@forestadmin/agent-bff 1.10.0 → 1.12.0

package/dist/api-key/agent-token.d.ts

@@ -1,8 +1,14 @@
 import type { ResolvedApiKeyIdentity } from './api-key-client';
+import type { BffAccessTokenPayload } from '../oauth/bff-token';
 export declare const AGENT_TOKEN_EXPIRES_IN = "5m";
 export interface IssueAgentTokenParams {
     identity: ResolvedApiKeyIdentity;
     authSecret: string;
 }
+export interface IssueAgentTokenFromPrincipalParams {
+    principal: BffAccessTokenPayload;
+    authSecret: string;
+}
 export declare function issueAgentToken({ identity, authSecret }: IssueAgentTokenParams): string;
+export declare function issueAgentTokenFromPrincipal({ principal, authSecret, }: IssueAgentTokenFromPrincipalParams): string;
 //# sourceMappingURL=agent-token.d.ts.map

package/dist/api-key/agent-token.js

@@ -5,30 +5,54 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AGENT_TOKEN_EXPIRES_IN = void 0;
 exports.issueAgentToken = issueAgentToken;
+exports.issueAgentTokenFromPrincipal = issueAgentTokenFromPrincipal;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const bff_http_error_1 = require("../http/bff-http-error");
 exports.AGENT_TOKEN_EXPIRES_IN = '5m';
+const POSITIVE_INTEGER = /^[1-9]\d*$/;
 function tagsToRecord(tags) {
     return tags.reduce((memo, { key, value }) => ({ ...memo, [key]: value }), {});
 }
+function signWithSnakeCaseAliasesForRubyAndPythonAgents(claims, authSecret) {
+    const firstName = claims.firstName ?? '';
+    const lastName = claims.lastName ?? '';
+    return jsonwebtoken_1.default.sign({
+        ...claims,
+        firstName,
+        lastName,
+        first_name: firstName,
+        last_name: lastName,
+        rendering_id: claims.renderingId,
+        permission_level: claims.permissionLevel,
+    }, authSecret, { algorithm: 'HS256', expiresIn: exports.AGENT_TOKEN_EXPIRES_IN });
+}
 function issueAgentToken({ identity, authSecret }) {
     const { user, renderingId } = identity;
-    const firstName = user.firstName ?? '';
-    const lastName = user.lastName ?? '';
-    const tags = tagsToRecord(user.tags);
-    // snake_case aliases: Ruby/Python agents splat JWT claims into Caller (snake_case kwargs).
-    return jsonwebtoken_1.default.sign({
+    return signWithSnakeCaseAliasesForRubyAndPythonAgents({
         id: user.id,
         email: user.email,
-        firstName,
-        lastName,
+        firstName: user.firstName,
+        lastName: user.lastName,
         team: user.team,
         renderingId,
-        tags,
+        tags: tagsToRecord(user.tags),
         permissionLevel: user.permissionLevel,
-        first_name: firstName,
-        last_name: lastName,
-        rendering_id: renderingId,
-        permission_level: user.permissionLevel,
-    }, authSecret, { algorithm: 'HS256', expiresIn: exports.AGENT_TOKEN_EXPIRES_IN });
+    }, authSecret);
+}
+function issueAgentTokenFromPrincipal({ principal, authSecret, }) {
+    if (!POSITIVE_INTEGER.test(String(principal.rendering_id))) {
+        throw (0, bff_http_error_1.unauthorized)('The session carries no usable rendering');
+    }
+    return signWithSnakeCaseAliasesForRubyAndPythonAgents({
+        id: principal.id,
+        email: principal.email,
+        firstName: principal.first_name,
+        lastName: principal.last_name,
+        team: principal.team,
+        renderingId: Number(principal.rendering_id),
+        tags: principal.tags ?? {},
+        permissionLevel: principal.permission_level,
+        role: principal.role,
