@marcoappio/marco-config 4.0.1 → 4.0.2

package/dist/appwrite/appwrite.js

@@ -64,7 +64,7 @@ const appwriteDeployments = {
     },
     production: {
         applicationUrl: 'https://app.marcoapp.io',
-        endpoint: 'https://api.marcoapp.io/v1',
+        endpoint: 'https://platform.marcoapp.io/v1',
         oauthClientIds: {
             google: '338197922176-oml1o2iputhhu3vijgue9h8sbfq17qme.apps.googleusercontent.com',
             microsoft: 'd34106a5-5210-417e-bf38-6ddbe3aa91a7',

package/dist/appwrite/appwrite.test.js

@@ -281,7 +281,7 @@ describe('appwrite', () => {
         expect(appwrite.environments).toEqual(['development', 'production', 'staging']);
         expect(appwrite.deployments.production).toEqual({
             applicationUrl: 'https://app.marcoapp.io',
-            endpoint: 'https://api.marcoapp.io/v1',
+            endpoint: 'https://platform.marcoapp.io/v1',
             oauthClientIds: {
                 google: '338197922176-oml1o2iputhhu3vijgue9h8sbfq17qme.apps.googleusercontent.com',
                 microsoft: 'd34106a5-5210-417e-bf38-6ddbe3aa91a7',

package/dist/appwrite/functions.d.ts

@@ -497,7 +497,7 @@ export declare const appwriteFunctions: {
                 context: "webhook";
                 method: "GET";
                 path: "/v1/wh/oauth/callback";
-                requestSchema: v.StrictObjectSchema<{
+                requestSchema: v.ObjectSchema<{
                     readonly code: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>]>, undefined>;
                     readonly state: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>]>, undefined>;
                 }, undefined>;

package/dist/appwrite/functions.js

@@ -134,7 +134,7 @@ const apiRoutes = {
         context: 'webhook',
         method: 'GET',
         path: oauth.redirectPath,
-        requestSchema: v.strictObject({
+        requestSchema: v.object({
             code: string.required(4096),
             state: string.required(4096),
         }),

package/dist/appwrite/functions.test.js

@@ -190,9 +190,36 @@ describe('appwriteFunctions', () => {
             expect(v.safeParse(route().requestSchema, request).success).toBe(true);
             expect(v.safeParse(route().responseSchema, response).success).toBe(true);
         });
-        it(`rejects caller ownership in the ${name} request and response`, () => {
-            expect(v.safeParse(route().requestSchema, { ...request, userId: 'another-user' }).success).toBe(false);
-            expect(v.safeParse(route().responseSchema, { ...response, userId: 'another-user' }).success).toBe(false);
+        if (name !== 'OAuth webhook') {
+            it(`rejects caller ownership in the ${name} request and response`, () => {
+                expect(v.safeParse(route().requestSchema, { ...request, userId: 'another-user' }).success).toBe(false);
+                expect(v.safeParse(route().responseSchema, { ...response, userId: 'another-user' }).success).toBe(false);
+            });
+        }
+    }
+    it('accepts provider-owned OAuth callback parameters without passing them to the handler', () => {
+        const result = v.safeParse(appwriteFunctions.api.routes.oauthWebhook.requestSchema, {
+            authuser: '0',
+            code: 'test-authorisation-code-1',
+            iss: 'https://accounts.google.com',
+            scope: 'openid email profile',
+            state: 'test-state-1',
+        });
+        expect(result.success).toBe(true);
+        if (result.success) {
+            expect(result.output).toEqual({ code: 'test-authorisation-code-1', state: 'test-state-1' });
+        }
+    });
+    for (const { description, request } of [
+        { description: 'missing code', request: { state: 'test-state-1' } },
+        { description: 'empty code', request: { code: '', state: 'test-state-1' } },
+        { description: 'oversized code', request: { code: 'a'.repeat(4097), state: 'test-state-1' } },
+        { description: 'missing state', request: { code: 'test-authorisation-code-1' } },
+        { description: 'empty state', request: { code: 'test-authorisation-code-1', state: '' } },
+        { description: 'oversized state', request: { code: 'test-authorisation-code-1', state: 'a'.repeat(4097) } },
+    ]) {
+        it(`rejects an OAuth callback with ${description}`, () => {
+            expect(v.safeParse(appwriteFunctions.api.routes.oauthWebhook.requestSchema, request).success).toBe(false);
         });
     }
     it('rejects caller-selected accounts for manual polling', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcoappio/marco-config",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "author": "team@marcoapp.io",
   "main": "dist/index.js",
   "repository": "git@github.com:marcoappio/marco-config.git",