@marcoappio/marco-config 4.0.0 → 4.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -64,7 +64,7 @@ const appwriteDeployments = {
|
|
|
64
64
|
},
|
|
65
65
|
production: {
|
|
66
66
|
applicationUrl: 'https://app.marcoapp.io',
|
|
67
|
-
endpoint: 'https://
|
|
67
|
+
endpoint: 'https://platform.marcoapp.io/v1',
|
|
68
68
|
oauthClientIds: {
|
|
69
69
|
google: '338197922176-oml1o2iputhhu3vijgue9h8sbfq17qme.apps.googleusercontent.com',
|
|
70
70
|
microsoft: 'd34106a5-5210-417e-bf38-6ddbe3aa91a7',
|
|
@@ -281,7 +281,7 @@ describe('appwrite', () => {
|
|
|
281
281
|
expect(appwrite.environments).toEqual(['development', 'production', 'staging']);
|
|
282
282
|
expect(appwrite.deployments.production).toEqual({
|
|
283
283
|
applicationUrl: 'https://app.marcoapp.io',
|
|
284
|
-
endpoint: 'https://
|
|
284
|
+
endpoint: 'https://platform.marcoapp.io/v1',
|
|
285
285
|
oauthClientIds: {
|
|
286
286
|
google: '338197922176-oml1o2iputhhu3vijgue9h8sbfq17qme.apps.googleusercontent.com',
|
|
287
287
|
microsoft: 'd34106a5-5210-417e-bf38-6ddbe3aa91a7',
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import * as v from 'valibot';
|
|
2
|
-
type AppwriteFunctionContext = 'authenticated' | 'internal' | 'webhook';
|
|
2
|
+
type AppwriteFunctionContext = 'authenticated' | 'internal' | 'public' | 'webhook';
|
|
3
3
|
export declare const appwriteFunctions: {
|
|
4
4
|
readonly api: {
|
|
5
5
|
readonly id: "marco-api";
|
|
@@ -111,6 +111,40 @@ export declare const appwriteFunctions: {
|
|
|
111
111
|
readonly failedAccountIds: v.ArraySchema<v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>, v.BrandAction<string, "AccountId">]>, undefined>, undefined>;
|
|
112
112
|
}, undefined>;
|
|
113
113
|
};
|
|
114
|
+
readonly authSendCode: {
|
|
115
|
+
errorSchema: v.StrictObjectSchema<{
|
|
116
|
+
readonly code: v.PicklistSchema<readonly ["AUTHENTICATION_FAILED", "AUTHORIZATION_FAILED", "CONFLICT", "INVALID_REQUEST", "NOT_FOUND", "PROVIDER_REJECTED", "TRANSIENT_FAILURE", "INTERNAL_ERROR"], undefined>;
|
|
117
|
+
readonly retryable: v.BooleanSchema<undefined>;
|
|
118
|
+
}, undefined>;
|
|
119
|
+
context: "public";
|
|
120
|
+
method: "POST";
|
|
121
|
+
path: "/auth/send-code";
|
|
122
|
+
requestSchema: v.StrictObjectSchema<{
|
|
123
|
+
readonly email: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RfcEmailAction<string, undefined>]>, undefined>;
|
|
124
|
+
readonly userId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 36, undefined>, v.RegexAction<string, undefined>]>;
|
|
125
|
+
}, undefined>;
|
|
126
|
+
responseSchema: v.StrictObjectSchema<{
|
|
127
|
+
readonly userId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 36, undefined>, v.RegexAction<string, undefined>]>;
|
|
128
|
+
}, undefined>;
|
|
129
|
+
};
|
|
130
|
+
readonly authVerifyCode: {
|
|
131
|
+
errorSchema: v.StrictObjectSchema<{
|
|
132
|
+
readonly code: v.PicklistSchema<readonly ["AUTHENTICATION_FAILED", "AUTHORIZATION_FAILED", "CONFLICT", "INVALID_REQUEST", "NOT_FOUND", "PROVIDER_REJECTED", "TRANSIENT_FAILURE", "INTERNAL_ERROR"], undefined>;
|
|
133
|
+
readonly retryable: v.BooleanSchema<undefined>;
|
|
134
|
+
}, undefined>;
|
|
135
|
+
context: "public";
|
|
136
|
+
method: "POST";
|
|
137
|
+
path: "/auth/verify-code";
|
|
138
|
+
requestSchema: v.StrictObjectSchema<{
|
|
139
|
+
readonly code: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, undefined>]>;
|
|
140
|
+
readonly email: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RfcEmailAction<string, undefined>]>, undefined>;
|
|
141
|
+
readonly userId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 36, undefined>, v.RegexAction<string, undefined>]>;
|
|
142
|
+
}, undefined>;
|
|
143
|
+
responseSchema: v.StrictObjectSchema<{
|
|
144
|
+
readonly secret: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>]>, undefined>;
|
|
145
|
+
readonly userId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 36, undefined>, v.RegexAction<string, undefined>]>;
|
|
146
|
+
}, undefined>;
|
|
147
|
+
};
|
|
114
148
|
readonly commands: {
|
|
115
149
|
errorSchema: v.StrictObjectSchema<{
|
|
116
150
|
readonly code: v.PicklistSchema<readonly ["AUTHENTICATION_FAILED", "AUTHORIZATION_FAILED", "CONFLICT", "INVALID_REQUEST", "NOT_FOUND", "PROVIDER_REJECTED", "TRANSIENT_FAILURE", "INTERNAL_ERROR"], undefined>;
|
|
@@ -463,7 +497,7 @@ export declare const appwriteFunctions: {
|
|
|
463
497
|
context: "webhook";
|
|
464
498
|
method: "GET";
|
|
465
499
|
path: "/v1/wh/oauth/callback";
|
|
466
|
-
requestSchema: v.
