@hazem3500/palette 0.9.110 → 0.9.111

package/dist/setup.js

@@ -1 +1 @@
-import{a as n,d as o}from"./chunk-U55ASP2Y.js";import"./chunk-KLPQTFVH.js";import"./chunk-RBHY7UDS.js";import"./chunk-LMXFSXO6.js";import"./chunk-DU7H4TEX.js";import"./chunk-5HZI7HRR.js";import"./chunk-2BS2OWWH.js";import"./chunk-J47R52WX.js";import"./chunk-VX6XCU4E.js";import"./chunk-4HBBEVFK.js";function r(r){return(t={})=>o(n({...r,...t}))}var t=r;export{t as defineKomo,r as definePalette};
+import{a as n,d as o}from"./chunk-DDYHX4RZ.js";import"./chunk-KLPQTFVH.js";import"./chunk-RBHY7UDS.js";import"./chunk-LMXFSXO6.js";import"./chunk-DU7H4TEX.js";import"./chunk-5HZI7HRR.js";import"./chunk-2BS2OWWH.js";import"./chunk-J47R52WX.js";import"./chunk-VX6XCU4E.js";import"./chunk-4HBBEVFK.js";function r(r){return(t={})=>o(n({...r,...t}))}var t=r;export{t as defineKomo,r as definePalette};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hazem3500/palette",
-  "version": "0.9.110",
+  "version": "0.9.111",
   "description": "Point, area, and threaded comments for website branches.",
   "type": "module",
   "license": "MIT",

package/server/index.ts

@@ -286,12 +286,10 @@ async function authenticate(
     .get("Authorization")
     ?.match(/^Bearer (.{1,200})$/)?.[1];
   check(bearer, 401, "Enter your name to comment.");
-  const { proxy, sessionMaxAge, allowGuests } = authOptions(env);
+  const { proxy, proxyAccessTokens, sessionMaxAge, allowGuests } = authOptions(env);
   if (isPersonalToken(bearer)) {
-    // A token would outlive the proxy's own sign-in checks; agents exchange
-    // their proxy identity for a session instead.
     check(
-      !proxy,
+      !proxy || proxyAccessTokens,
       403,
       "Access tokens are off behind the sign-in proxy. Use /auth/proxy/session."
     );
@@ -1055,7 +1053,7 @@ async function route(
   }
   if (accountRoute) {
     check(
-      !auth.proxy,
+      !auth.proxy || auth.proxyAccessTokens,
       403,
       "Access tokens are off behind the sign-in proxy. Use /auth/proxy/session."
     );
@@ -1072,6 +1070,7 @@ async function route(
         tokens: await listTokens(env, user.id),
         projects: await accountProjects(env, user.id),
         scopes: PAT_SCOPES,
+        ...(auth.proxy ? { policy: { explicitProjects: true, maxLifetimeDays: 365 } } : {}),
       });
     if (url.pathname === "/account/tokens" && request.method === "POST") {
       await limit(env, `pat:create:${user.id}`, 10, 3600);
@@ -1147,9 +1146,7 @@ async function route(
         !(await privateAccess(env, project)),
       private: await privateAccess(env, project),
       guestResolve: config.allowGuestResolve !== false,
-      // Signed-in Google accounts can manage personal access tokens here,
-      // except behind a sign-in proxy.
-      tokens: !auth.proxy,
+      tokens: !auth.proxy || auth.proxyAccessTokens,
       // Element snapshots are opt-in on the client; guests need project consent.
       snapshots: {
         guests: auth.allowGuests && config.allowGuestSnapshots === true,

package/server/proxy-auth.ts

@@ -27,6 +27,7 @@ export type AuthOptions = {
   signInPrefix: string;
   requireSessionForReads: boolean;
   allowGuests: boolean;
+  proxyAccessTokens: boolean;
   /** Session lifetime cap in milliseconds; undefined keeps the default. */
   sessionMaxAge?: number;
 };
@@ -95,6 +96,7 @@ function resolve(env: OptionEnv): AuthOptions {
   const allowGuests = flag(env, "PALETTE_ALLOW_GUESTS", true);
   return {
     proxy,
+    proxyAccessTokens: flag(env, "PALETTE_PROXY_ACCESS_TOKENS", false),
     signInPrefix,
     requireSessionForReads: !!proxy || requireSessionForReads,
     allowGuests: !proxy && allowGuests,

package/server/public-env.ts

@@ -20,6 +20,8 @@ export interface ServerEnv {
   PALETTE_PAUSED?: string;
   /** Trusted identity proxy that signs reviewers in, e.g. "gcp-iap". Off unless set. */
   PALETTE_PROXY_AUTH?: string;
+  /** Explicitly allow bounded, project-scoped access tokens behind a proxy. */
+  PALETTE_PROXY_ACCESS_TOKENS?: string;
   /** The audience the proxy signs its assertions for. */
   PALETTE_PROXY_AUDIENCE?: string;
   /** Older name: setting it alone turns on "gcp-iap" with this audience. */
@@ -53,6 +55,8 @@ export interface ServerEnv {
   KOMO_PAUSED?: string;
   /** @deprecated Read when PALETTE_PROXY_AUTH is unset. */
   KOMO_PROXY_AUTH?: string;
+  /** @deprecated Read when PALETTE_PROXY_ACCESS_TOKENS is unset. */
+  KOMO_PROXY_ACCESS_TOKENS?: string;
   /** @deprecated Read when PALETTE_PROXY_AUDIENCE is unset. */
   KOMO_PROXY_AUDIENCE?: string;
   /** @deprecated Read when PALETTE_IAP_AUDIENCE is unset. */