@de./sdk 2.2.1 → 2.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +25 -10
- package/dist/allend/Workspace/index.d.ts +21 -2
- package/dist/allend/Workspace/index.js +18 -2
- package/dist/allend/Workspace/index.js.map +1 -1
- package/dist/backend/Auth.d.ts +28 -14
- package/dist/backend/Auth.js +53 -6
- package/dist/backend/Auth.js.map +1 -1
- package/dist/core.d.ts +1 -1
- package/dist/core.js +1 -1
- package/dist/core.js.map +1 -1
- package/dist/types/index.d.ts +5 -3
- package/package.json +2 -2
- package/src/allend/Workspace/index.ts +22 -4
- package/src/backend/Auth.ts +92 -21
- package/src/core.ts +2 -2
- package/src/types/index.d.ts +5 -3
package/README.md
CHANGED
|
@@ -4300,20 +4300,35 @@ interface Peer {
|
|
|
4300
4300
|
|
|
4301
4301
|
### Authentication Types
|
|
4302
4302
|
|
|
4303
|
+
A connector answers to two credentials. The **secret** (`de_sk_…`) stays on
|
|
4304
|
+
your server. The **publishable key** (`de_pk_…`) is made to ship inside an app:
|
|
4305
|
+
its token acts for nobody and reaches only what a map needs. `Auth` refuses a
|
|
4306
|
+
secret when it finds itself running in a browser or React Native.
|
|
4307
|
+
|
|
4308
|
+
Both are shown once — in the reply that created or rotated them — because
|
|
4309
|
+
De. keeps only their hashes.
|
|
4310
|
+
|
|
4303
4311
|
```typescript
|
|
4304
|
-
|
|
4305
|
-
|
|
4312
|
+
type AuthConfig = {
|
|
4313
|
+
context: string;
|
|
4314
|
+
env?: 'dev' | 'staging' | 'prod';
|
|
4306
4315
|
version?: number;
|
|
4307
|
-
autorefresh?: boolean;
|
|
4316
|
+
autorefresh?: boolean; // renew ahead of expiry
|
|
4317
|
+
rotateAfterMins?: number;
|
|
4308
4318
|
onNewToken?: (token: string) => void;
|
|
4309
|
-
}
|
|
4319
|
+
} & (
|
|
4320
|
+
| { cid: string; secret: string; uid?: string } // server
|
|
4321
|
+
| { publicKey: string } // app
|
|
4322
|
+
);
|
|
4310
4323
|
|
|
4311
|
-
|
|
4312
|
-
|
|
4313
|
-
|
|
4314
|
-
|
|
4315
|
-
|
|
4316
|
-
|
|
4324
|
+
// Server
|
|
4325
|
+
const auth = new Auth({ context, cid, secret: process.env.DE_SECRET });
|
|
4326
|
+
|
|
4327
|
+
// App — MSI connectors only
|
|
4328
|
+
const auth = new Auth({ context, publicKey: 'de_pk_…', autorefresh: true });
|
|
4329
|
+
```
|
|
4330
|
+
|
|
4331
|
+
```typescript
|
|
4317
4332
|
|
|
4318
4333
|
interface SocketAuthCredentials {
|
|
4319
4334
|
utype: string;
|
|
@@ -84,8 +84,9 @@ export default class Workspace extends AccessManager {
|
|
|
84
84
|
intent?: string;
|
|
85
85
|
}): Promise<Res<void>>;
|
|
86
86
|
/**
|
|
87
|
-
* Created disabled
|
|
88
|
-
*
|
|
87
|
+
* Created disabled. The reply carries the secret, and it is the only one
|
|
88
|
+
* that ever will: the connector stores its hash, so `getConnector` has
|
|
89
|
+
* nothing to show. Keep it, or rotate.
|
|
89
90
|
*/
|
|
90
91
|
createConnector(wid: string, ctype: ContextType, xcode: string, body: {
|
|
91
92
|
name: string;
|
|
@@ -94,6 +95,7 @@ export default class Workspace extends AccessManager {
|
|
|
94
95
|
config?: Record<string, any>;
|
|
95
96
|
}): Promise<Res<{
|
|
96
97
|
connectorId: string;
|
|
98
|
+
secret: string;
|
|
97
99
|
}>>;
|
|
98
100
|
listConnectors(wid: string, ctype: ContextType, xcode: string, querystring?: Record<string, any>): Promise<Res<{
|
|
99
101
|
connectors?: Connector[];
|
|
@@ -121,8 +123,25 @@ export default class Workspace extends AccessManager {
|
|
|
121
123
|
origins?: string[];
|
|
122
124
|
maintainers?: string[];
|
|
123
125
|
}): Promise<Res<void>>;
|
|
126
|
+
/** The new secret is in this reply and nowhere else, ever. The old one stops at once. */
|
|
124
127
|
rotateConnectorSecret(wid: string, ctype: ContextType, xcode: string, id: string): Promise<Res<{
|
|
125
128
|
secret: string;
|
|
129
|
+
connector: Connector;
|
|
130
|
+
}>>;
|
|
131
|
+
/**
|
|
132
|
+
* Issue — or replace — the publishable key an app ships with instead of
|
|
133
|
+
* the secret. MSI connectors only. Like the secret, it is shown once.
|
|
134
|
+
*
|
|
135
|
+
* Replacing retires the old key immediately, so every released app build
|
|
136
|
+
* carrying it stops working: do it when a key is being abused.
|
|
137
|
+
*/
|
|
138
|
+
rotateConnectorPublicKey(wid: string, ctype: ContextType, xcode: string, id: string): Promise<Res<{
|
|
139
|
+
publicKey: string;
|
|
140
|
+
connector: Connector;
|
|
141
|
+
}>>;
|
|
142
|
+
/** Withdraw the publishable key; the connector answers to its secret only. */
|
|
143
|
+
revokeConnectorPublicKey(wid: string, ctype: ContextType, xcode: string, id: string): Promise<Res<{
|
|
144
|
+
connector: Connector;
|
|
126
145
|
}>>;
|
|
127
146
|
requestConnectorDeletion(wid: string, ctype: ContextType, xcode: string, id: string): Promise<Res<{
|
|
128
147
|
intent: string;
|
|
@@ -96,8 +96,9 @@ class Workspace extends Access_1.default {
|
|
|
96
96
|
}
|
|
97
97
|
// ── Connectors ────────────────────────────────────────────────────────────
|
|
98
98
|
/**
|
|
99
|
-
* Created disabled
|
|
100
|
-
*
|
|
99
|
+
* Created disabled. The reply carries the secret, and it is the only one
|
|
100
|
+
* that ever will: the connector stores its hash, so `getConnector` has
|
|
101
|
+
* nothing to show. Keep it, or rotate.
