@dudousxd/nestjs-durable-dashboard 0.56.0 → 0.57.0

package/dist/server/index.d.cts

@@ -88,6 +88,12 @@ declare class ConsoleAccessDenied extends HttpException {
         allowed: false;
     }>, page: boolean);
 }
+/**
+ * Marks a console route that is not part of the console: `authorize` does not apply to it. Used on
+ * the `ctx.webhook()` callback, which third parties call with the token as the secret.
+ */
+declare const CONSOLE_PUBLIC_METADATA = "@dudousxd/nestjs-durable-dashboard:console-public";
+declare const ConsolePublic: () => MethodDecorator;
 declare class ConsoleAuthorizeGuard implements CanActivate {
     private readonly decide;
     constructor(decide: ConsoleDecide);
@@ -422,9 +428,9 @@ declare class DurableApiControllerBase {
     }>;
     /**
      * Public callback endpoint for `ctx.webhook()`: a third party POSTs here (the url handed to it),
-     * and the body resumes the waiting run. NOTE: this is reachable by external systems — protect it
-     * by treating the token as a secret (it embeds runId:seq) and/or fronting it with signature
-     * verification in your own middleware.
+     * and the body resumes the waiting run. Not a console route: the console's `authorize` does not
+     * apply, the token is the secret. The app's `decorators` still do. Treat the token as a secret
+     * and/or front it with signature verification in your own middleware.
      */
     webhook(token: string, body: unknown): Promise<_dudousxd_nestjs_durable_core.RunResult>;
     /** Live query: the latest value a run published for `key` via `ctx.setEvent` (no side effect). */
@@ -443,7 +449,9 @@ declare class DurableApiController extends DurableApiControllerBase {
 
 interface DurableDashboardOptions {
     /**
-     * Who may use the console (the SPA, its JSON API, the run stream and the webhook route). One of:
+     * Who may use the console (the SPA, its JSON API and the run stream). Not the `ctx.webhook()`
+     * callback (`POST <apiBasePath>/webhooks/:token`), which third parties call with the token as the
+     * secret; {@link decorators} still apply to it. One of:
      *
      * - a function `(context) => boolean | { allowed } | { redirectTo }` (may be async);
      * - an `@Injectable()` class implementing {@link ConsoleAuthorizer} (constructor injection works;
@@ -588,4 +596,4 @@ declare class DurableUiControllerBase {
 declare class DurableUiController extends DurableUiControllerBase {
 }
 
-export { CONSOLE_AUTHORIZE_DECIDE, CONSOLE_AUTHORIZE_MISSING_WARNING, CONSOLE_GATE, CONSOLE_PAGE_METADATA, ConsoleAccessDenied, type ConsoleAuthorize, ConsoleAuthorizeFilter, ConsoleAuthorizeGuard, type ConsoleAuthorizeResult, type ConsoleAuthorizer, type ConsoleAuthorizerClass, type ConsoleDecide, type ConsoleDecision, type ConsoleGate, ConsolePage, type ConsolePolicyCheck, DASHBOARD_API_PATH, DASHBOARD_BASE_PATH, DashboardService, DurableApiController, DurableApiControllerBase, DurableApiModule, DurableDashboardModule, type DurableDashboardOptions, DurableUiController, DurableUiControllerBase, UseConsoleAuthorize, type WorkflowLifecyclePage, authorizeByToken, normalizeConsoleResult, resolveConsoleAuthorize };
+export { CONSOLE_AUTHORIZE_DECIDE, CONSOLE_AUTHORIZE_MISSING_WARNING, CONSOLE_GATE, CONSOLE_PAGE_METADATA, CONSOLE_PUBLIC_METADATA, ConsoleAccessDenied, type ConsoleAuthorize, ConsoleAuthorizeFilter, ConsoleAuthorizeGuard, type ConsoleAuthorizeResult, type ConsoleAuthorizer, type ConsoleAuthorizerClass, type ConsoleDecide, type ConsoleDecision, type ConsoleGate, ConsolePage, type ConsolePolicyCheck, ConsolePublic, DASHBOARD_API_PATH, DASHBOARD_BASE_PATH, DashboardService, DurableApiController, DurableApiControllerBase, DurableApiModule, DurableDashboardModule, type DurableDashboardOptions, DurableUiController, DurableUiControllerBase, UseConsoleAuthorize, type WorkflowLifecyclePage, authorizeByToken, normalizeConsoleResult, resolveConsoleAuthorize };

