@degallery/node 0.3.0 → 0.4.0

package/README.md

@@ -25,10 +25,7 @@ pnpm add @degallery/node
 The package re-exports `GalleryClient` and selected public SDK types:
 
 ```ts
-import {
-  GalleryClient,
-  type GallerySummary,
-} from '@degallery/node';
+import { GalleryClient, type GallerySummary } from '@degallery/node';
 ```
 
 ## Configure a server client
@@ -57,16 +54,19 @@ import { createDeliveryToken } from '@degallery/node';
 
 const token = createDeliveryToken(
   {
-    resourceId: 'asset-id',
-    environmentId: 'production',
+    organizationId: 'organization-id',
+    environmentId: 'environment-id',
+    resource: 'asset-id',
+    revision: 3,
     preset: 'large',
     expiresAt: Math.floor(Date.now() / 1000) + 300,
+    keyId: 'v1',
   },
   process.env.DEGALLERY_DELIVERY_SECRET!,
 );
 ```
 
-The helper signs the encoded payload with HMAC-SHA256. The token is not an authorization policy by itself: validate ownership, visibility, expiry, and requested transformations before issuing it.
+The helper signs the Worker-compatible claims (`iss`, `aud`, `org`, `env`, `resource`, `revision`, `preset`, `iat`, `exp`, and `kid`) with HMAC-SHA256. `expiresAt` is a Unix timestamp in seconds and the lifetime cannot exceed 15 minutes. The token is not an authorization policy by itself: validate ownership, visibility, expiry, and requested transformations before issuing it. Never issue a private delivery token in browser code.
 
 ## What this package exports
 

package/dist/lib/node.d.ts

@@ -1,10 +1,15 @@
 export { GalleryClient } from '@degallery/sdk';
 export type { Asset, GalleryDetail, GalleryLinkPayload, GallerySummary, } from '@degallery/sdk';
 export declare function node(): string;
-export declare function createDeliveryToken(input: {
-    resourceId: string;
+export type DeliveryTokenInput = Readonly<{
+    organizationId: string;
     environmentId: string;
-    preset: string;
+    resource: string;
+    revision: number;
+    preset: 'original' | 'thumbnail' | 'large';
     expiresAt: number;
-}, secret: string): string;
+    issuedAt?: number;
+    keyId?: string;
+}>;
+export declare function createDeliveryToken(input: DeliveryTokenInput, secret: string): string;
 //# sourceMappingURL=node.d.ts.map

package/dist/lib/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/lib/node.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,YAAY,EACV,KAAK,EACL,aAAa,EACb,kBAAkB,EAClB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,wBAAgB,IAAI,IAAI,MAAM,CAE7B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,MAAM,EAAE,MAAM,UAIf"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/lib/node.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,YAAY,EACV,KAAK,EACL,aAAa,EACb,kBAAkB,EAClB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,wBAAgB,IAAI,IAAI,MAAM,CAE7B;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,UA0C5E"}

package/dist/lib/node.js

@@ -10,6 +10,41 @@ function node() {
     return 'node';
 }
 function createDeliveryToken(input, secret) {
-    const payload = Buffer.from(JSON.stringify(input)).toString('base64url');
-    return `${payload}.${(0, node_crypto_1.createHmac)('sha256', secret).update(payload).digest('base64url')}`;
+    if (!secret)
+        throw new TypeError('A delivery signing secret is required.');
+    const issuedAt = input.issuedAt ?? Math.floor(Date.now() / 1000);
+    const lifetime = input.expiresAt - issuedAt;
+    const keyId = input.keyId ?? 'v1';
+    if (!input.organizationId ||
+        input.organizationId.length > 128 ||
+        !input.environmentId ||
+        input.environmentId.length > 128 ||
+        !input.resource ||
+        input.resource.length > 128 ||
+        !Number.isSafeInteger(input.revision) ||
+        input.revision < 1 ||
+        !['original', 'thumbnail', 'large'].includes(input.preset) ||
+        !Number.isSafeInteger(issuedAt) ||
+        !Number.isSafeInteger(input.expiresAt) ||
+        !keyId ||
+        keyId.length > 128 ||
+        lifetime < 1 ||
+        lifetime > 900)
+        throw new TypeError('Delivery token claims are invalid.');
+    const payload = Buffer.from(JSON.stringify({
+        iss: 'thegallery',
+        aud: 'media-delivery',
+        org: input.organizationId,
+        env: input.environmentId,
+        resource: input.resource,
+        revision: input.revision,
+        preset: input.preset,
+        iat: issuedAt,
+        exp: input.expiresAt,
+        kid: keyId,
+    })).toString('base64url');
+    const signature = (0, node_crypto_1.createHmac)('sha256', secret)
+        .update(payload)
+        .digest('base64url');
+    return `${payload}.${signature}`;
 }

package/package.json

@@ -1,12 +1,9 @@
 {
   "name": "@degallery/node",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
-  "scripts": {
-    "lib:publish": "npm publish --access public"
-  },
   "exports": {
     "./package.json": "./package.json",
     ".": {
@@ -22,6 +19,9 @@
   ],
   "dependencies": {
     "tslib": "^2.3.0",
-    "@degallery/sdk": "workspace:*"
+    "@degallery/sdk": "0.4.0"
+  },
+  "scripts": {
+    "lib:publish": "pnpm publish --access public"
   }
-}
+}