|
|
101
102
|
*/
|
|
102
103
|
async createConnector(wid, ctype, xcode, body) {
|
|
103
104
|
return this.call('POST', `/${wid}/${ctype}/${xcode}/connectors`, body);
|
|
@@ -135,9 +136,24 @@ class Workspace extends Access_1.default {
|
|
|
135
136
|
async setConnectorAccess(wid, ctype, xcode, id, body) {
|
|
136
137
|
return this.call('PATCH', `/${wid}/${ctype}/${xcode}/connectors/${id}/access`, body);
|
|
137
138
|
}
|
|
139
|
+
/** The new secret is in this reply and nowhere else, ever. The old one stops at once. */
|
|
138
140
|
async rotateConnectorSecret(wid, ctype, xcode, id) {
|
|
139
141
|
return this.call('PATCH', `/${wid}/${ctype}/${xcode}/connectors/${id}/secret/rotate`);
|
|
140
142
|
}
|
|
143
|
+
/**
|
|
144
|
+
* Issue — or replace — the publishable key an app ships with instead of
|
|
145
|
+
* the secret. MSI connectors only. Like the secret, it is shown once.
|
|
146
|
+
*
|
|
147
|
+
* Replacing retires the old key immediately, so every released app build
|
|
148
|
+
* carrying it stops working: do it when a key is being abused.
|
|
149
|
+
*/
|
|
150
|
+
async rotateConnectorPublicKey(wid, ctype, xcode, id) {
|
|
151
|
+
return this.call('PATCH', `/${wid}/${ctype}/${xcode}/connectors/${id}/publickey/rotate`);
|
|
152
|
+
}
|
|
153
|
+
/** Withdraw the publishable key; the connector answers to its secret only. */
|
|
154
|
+
async revokeConnectorPublicKey(wid, ctype, xcode, id) {
|
|
155
|
+
return this.call('DELETE', `/${wid}/${ctype}/${xcode}/connectors/${id}/publickey`);
|
|
156
|
+
}
|
|
141
157
|
async requestConnectorDeletion(wid, ctype, xcode, id) {
|
|
142
158
|
return this.call('POST', `/${wid}/${ctype}/${xcode}/connectors/${id}/deletion/intent`, {});
|
|
143
159
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/allend/Workspace/index.ts"],"names":[],"mappings":";;;;;AAIA,uDAAqC;AACrC,uCAA0C;AA8B1C,gFAAgF;AAChF,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,EAAE;AACF,6DAA6D;AAC7D,EAAE;AACF,gFAAgF;AAEhF,MAAqB,SAAU,SAAQ,gBAAa;IACnD,YAAa,MAAuB;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAO,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QACtG,IAAI,CAAC,MAAM,CAAC,WAAW;YAAG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAErG,MAAM,MAAM,GAAkB;YAC7B,OAAO,EAAO,MAAM,CAAC,OAAO;YAC5B,WAAW,EAAG,MAAM,CAAC,WAAW;YAChC,GAAG,EAAW,MAAM,CAAC,GAAG,IAAS,KAAK;YACtC,QAAQ,EAAM,MAAM,CAAC,QAAQ,IAAI,OAAO;YACxC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,OAAO,EAAO,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAO,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAO,MAAM,CAAC,OAAO;SAC5B,CAAA;QACD,KAAK,CAAE,MAAM,EAAE,KAAK,CAAE,CAAA;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,IAAI,CAAK,MAAmD,EAAE,GAAW,EAAE,IAAU;QAC5F,OAAO,IAAI,CAAC,OAAO,CAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAE,OAA0C,EAAE;QACzD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,CAAE,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAE,GAAW;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAE,GAAW,EAAE,IAAgD;QAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,EAAE,EAAE,IAAI,CAAE,CAAA;IACtD,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,eAAe,CAAE,GAAW;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CAAE,GAAW,EAAE,WAAiC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,GAAG,GAAG,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,cAAc,CAAE,GAAW,EAAE,IAAkB,EAAE,IAAyB;QAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,IAAI,QAAQ,EAAE,IAAI,CAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,aAAa,CAAE,GAAW,EAAE,IAAkB;QACnD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,IAAI,GAAG,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa;QACrE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,cAAc,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa,EAAE,IAAyB;QAC9F,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,IAAI,CAAE,CAAA;IAC7D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,UAAU,CAAC,CAAA;IAC5D,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa;QAC5E,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,kBAAkB,EAAE,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,KAAK,CAAC,cAAc,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa,EAAE,WAAiC;QACtG,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,6EAA6E;IAE7E
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/allend/Workspace/index.ts"],"names":[],"mappings":";;;;;AAIA,uDAAqC;AACrC,uCAA0C;AA8B1C,gFAAgF;AAChF,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,EAAE;AACF,6DAA6D;AAC7D,EAAE;AACF,gFAAgF;AAEhF,MAAqB,SAAU,SAAQ,gBAAa;IACnD,YAAa,MAAuB;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAO,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QACtG,IAAI,CAAC,MAAM,CAAC,WAAW;YAAG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAErG,MAAM,MAAM,GAAkB;YAC7B,OAAO,EAAO,MAAM,CAAC,OAAO;YAC5B,WAAW,EAAG,MAAM,CAAC,WAAW;YAChC,GAAG,EAAW,MAAM,CAAC,GAAG,IAAS,KAAK;YACtC,QAAQ,EAAM,MAAM,CAAC,QAAQ,IAAI,OAAO;YACxC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,OAAO,EAAO,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAO,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAO,MAAM,CAAC,OAAO;SAC5B,CAAA;QACD,KAAK,CAAE,MAAM,EAAE,KAAK,CAAE,CAAA;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,IAAI,CAAK,MAAmD,EAAE,GAAW,EAAE,IAAU;QAC5F,OAAO,IAAI,CAAC,OAAO,CAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAE,OAA0C,EAAE;QACzD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,CAAE,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAE,GAAW;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAE,GAAW,EAAE,IAAgD;QAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,EAAE,EAAE,IAAI,CAAE,CAAA;IACtD,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,eAAe,CAAE,GAAW;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CAAE,GAAW,EAAE,WAAiC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,GAAG,GAAG,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,cAAc,CAAE,GAAW,EAAE,IAAkB,EAAE,IAAyB;QAC/E,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,IAAI,QAAQ,EAAE,IAAI,CAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,aAAa,CAAE,GAAW,EAAE,IAAkB;QACnD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,IAAI,GAAG,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa;QACrE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,cAAc,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa,EAAE,IAAyB;QAC9F,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,IAAI,CAAE,CAAA;IAC7D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,UAAU,CAAC,CAAA;IAC5D,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa;QAC5E,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,kBAAkB,EAAE,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,KAAK,CAAC,cAAc,CAAE,GAAW,EAAE,IAAkB,EAAE,KAAa,EAAE,WAAiC;QACtG,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,6EAA6E;IAE7E;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACpB,GAAW,EAAE,KAAkB,EAAE,KAAa,EAC9C,IAA+F;QAE/F,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,aAAa,EAAE,IAAI,CAAE,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,cAAc,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,WAAiC;QACtG,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,cAAc,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IACpF,CAAC;IAED,KAAK,CAAC,YAAY,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU;QAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,KAAK,CAAC,eAAe,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU,EAAE,IAAyB;QAC3G,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,EAAE,EAAE,IAAI,CAAE,CAAA;IAC/E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU,EAAE,OAAgB;QACtG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IAC1G,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,kBAAkB,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU,EAAE,MAA2B;QAChH,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,SAAS,EAAE,MAAM,CAAE,CAAA;IACtF,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU,EAAE,MAA2B;QAClH,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,SAAS,EAAE,MAAM,CAAE,CAAA;IACxF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU,EAAE,IAAoD;QACzI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,SAAS,EAAE,IAAI,CAAE,CAAA;IACtF,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,qBAAqB,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU;QACtF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,gBAAgB,CAAC,CAAA;IACtF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,wBAAwB,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU;QACzF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,mBAAmB,CAAC,CAAA;IACzF,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,wBAAwB,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU;QACzF,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,YAAY,CAAC,CAAA;IACnF,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU;QACzF,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,KAAK,CAAC,eAAe,CAAE,GAAW,EAAE,KAAkB,EAAE,KAAa,EAAE,EAAU,EAAE,WAAiC;QACnH,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,eAAe,EAAE,GAAG,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,UAAU,CAAE,GAAW,EAAE,WAAiC;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,UAAU,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAE,GAAW,EAAE,EAAU;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,WAAW,EAAE,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAE,GAAW,EAAE,EAAU,EAAE,IAAiB;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,WAAW,EAAE,EAAE,EAAE,IAAI,CAAE,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,WAAW,CAAE,GAAW,EAAE,EAAU;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,WAAW,EAAE,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,UAAU,CAAE,GAAW,EAAE,WAAiC;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,YAAY,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,eAAe,CAAE,GAAW,EAAE,WAAiC;QACpE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,kBAAkB,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAE,GAAW,EAAE,WAAiC;QAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,0BAA0B,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,KAAK,CAAC,8BAA8B,CAAE,GAAW,EAAE,EAAU;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,2BAA2B,EAAE,cAAc,EAAE,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,KAAK,CAAC,YAAY,CAAE,GAAW,EAAE,WAAiC;QACjE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,qBAAqB,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAE,GAAW,EAAE,WAAiC;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,uBAAuB,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAE,GAAW,EAAE,GAAW;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,wBAAwB,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAE,GAAW,EAAE,GAAW,EAAE,WAAiC;QAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,wBAAwB,GAAG,WAAW,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAE,GAAW,EAAE,GAAW,EAAE,IAAyB;QAClF,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,wBAAwB,GAAG,WAAW,EAAE,IAAI,CAAE,CAAA;IAC/E,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAE,GAAW,EAAE,GAAW,EAAE,IAAyB;QAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,wBAAwB,GAAG,cAAc,EAAE,IAAI,CAAE,CAAA;IAClF,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,SAAS,CAAE,GAAW,EAAE,WAAiC;QAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,SAAS,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,KAAK,CAAC,OAAO,CAAE,GAAW,EAAE,GAAW;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,UAAU,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,UAAU,CAAE,GAAW,EAAE,GAAW;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,UAAU,GAAG,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,UAAU,CAAE,GAAW;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,UAAU,CAAC,CAAA;IAC3C,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,eAAe,CAAE,GAAW,EAAE,WAAiC;QACpE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,iBAAiB,IAAA,UAAE,EAAE,WAAW,CAAE,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,MAAM,CAAE,GAAW,EAAE,EAAU,EAAE,IAAyB;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,eAAe,EAAE,EAAE,EAAE,IAAI,CAAE,CAAA;IAC5D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAE,GAAW,EAAE,IAAyB;QAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,aAAa,EAAE,IAAI,CAAE,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAE,GAAW,EAAE,IAAuB;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,oBAAoB,EAAE,IAAI,CAAE,CAAA;IAC7D,CAAC;CACD;AA9QD,4BA8QC"}
|
package/dist/backend/Auth.d.ts
CHANGED
|
@@ -1,19 +1,8 @@
|
|
|
1
|
-
|
|
1
|
+
type AuthCommonConfig = {
|
|
2
2
|
context: string;
|
|
3
|
-
cid: string;
|
|
4
|
-
secret: string;
|
|
5
3
|
remoteOrigin?: string;
|
|
6
4
|
env?: 'dev' | 'staging' | 'prod';
|
|
7
5
|
version?: number;
|
|
8
|
-
/**
|
|
9
|
-
* Operator uid to embed in the minted token's scope.
|
|
10
|
-
*
|
|
11
|
-
* Routes behind `isAllowed` look the caller up in the `operators`
|
|
12
|
-
* collection by uid, so a token minted without one is rejected with
|
|
13
|
-
* "Require <uid> generated accessToken" no matter how valid the connector
|
|
14
|
-
* credentials are. Omit it for pure machine-to-machine access.
|
|
15
|
-
*/
|
|
16
|
-
uid?: string;
|
|
17
6
|
/**
|
|
18
7
|
* Rotate the token ahead of expiry.
|
|
19
8
|
*
|
|
@@ -32,11 +21,35 @@ export type AuthConfig = {
|
|
|
32
21
|
/** Host to substitute for `localhost` in `dev` (Eg. a native emulator) */
|
|
33
22
|
devHostname?: string;
|
|
34
23
|
};
|
|
24
|
+
export type SecretAuthConfig = AuthCommonConfig & {
|
|
25
|
+
cid: string;
|
|
26
|
+
/** `de_sk_…` — or `vs_…`, issued before the prefixes, which still works */
|
|
27
|
+
secret: string;
|
|
28
|
+
/**
|
|
29
|
+
* Operator uid to embed in the minted token's scope.
|
|
30
|
+
*
|
|
31
|
+
* Routes behind `isAllowed` look the caller up in the `operators`
|
|
32
|
+
* collection by uid, so a token minted without one is rejected with
|
|
33
|
+
* "Require <uid> generated accessToken" no matter how valid the connector
|
|
34
|
+
* credentials are. Omit it for pure machine-to-machine access.
|
|
35
|
+
*/
|
|
36
|
+
uid?: string;
|
|
37
|
+
publicKey?: never;
|
|
38
|
+
};
|
|
39
|
+
export type PublicAuthConfig = AuthCommonConfig & {
|
|
40
|
+
/** `de_pk_…` — names its own connector, so there is no `cid` to send */
|
|
41
|
+
publicKey: string;
|
|
42
|
+
cid?: never;
|
|
43
|
+
secret?: never;
|
|
44
|
+
uid?: never;
|
|
45
|
+
};
|
|
46
|
+
export type AuthConfig = SecretAuthConfig | PublicAuthConfig;
|
|
35
47
|
export default class Auth {
|
|
36
48
|
private version;
|
|
37
49
|
private env;
|
|
38
|
-
private cid
|
|
39
|
-
private secret
|
|
50
|
+
private cid?;
|
|
51
|
+
private secret?;
|
|
52
|
+
private publicKey?;
|
|
40
53
|
private context;
|
|
41
54
|
private uid?;
|
|
42
55
|
private remoteOrigin?;
|
|
@@ -74,3 +87,4 @@ export default class Auth {
|
|
|
74
87
|
*/
|
|
75
88
|
destroy(): void;
|
|
76
89
|
}
|
|
90
|
+
export {};
|
package/dist/backend/Auth.js
CHANGED
|
@@ -13,6 +13,17 @@ const baseUrl_1 = require("../baseUrl");
|
|
|
13
13
|
* answered 401 with nothing to say why.
|
|
14
14
|
*/
|
|
15
15
|
const ACCESS_TOKEN_EXPIRY = 3.75;
|
|
16
|
+
/**
|
|
17
|
+
* Whether this code is running inside an app rather than on a server.