package/dist/server/index.d.ts

@@ -88,6 +88,12 @@ declare class ConsoleAccessDenied extends HttpException {
         allowed: false;
     }>, page: boolean);
 }
+/**
+ * Marks a console route that is not part of the console: `authorize` does not apply to it. Used on
+ * the `ctx.webhook()` callback, which third parties call with the token as the secret.
+ */
+declare const CONSOLE_PUBLIC_METADATA = "@dudousxd/nestjs-durable-dashboard:console-public";
+declare const ConsolePublic: () => MethodDecorator;
 declare class ConsoleAuthorizeGuard implements CanActivate {
     private readonly decide;
     constructor(decide: ConsoleDecide);
@@ -422,9 +428,9 @@ declare class DurableApiControllerBase {
     }>;
     /**
      * Public callback endpoint for `ctx.webhook()`: a third party POSTs here (the url handed to it),
-     * and the body resumes the waiting run. NOTE: this is reachable by external systems — protect it
-     * by treating the token as a secret (it embeds runId:seq) and/or fronting it with signature
-     * verification in your own middleware.
+     * and the body resumes the waiting run. Not a console route: the console's `authorize` does not
+     * apply, the token is the secret. The app's `decorators` still do. Treat the token as a secret
+     * and/or front it with signature verification in your own middleware.
      */
     webhook(token: string, body: unknown): Promise<_dudousxd_nestjs_durable_core.RunResult>;
     /** Live query: the latest value a run published for `key` via `ctx.setEvent` (no side effect). */
@@ -443,7 +449,9 @@ declare class DurableApiController extends DurableApiControllerBase {
 
 interface DurableDashboardOptions {
     /**
-     * Who may use the console (the SPA, its JSON API, the run stream and the webhook route). One of:
+     * Who may use the console (the SPA, its JSON API and the run stream). Not the `ctx.webhook()`
+     * callback (`POST <apiBasePath>/webhooks/:token`), which third parties call with the token as the
+     * secret; {@link decorators} still apply to it. One of:
      *
      * - a function `(context) => boolean | { allowed } | { redirectTo }` (may be async);
      * - an `@Injectable()` class implementing {@link ConsoleAuthorizer} (constructor injection works;
@@ -588,4 +596,4 @@ declare class DurableUiControllerBase {
 declare class DurableUiController extends DurableUiControllerBase {
 }
 
-export { CONSOLE_AUTHORIZE_DECIDE, CONSOLE_AUTHORIZE_MISSING_WARNING, CONSOLE_GATE, CONSOLE_PAGE_METADATA, ConsoleAccessDenied, type ConsoleAuthorize, ConsoleAuthorizeFilter, ConsoleAuthorizeGuard, type ConsoleAuthorizeResult, type ConsoleAuthorizer, type ConsoleAuthorizerClass, type ConsoleDecide, type ConsoleDecision, type ConsoleGate, ConsolePage, type ConsolePolicyCheck, DASHBOARD_API_PATH, DASHBOARD_BASE_PATH, DashboardService, DurableApiController, DurableApiControllerBase, DurableApiModule, DurableDashboardModule, type DurableDashboardOptions, DurableUiController, DurableUiControllerBase, UseConsoleAuthorize, type WorkflowLifecyclePage, authorizeByToken, normalizeConsoleResult, resolveConsoleAuthorize };
+export { CONSOLE_AUTHORIZE_DECIDE, CONSOLE_AUTHORIZE_MISSING_WARNING, CONSOLE_GATE, CONSOLE_PAGE_METADATA, CONSOLE_PUBLIC_METADATA, ConsoleAccessDenied, type ConsoleAuthorize, ConsoleAuthorizeFilter, ConsoleAuthorizeGuard, type ConsoleAuthorizeResult, type ConsoleAuthorizer, type ConsoleAuthorizerClass, type ConsoleDecide, type ConsoleDecision, type ConsoleGate, ConsolePage, type ConsolePolicyCheck, ConsolePublic, DASHBOARD_API_PATH, DASHBOARD_BASE_PATH, DashboardService, DurableApiController, DurableApiControllerBase, DurableApiModule, DurableDashboardModule, type DurableDashboardOptions, DurableUiController, DurableUiControllerBase, UseConsoleAuthorize, type WorkflowLifecyclePage, authorizeByToken, normalizeConsoleResult, resolveConsoleAuthorize };

package/dist/server/index.js

@@ -239,6 +239,10 @@ var ConsoleAccessDenied = class extends HttpException {
     }, unauthenticated2 ? 401 : 403), this.decision = decision, this.page = page;
   }
 };
+var CONSOLE_PUBLIC_METADATA = `${PACKAGE}:console-public`;
+var ConsolePublic = /* @__PURE__ */ __name(() => (_target, _key, descriptor) => {
+  Reflect.defineMetadata(CONSOLE_PUBLIC_METADATA, true, descriptor.value);
+}, "ConsolePublic");
 var ConsoleAuthorizeGuard = class {
   static {
     __name(this, "ConsoleAuthorizeGuard");
@@ -248,6 +252,7 @@ var ConsoleAuthorizeGuard = class {
     this.decide = decide;
   }
   async canActivate(context) {
+    if (Reflect.getMetadata(CONSOLE_PUBLIC_METADATA, context.getHandler()) === true) return true;
     const decision = await this.decide(context);
     if (decision.allowed) return true;
     throw new ConsoleAccessDenied(decision, isPageNavigation(context));
@@ -308,7 +313,7 @@ var UseConsoleAuthorize = /* @__PURE__ */ __name(() => applyDecorators(UseGuards
 
