@dudousxd/nestjs-durable-dashboard 0.56.0 → 0.57.0

package/dist/server/index.cjs

@@ -36,10 +36,12 @@ __export(index_exports, {
   CONSOLE_AUTHORIZE_MISSING_WARNING: () => CONSOLE_AUTHORIZE_MISSING_WARNING,
   CONSOLE_GATE: () => CONSOLE_GATE,
   CONSOLE_PAGE_METADATA: () => CONSOLE_PAGE_METADATA,
+  CONSOLE_PUBLIC_METADATA: () => CONSOLE_PUBLIC_METADATA,
   ConsoleAccessDenied: () => ConsoleAccessDenied,
   ConsoleAuthorizeFilter: () => ConsoleAuthorizeFilter,
   ConsoleAuthorizeGuard: () => ConsoleAuthorizeGuard,
   ConsolePage: () => ConsolePage,
+  ConsolePublic: () => ConsolePublic,
   DASHBOARD_API_PATH: () => DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH: () => DASHBOARD_BASE_PATH,
   DashboardService: () => DashboardService,
@@ -294,6 +296,10 @@ var ConsoleAccessDenied = class extends import_common.HttpException {
     }, unauthenticated2 ? 401 : 403), this.decision = decision, this.page = page;
   }
 };
+var CONSOLE_PUBLIC_METADATA = `${PACKAGE}:console-public`;
+var ConsolePublic = /* @__PURE__ */ __name(() => (_target, _key, descriptor) => {
+  Reflect.defineMetadata(CONSOLE_PUBLIC_METADATA, true, descriptor.value);
+}, "ConsolePublic");
 var ConsoleAuthorizeGuard = class {
   static {
     __name(this, "ConsoleAuthorizeGuard");
@@ -303,6 +309,7 @@ var ConsoleAuthorizeGuard = class {
     this.decide = decide;
   }
   async canActivate(context) {
+    if (Reflect.getMetadata(CONSOLE_PUBLIC_METADATA, context.getHandler()) === true) return true;
     const decision = await this.decide(context);
     if (decision.allowed) return true;
     throw new ConsoleAccessDenied(decision, isPageNavigation(context));
@@ -415,7 +422,7 @@ var DashboardService = class {
   */
   controlPlane() {
     if (!this.store || !this.engine) {
-      throw new Error("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
+      throw new import_common2.NotImplementedException("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
     }
     return {
       store: this.store,
@@ -1670,9 +1677,9 @@ var DurableApiControllerBase = class {
   }
   /**
   * Public callback endpoint for `ctx.webhook()`: a third party POSTs here (the url handed to it),
-  * and the body resumes the waiting run. NOTE: this is reachable by external systems — protect it
-  * by treating the token as a secret (it embeds runId:seq) and/or fronting it with signature
-  * verification in your own middleware.
+  * and the body resumes the waiting run. Not a console route: the console's `authorize` does not
+  * apply, the token is the secret. The app's `decorators` still do. Treat the token as a secret
+  * and/or front it with signature verification in your own middleware.
   */
   async webhook(token, body) {
     const result = await this.dashboard.deliverWebhook(token, body);
@@ -1910,6 +1917,7 @@ _ts_decorate6([
   _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "redispatch", null);
 _ts_decorate6([
+  ConsolePublic(),
   (0, import_common6.Post)("webhooks/:token"),
   _ts_param3(0, (0, import_common6.Param)("token")),
   _ts_param3(1, (0, import_common6.Body)()),
@@ -2339,10 +2347,12 @@ DurableDashboardModule = _ts_decorate8([
   CONSOLE_AUTHORIZE_MISSING_WARNING,
   CONSOLE_GATE,
   CONSOLE_PAGE_METADATA,
+  CONSOLE_PUBLIC_METADATA,
   ConsoleAccessDenied,
   ConsoleAuthorizeFilter,
   ConsoleAuthorizeGuard,
   ConsolePage,
+  ConsolePublic,
   DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH,
   DashboardService,