|
|
500
|
+
requestSchema: v.ObjectSchema<{
|
|
467
501
|
readonly code: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>]>, undefined>;
|
|
468
502
|
readonly state: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>]>, undefined>;
|
|
469
503
|
}, undefined>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../src/appwrite/functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAS5B,KAAK,uBAAuB,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,CAAA;
|
|
1
|
+
{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../src/appwrite/functions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAS5B,KAAK,uBAAuB,GAAG,eAAe,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAA;AA6MlF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWpB,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iBAAiB,CAAC,WAAW,CAAC,CAAA;AACvF,YAAY,EAAE,uBAAuB,EAAE,CAAA;AACvC,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,QAAQ,CAAA;AACnD,MAAM,MAAM,yBAAyB,CAAC,SAAS,SAAS,oBAAoB,IAAI,SAAS,SAAS,oBAAoB,GAClH,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,GACrD,KAAK,CAAA;AACT,MAAM,MAAM,qBAAqB,CAAC,SAAS,SAAS,oBAAoB,EAAE,MAAM,SAAS,yBAAyB,CAAC,SAAS,CAAC,IAAI,SAAS,SAAS,oBAAoB,GACnK,MAAM,SAAS,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,GAClE,CAAC,OAAO,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GACvD,KAAK,GACP,KAAK,CAAA;AACT,MAAM,MAAM,uBAAuB,CAAC,SAAS,SAAS,oBAAoB,EAAE,MAAM,SAAS,yBAAyB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CACtJ,SAAS,EACT,MAAM,CACP,SAAS;IAAE,aAAa,EAAE,MAAM,OAAO,SAAS,CAAC,CAAC,aAAa,CAAA;CAAE,GAC9D,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GACtB,KAAK,CAAA;AACT,MAAM,MAAM,wBAAwB,CAAC,SAAS,SAAS,oBAAoB,EAAE,MAAM,SAAS,yBAAyB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CACvJ,SAAS,EACT,MAAM,CACP,SAAS;IAAE,cAAc,EAAE,MAAM,OAAO,SAAS,CAAC,CAAC,aAAa,CAAA;CAAE,GAC/D,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GACtB,KAAK,CAAA"}
|
|
@@ -48,6 +48,21 @@ const connectionResultSchema = v.strictObject({
|
|
|
48
48
|
});
|
|
49
49
|
const completedSchema = v.strictObject({ state: v.literal('COMPLETED') });
|
|
50
50
|
const emptySchema = v.strictObject({});
|
|
51
|
+
const authUserIdSchema = appwriteRowIdSchema;
|
|
52
|
+
const authSendCodeRequestSchema = v.strictObject({
|
|
53
|
+
email: string.email(),
|
|
54
|
+
userId: authUserIdSchema,
|
|
55
|
+
});
|
|
56
|
+
const authSendCodeResponseSchema = v.strictObject({ userId: authUserIdSchema });
|
|
57
|
+
const authVerifyCodeRequestSchema = v.strictObject({
|
|
58
|
+
code: v.pipe(v.string(), v.regex(/^\d{6}$/)),
|
|
59
|
+
email: string.email(),
|
|
60
|
+
userId: authUserIdSchema,
|
|
61
|
+
});
|
|
62
|
+
const authVerifyCodeResponseSchema = v.strictObject({
|
|
63
|
+
secret: string.required(4096),
|
|
64
|
+
userId: authUserIdSchema,
|
|
65
|
+
});
|
|
51
66
|
const timestampSchema = v.pipe(v.string(), v.isoTimestamp(), v.check(timestamp => {
|
|
52
67
|
const milliseconds = Date.parse(timestamp);
|
|
53
68
|
return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === timestamp;
|
|
@@ -94,6 +109,20 @@ const apiRoutes = {
|
|
|
94
109
|
failedAccountIds: v.array(id.accountId.required()),
|
|
95
110
|
}),
|
|
96
111
|
}),
|
|
112
|
+
authSendCode: createRoute({
|
|
113
|
+
context: 'public',
|
|
114
|
+
method: 'POST',
|
|
115
|
+
path: '/auth/send-code',
|
|
116
|
+
requestSchema: authSendCodeRequestSchema,
|
|
117
|
+
responseSchema: authSendCodeResponseSchema,
|
|
118
|
+
}),
|
|
