@forumone/throughline-approvals 0.7.0 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +78 -0
- package/dist/tokens.d.ts.map +1 -1
- package/dist/tokens.js +21 -1
- package/dist/tokens.js.map +1 -1
- package/package.json +5 -5
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,83 @@
|
|
|
1
1
|
# @forumone/throughline-approvals
|
|
2
2
|
|
|
3
|
+
## 0.8.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- a12fa96: An emailed approval link lasts 72 hours, not 14 days
|
|
8
|
+
|
|
9
|
+
The action token's default lifetime outlived the thing it acts on. `plugin.ts`
|
|
10
|
+
expires an approval request after seven days (`expirationDays ?? 7`), so the
|
|
11
|
+
second week of a token's life could only ever act on a request that was already
|
|
12
|
+
gone — a link that still verifies and then finds nothing.
|
|
13
|
+
|
|
14
|
+
Seventy-two hours is what an approval actually needs: it covers a weekend, which
|
|
15
|
+
is the realistic gap between sending a request and somebody opening their mail,
|
|
16
|
+
and it stays well inside the request's own expiry so the two cannot disagree.
|
|
17
|
+
`createExpireStaleApprovalsFunction` handles anything that ages out either way.
|
|
18
|
+
|
|
19
|
+
The token is otherwise well built — HMAC-SHA256, constant-time compare, bound to
|
|
20
|
+
one approval, action and approver, single-use, with a confirmation interstitial
|
|
21
|
+
— so this narrows a window rather than closing a hole.
|
|
22
|
+
|
|
23
|
+
`maxAgeMs` per call is unchanged, so a host that wants the old behaviour can
|
|
24
|
+
pass it. **Minor rather than patch**: a link somebody was sitting on for a week
|
|
25
|
+
stops working, which is a behaviour change even though it is the intended one.
|
|
26
|
+
|
|
27
|
+
Nothing asserted the default before. There is now a test that does, and it says
|
|
28
|
+
why the number is what it is, so it cannot drift back without somebody deciding
|
|
29
|
+
to.
|
|
30
|
+
|
|
31
|
+
Found auditing the host that consumes this suite: forumone/forumone-2026#486,
|
|
32
|
+
F-13.
|
|
33
|
+
|
|
34
|
+
## 0.7.1
|
|
35
|
+
|
|
36
|
+
### Patch Changes
|
|
37
|
+
|
|
38
|
+
- 957403b: One `@types/node`, so a host does not end up with two copies of `@payloadcms/ui`
|
|
39
|
+
|
|
40
|
+
Twelve packages asked for `@types/node@^20.17.0` and `design-system-payload`
|
|
41
|
+
asked for `^24.13.2`. Inside this repository that is untidy. Inside a host that
|
|
42
|
+
consumes the suite from source — which is how `forumone/forumone-2026` uses it,
|
|
43
|
+
as a git submodule in one pnpm workspace — it is a runtime failure.
|
|
44
|
+
|
|
45
|
+
pnpm hashes a package's identity with its resolved peers. `publishing` and
|
|
46
|
+
`integrations` both take `@payloadcms/ui` as a peer _and_ as a devDependency, so
|
|
47
|
+
each got its own copy resolved against `@types/node@20`, while the host's copy
|
|
48
|
+
resolved against `@types/node@24`. Same version, 3.87.1, two directories:
|
|
49
|
+
|
|
50
|
+
apps/web → @payloadcms+ui@3.87.1_…_9ce0de5c…
|
|
51
|
+
packages/publishing → @payloadcms+ui@3.87.1_…_13184ec4…
|
|
52
|
+
packages/integrations → @payloadcms+ui@3.87.1_…_13184ec4…
|
|
53
|
+
|
|
54
|
+
Two directories are two module instances. Two instances of `@payloadcms/ui` are
|
|
55
|
+
two `ConfigContext` objects, and `PublishButton` read the one the admin's
|
|
56
|
+
provider had never populated:
|
|
57
|
+
|
|
58
|
+
TypeError: Cannot destructure property 'config' of useConfig() as it is undefined
|
|
59
|
+
|
|
60
|
+
The host saw an intermittent 500 on every admin document view — `PublishButton`
|
|
61
|
+
is installed on each collection with a publish policy, so lists, `/admin` and
|
|
62
|
+
the login screen were all fine and only editing broke. Nothing caught it:
|
|
63
|
+
install, `--frozen-lockfile`, typecheck, lint and every test passed, because the
|
|
64
|
+
two copies are byte-identical and the split exists only at module resolution.
|
|
65
|
+
forumone/forumone-2026#498.
|
|
66
|
+
|
|
67
|
+
Aligning on `^24.13.2` collapses them to one instance. Nothing here targets a
|
|
68
|
+
Node 20 API deliberately; the packages typecheck and test unchanged against the
|
|
69
|
+
newer types.
|
|
70
|
+
|
|
71
|
+
`create-throughline` keeps `^20.17.0` on purpose. It is the one package
|
|
72
|
+
declaring `engines.node: >=20.9.0`, and typechecking a CLI against types newer
|
|
73
|
+
than the runtime it promises to support is how a Node 24-only call ships to
|
|
74
|
+
somebody on Node 20.