+    }, authSecret);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtdG9rZW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXBpLWtleS9hZ2VudC10b2tlbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFlQSwwQ0F5QkM7QUF0Q0QsZ0VBQXdDO0FBRTNCLFFBQUEsc0JBQXNCLEdBQUcsSUFBSSxDQUFDO0FBTzNDLFNBQVMsWUFBWSxDQUFDLElBQXNDO0lBQzFELE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsSUFBSSxFQUFFLENBQUMsR0FBRyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztBQUNoRixDQUFDO0FBRUQsU0FBZ0IsZUFBZSxDQUFDLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBeUI7SUFDN0UsTUFBTSxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsR0FBRyxRQUFRLENBQUM7SUFDdkMsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUM7SUFDdkMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsSUFBSSxFQUFFLENBQUM7SUFDckMsTUFBTSxJQUFJLEdBQUcsWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUVyQywyRkFBMkY7SUFDM0YsT0FBTyxzQkFBWSxDQUFDLElBQUksQ0FDdEI7UUFDRSxFQUFFLEVBQUUsSUFBSSxDQUFDLEVBQUU7UUFDWCxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUs7UUFDakIsU0FBUztRQUNULFFBQVE7UUFDUixJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7UUFDZixXQUFXO1FBQ1gsSUFBSTtRQUNKLGVBQWUsRUFBRSxJQUFJLENBQUMsZUFBZTtRQUNyQyxVQUFVLEVBQUUsU0FBUztRQUNyQixTQUFTLEVBQUUsUUFBUTtRQUNuQixZQUFZLEVBQUUsV0FBVztRQUN6QixnQkFBZ0IsRUFBRSxJQUFJLENBQUMsZUFBZTtLQUN2QyxFQUNELFVBQVUsRUFDVixFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLDhCQUFzQixFQUFFLENBQzFELENBQUM7QUFDSixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtdG9rZW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXBpLWtleS9hZ2VudC10b2tlbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUEyREEsMENBZ0JDO0FBRUQsb0VBc0JDO0FBaEdELGdFQUF3QztBQUV4QywyREFBc0Q7QUFFekMsUUFBQSxzQkFBc0IsR0FBRyxJQUFJLENBQUM7QUFZM0MsTUFBTSxnQkFBZ0IsR0FBRyxZQUFZLENBQUM7QUFFdEMsU0FBUyxZQUFZLENBQUMsSUFBc0M7SUFDMUQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsR0FBRyxJQUFJLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0FBQ2hGLENBQUM7QUFjRCxTQUFTLDhDQUE4QyxDQUNyRCxNQUF5QixFQUN6QixVQUFrQjtJQUVsQixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQztJQUN6QyxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsUUFBUSxJQUFJLEVBQUUsQ0FBQztJQUV2QyxPQUFPLHNCQUFZLENBQUMsSUFBSSxDQUN0QjtRQUNFLEdBQUcsTUFBTTtRQUNULFNBQVM7UUFDVCxRQUFRO1FBQ1IsVUFBVSxFQUFFLFNBQVM7UUFDckIsU0FBUyxFQUFFLFFBQVE7UUFDbkIsWUFBWSxFQUFFLE1BQU0sQ0FBQyxXQUFXO1FBQ2hDLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxlQUFlO0tBQ3pDLEVBQ0QsVUFBVSxFQUNWLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsOEJBQXNCLEVBQUUsQ0FDMUQsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFnQixlQUFlLENBQUMsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUF5QjtJQUM3RSxNQUFNLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxHQUFHLFFBQVEsQ0FBQztJQUV2QyxPQUFPLDhDQUE4QyxDQUNuRDtRQUNFLEVBQUUsRUFBRSxJQUFJLENBQUMsRUFBRTtRQUNYLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSztRQUNqQixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7UUFDekIsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO1FBQ3ZCLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtRQUNmLFdBQVc7UUFDWCxJQUFJLEVBQUUsWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7UUFDN0IsZUFBZSxFQUFFLElBQUksQ0FBQyxlQUFlO0tBQ3RDLEVBQ0QsVUFBVSxDQUNYLENBQUM7QUFDSixDQUFDO0FBRUQsU0FBZ0IsNEJBQTRCLENBQUMsRUFDM0MsU0FBUyxFQUNULFVBQVUsR0FDeUI7SUFDbkMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMzRCxNQUFNLElBQUEsNkJBQVksRUFBQyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7SUFFRCxPQUFPLDhDQUE4QyxDQUNuRDtRQUNFLEVBQUUsRUFBRSxTQUFTLENBQUMsRUFBRTtRQUNoQixLQUFLLEVBQUUsU0FBUyxDQUFDLEtBQUs7UUFDdEIsU0FBUyxFQUFFLFNBQVMsQ0FBQyxVQUFVO1FBQy9CLFFBQVEsRUFBRSxTQUFTLENBQUMsU0FBUztRQUM3QixJQUFJLEVBQUUsU0FBUyxDQUFDLElBQUk7UUFDcEIsV0FBVyxFQUFFLE1BQU0sQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDO1FBQzNDLElBQUksRUFBRSxTQUFTLENBQUMsSUFBSSxJQUFJLEVBQUU7UUFDMUIsZUFBZSxFQUFFLFNBQVMsQ0FBQyxnQkFBZ0I7UUFDM0MsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJO0tBQ3JCLEVBQ0QsVUFBVSxDQUNYLENBQUM7QUFDSixDQUFDIn0=

