@domino-sdk/relay 1.5.2 → 1.6.0

package/dist/portal-proxy.js

@@ -1,36 +1,45 @@
 import {
-  isActivityParticipantRoute,
-  isContentParticipantRoute,
-  isOfferParticipantRoute,
-  isPointsParticipantRoute,
-  isProfileParticipantRoute,
-  isQuestOutcomeParticipantRoute,
-  isRewardsParticipantRoute,
-  isWalletParticipantRoute,
-  isWalletSignInRoute
-} from "./chunk-GUP7YRR4.js";
+  isParticipantRoute
+} from "./chunk-AXRMT33W.js";
 import {
   exchangeResultSchema
-} from "./chunk-XFMSUPNS.js";
-import "./chunk-JON5SESL.js";
+} from "./chunk-6ON4RMEN.js";
+import "./chunk-KGJSKGKI.js";
 
 // src/portal-proxy.ts
+var statusCode = (status) => ({
+  400: "invalid-request",
+  401: "unauthenticated",
+  403: "forbidden",
+  404: "not-found",
+  405: "method-not-allowed",
+  409: "conflict",
+  410: "gone",
+  413: "payload-too-large",
+  415: "unsupported-media-type",
+  422: "validation-failed",
+  429: "rate-limited",
+  500: "internal-error",
+  502: "upstream-failed",
+  503: "unavailable",
+  504: "upstream-timeout"
+})[status] ?? (status >= 500 ? "internal-error" : "invalid-request");
 async function proxyParticipant(request, upstream) {
   const incoming = new URL(request.url);
   const path = incoming.pathname.slice("/relay".length);
-  const allowed = incoming.pathname.startsWith("/relay/") && (/^\/v1\/auth\/(providers|accounts(?:\/disconnect)?|start|authorize|complete|session|logout|email\/start|email\/verify|callback\/[a-z][a-z0-9-]*)$/.test(
-    path
-  ) || /^\/v1\/me\/(progress|experience|attempts|evidence|collection-pass)$/.test(
-    path
-  ) || isWalletParticipantRoute(path) || isWalletSignInRoute(path) || path === "/v1/me" && request.method === "GET" || /^\/v1\/attempts\/[\w-]+\/retry$/.test(path) || /^\/v1\/referrals(?:\/(me|history))?$/.test(path) && request.method === "GET" || isContentParticipantRoute(path, request.method) || isQuestOutcomeParticipantRoute(path, request.method) || isProfileParticipantRoute(path, request.method) || isPointsParticipantRoute(path, request.method) || isRewardsParticipantRoute(path, request.method) || isActivityParticipantRoute(path, request.method) || isOfferParticipantRoute(path, request.method) || path === "/v1/reward-deliveries" && request.method === "GET" || path === "/v1/referrals/accept" && request.method === "POST" || request.method === "GET" && /^\/v1\/leaderboards(?:\/[\w-]+)?$/.test(path) || request.method === "GET" && (path === "/v1/point-ledgers" || path === "/v1/tiered-rewards"));
-  if (!allowed || !["GET", "POST"].includes(request.method)) {
-    return Response.json({ error: "Route not found" }, { status: 404 });
+  const allowed = incoming.pathname.startsWith("/relay/") && isParticipantRoute(path, request.method);
+  if (!allowed) {
+    return Response.json(
+      { error: "Route not found", code: "route-not-found" },
+      { status: 404 }
+    );
   }
   const target = new URL(upstream.baseUrl);
   if (target.protocol !== "https:" || target.username || target.password || target.pathname !== "/" || target.search || target.hash) {
     return Response.json(
       {
-        error: "Participant API is not configured. Use the API origin, such as https://relay.domino.run, not a management URL."
+        error: "Participant API is not configured. Use the API origin, such as https://relay.domino.run, not a management URL.",
+        code: "not-configured"
       },
       { status: 503 }
     );
@@ -86,20 +95,23 @@ function createParticipantBackend(options) {
   const cookie = (token) => `domino_app_session=${token}; Path=/relay; HttpOnly; Secure; SameSite=Lax; Max-Age=${token ? 28800 : 0}`;
   return async (request) => {
     const url = new URL(request.url);
-    const reject = (error, status) => Response.json(
-      { error },
+    const reject = (error, status, code) => Response.json(
+      { error, code },
       { status, headers: { "Cache-Control": "no-store" } }
     );
     if (url.origin !== options.origin) {
-      return reject("Unexpected application origin", 403);
+      return reject("Unexpected application origin", 403, "forbidden");
     }
     if (request.method !== "GET" && (request.headers.get("Origin") !== options.origin || request.headers.get("X-Relay-CSRF") !== "1")) {
-      return reject("Untrusted browser request", 403);
+      return reject("Untrusted browser request", 403, "forbidden");
     }
     const identity = await options.authenticate(request);
     if (!identity) {
       return Response.json(
-        url.pathname === "/relay/v1/auth/session" ? null : { error: "Sign in to the application" },
+        url.pathname === "/relay/v1/auth/session" ? null : {
+          error: "Sign in to the application",
+          code: "unauthenticated"
+        },
         {
           status: url.pathname === "/relay/v1/auth/session" ? 200 : 401,
           headers: { "Set-Cookie": cookie(""), "Cache-Control": "no-store" }
@@ -116,25 +128,25 @@ function createParticipantBackend(options) {
       },
       body: JSON.stringify({ subject: identity.subject, previousToken })
     });
-    if (exchanged.status === 409) {
+    if (!exchanged.ok) {
       const body = await exchanged.json().catch(() => null);
+      const code = typeof body?.code === "string" ? body.code : statusCode(exchanged.status);
+      const retryAfter = exchanged.headers.get("Retry-After");
       return Response.json(
         {
-          error: typeof body?.error === "string" ? body.error : "Domino refused this account. Ask an organizer.",
-          ...typeof body?.code === "string" ? { code: body.code } : {}
+          error: exchanged.status === 409 && typeof body?.error === "string" ? body.error : exchanged.status === 409 ? "Domino refused this account. Ask an organizer." : "Domino identity exchange failed. Check the server integration key and its expiry in Console Settings.",
+          code
         },
         {
-          status: 409,
-          headers: { "Set-Cookie": cookie(""), "Cache-Control": "no-store" }
+          status: exchanged.status,
+          headers: {
+            "Set-Cookie": cookie(""),
+            "Cache-Control": "no-store",
+            ...retryAfter ? { "Retry-After": retryAfter } : {}
+          }
         }
       );
     }
-    if (!exchanged.ok) {
-      return reject(
-        "Domino identity exchange failed. Check the server integration key and its expiry in Console Settings.",
-        exchanged.status
-      );
-    }
     const { token } = exchangeResultSchema.parse(await exchanged.json());
     const response = await proxyParticipant(request, {
       baseUrl: options.baseUrl,