@foir/sdk 0.1.0 → 0.3.0

package/dist/server.js

@@ -184,6 +184,67 @@ function parseContextHeader(raw) {
   return out;
 }
 
+// src/server/require-scoped-token.ts
+var TOKEN_HEADER = "X-Foir-Token";
+var CONTEXT_HEADER = "X-Foir-Context";
+var DEFAULT_JWKS_URL = "https://api.foir.dev/.well-known/jwks.json";
+var ScopedTokenError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "ScopedTokenError";
+    this.status = status;
+  }
+};
+async function requireScopedToken(request, options) {
+  const token = request.headers.get(TOKEN_HEADER);
+  if (!token) {
+    throw new ScopedTokenError(
+      `missing ${TOKEN_HEADER} header \u2014 this route only accepts platform-dispatched requests`,
+      401
+    );
+  }
+  let claims;
+  try {
+    claims = await verifyScopedToken(
+      token,
+      options?.jwksUrl ?? DEFAULT_JWKS_URL,
+      options
+    );
+  } catch (err) {
+    throw new ScopedTokenError(
+      `invalid scoped token: ${err instanceof Error ? err.message : String(err)}`,
+      401
+    );
+  }
+  let subject;
+  try {
+    subject = parseSubject(claims.sub);
+  } catch (err) {
+    throw new ScopedTokenError(
+      `invalid scoped token subject: ${err instanceof Error ? err.message : String(err)}`,
+      401
+    );
+  }
+  if (options?.expectedProjectId && subject.projectId !== options.expectedProjectId) {
+    throw new ScopedTokenError(
+      "scoped token is bound to a different project",
+      403
+    );
+  }
+  if (options?.expectedTenantId && subject.tenantId !== options.expectedTenantId) {
+    throw new ScopedTokenError(
+      "scoped token is bound to a different tenant",
+      403
+    );
+  }
+  return {
+    claims,
+    subject,
+    context: parseContextHeader(request.headers.get(CONTEXT_HEADER))
+  };
+}
+
 // src/server/callback-client.ts
 function createCallbackClient(callback, opts) {
   const { executionId, signingSecret } = opts;
@@ -284,6 +345,7 @@ async function hmacSha256Hex(secret, body) {
   return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 export {
+  ScopedTokenError,
   ServerClientError,
   createCallbackClient,
   createServerClient,
@@ -291,6 +353,7 @@ export {
   parseSubject,
   recordsReadModels,
   recordsWriteModels,
+  requireScopedToken,
   verifyScopedToken,
   verifyWebhookSignature
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/sdk",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Official Foir SDK — editor iframe client + server-side platform helpers",
   "type": "module",
   "publishConfig": {
@@ -33,6 +33,18 @@
       "types": "./dist/auth.d.ts",
       "import": "./dist/auth.js"
     },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "import": "./dist/react.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "import": "./dist/next.js"
+    },
+    "./push": {
+      "types": "./dist/push.d.ts",
+      "import": "./dist/push.js"
+    },
     "./realtime": {
       "types": "./dist/realtime.d.ts",
       "import": "./dist/realtime.js"