package/dist/auth/auth-mode-middleware.js

@@ -7,6 +7,7 @@ exports.BFF_KEY_HEADER = void 0;
 exports.default = createAuthModeMiddleware;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const auth_mode_1 = require("./auth-mode");
+const agent_token_1 = require("../api-key/agent-token");
 const bff_http_error_1 = require("../http/bff-http-error");
 const bff_token_1 = require("../oauth/bff-token");
 exports.BFF_KEY_HEADER = 'X-Forest-Bff-Key';
@@ -45,9 +46,12 @@ function createAuthModeMiddleware({ authSecret, }) {
         const mode = (0, auth_mode_1.resolveAuthMode)({ hasBearer: bearer !== undefined, hasApiKey: apiKey !== '' });
         ctx.state.authMode = mode;
         if (mode === 'oauth') {
-            ctx.state.principal = verifyBffAccess(bearer, authSecret);
+            const principal = verifyBffAccess(bearer, authSecret);
+            ctx.state.principal = principal;
+            ctx.state.agentToken = (0, agent_token_1.issueAgentTokenFromPrincipal)({ principal, authSecret });
+            ctx.set('Cache-Control', 'no-store');
         }
         await next();
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC1tb2RlLW1pZGRsZXdhcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXV0aC9hdXRoLW1vZGUtbWlkZGxld2FyZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFtREEsMkNBaUJDO0FBakVELGdFQUF3QztBQUV4QywyQ0FBa0U7QUFDbEUsMkRBQXNFO0FBQ3RFLGtEQUEyRDtBQUU5QyxRQUFBLGNBQWMsR0FBRyxrQkFBa0IsQ0FBQztBQU1qRCxTQUFTLGVBQWUsQ0FBQyxLQUFhLEVBQUUsVUFBa0I7SUFDeEQsSUFBSSxPQUFnQixDQUFDO0lBRXJCLDZFQUE2RTtJQUM3RSw4RUFBOEU7SUFDOUUsa0VBQWtFO0lBQ2xFLElBQUksQ0FBQztRQUNILE9BQU8sR0FBRyxzQkFBWSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsVUFBVSxFQUFFO1lBQy9DLFVBQVUsRUFBRSxDQUFDLE9BQU8sQ0FBQztZQUNyQixnQkFBZ0IsRUFBRSxJQUFJO1NBQ3ZCLENBQUMsQ0FBQztJQUNMLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLElBQUEsNkJBQVksR0FBRSxDQUFDO0lBQ3ZCLENBQUM7SUFFRCxJQUNFLE9BQU8sT0FBTyxLQUFLLFFBQVE7UUFDM0IsT0FBTyxLQUFLLElBQUk7UUFDZixPQUE4QixDQUFDLElBQUksS0FBSyxpQ0FBcUIsRUFDOUQsQ0FBQztRQUNELE1BQU0sSUFBQSw2QkFBWSxHQUFFLENBQUM7SUFDdkIsQ0FBQztJQUVELE1BQU0sRUFBRSxHQUFHLEVBQUUsR0FBRyxPQUE0QixDQUFDO0lBRTdDLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDNUIsTUFBTSxJQUFBLDZCQUFZLEdBQUUsQ0FBQztJQUN2QixDQUFDO0lBRUQsSUFBSSxHQUFHLEdBQUcsSUFBSSxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQzdCLE1BQU0sSUFBQSwrQkFBYyxHQUFFLENBQUM7SUFDekIsQ0FBQztJQUVELE9BQU8sT0FBZ0MsQ0FBQztBQUMxQyxDQUFDO0FBRUQsU0FBd0Isd0JBQXdCLENBQUMsRUFDL0MsVUFBVSxHQUNnQjtJQUMxQixPQUFPLEtBQUssVUFBVSxrQkFBa0IsQ0FBQyxHQUFHLEVBQUUsSUFBSTtRQUNoRCxNQUFNLE1BQU0sR0FBRyxJQUFBLDhCQUFrQixFQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQztRQUM1RCxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsR0FBRyxDQUFDLHNCQUFjLENBQUMsQ0FBQztRQUV2QyxNQUFNLElBQUksR0FBRyxJQUFBLDJCQUFlLEVBQUMsRUFBRSxTQUFTLEVBQUUsTUFBTSxLQUFLLFNBQVMsRUFBRSxTQUFTLEVBQUUsTUFBTSxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFNUYsR0FBRyxDQUFDLEtBQUssQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO1FBRTFCLElBQUksSUFBSSxLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQ3JCLEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBUyxHQUFHLGVBQWUsQ0FBQyxNQUFnQixFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3RFLENBQUM7UUFFRCxNQUFNLElBQUksRUFBRSxDQUFDO0lBQ2YsQ0FBQyxDQUFDO0FBQ0osQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC1tb2RlLW1pZGRsZXdhcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXV0aC9hdXRoLW1vZGUtbWlkZGxld2FyZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFvREEsMkNBb0JDO0FBckVELGdFQUF3QztBQUV4QywyQ0FBa0U7QUFDbEUsd0RBQXNFO0FBQ3RFLDJEQUFzRTtBQUN0RSxrREFBMkQ7QUFFOUMsUUFBQSxjQUFjLEdBQUcsa0JBQWtCLENBQUM7QUFNakQsU0FBUyxlQUFlLENBQUMsS0FBYSxFQUFFLFVBQWtCO0lBQ3hELElBQUksT0FBZ0IsQ0FBQztJQUVyQiw2RUFBNkU7SUFDN0UsOEVBQThFO0lBQzlFLGtFQUFrRTtJQUNsRSxJQUFJLENBQUM7UUFDSCxPQUFPLEdBQUcsc0JBQVksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRTtZQUMvQyxVQUFVLEVBQUUsQ0FBQyxPQUFPLENBQUM7WUFDckIsZ0JBQWdCLEVBQUUsSUFBSTtTQUN2QixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsTUFBTSxJQUFBLDZCQUFZLEdBQUUsQ0FBQztJQUN2QixDQUFDO0lBRUQsSUFDRSxPQUFPLE9BQU8sS0FBSyxRQUFRO1FBQzNCLE9BQU8sS0FBSyxJQUFJO1FBQ2YsT0FBOEIsQ0FBQyxJQUFJLEtBQUssaUNBQXFCLEVBQzlELENBQUM7UUFDRCxNQUFNLElBQUEsNkJBQVksR0FBRSxDQUFDO0lBQ3ZCLENBQUM7SUFFRCxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsT0FBNEIsQ0FBQztJQUU3QyxJQUFJLE9BQU8sR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzVCLE1BQU0sSUFBQSw2QkFBWSxHQUFFLENBQUM7SUFDdkIsQ0FBQztJQUVELElBQUksR0FBRyxHQUFHLElBQUksSUFBSSxJQUFJLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUM3QixNQUFNLElBQUEsK0JBQWMsR0FBRSxDQUFDO0lBQ3pCLENBQUM7SUFFRCxPQUFPLE9BQWdDLENBQUM7QUFDMUMsQ0FBQztBQUVELFNBQXdCLHdCQUF3QixDQUFDLEVBQy9DLFVBQVUsR0FDZ0I7SUFDMUIsT0FBTyxLQUFLLFVBQVUsa0JBQWtCLENBQUMsR0FBRyxFQUFFLElBQUk7UUFDaEQsTUFBTSxNQUFNLEdBQUcsSUFBQSw4QkFBa0IsRUFBQyxHQUFHLENBQUMsR0FBRyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUM7UUFDNUQsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxzQkFBYyxDQUFDLENBQUM7UUFFdkMsTUFBTSxJQUFJLEdBQUcsSUFBQSwyQkFBZSxFQUFDLEVBQUUsU0FBUyxFQUFFLE1BQU0sS0FBSyxTQUFTLEVBQUUsU0FBUyxFQUFFLE1BQU0sS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRTVGLEdBQUcsQ0FBQyxLQUFLLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQztRQUUxQixJQUFJLElBQUksS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUNyQixNQUFNLFNBQVMsR0FBRyxlQUFlLENBQUMsTUFBZ0IsRUFBRSxVQUFVLENBQUMsQ0FBQztZQUNoRSxHQUFHLENBQUMsS0FBSyxDQUFDLFNBQVMsR0FBRyxTQUFTLENBQUM7WUFDaEMsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFVLEdBQUcsSUFBQSwwQ0FBNEIsRUFBQyxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO1lBQy9FLEdBQUcsQ0FBQyxHQUFHLENBQUMsZUFBZSxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7UUFFRCxNQUFNLElBQUksRUFBRSxDQUFDO0lBQ2YsQ0FBQyxDQUFDO0FBQ0osQ0FBQyJ9