|
|
18
|
+
*
|
|
19
|
+
* A browser has a `document`; React Native says so on `navigator.product`.
|
|
20
|
+
* Node, Bun, Deno and edge runtimes have neither.
|
|
21
|
+
*/
|
|
22
|
+
const inAppBundle = () => {
|
|
23
|
+
var _a;
|
|
24
|
+
return typeof globalThis.document !== 'undefined'
|
|
25
|
+
|| ((_a = globalThis.navigator) === null || _a === void 0 ? void 0 : _a.product) === 'ReactNative';
|
|
26
|
+
};
|
|
16
27
|
class Auth {
|
|
17
28
|
constructor(config) {
|
|
18
29
|
this.isRotating = false;
|
|
@@ -20,14 +31,28 @@ class Auth {
|
|
|
20
31
|
throw new Error('Undefined config. Check https://doc.dedot.io/sdk/auth');
|
|
21
32
|
if (!config.context)
|
|
22
33
|
throw new Error('Undefined context. Check https://doc.dedot.io/sdk/auth');
|
|
23
|
-
if (
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
34
|
+
if (config.publicKey) {
|
|
35
|
+
if (config.cid || config.secret)
|
|
36
|
+
throw new Error('Pass either <publicKey>, or <cid> and <secret> — not both. Check https://doc.dedot.io/sdk/auth');
|
|
37
|
+
}
|
|
38
|
+
else {
|
|
39
|
+
if (!config.cid)
|
|
40
|
+
throw new Error('Undefined cid. Check https://doc.dedot.io/sdk/auth');
|
|
41
|
+
if (!config.secret)
|
|
42
|
+
throw new Error('Undefined secret. Check https://doc.dedot.io/sdk/auth');
|
|
43
|
+
/**
|
|
44
|
+
* A secret inside an app is a secret everyone who downloads the app
|
|
45
|
+
* has. Refused here rather than documented, because the app that does
|
|
46
|
+
* it works perfectly — nothing would ever say so.
|
|
47
|
+
*/
|
|
48
|
+
if (inAppBundle())
|
|
49
|
+
throw new Error('A connector secret cannot be used inside an app. Use a publishable key (`publicKey`), or have your server mint the token. Check https://doc.dedot.io/sdk/auth');
|
|
50
|
+
}
|
|
27
51
|
this.context = config.context;
|
|
28
52
|
this.uid = config.uid;
|
|
29
53
|
this.cid = config.cid;
|
|
30
54
|
this.secret = config.secret;
|
|
55
|
+
this.publicKey = config.publicKey;
|
|
31
56
|
this.remoteOrigin = config.remoteOrigin;
|
|
32
57
|
this.env = config.env || 'dev';
|
|
33
58
|
this.version = config.version || 1;
|
|
@@ -54,7 +79,12 @@ class Auth {
|
|
|
54
79
|
options.body = JSON.stringify(options.body);
|
|
55
80
|
}
|
|
56
81
|
options = { ...rawOptions, ...options };
|
|
57
|
-
|
|
82
|
+
/**
|
|
83
|
+
* Method and URL only. This logged the whole request, and the body of
|
|
84
|
+
* every one of these is a credential — the secret, or a bearer token —
|
|
85
|
+
* printed into whatever collects a dev server's output.
|
|
86
|
+
*/
|
|
87
|
+
this.debug('Auth request', options.method, `${this.baseURL}/v${this.version}/${url.replace(/^\//, '')}`);
|
|
58
88
|
const response = await fetch(`${this.baseURL}/v${this.version}/${url.replace(/^\//, '')}`, options);
|
|
59
89
|
return await response.json();
|
|
60
90
|
}
|
|
@@ -86,7 +116,9 @@ class Auth {
|
|
|
86
116
|
const options = {
|
|
87
117
|
url: '/access/token',
|
|
88
118
|
method: 'POST',
|
|
89
|
-
body:
|
|
119
|
+
body: this.publicKey
|
|
120
|
+
? { context: this.context, publicKey: this.publicKey }
|
|
121
|
+
: { context: this.context, cid: this.cid, secret: this.secret, remoteOrigin: this.remoteOrigin, ...(this.uid ? { uid: this.uid } : {}) }
|
|
90
122
|
}, { error, message, data } = await this.request(options);
|
|
91
123
|
if (error)
|
|
92
124
|
throw new Error(message);
|
|
@@ -102,6 +134,21 @@ class Auth {
|
|
|
102
134
|
}
|
|
103
135
|
if (!this.accessToken)
|
|
104
136
|
throw new Error('No access token found');
|
|
137
|
+
/**
|
|
138
|
+
* Rotation proves possession of the secret, which an app does not have.
|
|
139
|
+
* A publishable key renews by minting afresh — same result, one call.
|
|
140
|
+
*/
|
|
141
|
+
if (this.publicKey) {
|
|
142
|
+
const token = await this.getToken();
|
|
143
|
+
if (typeof this.onNewToken === 'function')
|
|
144
|
+
try {
|
|
145
|
+
this.onNewToken(token);
|
|
146
|
+
}
|
|
147
|
+
catch (callbackError) {
|
|
148
|
+
this.error('[Auth] Error in onNewToken callback:', callbackError);
|
|
149
|
+
}
|
|
150
|
+
return token;
|
|
151
|
+
}
|
|
105
152
|
this.isRotating = true;
|
|
106
153
|
try {
|
|
107
154
|
const options = {
|
package/dist/backend/Auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Auth.js","sourceRoot":"","sources":["../../src/backend/Auth.ts"],"names":[],"mappings":";;AAAA,wCAAoC;AAGpC;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAA;
|
|
1
|
+
{"version":3,"file":"Auth.js","sourceRoot":"","sources":["../../src/backend/Auth.ts"],"names":[],"mappings":";;AAAA,wCAAoC;AAGpC;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAoEhC;;;;;GAKG;AACH,MAAM,WAAW,GAAG,GAAY,EAAE;;IAChC,OAAA,OAAS,UAAmB,CAAC,QAAQ,KAAK,WAAW;WAClD,CAAA,MAAE,UAAmB,CAAC,SAAS,0CAAE,OAAO,MAAK,aAAa,CAAA;CAAA,CAAA;AAU/D,MAAqB,IAAI;IAiBvB,YAAa,MAAkB;QAHvB,eAAU,GAAY,KAAK,CAAA;QAIjC,IAAI,CAAC,MAAM;YAAW,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC9F,IAAI,CAAC,MAAM,CAAC,OAAO;YAAG,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAE/F,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM;gBAC7B,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAA;QACrH,CAAC;aACI,CAAC;YACJ,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAO,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;YAC3F,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAI,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;YAE9F;;;;eAIG;YACH,IAAI,WAAW,EAAE;gBACf,MAAM,IAAI,KAAK,CAAC,+JAA+J,CAAC,CAAA;QACpL,CAAC;QAED,IAAI,CAAC,OAAO,GAAQ,MAAM,CAAC,OAAO,CAAA;QAClC,IAAI,CAAC,GAAG,GAAY,MAAM,CAAC,GAAG,CAAA;QAC9B,IAAI,CAAC,GAAG,GAAY,MAAM,CAAC,GAAG,CAAA;QAC9B,IAAI,CAAC,MAAM,GAAS,MAAM,CAAC,MAAM,CAAA;QACjC,IAAI,CAAC,SAAS,GAAM,MAAM,CAAC,SAAS,CAAA;QACpC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAA;QACvC,IAAI,CAAC,GAAG,GAAY,MAAM,CAAC,GAAG,IAAI,KAAK,CAAA;QACvC,IAAI,CAAC,OAAO,GAAQ,MAAM,CAAC,OAAO,IAAI,CAAC,CAAA;QACvC,IAAI,CAAC,OAAO,GAAQ,IAAA,iBAAO,EAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAE,CAAA;QACjE,IAAI,CAAC,WAAW,GAAI,MAAM,CAAC,WAAW,IAAI,KAAK,CAAA;QAC/C,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,GAAG,CAAC;YACjD,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,mBAAmB,CAAA;QAC/C,IAAI,CAAC,UAAU,GAAK,MAAM,CAAC,UAAU,CAAA;IACvC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,EAAE,GAAG,EAAE,GAAG,OAAO,EAAsB;QAC9D,MAAM,UAAU,GAAQ;YACtB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI,CAAC,YAAY;gBAC3B,eAAe,EAAE,aAAa,IAAI,CAAC,OAAO,IAAI;aAC/C;SACF,CAAA;QAED,IAAI,IAAI,CAAC,WAAW;YAClB,UAAU,CAAC,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,WAAW,EAAE,CAAA;QAEjE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;YACvD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAClC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAE,OAAO,CAAC,IAAI,CAAE,CAAA;QACjD,CAAC;QAED,OAAO,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,EAAE,CAAA;QAEvC;;;;WAIG;QACH,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QACxG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,CAAE,CAAA;QAEpG,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAO,CAAA;IACnC,CAAC;IAEO,KAAK,CAAE,GAAG,IAAW;QAC3B,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAE,CAAA;IACzD,CAAC;IACO,KAAK,CAAE,GAAG,IAAW;QAC3B,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAE,CAAA;IACnC,CAAC;IAED;;OAEG;IACK,gBAAgB;QACtB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAG,OAAM;QAE9B,IAAI,CAAC,aAAa,EAAE,CAAA;QACpB,IAAI,CAAC,YAAY,GAAG,UAAU,CAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,IAAI,CAAE,CAAA;IAC9F,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,YAAY;YAAG,OAAM;QAE/B,YAAY,CAAE,IAAI,CAAC,YAAY,CAAE,CAAA;QACjC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAA;IAC/B,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MACA,OAAO,GAAuB;YAC5B,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS;gBACZ,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;gBACtD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAE,EAAE;SACnJ,EACD,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgB,OAAO,CAAE,CAAA;QACtE,IAAI,KAAK;YAAG,MAAM,IAAI,KAAK,CAAE,OAAO,CAAE,CAAA;QAEtC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAA;QAC7B,IAAI,CAAC,gBAAgB,EAAE,CAAA,CAAC,wBAAwB;QAEhD,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,uCAAuC;QACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;YAC1D,OAAO,IAAI,CAAC,WAAY,CAAA;QAC1B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW;YACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAE1C;;;WAGG;QACH,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;YAEnC,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,UAAU;gBACvC,IAAI,CAAC;oBAAC,IAAI,CAAC,UAAU,CAAE,KAAK,CAAE,CAAA;gBAAC,CAAC;gBAChC,OAAO,aAAa,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,sCAAsC,EAAE,aAAa,CAAC,CAAA;gBAAC,CAAC;YAE7F,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QAEtB,IAAI,CAAC;YACH,MACA,OAAO,GAAuB;gBAC5B,GAAG,EAAE,sBAAsB;gBAC3B,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;aAC9B,EACD,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgB,OAAO,CAAE,CAAA;YACtE,IAAI,KAAK;gBAAG,MAAM,IAAI,KAAK,CAAE,OAAO,CAAE,CAAA;YAEtC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAA;YAE7B,2BAA2B;YAC3B,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,UAAU;gBACvC,IAAI,CAAC;oBAAC,IAAI,CAAC,UAAU,CAAE,IAAI,CAAC,KAAK,CAAE,CAAA;gBAAC,CAAC;gBACrC,OAAO,aAAa,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,sCAAsC,EAAE,aAAa,CAAC,CAAA;gBAAC,CAAC;YAE7F,yBAAyB;YACzB,IAAI,CAAC,gBAAgB,EAAE,CAAA;YAEvB,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;YACxC,OAAO,IAAI,CAAC,KAAK,CAAA;QACnB,CAAC;QACD,OAAO,KAAU,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAEzD,IAAI,CAAC;gBACH,kCAAkC;gBAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;gBACtC,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;gBAE9C,2CAA2C;gBAC3C,IAAI,IAAI,CAAC,UAAU;oBACjB,IAAI,CAAC;wBAAC,IAAI,CAAC,UAAU,CAAE,QAAQ,CAAE,CAAA;oBAAC,CAAC;oBACnC,OAAO,aAAa,EAAE,CAAC;wBAAC,IAAI,CAAC,KAAK,CAAC,+BAA+B,EAAE,aAAa,CAAC,CAAA;oBAAC,CAAC;gBAEtF,OAAO,QAAQ,CAAA;YACjB,CAAC;YACD,OAAO,aAAkB,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,oCAAoC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;gBACvE,MAAM,aAAa,CAAA;YACrB,CAAC;QACH,CAAC;gBACO,CAAC;YAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;QAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEnC,IAAI,CAAC,aAAa,EAAE,CAAA;QACpB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAEnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAA;IACzB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACtC,IAAI,CAAC,eAAe,EAAE,CAAA;QAEtB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAA;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;IAC7B,CAAC;CACF;AAxOD,uBAwOC"}
|
package/dist/core.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
export { default as Auth } from './backend/Auth';
|
|
2
|
-
export type { AuthConfig } from './backend/Auth';
|
|
2
|
+
export type { AuthConfig, SecretAuthConfig, PublicAuthConfig } from './backend/Auth';