 // src/server/dashboard.service.ts
 import { RunGateway, STATE_STORE_CANONICAL, TERMINAL_RUN_STATUSES, WorkflowEngine, collectMetrics, parseWebhookToken } from "@dudousxd/nestjs-durable-core";
-import { Inject as Inject2, Injectable as Injectable2, Optional } from "@nestjs/common";
+import { Inject as Inject2, Injectable as Injectable2, NotImplementedException, Optional } from "@nestjs/common";
 import { Observable } from "rxjs";
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -360,7 +365,7 @@ var DashboardService = class {
   */
   controlPlane() {
     if (!this.store || !this.engine) {
-      throw new Error("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
+      throw new NotImplementedException("This durable dashboard operation requires the control plane (not available on a tenant deployment).");
     }
     return {
       store: this.store,
@@ -624,7 +629,7 @@ DashboardService = _ts_decorate2([
 
 // src/server/durable-api.controller.ts
 import { ApplyFilter, ApplyFilterInterceptor, FilterRunner } from "@dudousxd/nestjs-filter";
-import { BadRequestException as BadRequestException2, Body, Controller, Get, Header, Headers, NotFoundException, NotImplementedException, Param, Post, Query, Res, Sse, UseFilters as UseFilters2, UseInterceptors } from "@nestjs/common";
+import { BadRequestException as BadRequestException2, Body, Controller, Get, Header, Headers, NotFoundException, NotImplementedException as NotImplementedException2, Param, Post, Query, Res, Sse, UseFilters as UseFilters2, UseInterceptors } from "@nestjs/common";
 
 // src/server/durable-run.ts
 var DurableRun = class {
@@ -1502,7 +1507,7 @@ var DurableApiControllerBase = class {
   */
   async workflowLifecycle(name) {
     const links = await this.dashboard.workflowLifecycle(name).catch(notSupportedByServer);
-    if (!links) throw new NotImplementedException("workflow lifecycle links need the control plane");
+    if (!links) throw new NotImplementedException2("workflow lifecycle links need the control plane");
     return links;
   }
   /** This deployment's durable role (control plane vs tenant) + tenant name — for the header badge. */
@@ -1598,7 +1603,7 @@ var DurableApiControllerBase = class {
       return notSupportedByServer(error);
     }
     if (!result) {
-      throw new NotImplementedException("republishing lifecycle events needs the control plane");
+      throw new NotImplementedException2("republishing lifecycle events needs the control plane");
     }
     return result;
   }
@@ -1615,9 +1620,9 @@ var DurableApiControllerBase = class {
   }
   /**
   * Public callback endpoint for `ctx.webhook()`: a third party POSTs here (the url handed to it),
-  * and the body resumes the waiting run. NOTE: this is reachable by external systems — protect it
-  * by treating the token as a secret (it embeds runId:seq) and/or fronting it with signature
-  * verification in your own middleware.
+  * and the body resumes the waiting run. Not a console route: the console's `authorize` does not
+  * apply, the token is the secret. The app's `decorators` still do. Treat the token as a secret
+  * and/or front it with signature verification in your own middleware.
   */
   async webhook(token, body) {
     const result = await this.dashboard.deliverWebhook(token, body);
@@ -1855,6 +1860,7 @@ _ts_decorate6([
   _ts_metadata5("design:returntype", Promise)
 ], DurableApiControllerBase.prototype, "redispatch", null);
 _ts_decorate6([
+  ConsolePublic(),
   Post("webhooks/:token"),
   _ts_param3(0, Param("token")),
   _ts_param3(1, Body()),
@@ -1908,7 +1914,7 @@ function notFound(error) {
 __name(notFound, "notFound");
 function notSupportedByServer(error) {
   if (error?.code === "unsupported-request") {
-    throw new NotImplementedException(error instanceof Error ? error.message : String(error));
+    throw new NotImplementedException2(error instanceof Error ? error.message : String(error));
   }
   throw error;
 }
@@ -2283,10 +2289,12 @@ export {
   CONSOLE_AUTHORIZE_MISSING_WARNING,
   CONSOLE_GATE,
   CONSOLE_PAGE_METADATA,
+  CONSOLE_PUBLIC_METADATA,
   ConsoleAccessDenied,
   ConsoleAuthorizeFilter,
   ConsoleAuthorizeGuard,
   ConsolePage,
+  ConsolePublic,
   DASHBOARD_API_PATH,
   DASHBOARD_BASE_PATH,
   DashboardService,