package/dist/cors/cors-middleware.d.ts

@@ -1,6 +1,6 @@
 import type { Middleware } from 'koa';
 export declare const ALLOWED_METHODS = "GET, POST, PUT, PATCH, DELETE, OPTIONS";
-export declare const ALLOWED_HEADERS = "Authorization, Content-Type, X-Forest-Timezone, X-Forest-Bff-Key, X-Request-Id";
+export declare const ALLOWED_HEADERS = "Authorization, Content-Type, X-Forest-Timezone, X-Forest-Bff-Key, X-Request-Id, Forest-Projection";
 export declare const PREFLIGHT_MAX_AGE_SECONDS = 600;
 export interface CorsMiddlewareOptions {
     allowedOrigins: string[];

package/dist/cors/cors-middleware.js

@@ -4,7 +4,7 @@ exports.PREFLIGHT_MAX_AGE_SECONDS = exports.ALLOWED_HEADERS = exports.ALLOWED_ME
 exports.default = createCorsMiddleware;
 const origin_1 = require("./origin");
 exports.ALLOWED_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
-exports.ALLOWED_HEADERS = 'Authorization, Content-Type, X-Forest-Timezone, X-Forest-Bff-Key, X-Request-Id';
+exports.ALLOWED_HEADERS = 'Authorization, Content-Type, X-Forest-Timezone, X-Forest-Bff-Key, X-Request-Id, Forest-Projection';
 exports.PREFLIGHT_MAX_AGE_SECONDS = 600;
 function createCorsMiddleware({ allowedOrigins, }) {
     return async function corsMiddleware(ctx, next) {
@@ -26,4 +26,4 @@ function createCorsMiddleware({ allowedOrigins, }) {
         await next();
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29ycy1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvcnMvY29ycy1taWRkbGV3YXJlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQWFBLHVDQTBCQztBQXJDRCxxQ0FBeUM7QUFFNUIsUUFBQSxlQUFlLEdBQUcsd0NBQXdDLENBQUM7QUFDM0QsUUFBQSxlQUFlLEdBQzFCLGdGQUFnRixDQUFDO0FBQ3RFLFFBQUEseUJBQXlCLEdBQUcsR0FBRyxDQUFDO0FBTTdDLFNBQXdCLG9CQUFvQixDQUFDLEVBQzNDLGNBQWMsR0FDUTtJQUN0QixPQUFPLEtBQUssVUFBVSxjQUFjLENBQUMsR0FBRyxFQUFFLElBQUk7UUFDNUMsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUVqQyxJQUFJLE1BQU07WUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRS9CLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBQSxzQkFBYSxFQUFDLE1BQU0sRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO1FBRXZFLElBQUksT0FBTztZQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsNkJBQTZCLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFFNUQsSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzdCLElBQUksT0FBTyxFQUFFLENBQUM7Z0JBQ1osR0FBRyxDQUFDLEdBQUcsQ0FBQyw4QkFBOEIsRUFBRSx1QkFBZSxDQUFDLENBQUM7Z0JBQ3pELEdBQUcsQ0FBQyxHQUFHLENBQUMsOEJBQThCLEVBQUUsdUJBQWUsQ0FBQyxDQUFDO2dCQUN6RCxHQUFHLENBQUMsR0FBRyxDQUFDLHdCQUF3QixFQUFFLE1BQU0sQ0FBQyxpQ0FBeUIsQ0FBQyxDQUFDLENBQUM7WUFDdkUsQ0FBQztZQUVELEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO1lBRWpCLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUMsQ0FBQztBQUNKLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29ycy1taWRkbGV3YXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvcnMvY29ycy1taWRkbGV3YXJlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQWFBLHVDQTBCQztBQXJDRCxxQ0FBeUM7QUFFNUIsUUFBQSxlQUFlLEdBQUcsd0NBQXdDLENBQUM7QUFDM0QsUUFBQSxlQUFlLEdBQzFCLG1HQUFtRyxDQUFDO0FBQ3pGLFFBQUEseUJBQXlCLEdBQUcsR0FBRyxDQUFDO0FBTTdDLFNBQXdCLG9CQUFvQixDQUFDLEVBQzNDLGNBQWMsR0FDUTtJQUN0QixPQUFPLEtBQUssVUFBVSxjQUFjLENBQUMsR0FBRyxFQUFFLElBQUk7UUFDNUMsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUVqQyxJQUFJLE1BQU07WUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRS9CLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBQSxzQkFBYSxFQUFDLE1BQU0sRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO1FBRXZFLElBQUksT0FBTztZQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsNkJBQTZCLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFFNUQsSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzdCLElBQUksT0FBTyxFQUFFLENBQUM7Z0JBQ1osR0FBRyxDQUFDLEdBQUcsQ0FBQyw4QkFBOEIsRUFBRSx1QkFBZSxDQUFDLENBQUM7Z0JBQ3pELEdBQUcsQ0FBQyxHQUFHLENBQUMsOEJBQThCLEVBQUUsdUJBQWUsQ0FBQyxDQUFDO2dCQUN6RCxHQUFHLENBQUMsR0FBRyxDQUFDLHdCQUF3QixFQUFFLE1BQU0sQ0FBQyxpQ0FBeUIsQ0FBQyxDQUFDLENBQUM7WUFDdkUsQ0FBQztZQUVELEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO1lBRWpCLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxJQUFJLEVBQUUsQ0FBQztJQUNmLENBQUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist/http/agent-route-helpers.js