|
|
3
3
|
export type { RealtimeConnectOptions } from './allend/realtime-socket';
|
|
4
4
|
export type { RealtimeUserType } from './allend/Realtime';
|
|
5
5
|
export { default as OTPAuth } from './allend/OTPAuth';
|
package/dist/core.js
CHANGED
|
@@ -22,7 +22,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
|
22
22
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
23
23
|
exports.core = exports.DClient = exports.Utilities = exports.Queries = exports.Agent = exports.Customer = exports.IoTClient = exports.statusOf = exports.APIError = exports.Utils = exports.Workflows = exports.Realtime = exports.Workspace = exports.IoTBackendRecords = exports.IoTSP = exports.DEV = exports.CSP = exports.LSP = exports.Pipelines = exports.Tracking = exports.OTPAuth = exports.Auth = void 0;
|
|
24
24
|
// ── Named exports (preferred — tree-shakeable) ────────────────────────────────
|
|
25
|
-
//
|
|
25
|
+
// Connector credentials → access token: the secret on a server, the publishable key in an app
|
|
26
26
|
var Auth_1 = require("./backend/Auth");
|
|
27
27
|
Object.defineProperty(exports, "Auth", { enumerable: true, get: function () { return __importDefault(Auth_1).default; } });
|
|
28
28
|
// Client-side OTP auth (de.auth service)
|
package/dist/core.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":";AAAA,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,WAAW;AACX,EAAE;AACF,0BAA0B;AAC1B,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,EAAE;AACF,gFAAgF;;;;;;AAEhF,iFAAiF;AAEjF,
|
|
1
|
+
{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":";AAAA,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,WAAW;AACX,EAAE;AACF,0BAA0B;AAC1B,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,EAAE;AACF,gFAAgF;;;;;;AAEhF,iFAAiF;AAEjF,8FAA8F;AAC9F,uCAAgD;AAAvC,6GAAA,OAAO,OAAQ;AAOxB,yCAAyC;AACzC,4CAAqD;AAA5C,mHAAA,OAAO,OAAW;AAE3B,0CAA0C;AAC1C,8CAAuD;AAA9C,qHAAA,OAAO,OAAY;AAG5B,gDAAyD;AAAhD,uHAAA,OAAO,OAAa;AAG7B,oCAA6C;AAApC,2GAAA,OAAO,OAAO;AAGvB,oCAA6C;AAApC,2GAAA,OAAO,OAAO;AAGvB,oCAA6C;AAApC,2GAAA,OAAO,OAAO;AAGvB,qEAAqE;AACrE,wCAA+E;AAAtE,+GAAA,OAAO,OAAS;AAAE,0GAAA,OAAO,OAAqB;AAGvD,gDAAyD;AAAhD,uHAAA,OAAO,OAAa;AAG7B,4CAA4C;AAC5C,8CAAuD;AAA9C,qHAAA,OAAO,OAAY;AAE5B,sBAAsB;AACtB,gDAAyD;AAAhD,uHAAA,OAAO,OAAa;AAG7B,YAAY;AACZ,iCAA0C;AAAjC,+GAAA,OAAO,OAAS;AAEzB,iCAA6C;AAApC,kHAAA,OAAO,OAAY;AAC5B,uCAAqC;AAA5B,oGAAA,QAAQ,OAAA;AAEjB,iFAAiF;AACjF,8EAA8E;AAC9E,kBAAkB;AAClB,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,sDAAsD;AACtD,gDAAyD;AAAhD,uHAAA,OAAO,OAAa;AAG7B,8CAAuD;AAA9C,qHAAA,OAAO,OAAY;AAG5B,wCAAiD;AAAxC,+GAAA,OAAO,OAAS;AAIzB,4CAAqD;AAA5C,mHAAA,OAAO,OAAW;AAG3B,gDAAyD;AAAhD,uHAAA,OAAO,OAAa;AAe7B,iFAAiF;AAEjF,0DAAsC;AACtC,+DAAwC;AACxC,mEAA0C;AAC1C,iEAAyC;AACzC,qEAA8C;AAC9C,uDAAoC;AACpC,uDAAoC;AACpC,uDAAoC;AACpC,2DAAsC;AACtC,mEAA0C;AAC1C,mEAA0C;AAC1C,iEAAyC;AACzC,oDAA+B;AAC/B,mEAA0C;AAC1C,iEAAyC;AACzC,2DAAsC;AACtC,+DAAwC;AACxC,mEAA0C;AAC1C,uEAAiD;AACjD,iEAAyC;AAEzC,qEAAqE;AACrE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAN,gBAAM,EAAE,KAAK,EAAL,kBAAK,EAAE,CAAA;AACxB,0BAAO;AAEH,QAAA,IAAI,GAAG;IACnB,IAAI,EAAJ,cAAI;IACJ,OAAO,EAAP,iBAAO;IACP,SAAS,EAAT,mBAAS;IACT,QAAQ,EAAR,kBAAQ;IACR,GAAG,EAAH,iBAAG;IACH,GAAG,EAAH,aAAG;IACH,GAAG,EAAH,aAAG;IACH,GAAG,EAAH,aAAG;IACH,KAAK,EAAL,eAAK;IACL,SAAS,EAAT,mBAAS;IACT,SAAS,EAAT,mBAAS;IACT,QAAQ,EAAR,kBAAQ;IACR,KAAK,EAAL,eAAK;IACL,OAAO;IACP,SAAS,EAAT,mBAAS;IACT,QAAQ,EAAR,kBAAQ;IACR,KAAK,EAAL,eAAK;IACL,OAAO,EAAP,iBAAO;IACP,SAAS,EAAT,mBAAS;CACT,CAAA"}
|
package/dist/types/index.d.ts
CHANGED
|
@@ -175,16 +175,18 @@ export type CoreConfig = {
|
|
|
175
175
|
version?: number
|
|
176
176
|
}
|
|
177
177
|
|
|
178
|
+
/** Mirrors `AuthConfig` in backend/Auth: the secret on a server, or the publishable key in an app */
|
|
178
179
|
export type AuthConfig = {
|
|
179
180
|
context: string
|
|
180
|
-
cid: string
|
|
181
|
-
secret: string
|
|
182
181
|
remoteOrigin?: string
|
|
183
182
|
env?: Env
|
|
184
183
|
version?: number
|
|
185
184
|
autorefresh?: boolean
|
|
186
185
|
onNewToken?: ( token: string ) => void
|
|
187
|
-
}
|
|
186
|
+
} & (
|
|
187
|
+
{ cid: string, secret: string, uid?: string, publicKey?: never }
|
|
188
|
+
| { publicKey: string, cid?: never, secret?: never, uid?: never }
|
|
189
|
+
)
|
|
188
190
|
|
|
189
191
|
export type OTPAuthConfig = {
|
|
190
192
|
context: string
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@de./sdk",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.3.0",
|
|
4
4
|
"description": "Complete SDK pack for MSI (Map Service Interface), IoTClient and DClient services — web, server and React Native",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"types": "./dist/index.d.ts",
|
|
@@ -41,7 +41,7 @@
|
|
|
41
41
|
"test:event": "npm run build:tsc && jest test/event.test.js"
|
|
42
42
|
},
|
|
43
43
|
"dependencies": {
|
|
44
|
-
"@de./types": "^2.
|
|
44
|
+
"@de./types": "^2.3.0",
|
|
45
45
|
"events": "^3.3.0",
|
|
46
46
|
"iframe.io": "^1.3.0",
|
|
47
47
|
"node-fetch": "2.6.1",
|
|
@@ -141,13 +141,14 @@ export default class Workspace extends AccessManager {
|
|
|
141
141
|
// ── Connectors ────────────────────────────────────────────────────────────
|
|
142
142
|
|
|
143
143
|
/**
|
|
144
|
-
* Created disabled
|
|
145
|
-
*
|
|
144
|
+
* Created disabled. The reply carries the secret, and it is the only one
|
|
145
|
+
* that ever will: the connector stores its hash, so `getConnector` has
|
|
146
|
+
* nothing to show. Keep it, or rotate.