119
|
+
authVerifyCode: createRoute({
|
|
120
|
+
context: 'public',
|
|
121
|
+
method: 'POST',
|
|
122
|
+
path: '/auth/verify-code',
|
|
123
|
+
requestSchema: authVerifyCodeRequestSchema,
|
|
124
|
+
responseSchema: authVerifyCodeResponseSchema,
|
|
125
|
+
}),
|
|
97
126
|
commands: createRoute({
|
|
98
127
|
context: 'authenticated',
|
|
99
128
|
method: 'POST',
|
|
@@ -105,7 +134,7 @@ const apiRoutes = {
|
|
|
105
134
|
context: 'webhook',
|
|
106
135
|
method: 'GET',
|
|
107
136
|
path: oauth.redirectPath,
|
|
108
|
-
requestSchema: v.
|
|
137
|
+
requestSchema: v.object({
|
|
109
138
|
code: string.required(4096),
|
|
110
139
|
state: string.required(4096),
|
|
111
140
|
}),
|
|
@@ -114,6 +114,8 @@ describe('appwriteFunctions', () => {
|
|
|
114
114
|
it('publishes the complete Appwrite Function route manifest', () => {
|
|
115
115
|
expect([
|
|
116
116
|
{ functionId: appwriteFunctions.api.id, route: appwriteFunctions.api.routes.profileEnsure },
|
|
117
|
+
{ functionId: appwriteFunctions.api.id, route: appwriteFunctions.api.routes.authSendCode },
|
|
118
|
+
{ functionId: appwriteFunctions.api.id, route: appwriteFunctions.api.routes.authVerifyCode },
|
|
117
119
|
{ functionId: appwriteFunctions.api.id, route: appwriteFunctions.api.routes.commands },
|
|
118
120
|
{ functionId: appwriteFunctions.api.id, route: appwriteFunctions.api.routes.accountsConnect },
|
|
119
121
|
{ functionId: appwriteFunctions.api.id, route: appwriteFunctions.api.routes.accountsPoll },
|
|
@@ -131,6 +133,8 @@ describe('appwriteFunctions', () => {
|
|
|
131
133
|
path: route.path,
|
|
132
134
|
}))).toEqual([
|
|
133
135
|
{ context: 'authenticated', functionId: 'marco-api', method: 'POST', path: '/profile/ensure' },
|
|
136
|
+
{ context: 'public', functionId: 'marco-api', method: 'POST', path: '/auth/send-code' },
|
|
137
|
+
{ context: 'public', functionId: 'marco-api', method: 'POST', path: '/auth/verify-code' },
|
|
134
138
|
{ context: 'authenticated', functionId: 'marco-api', method: 'POST', path: '/commands' },
|
|
135
139
|
{ context: 'authenticated', functionId: 'marco-api', method: 'POST', path: '/accounts/connect' },
|
|
136
140
|
{ context: 'authenticated', functionId: 'marco-api', method: 'POST', path: '/accounts/poll' },
|
|
@@ -143,14 +147,79 @@ describe('appwriteFunctions', () => {
|
|
|
143
147
|
{ context: 'internal', functionId: 'marco-worker', method: 'POST', path: '/jobs/run' },
|
|
144
148
|
]);
|
|
145
149
|
});
|
|
150
|
+
const authRoutes = [
|
|
151
|
+
{
|
|
152
|
+
request: { email: 'test-user-email-1@example.com', userId: 'test-appwrite-user-id-1' },
|
|
153
|
+
response: { userId: 'test-appwrite-user-id-1' },
|
|
154
|
+
route: () => appwriteFunctions.api.routes.authSendCode,
|
|
155
|
+
},
|
|
156
|
+
{
|
|
157
|
+
request: { code: '123456', email: 'test-user-email-1@example.com', userId: 'test-appwrite-user-id-1' },
|
|
158
|
+
response: { secret: 'test-appwrite-secret-1', userId: 'test-appwrite-user-id-1' },
|
|
159
|
+
route: () => appwriteFunctions.api.routes.authVerifyCode,
|
|
160
|
+
},
|
|
161
|
+
];
|
|
162
|
+
for (const { request, response, route } of authRoutes) {
|
|
163
|
+
it(`accepts the public ${route().path} contract`, () => {
|
|
164
|
+
expect(v.safeParse(route().requestSchema, request).success).toBe(true);
|
|
165
|
+
expect(v.safeParse(route().responseSchema, response).success).toBe(true);
|
|
166
|
+
});
|
|
167
|
+
