@degallery/node 0.2.2 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +98 -6
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,11 +1,103 @@
|
|
|
1
|
-
# node
|
|
1
|
+
# `@degallery/node`
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Node.js helpers for trusted DeGallery integrations. Use this package at a server boundary when you need the framework-neutral `@degallery/sdk` client plus Node-specific signing utilities.
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
This package is not a browser UI library and must not be included in a public client bundle.
|
|
6
6
|
|
|
7
|
-
|
|
7
|
+
## Product and developer links
|
|
8
8
|
|
|
9
|
-
|
|
9
|
+
- [DeGallery landing page](https://degallery.dev)
|
|
10
|
+
- [Developer documentation](https://docs.degallery.dev)
|
|
11
|
+
- [JavaScript installation](https://docs.degallery.dev/docs/javascript/installation)
|
|
12
|
+
- [Production readiness](https://docs.degallery.dev/docs/guides/production-readiness)
|
|
13
|
+
- [Private gallery authorization](https://docs.degallery.dev/docs/how-to/authorize-a-private-gallery)
|
|
14
|
+
- [Image delivery guide](https://docs.degallery.dev/docs/how-to/track-delivery)
|
|
15
|
+
- [Live demo](https://demo.degallery.dev)
|
|
16
|
+
- [Dashboard](https://app.degallery.dev)
|
|
17
|
+
- [Source repository](https://github.com/mmpotulo28/thegallery)
|
|
10
18
|
|
|
11
|
-
|
|
19
|
+
## Install
|
|
20
|
+
|
|
21
|
+
```bash
|
|
22
|
+
pnpm add @degallery/node
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
The package re-exports `GalleryClient` and selected public SDK types:
|
|
26
|
+
|
|
27
|
+
```ts
|
|
28
|
+
import {
|
|
29
|
+
GalleryClient,
|
|
30
|
+
type GallerySummary,
|
|
31
|
+
} from '@degallery/node';
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
## Configure a server client
|
|
35
|
+
|
|
36
|
+
```ts
|
|
37
|
+
import { GalleryClient } from '@degallery/node';
|
|
38
|
+
|
|
39
|
+
const client = new GalleryClient({
|
|
40
|
+
apiUrl: process.env.DEGALLERY_API_URL ?? 'https://api.degallery.dev',
|
|
41
|
+
apiKey: process.env.DEGALLERY_API_KEY,
|
|
42
|
+
});
|
|
43
|
+
|
|
44
|
+
const gallery = await client.getGallery('gallery-id-or-slug');
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
Keep `DEGALLERY_API_KEY` in the server secret manager. Never use a `NEXT_PUBLIC_*` variable for a private credential and never return the credential to a browser.
|
|
48
|
+
|
|
49
|
+
For the full client surface, see the [`@degallery/sdk` README](../sdk/README.md) and the [JavaScript client documentation](https://docs.degallery.dev/docs/javascript/get-started).
|
|
50
|
+
|
|
51
|
+
## Create a delivery token
|
|
52
|
+
|
|
53
|
+
`createDeliveryToken` creates a signed token for a delivery resource. Keep the signing secret private and issue tokens only after your server has authorized the requested resource:
|
|
54
|
+
|
|
55
|
+
```ts
|
|
56
|
+
import { createDeliveryToken } from '@degallery/node';
|
|
57
|
+
|
|
58
|
+
const token = createDeliveryToken(
|
|
59
|
+
{
|
|
60
|
+
resourceId: 'asset-id',
|
|
61
|
+
environmentId: 'production',
|
|
62
|
+
preset: 'large',
|
|
63
|
+
expiresAt: Math.floor(Date.now() / 1000) + 300,
|
|
64
|
+
},
|
|
65
|
+
process.env.DEGALLERY_DELIVERY_SECRET!,
|
|
66
|
+
);
|
|
67
|
+
```
|
|
68
|
+
|
|
69
|
+
The helper signs the encoded payload with HMAC-SHA256. The token is not an authorization policy by itself: validate ownership, visibility, expiry, and requested transformations before issuing it.
|
|
70
|
+
|
|
71
|
+
## What this package exports
|
|
72
|
+
|
|
73
|
+
- `GalleryClient` from `@degallery/sdk`
|
|
74
|
+
- `Asset`, `GalleryDetail`, `GalleryLinkPayload`, and `GallerySummary` types
|
|
75
|
+
- `createDeliveryToken`
|
|
76
|
+
- `node`, the package health-check export
|
|
77
|
+
|
|
78
|
+
For uploads, use the SDK intent flow from the server:
|
|
79
|
+
|
|
80
|
+
```ts
|
|
81
|
+
const intent = await client.createUpload({
|
|
82
|
+
filename: 'image.jpg',
|
|
83
|
+
contentType: 'image/jpeg',
|
|
84
|
+
size: bytes.byteLength,
|
|
85
|
+
visibility: 'private',
|
|
86
|
+
});
|
|
87
|
+
|
|
88
|
+
await fetch(intent.uploadUrl, {
|
|
89
|
+
method: intent.method ?? 'PUT',
|
|
90
|
+
headers: { 'Content-Type': intent.contentType ?? 'image/jpeg' },
|
|
91
|
+
body: bytes,
|
|
92
|
+
});
|
|
93
|
+
|
|
94
|
+
await client.completeUpload(intent.intentId);
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
## Runtime guidance
|
|
98
|
+
|
|
99
|
+
- Run this package only in Node.js or another trusted server runtime.
|
|
100
|
+
- Store API and delivery secrets in a managed secret store.
|
|
101
|
+
- Keep delivery tokens short-lived.
|
|
102
|
+
- Do not log signed URLs, API keys, or delivery tokens.
|
|
103
|
+
- Treat client-provided asset IDs and presets as untrusted input.
|