|
|
146
147
|
*/
|
|
147
148
|
async createConnector(
|
|
148
149
|
wid: string, ctype: ContextType, xcode: string,
|
|
149
150
|
body: { name: string, type: ConnectorType, description?: string, config?: Record<string, any> }
|
|
150
|
-
): Promise<Res<{ connectorId: string }>> {
|
|
151
|
+
): Promise<Res<{ connectorId: string, secret: string }>> {
|
|
151
152
|
return this.call('POST', `/${wid}/${ctype}/${xcode}/connectors`, body )
|
|
152
153
|
}
|
|
153
154
|
|
|
@@ -191,10 +192,27 @@ export default class Workspace extends AccessManager {
|
|
|
191
192
|
return this.call('PATCH', `/${wid}/${ctype}/${xcode}/connectors/${id}/access`, body )
|
|
192
193
|
}
|
|
193
194
|
|
|
194
|
-
|
|
195
|
+
/** The new secret is in this reply and nowhere else, ever. The old one stops at once. */
|
|
196
|
+
async rotateConnectorSecret( wid: string, ctype: ContextType, xcode: string, id: string ): Promise<Res<{ secret: string, connector: Connector }>> {
|
|
195
197
|
return this.call('PATCH', `/${wid}/${ctype}/${xcode}/connectors/${id}/secret/rotate`)
|
|
196
198
|
}
|
|
197
199
|
|
|
200
|
+
/**
|
|
201
|
+
* Issue — or replace — the publishable key an app ships with instead of
|
|
202
|
+
* the secret. MSI connectors only. Like the secret, it is shown once.
|
|
203
|
+
*
|
|
204
|
+
* Replacing retires the old key immediately, so every released app build
|
|
205
|
+
* carrying it stops working: do it when a key is being abused.
|
|
206
|
+
*/
|
|
207
|
+
async rotateConnectorPublicKey( wid: string, ctype: ContextType, xcode: string, id: string ): Promise<Res<{ publicKey: string, connector: Connector }>> {
|
|
208
|
+
return this.call('PATCH', `/${wid}/${ctype}/${xcode}/connectors/${id}/publickey/rotate`)
|
|
209
|
+
}
|
|
210
|
+
|
|
211
|
+
/** Withdraw the publishable key; the connector answers to its secret only. */
|
|
212
|
+
async revokeConnectorPublicKey( wid: string, ctype: ContextType, xcode: string, id: string ): Promise<Res<{ connector: Connector }>> {
|
|
213
|
+
return this.call('DELETE', `/${wid}/${ctype}/${xcode}/connectors/${id}/publickey`)
|
|
214
|
+
}
|
|
215
|
+
|
|
198
216
|
async requestConnectorDeletion( wid: string, ctype: ContextType, xcode: string, id: string ): Promise<Res<{ intent: string }>> {
|
|
199
217
|
return this.call('POST', `/${wid}/${ctype}/${xcode}/connectors/${id}/deletion/intent`, {})
|
|
200
218
|
}
|
package/src/backend/Auth.ts
CHANGED
|
@@ -16,28 +16,25 @@ const ACCESS_TOKEN_EXPIRY = 3.75
|
|
|
16
16
|
|
|
17
17
|
// ─── Config ───────────────────────────────────────────────────────────────────
|
|
18
18
|
//
|
|
19
|
-
//
|
|
20
|
-
//
|
|
19
|
+
// Connector credentials → access token, with one of two credentials:
|
|
20
|
+
//
|
|
21
|
+
// Server — the secret (`de_sk_…`). Never let it leave the server.
|
|
22
|
+
// const auth = new Auth({ context, cid, secret, env })
|
|
23
|
+
//
|
|
24
|
+
// App — the publishable key (`de_pk_…`), made to ship inside a bundle. Its
|
|
25
|
+
// token acts for nobody and reaches only what a map needs.
|
|
26
|
+
// const auth = new Auth({ context, publicKey, env, autorefresh: true })
|
|
21
27
|
//
|
|
22
|
-
// const auth = new Auth({ context, cid, secret, env })
|
|
23
28
|
// const token = await auth.getToken()
|
|
29
|
+
//
|
|
30
|
+
// Anything an app needs beyond that goes through its own server, which holds
|
|
31
|
+
// the secret and hands the app a short-lived token it minted.
|
|
24
32
|
|
|
25
|
-
|
|
33
|
+
type AuthCommonConfig = {
|
|
26
34
|
context: string
|
|
27
|
-
cid: string
|
|
28
|
-
secret: string
|
|
29
35
|
remoteOrigin?: string
|
|
30
36
|
env?: 'dev' | 'staging' | 'prod'
|
|
31
37
|
version?: number
|
|
32
|
-
/**
|
|
33
|
-
* Operator uid to embed in the minted token's scope.
|
|
34
|
-
*
|
|
35
|
-
* Routes behind `isAllowed` look the caller up in the `operators`
|
|
36
|
-
* collection by uid, so a token minted without one is rejected with
|
|
37
|
-
* "Require <uid> generated accessToken" no matter how valid the connector
|
|
38
|
-
* credentials are. Omit it for pure machine-to-machine access.
|
|
39
|
-
*/
|
|
40
|
-
uid?: string
|
|
41
38
|
/**
|
|
42
39
|
* Rotate the token ahead of expiry.
|
|
43
40
|
*
|
|
@@ -57,6 +54,42 @@ export type AuthConfig = {
|
|
|
57
54
|
devHostname?: string
|
|
58
55
|
}
|
|
59
56
|
|
|
57
|
+
export type SecretAuthConfig = AuthCommonConfig & {
|
|
58
|
+
cid: string
|
|
59
|
+
/** `de_sk_…` — or `vs_…`, issued before the prefixes, which still works */
|
|
60
|
+
secret: string
|
|
61
|
+
/**
|
|
62
|
+
* Operator uid to embed in the minted token's scope.
|
|
63
|
+
*
|
|
64
|
+
* Routes behind `isAllowed` look the caller up in the `operators`
|
|
65
|
+
* collection by uid, so a token minted without one is rejected with
|
|
66
|
+
* "Require <uid> generated accessToken" no matter how valid the connector
|
|
67
|
+
* credentials are. Omit it for pure machine-to-machine access.
|
|
68
|
+
*/
|
|
69
|
+
uid?: string
|
|
70
|
+
publicKey?: never
|
|
71
|
+
}
|
|
72
|
+
|
|
73
|
+
export type PublicAuthConfig = AuthCommonConfig & {
|
|
74
|
+
/** `de_pk_…` — names its own connector, so there is no `cid` to send */
|
|
75
|
+
publicKey: string
|
|
76
|
+
cid?: never
|
|
77
|
+
secret?: never
|
|
78
|
+
uid?: never
|
|
79
|
+
}
|
|
80
|
+
|
|
81
|
+
export type AuthConfig = SecretAuthConfig | PublicAuthConfig
|
|
82
|
+
|
|
83
|
+
/**
|
|
84
|
+
* Whether this code is running inside an app rather than on a server.
|
|
85
|
+
*
|
|
86
|
+
* A browser has a `document`; React Native says so on `navigator.product`.
|
|
87
|
+
* Node, Bun, Deno and edge runtimes have neither.