it(`rejects unknown fields in the public ${route().path} contract`, () => {
|
|
168
|
+
expect(v.safeParse(route().requestSchema, { ...request, unexpected: true }).success).toBe(false);
|
|
169
|
+
expect(v.safeParse(route().responseSchema, { ...response, unexpected: true }).success).toBe(false);
|
|
170
|
+
});
|
|
171
|
+
}
|
|
172
|
+
for (const { description, request, route } of [
|
|
173
|
+
{
|
|
174
|
+
description: 'malformed email',
|
|
175
|
+
request: { email: 'not-an-email', userId: 'test-appwrite-user-id-1' },
|
|
176
|
+
route: () => appwriteFunctions.api.routes.authSendCode,
|
|
177
|
+
},
|
|
178
|
+
{
|
|
179
|
+
description: 'malformed code',
|
|
180
|
+
request: { code: '12345', email: 'test-user-email-1@example.com', userId: 'test-appwrite-user-id-1' },
|
|
181
|
+
route: () => appwriteFunctions.api.routes.authVerifyCode,
|
|
182
|
+
},
|
|
183
|
+
]) {
|
|
184
|
+
it(`rejects a public auth request with a ${description}`, () => {
|
|
185
|
+
expect(v.safeParse(route().requestSchema, request).success).toBe(false);
|
|
186
|
+
});
|
|
187
|
+
}
|
|
146
188
|
for (const { name, request, response, route } of routeFixtures) {
|
|
147
189
|
it(`accepts the ${name} request and response`, () => {
|
|
148
190
|
expect(v.safeParse(route().requestSchema, request).success).toBe(true);
|
|
149
191
|
expect(v.safeParse(route().responseSchema, response).success).toBe(true);
|
|
150
192
|
});
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
193
|
+
if (name !== 'OAuth webhook') {
|
|
194
|
+
it(`rejects caller ownership in the ${name} request and response`, () => {
|
|
195
|
+
expect(v.safeParse(route().requestSchema, { ...request, userId: 'another-user' }).success).toBe(false);
|
|
196
|
+
expect(v.safeParse(route().responseSchema, { ...response, userId: 'another-user' }).success).toBe(false);
|
|
197
|
+
});
|
|
198
|
+
}
|
|
199
|
+
}
|
|
200
|
+
it('accepts provider-owned OAuth callback parameters without passing them to the handler', () => {
|
|
201
|
+
const result = v.safeParse(appwriteFunctions.api.routes.oauthWebhook.requestSchema, {
|
|
202
|
+
authuser: '0',
|
|
203
|
+
code: 'test-authorisation-code-1',
|
|
204
|
+
iss: 'https://accounts.google.com',
|
|
205
|
+
scope: 'openid email profile',
|
|
206
|
+
state: 'test-state-1',
|
|
207
|
+
});
|
|
208
|
+
expect(result.success).toBe(true);
|
|
209
|
+
if (result.success) {
|
|
210
|
+
expect(result.output).toEqual({ code: 'test-authorisation-code-1', state: 'test-state-1' });
|
|
211
|
+
}
|
|
212
|
+
});
|
|
213
|
+
for (const { description, request } of [
|
|
214
|
+
{ description: 'missing code', request: { state: 'test-state-1' } },
|
|
215
|
+
{ description: 'empty code', request: { code: '', state: 'test-state-1' } },
|
|
216
|
+
{ description: 'oversized code', request: { code: 'a'.repeat(4097), state: 'test-state-1' } },
|
|
217
|
+
{ description: 'missing state', request: { code: 'test-authorisation-code-1' } },
|
|
218
|
+
{ description: 'empty state', request: { code: 'test-authorisation-code-1', state: '' } },
|
|
219
|
+
{ description: 'oversized state', request: { code: 'test-authorisation-code-1', state: 'a'.repeat(4097) } },
|
|
220
|
+
]) {
|
|
221
|
+
it(`rejects an OAuth callback with ${description}`, () => {
|
|
222
|
+
expect(v.safeParse(appwriteFunctions.api.routes.oauthWebhook.requestSchema, request).success).toBe(false);
|
|
154
223
|
});
|
|
155
224
|
}
|
|
156
225
|
it('rejects caller-selected accounts for manual polling', () => {
|