@@ -29,9 +29,6 @@ async function resolveReadModel(store) {
         throw error;
     }
 }
-// The agent token is minted only on the API-key path; the OAuth path sets a principal but no agent
-// token yet. Fail closed instead of calling the agent with `Bearer undefined`.
-// TODO(PRD-637): mint an agent token from the OAuth principal so agent routes work in OAuth mode.
 function requireAgentToken(ctx) {
     const token = ctx.state.agentToken;
     if (!token)
@@ -48,4 +45,4 @@ async function callAgent(fn, logger) {
         throw (0, agent_error_mapper_1.mapAgentError)(error, { logger });
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtcm91dGUtaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9odHRwL2FnZW50LXJvdXRlLWhlbHBlcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFVQSxzQ0FNQztBQUVELDRDQU9DO0FBS0QsOENBS0M7QUFJRCw4QkFNQztBQXhDRCw2REFBcUQ7QUFDckQscURBQWdEO0FBQ2hELHlEQUF1RTtBQUN2RSxrRUFBMEQ7QUFFMUQsU0FBZ0IsYUFBYSxDQUFDLEdBQVcsRUFBRSxLQUFhO0lBQ3RELElBQUksQ0FBQztRQUNILE9BQU8sa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDakMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE1BQU0sSUFBQSxpQ0FBYyxFQUFDLGFBQWEsS0FBSyxVQUFVLENBQUMsQ0FBQztJQUNyRCxDQUFDO0FBQ0gsQ0FBQztBQUVNLEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxLQUFxQjtJQUMxRCxJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDO0lBQ3BDLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksZ0JBQXNCO1lBQUUsTUFBTSxJQUFBLG9DQUFpQixHQUFFLENBQUM7UUFDdkUsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO0FBQ0gsQ0FBQztBQUVELG1HQUFtRztBQUNuRywrRUFBK0U7QUFDL0Usa0dBQWtHO0FBQ2xHLFNBQWdCLGlCQUFpQixDQUFDLEdBQVk7SUFDNUMsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFnQyxDQUFDO0lBQ3pELElBQUksQ0FBQyxLQUFLO1FBQUUsTUFBTSxJQUFBLDZCQUFZLEVBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUV4RSxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRCxtR0FBbUc7QUFDbkcsNkRBQTZEO0FBQ3RELEtBQUssVUFBVSxTQUFTLENBQUksRUFBb0IsRUFBRSxNQUFjO0lBQ3JFLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxFQUFFLEVBQUUsQ0FBQztJQUNwQixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE1BQU0sSUFBQSxrQ0FBYSxFQUFDLEtBQUssRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDekMsQ0FBQztBQUNILENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWdlbnQtcm91dGUtaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9odHRwL2FnZW50LXJvdXRlLWhlbHBlcnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFVQSxzQ0FNQztBQUVELDRDQU9DO0FBRUQsOENBS0M7QUFJRCw4QkFNQztBQXJDRCw2REFBcUQ7QUFDckQscURBQWdEO0FBQ2hELHlEQUF1RTtBQUN2RSxrRUFBMEQ7QUFFMUQsU0FBZ0IsYUFBYSxDQUFDLEdBQVcsRUFBRSxLQUFhO0lBQ3RELElBQUksQ0FBQztRQUNILE9BQU8sa0JBQWtCLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDakMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE1BQU0sSUFBQSxpQ0FBYyxFQUFDLGFBQWEsS0FBSyxVQUFVLENBQUMsQ0FBQztJQUNyRCxDQUFDO0FBQ0gsQ0FBQztBQUVNLEtBQUssVUFBVSxnQkFBZ0IsQ0FBQyxLQUFxQjtJQUMxRCxJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDO0lBQ3BDLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksZ0JBQXNCO1lBQUUsTUFBTSxJQUFBLG9DQUFpQixHQUFFLENBQUM7UUFDdkUsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQWdCLGlCQUFpQixDQUFDLEdBQVk7SUFDNUMsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFnQyxDQUFDO0lBQ3pELElBQUksQ0FBQyxLQUFLO1FBQUUsTUFBTSxJQUFBLDZCQUFZLEVBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUV4RSxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUM7QUFFRCxtR0FBbUc7QUFDbkcsNkRBQTZEO0FBQ3RELEtBQUssVUFBVSxTQUFTLENBQUksRUFBb0IsRUFBRSxNQUFjO0lBQ3JFLElBQUksQ0FBQztRQUNILE9BQU8sTUFBTSxFQUFFLEVBQUUsQ0FBQztJQUNwQixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE1BQU0sSUFBQSxrQ0FBYSxFQUFDLEtBQUssRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDekMsQ0FBQztBQUNILENBQUMifQ==

package/dist/oauth/bff-token.d.ts

@@ -18,6 +18,7 @@ export interface BffAccessTokenPayload {
     team: string;
     rendering_id: string;
     permission_level: string;
+    role?: string;
     tags: Record<string, string>;
 }
 export declare function issueBffAccessToken({ sid, user, renderingId, authSecret, expiresInSeconds, }: IssueBffAccessTokenParams): string;