|
|
88
|
+
*/
|
|
89
|
+
const inAppBundle = (): boolean =>
|
|
90
|
+
typeof ( globalThis as any ).document !== 'undefined'
|
|
91
|
+
|| ( globalThis as any ).navigator?.product === 'ReactNative'
|
|
92
|
+
|
|
60
93
|
type AuthResponse = {
|
|
61
94
|
error: boolean
|
|
62
95
|
message: string
|
|
@@ -68,8 +101,9 @@ type AuthResponse = {
|
|
|
68
101
|
export default class Auth {
|
|
69
102
|
private version: number
|
|
70
103
|
private env: AuthConfig['env']
|
|
71
|
-
private cid
|
|
72
|
-
private secret
|
|
104
|
+
private cid?: string
|
|
105
|
+
private secret?: string
|
|
106
|
+
private publicKey?: string
|
|
73
107
|
private context: string
|
|
74
108
|
private uid?: string
|
|
75
109
|
private remoteOrigin?: string
|
|
@@ -84,13 +118,29 @@ export default class Auth {
|
|
|
84
118
|
constructor( config: AuthConfig ){
|
|
85
119
|
if( !config ) throw new Error('Undefined config. Check https://doc.dedot.io/sdk/auth')
|
|
86
120
|
if( !config.context ) throw new Error('Undefined context. Check https://doc.dedot.io/sdk/auth')
|
|
87
|
-
|
|
88
|
-
if(
|
|
121
|
+
|
|
122
|
+
if( config.publicKey ){
|
|
123
|
+
if( config.cid || config.secret )
|
|
124
|
+
throw new Error('Pass either <publicKey>, or <cid> and <secret> — not both. Check https://doc.dedot.io/sdk/auth')
|
|
125
|
+
}
|
|
126
|
+
else {
|
|
127
|
+
if( !config.cid ) throw new Error('Undefined cid. Check https://doc.dedot.io/sdk/auth')
|
|
128
|
+
if( !config.secret ) throw new Error('Undefined secret. Check https://doc.dedot.io/sdk/auth')
|
|
129
|
+
|
|
130
|
+
/**
|
|
131
|
+
* A secret inside an app is a secret everyone who downloads the app
|
|
132
|
+
* has. Refused here rather than documented, because the app that does
|
|
133
|
+
* it works perfectly — nothing would ever say so.
|
|
134
|
+
*/
|
|
135
|
+
if( inAppBundle() )
|
|
136
|
+
throw new Error('A connector secret cannot be used inside an app. Use a publishable key (`publicKey`), or have your server mint the token. Check https://doc.dedot.io/sdk/auth')
|
|
137
|
+
}
|
|
89
138
|
|
|
90
139
|
this.context = config.context
|
|
91
140
|
this.uid = config.uid
|
|
92
141
|
this.cid = config.cid
|
|
93
142
|
this.secret = config.secret
|
|
143
|
+
this.publicKey = config.publicKey
|
|
94
144
|
this.remoteOrigin = config.remoteOrigin
|
|
95
145
|
this.env = config.env || 'dev'
|
|
96
146
|
this.version = config.version || 1
|
|
@@ -122,7 +172,12 @@ export default class Auth {
|
|
|
122
172
|
|
|
123
173
|
options = { ...rawOptions, ...options }
|
|
124
174
|
|
|
125
|
-
|
|
175
|
+
/**
|
|
176
|
+
* Method and URL only. This logged the whole request, and the body of
|
|
177
|
+
* every one of these is a credential — the secret, or a bearer token —
|
|
178
|
+
* printed into whatever collects a dev server's output.
|
|
179
|
+
*/
|
|
180
|
+
this.debug('Auth request', options.method, `${this.baseURL}/v${this.version}/${url.replace(/^\//, '')}`)
|
|
126
181
|
const response = await fetch(`${this.baseURL}/v${this.version}/${url.replace(/^\//, '')}`, options )
|
|
127
182
|
|
|
128
183
|
return await response.json() as T
|
|
@@ -160,7 +215,9 @@ export default class Auth {
|
|
|
160
215
|
options: AuthRequestOptions = {
|
|
161
216
|
url: '/access/token',
|
|
162
217
|
method: 'POST',
|
|
163
|
-
body:
|
|
218
|
+
body: this.publicKey
|
|
219
|
+
? { context: this.context, publicKey: this.publicKey }
|
|
220
|
+
: { context: this.context, cid: this.cid, secret: this.secret, remoteOrigin: this.remoteOrigin, ...( this.uid ? { uid: this.uid } : {} ) }
|
|
164
221
|
},
|
|
165
222
|
{ error, message, data } = await this.request<AuthResponse>( options )
|
|
166
223
|
if( error ) throw new Error( message )
|
|
@@ -181,6 +238,20 @@ export default class Auth {
|
|
|
181
238
|
if( !this.accessToken )
|
|
182
239
|
throw new Error('No access token found')
|
|
183
240
|
|
|
241
|
+
/**
|
|
242
|
+
* Rotation proves possession of the secret, which an app does not have.
|
|
243
|
+
* A publishable key renews by minting afresh — same result, one call.
|
|
244
|
+
*/
|
|
245
|
+
if( this.publicKey ){
|
|
246
|
+
const token = await this.getToken()
|
|
247
|
+
|
|
248
|
+
if( typeof this.onNewToken === 'function' )
|
|
249
|
+
try { this.onNewToken( token ) }
|
|
250
|
+
catch( callbackError ){ this.error('[Auth] Error in onNewToken callback:', callbackError) }
|
|
251
|
+
|
|
252
|
+
return token
|
|
253
|
+
}
|
|
254
|
+
|
|
184
255
|
this.isRotating = true
|
|
185
256
|
|
|
186
257
|
try {
|
package/src/core.ts
CHANGED
|
@@ -18,9 +18,9 @@
|
|
|
18
18
|
|
|
19
19
|
// ── Named exports (preferred — tree-shakeable) ────────────────────────────────
|
|
20
20
|
|
|
21
|
-
//
|
|
21
|
+
// Connector credentials → access token: the secret on a server, the publishable key in an app
|
|
22
22
|
export { default as Auth } from './backend/Auth'
|
|
23
|
-
export type { AuthConfig } from './backend/Auth'
|
|
23
|
+
export type { AuthConfig, SecretAuthConfig, PublicAuthConfig } from './backend/Auth'
|
|
24
24
|
|
|
25
25
|
// Order-room sockets — shared connect/rejoin behaviour
|
|
26
26
|
export type { RealtimeConnectOptions } from './allend/realtime-socket'
|
package/src/types/index.d.ts
CHANGED
|
@@ -175,16 +175,18 @@ export type CoreConfig = {
|
|
|
175
175
|
version?: number
|
|
176
176
|
}
|
|
177
177
|
|
|
178
|
+
/** Mirrors `AuthConfig` in backend/Auth: the secret on a server, or the publishable key in an app */
|
|
178
179
|
export type AuthConfig = {
|
|
179
180
|
context: string
|
|
180
|
-
cid: string
|
|
181
|
-
secret: string
|
|
182
181
|
remoteOrigin?: string
|
|
183
182
|
env?: Env
|
|
184
183
|
version?: number
|
|
185
184
|
autorefresh?: boolean
|
|
186
185
|
onNewToken?: ( token: string ) => void
|
|
187
|
-
}
|
|
186
|
+
} & (
|
|
187
|
+
{ cid: string, secret: string, uid?: string, publicKey?: never }
|
|
188
|
+
| { publicKey: string, cid?: never, secret?: never, uid?: never }
|
|
189
|
+
)
|
|
188
190
|
|
|
189
191
|
export type OTPAuthConfig = {
|
|
190
192
|
context: string
|