@drawbridge/drawbridge-utils 0.0.81 → 0.0.83

package/dist/oauth/server.cjs

@@ -361,6 +361,19 @@ var createOAuthModel = ({ controller }) => ({
     const granted = intersect(scope, token.scope ?? []);
     return granted.length > 0;
   },
+  // Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+  // AuthorizeHandler grants whatever scope the request asks for — the client
+  // registry's scopes list was only advisory (reachable from any logged-in
+  // browser via the dashboard's authorize BFF). Every requested scope must be
+  // registered on the client; an empty request falls back to the client's
+  // full registered grant. Returning false → invalid_scope.
+  validateScope: (user, client, scope) => {
+    const requested = Array.isArray(scope) ? scope : scope ? String(scope).split(/\s+/).filter(Boolean) : [];
+    const allowed = (client == null ? void 0 : client.scopes) ?? [];
+    if (!requested.length) return allowed;
+    const invalid = requested.filter((entry) => !allowed.includes(entry));
+    return invalid.length ? false : requested;
+  },
   // client_credentials grant: treat the client as the resource owner.
   getUserFromClient: (client) => ({ id: client.id, type: "client" })
 });

package/dist/oauth/server.d.cts

@@ -304,6 +304,28 @@ const createOAuthModel = ({ controller }) => ({
 
 	},
 
+	// Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+	// AuthorizeHandler grants whatever scope the request asks for — the client
+	// registry's scopes list was only advisory (reachable from any logged-in
+	// browser via the dashboard's authorize BFF). Every requested scope must be
+	// registered on the client; an empty request falls back to the client's
+	// full registered grant. Returning false → invalid_scope.
+	validateScope : ( user, client, scope ) => {
+
+		const requested = Array.isArray( scope )
+			? scope
+			: ( scope ? String( scope ).split( /\s+/ ).filter( Boolean ) : [] );
+
+		const allowed = client?.scopes ?? [];
+
+		if( ! requested.length ) return allowed;
+
+		const invalid = requested.filter( ( entry ) => ! allowed.includes( entry ) );
+
+		return invalid.length ? false : requested;
+
+	},
+
 	// client_credentials grant: treat the client as the resource owner.
 	getUserFromClient : ( client ) => ({ id : client.id, type : 'client' })
 

package/dist/oauth/server.d.ts

@@ -304,6 +304,28 @@ const createOAuthModel = ({ controller }) => ({
 
 	},
 
+	// Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+	// AuthorizeHandler grants whatever scope the request asks for — the client
+	// registry's scopes list was only advisory (reachable from any logged-in
+	// browser via the dashboard's authorize BFF). Every requested scope must be
+	// registered on the client; an empty request falls back to the client's
+	// full registered grant. Returning false → invalid_scope.
+	validateScope : ( user, client, scope ) => {
+
+		const requested = Array.isArray( scope )
+			? scope
+			: ( scope ? String( scope ).split( /\s+/ ).filter( Boolean ) : [] );
+
+		const allowed = client?.scopes ?? [];
+
+		if( ! requested.length ) return allowed;
+
+		const invalid = requested.filter( ( entry ) => ! allowed.includes( entry ) );
+
+		return invalid.length ? false : requested;
+
+	},
+
 	// client_credentials grant: treat the client as the resource owner.
 	getUserFromClient : ( client ) => ({ id : client.id, type : 'client' })
 

package/dist/oauth/server.js

@@ -326,6 +326,19 @@ var createOAuthModel = ({ controller }) => ({
     const granted = intersect(scope, token.scope ?? []);
     return granted.length > 0;
   },
+  // Scope enforcement at AUTHORIZE time. Without this, @node-oauth's
+  // AuthorizeHandler grants whatever scope the request asks for — the client
+  // registry's scopes list was only advisory (reachable from any logged-in
+  // browser via the dashboard's authorize BFF). Every requested scope must be
+  // registered on the client; an empty request falls back to the client's
+  // full registered grant. Returning false → invalid_scope.
+  validateScope: (user, client, scope) => {
+    const requested = Array.isArray(scope) ? scope : scope ? String(scope).split(/\s+/).filter(Boolean) : [];
+    const allowed = (client == null ? void 0 : client.scopes) ?? [];
+    if (!requested.length) return allowed;
+    const invalid = requested.filter((entry) => !allowed.includes(entry));
+    return invalid.length ? false : requested;
+  },
   // client_credentials grant: treat the client as the resource owner.
   getUserFromClient: (client) => ({ id: client.id, type: "client" })
 });

