayPodSessionExchangeSchema.safeParse({
+            ...exchange,
+            roles: ['OUTREACH'],
+            codeHash: 'must-not-leak',
+        }).success).toBe(false);
+    });
+    (0, bun_test_1.it)('validates to the same replacement resolved-rule snapshot', () => {
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.RelayPodSessionValidationSchema.parse(exchange).rules).toEqual(exchange.rules);
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.RelayPodSessionValidationSchema.safeParse({
+            ...exchange,
+            secretHash: 'must-not-leak',
+            token: 'must-not-leak',
+        }).success).toBe(false);
+    });
+    bun_test_1.it.each([
+        ['exchange', 'secretHash', relay_pod_sessions_contract_1.RelayPodSessionExchangeSchema],
+        ['exchange', 'codeHash', relay_pod_sessions_contract_1.RelayPodSessionExchangeSchema],
+        ['exchange', 'token', relay_pod_sessions_contract_1.RelayPodSessionExchangeSchema],
+        ['validation', 'secretHash', relay_pod_sessions_contract_1.RelayPodSessionValidationSchema],
+        ['validation', 'codeHash', relay_pod_sessions_contract_1.RelayPodSessionValidationSchema],
+        ['validation', 'token', relay_pod_sessions_contract_1.RelayPodSessionValidationSchema],
+    ])('%s rejects nested %s keys in resolved rule conditions', (_response, forbiddenKey, schema) => {
+        (0, bun_test_1.expect)(schema.safeParse({
+            ...exchange,
+            rules: [
+                {
+                    action: 'manage',
+                    subject: 'RelayPod',
+                    conditions: {
+                        anyOf: [{ nested: { [forbiddenKey]: 'must-not-leak' } }],
+                    },
+                },
+            ],
+        }).success).toBe(false);
+    });
+    (0, bun_test_1.it)('retains generic nested CASL conditions without overmatching key names', () => {
+        const parsed = relay_pod_sessions_contract_1.RelayPodSessionExchangeSchema.parse({
+            ...exchange,
+            rules: [
+                {
+                    action: 'manage',
+                    subject: 'RelayPod',
+                    conditions: {
+                        anyOf: [
+                            {
+                                tokenIdentifier: 'pod_01',
+                                secretHashAlgorithm: 'sha256',
+                            },
+                        ],
+                    },
+                },
+            ],
+        });
+        (0, bun_test_1.expect)(parsed.rules[0].conditions).toEqual({
+            anyOf: [
+                {
+                    tokenIdentifier: 'pod_01',
+                    secretHashAlgorithm: 'sha256',
+                },
+            ],
+        });
+    });
+    (0, bun_test_1.it)('acknowledges idempotent revocation without returning session data', () => {
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.RevokeRelayPodSessionResponseSchema.parse({ revoked: true })).toEqual({
+            revoked: true,
+        });
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.RevokeRelayPodSessionResponseSchema.safeParse({
+            revoked: true,
+            sessionId: exchange.sessionId,
+        }).success).toBe(false);
+    });
+});
+(0, bun_test_1.describe)('relayPodSessionsContract routes', () => {
+    (0, bun_test_1.it)('publishes exchange, validate, and revoke under /v2', () => {
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.relayPodSessionsContract.exchange).toMatchObject({
+            method: 'POST',
+            path: '/v2/relay-pod-sessions/exchange',
+        });
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.relayPodSessionsContract.validate).toMatchObject({
+            method: 'POST',
+            path: '/v2/relay-pod-sessions/:id/validate',
+        });
+        (0, bun_test_1.expect)(relay_pod_sessions_contract_1.relayPodSessionsContract.revoke).toMatchObject({
+            method: 'POST',
+            path: '/v2/relay-pod-sessions/:id/revoke',
+        });
+        (0, bun_test_1.expect)(index_1.apiContractRouter.RelayPodSessions.exchange.path).toBe('/v2/relay-pod-sessions/exchange');
+    });
+});