package/dist/oauth/bff-token.js

@@ -19,6 +19,7 @@ function issueBffAccessToken({ sid, user, renderingId, authSecret, expiresInSeco
         team: user.team,
         rendering_id: String(renderingId),
         permission_level: user.permissionLevel,
+        role: user.role,
         tags: user.tags ?? {},
     };
     return jsonwebtoken_1.default.sign(payload, authSecret, {
@@ -26,4 +27,4 @@ function issueBffAccessToken({ sid, user, renderingId, authSecret, expiresInSeco
         expiresIn: Math.min(expiresInSeconds, exports.BFF_ACCESS_TOKEN_MAX_EXPIRES_IN),
     });
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmZmLXRva2VuLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL29hdXRoL2JmZi10b2tlbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUE0QkEsa0RBd0JDO0FBbERELGdFQUF3QztBQUUzQixRQUFBLHFCQUFxQixHQUFHLFlBQVksQ0FBQztBQUNyQyxRQUFBLCtCQUErQixHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUM7QUF1QnZELFNBQWdCLG1CQUFtQixDQUFDLEVBQ2xDLEdBQUcsRUFDSCxJQUFJLEVBQ0osV0FBVyxFQUNYLFVBQVUsRUFDVixnQkFBZ0IsR0FDVTtJQUMxQixNQUFNLE9BQU8sR0FBMEI7UUFDckMsSUFBSSxFQUFFLDZCQUFxQjtRQUMzQixHQUFHO1FBQ0gsRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFO1FBQ1gsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLO1FBQ2pCLFVBQVUsRUFBRSxJQUFJLENBQUMsU0FBUztRQUMxQixTQUFTLEVBQUUsSUFBSSxDQUFDLFFBQVE7UUFDeEIsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQ2YsWUFBWSxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDakMsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLGVBQWU7UUFDdEMsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLElBQUksRUFBRTtLQUN0QixDQUFDO0lBRUYsT0FBTyxzQkFBWSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsVUFBVSxFQUFFO1FBQzVDLFNBQVMsRUFBRSxPQUFPO1FBQ2xCLFNBQVMsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLGdCQUFnQixFQUFFLHVDQUErQixDQUFDO0tBQ3ZFLENBQUMsQ0FBQztBQUNMLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmZmLXRva2VuLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL29hdXRoL2JmZi10b2tlbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUE2QkEsa0RBeUJDO0FBcERELGdFQUF3QztBQUUzQixRQUFBLHFCQUFxQixHQUFHLFlBQVksQ0FBQztBQUNyQyxRQUFBLCtCQUErQixHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUM7QUF3QnZELFNBQWdCLG1CQUFtQixDQUFDLEVBQ2xDLEdBQUcsRUFDSCxJQUFJLEVBQ0osV0FBVyxFQUNYLFVBQVUsRUFDVixnQkFBZ0IsR0FDVTtJQUMxQixNQUFNLE9BQU8sR0FBMEI7UUFDckMsSUFBSSxFQUFFLDZCQUFxQjtRQUMzQixHQUFHO1FBQ0gsRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFO1FBQ1gsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLO1FBQ2pCLFVBQVUsRUFBRSxJQUFJLENBQUMsU0FBUztRQUMxQixTQUFTLEVBQUUsSUFBSSxDQUFDLFFBQVE7UUFDeEIsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQ2YsWUFBWSxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDakMsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLGVBQWU7UUFDdEMsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQ2YsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLElBQUksRUFBRTtLQUN0QixDQUFDO0lBRUYsT0FBTyxzQkFBWSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsVUFBVSxFQUFFO1FBQzVDLFNBQVMsRUFBRSxPQUFPO1FBQ2xCLFNBQVMsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLGdCQUFnQixFQUFFLHVDQUErQixDQUFDO0tBQ3ZFLENBQUMsQ0FBQztBQUNMLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestadmin/agent-bff",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "main": "dist/index.js",
   "bin": {
     "forest-bff": "dist/cli.js"