package/dist/plans.cjs

@@ -342,7 +342,11 @@ var plans = {
     limits: all.limits({ actions: 15e3, members: 5, storage: gigabyte * 20 }),
     marketing: {
       description: "Expand your reach and grow your lead pipeline.",
-      features: [],
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
       limits: [
         ["Actions per month", "15,000"],
         ["Affiliates", "Unlimited"],
@@ -368,7 +372,11 @@ var plans = {
     limits: all.limits({ actions: 4e4, members: 10, storage: gigabyte * 50 }),
     marketing: {
       description: "Accelerate acquisition with more power and flexibility.",
-      features: [],
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
       limits: [
         ["Actions per month", "40,000"],
         ["Affiliates", "Unlimited"],
@@ -394,7 +402,11 @@ var plans = {
     limits: all.limits({ actions: 1e5, members: infinite, storage: gigabyte * 100 }),
     marketing: {
       description: "Built for brands focused on results.",
-      features: [],
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
       limits: [
         ["Actions per month", "100,000"],
         ["Affiliates", "Unlimited"],

package/dist/plans.d.cts

@@ -114,7 +114,11 @@ const plans = {
 		limits : all.limits({ actions : 15000, members : 5, storage : gigabyte * 20 }),
 		marketing : {
 			description : 'Expand your reach and grow your lead pipeline.',
-			features : [],
+			features : [
+				'Analytics',
+				'Custom subdomain / URLs',
+				'Confirmation page ads'
+			],
 			limits : [
 				[ 'Actions per month', '15,000' ],
 				[ 'Affiliates', 'Unlimited' ],
@@ -140,7 +144,11 @@ const plans = {
 		limits : all.limits({ actions : 40000, members : 10, storage : gigabyte * 50 }),
 		marketing : {
 			description : 'Accelerate acquisition with more power and flexibility.',
-			features : [],
+			features : [
+				'Analytics',
+				'Custom subdomain / URLs',
+				'Confirmation page ads'
+			],
 			limits : [
 				[ 'Actions per month', '40,000' ],
 				[ 'Affiliates', 'Unlimited' ],
@@ -166,7 +174,11 @@ const plans = {
 		limits : all.limits({ actions : 100000, members : infinite, storage : gigabyte * 100 }),
 		marketing : {
 			description : 'Built for brands focused on results.',
-			features : [],
+			features : [
+				'Analytics',
+				'Custom subdomain / URLs',
+				'Confirmation page ads'
+			],
 			limits : [
 				[ 'Actions per month', '100,000' ],
 				[ 'Affiliates', 'Unlimited' ],

package/dist/plans.d.ts

@@ -114,7 +114,11 @@ const plans = {
 		limits : all.limits({ actions : 15000, members : 5, storage : gigabyte * 20 }),
 		marketing : {
 			description : 'Expand your reach and grow your lead pipeline.',
-			features : [],
+			features : [
+				'Analytics',
+				'Custom subdomain / URLs',
+				'Confirmation page ads'
+			],
 			limits : [
 				[ 'Actions per month', '15,000' ],
 				[ 'Affiliates', 'Unlimited' ],
@@ -140,7 +144,11 @@ const plans = {
 		limits : all.limits({ actions : 40000, members : 10, storage : gigabyte * 50 }),
 		marketing : {
 			description : 'Accelerate acquisition with more power and flexibility.',
-			features : [],
+			features : [
+				'Analytics',
+				'Custom subdomain / URLs',
+				'Confirmation page ads'
+			],
 			limits : [
 				[ 'Actions per month', '40,000' ],
 				[ 'Affiliates', 'Unlimited' ],
@@ -166,7 +174,11 @@ const plans = {
 		limits : all.limits({ actions : 100000, members : infinite, storage : gigabyte * 100 }),
 		marketing : {
 			description : 'Built for brands focused on results.',
-			features : [],
+			features : [
+				'Analytics',
+				'Custom subdomain / URLs',
+				'Confirmation page ads'
+			],
 			limits : [
 				[ 'Actions per month', '100,000' ],
 				[ 'Affiliates', 'Unlimited' ],

package/dist/plans.js

@@ -305,7 +305,11 @@ var plans = {
     limits: all.limits({ actions: 15e3, members: 5, storage: gigabyte * 20 }),
     marketing: {
       description: "Expand your reach and grow your lead pipeline.",
-      features: [],
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
       limits: [
         ["Actions per month", "15,000"],
         ["Affiliates", "Unlimited"],
@@ -331,7 +335,11 @@ var plans = {
     limits: all.limits({ actions: 4e4, members: 10, storage: gigabyte * 50 }),
     marketing: {
       description: "Accelerate acquisition with more power and flexibility.",
-      features: [],
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
       limits: [
         ["Actions per month", "40,000"],
         ["Affiliates", "Unlimited"],
@@ -357,7 +365,11 @@ var plans = {
     limits: all.limits({ actions: 1e5, members: infinite, storage: gigabyte * 100 }),
     marketing: {
       description: "Built for brands focused on results.",
-      features: [],
+      features: [
+        "Analytics",
+        "Custom subdomain / URLs",
+        "Confirmation page ads"
+      ],
       limits: [
         ["Actions per month", "100,000"],
         ["Affiliates", "Unlimited"],

package/package.json

@@ -164,5 +164,5 @@
     "test": "node --test test/"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.81"
+  "version": "0.0.83"
 }