@faable/auth-sdk 2.0.1 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/FaableAuthApi.js +42 -1
- package/package.json +2 -2
- package/spec/openapi.json +1 -1
package/dist/FaableAuthApi.js
CHANGED
|
@@ -1,7 +1,35 @@
|
|
|
1
1
|
import { getDomain, isPlainObject, requireId } from "./helpers.js";
|
|
2
2
|
import { FaableApiError } from "./error_handler.js";
|
|
3
|
-
import { FaableApi } from "@faable/sdk-base";
|
|
3
|
+
import { FaableApi, authClientCredentials } from "@faable/sdk-base";
|
|
4
4
|
import { version } from "./version.js";
|
|
5
|
+
// auth-sdk exists to drive the Faable management API, so a client_credentials
|
|
6
|
+
// client should "just work" against it from `domain` alone. The management API
|
|
7
|
+
// audience is `faable:management:<account_id>`, where `<account_id>` is this
|
|
8
|
+
// host's tenant. We discover it from the public OIDC discovery document (which
|
|
9
|
+
// resolves the account by host and exposes its id as `account`) lazily on the
|
|
10
|
+
// first token request, and memoize it. Omitting `scope` then yields the full
|
|
11
|
+
// management catalog server-side (Auth0 parity), so no scope wiring is needed.
|
|
12
|
+
const discoverManagementAudience = (baseURL) => {
|
|
13
|
+
let cached;
|
|
14
|
+
return async () => {
|
|
15
|
+
if (cached)
|
|
16
|
+
return cached;
|
|
17
|
+
const url = `${baseURL}/.well-known/openid-configuration`;
|
|
18
|
+
const res = await fetch(url);
|
|
19
|
+
if (!res.ok) {
|
|
20
|
+
throw new FaableApiError(`FaableAuthApi: OIDC discovery failed (${res.status}) at ${url}. ` +
|
|
21
|
+
"Pass `auth.audience` explicitly if discovery is unavailable.");
|
|
22
|
+
}
|
|
23
|
+
const doc = (await res.json());
|
|
24
|
+
if (!doc.account) {
|
|
25
|
+
throw new FaableApiError(`FaableAuthApi: discovery at ${url} did not expose 'account' — the ` +
|
|
26
|
+
"auth server may be older than the management-audience support. " +
|
|
27
|
+
"Pass `auth.audience` explicitly (faable:management:<account_id>).");
|
|
28
|
+
}
|
|
29
|
+
cached = `faable:management:${doc.account}`;
|
|
30
|
+
return cached;
|
|
31
|
+
};
|
|
32
|
+
};
|
|
5
33
|
export class FaableAuthApi extends FaableApi {
|
|
6
34
|
constructor(params) {
|
|
7
35
|
if (!params?.domain) {
|
|
@@ -10,9 +38,22 @@ export class FaableAuthApi extends FaableApi {
|
|
|
10
38
|
"The hardcoded default was removed so SDK calls never target another tenant by accident.");
|
|
11
39
|
}
|
|
12
40
|
const baseURL = getDomain(params.domain);
|
|
41
|
+
// When authenticating via client_credentials without an explicit audience,
|
|
42
|
+
// default it to this tenant's management audience (discovered from the
|
|
43
|
+
// domain). Only when the resolved strategy is client_credentials — an
|
|
44
|
+
// api-key (or other) strategy has no audience.
|
|
45
|
+
const usesClientCredentials = !!params.auth &&
|
|
46
|
+
(!params.authStrategy || params.authStrategy === authClientCredentials);
|
|
47
|
+
const auth = usesClientCredentials && params.auth
|
|
48
|
+
? {
|
|
49
|
+
...params.auth,
|
|
50
|
+
audience: params.auth.audience ?? discoverManagementAudience(baseURL),
|
|
51
|
+
}
|
|
52
|
+
: params.auth;
|
|
13
53
|
super({
|
|
14
54
|
baseURL,
|
|
15
55
|
...params,
|
|
56
|
+
auth,
|
|
16
57
|
fetcher: {
|
|
17
58
|
...params?.fetcher,
|
|
18
59
|
headers: {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@faable/auth-sdk",
|
|
3
|
-
"version": "2.0
|
|
3
|
+
"version": "2.1.0",
|
|
4
4
|
"author": "Marc Pomar <marc@faable.com>",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
},
|
|
11
11
|
"type": "module",
|
|
12
12
|
"dependencies": {
|
|
13
|
-
"@faable/sdk-base": "^1.5.
|
|
13
|
+
"@faable/sdk-base": "^1.5.1"
|
|
14
14
|
},
|
|
15
15
|
"devDependencies": {
|
|
16
16
|
"@ava/typescript": "^5.0.0",
|
package/spec/openapi.json
CHANGED