|
|
75
|
+
|
|
76
|
+
- Updated dependencies [957403b]
|
|
77
|
+
- @forumone/throughline-core@0.8.1
|
|
78
|
+
- @forumone/throughline-plugin-contract@0.4.1
|
|
79
|
+
- @forumone/throughline-publishing@0.9.1
|
|
80
|
+
|
|
3
81
|
## 0.7.0
|
|
4
82
|
|
|
5
83
|
### Minor Changes
|
package/dist/tokens.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;AAE7E,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAA;CACjB;
|
|
1
|
+
{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;AAE7E,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAA;CACjB;AA2BD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhC;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAiDvB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGvE"}
|
package/dist/tokens.js
CHANGED
|
@@ -8,7 +8,27 @@
|
|
|
8
8
|
* Crypto uses the Web Crypto API (`crypto.subtle`) so the same code runs
|
|
9
9
|
* in Node and edge runtimes.
|
|
10
10
|
*/
|
|
11
|
-
|
|
11
|
+
/**
|
|
12
|
+
* How long an emailed action link stays usable.
|
|
13
|
+
*
|
|
14
|
+
* Was fourteen days, which outlived the thing the link acts on: `plugin.ts`
|
|
15
|
+
* expires an approval request after seven (`expirationDays ?? 7`), so the
|
|
16
|
+
* second week of a token's life could only ever act on something already gone.
|
|
17
|
+
*
|
|
18
|
+
* Seventy-two hours is what an approval actually needs. It covers a weekend,
|
|
19
|
+
* which is the realistic gap between sending a request and somebody opening
|
|
20
|
+
* their mail, and it is well inside the request's own expiry so the two cannot
|
|
21
|
+
* disagree. `createExpireStaleApprovalsFunction` handles anything that ages
|
|
22
|
+
* out either way.
|
|
23
|
+
*
|
|
24
|
+
* The token is otherwise well built — HMAC-SHA256, constant-time compare, bound
|
|
25
|
+
* to one approval, action and approver, single-use, with a confirmation
|
|
26
|
+
* interstitial — so this is narrowing a window rather than closing a hole.
|
|
27
|
+
* forumone/forumone-2026#486, F-13.
|
|
28
|
+
*
|
|
29
|
+
* Overridable per call through `maxAgeMs`, which is unchanged.
|
|
30
|
+
*/
|
|
31
|
+
const DEFAULT_MAX_AGE_MS = 72 * 60 * 60 * 1000;
|
|
12
32
|
const TOKEN_PARTS = 5;
|
|
13
33
|
const VALID_ACTIONS = new Set(['approve', 'decline', 'changes', 'discuss']);
|
|
14
34
|
const ENCODER = new TextEncoder();
|
package/dist/tokens.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,
|
|
1
|
+
{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC9C,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;AAC9F,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAkB,EAClB,MAAc;IAEd,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC3F,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACpD,OAAO,eAAe,CAAC,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC,CAAA;AACnD,CAAC;AAaD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,MAAc,EACd,UAAyB,EAAE;IAE3B,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAA;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAA;IAErF,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,KAMxE,CAAA;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAA;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;IACxD,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAA2B,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;IAC/C,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,WAAW,CACzC,GAAG,UAAU,IAAI,MAAM,IAAI,UAAU,IAAI,QAAQ,EAAE,EACnD,MAAM,CACP,CAAA;IACD,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAA;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IACrC,IAAI,GAAG,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAClD,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAA2B,EAAE,UAAU,EAAE,QAAQ,EAAE;KACjF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,KAAa;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACzC,OAAO,GAAG,IAAI,+BAA+B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAChF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAkB;IAC/C,IACE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9B,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9B,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC5D,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@forumone/throughline-approvals",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.8.0",
|
|
4
4
|
"description": "Conversational approval workflow server for Throughline. Provides the approval resolver the publishing server consumes plus MCP tools for requesting and responding to approvals.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -42,12 +42,12 @@
|
|
|
42
42
|
},
|
|
43
43
|
"dependencies": {
|
|
44
44
|
"zod": "^3.23.0",
|
|
45
|
-
"@forumone/throughline-core": "0.8.
|
|
46
|
-
"@forumone/throughline-plugin-contract": "0.4.
|
|
47
|
-
"@forumone/throughline-publishing": "0.9.
|
|
45
|
+
"@forumone/throughline-core": "0.8.1",
|
|
46
|
+
"@forumone/throughline-plugin-contract": "0.4.1",
|
|
47
|
+
"@forumone/throughline-publishing": "0.9.1"
|
|
48
48
|
},
|
|
49
49
|
"devDependencies": {
|
|
50
|
-
"@types/node": "^
|
|
50
|
+
"@types/node": "^24.13.2",
|
|
51
51
|
"eslint": "^9.15.0",
|
|
52
52
|
"inngest": "^4.2.0",
|
|
53
53
|
"payload": "^3.83.0",
|