@marcoappio/marco-config 4.0.1 → 4.0.3

package/dist/appwrite/appwrite.d.ts

@@ -263,7 +263,7 @@ declare const rowSchemas: {
         readonly operation: v.PicklistSchema<readonly ["CONNECT", "REPLACE"], undefined>;
         readonly profile: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>;
         readonly provider: v.PicklistSchema<readonly ["GMAIL", "OUTLOOK"], undefined>;
-        readonly returnUri: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/provider-selection", "https://app.staging.marcoapp.io/onboarding/provider-selection"], undefined>;
+        readonly returnUri: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/loading"], undefined>;
         readonly userId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>;
         readonly $createdAt: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, undefined>]>;
         readonly $databaseId: v.LiteralSchema<"marco", undefined>;
@@ -481,8 +481,8 @@ export declare const appwrite: {
     readonly oauth: {
         readonly operations: readonly ["CONNECT", "REPLACE"];
         readonly providers: readonly ["GMAIL", "OUTLOOK"];
-        readonly returnUriSchema: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/provider-selection", "https://app.staging.marcoapp.io/onboarding/provider-selection"], undefined>;
-        readonly returnUris: readonly ["https://app.marcoapp.io/onboarding/provider-selection", "https://app.staging.marcoapp.io/onboarding/provider-selection"];
+        readonly returnUriSchema: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/loading"], undefined>;
+        readonly returnUris: readonly ["https://app.marcoapp.io/onboarding/loading"];
     };
     readonly polling: {
         readonly shardStates: readonly ["ACTIVE", "STOPPED", "FAILED"];
@@ -710,7 +710,7 @@ export declare const appwrite: {
             readonly operation: v.PicklistSchema<readonly ["CONNECT", "REPLACE"], undefined>;
             readonly profile: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>;
             readonly provider: v.PicklistSchema<readonly ["GMAIL", "OUTLOOK"], undefined>;
-            readonly returnUri: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/provider-selection", "https://app.staging.marcoapp.io/onboarding/provider-selection"], undefined>;
+            readonly returnUri: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/loading"], undefined>;
             readonly userId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 255, undefined>]>;
             readonly $createdAt: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, undefined>]>;
             readonly $databaseId: v.LiteralSchema<"marco", undefined>;

package/dist/appwrite/appwrite.js

@@ -48,7 +48,7 @@ const mailboxSyncLaneStates = ['PENDING', 'RUNNING', 'COMPLETED', 'FAILED'];
 const mailboxSyncStates = ['INITIAL', 'SYNCING', 'CURRENT', 'ERROR'];
 const oauthOperations = ['CONNECT', 'REPLACE'];
 const oauthProviders = ['GMAIL', 'OUTLOOK'];
-const oauthReturnUris = ['https://app.marcoapp.io/onboarding/provider-selection', 'https://app.staging.marcoapp.io/onboarding/provider-selection'];
+const oauthReturnUris = ['https://app.marcoapp.io/onboarding/loading'];
 const oauthReturnUriSchema = v.picklist(oauthReturnUris);
 const pollShardStates = ['ACTIVE', 'STOPPED', 'FAILED'];
 const appwriteEnvironments = ['development', 'production', 'staging'];
@@ -64,7 +64,7 @@ const appwriteDeployments = {
     },
     production: {
         applicationUrl: 'https://app.marcoapp.io',
-        endpoint: 'https://api.marcoapp.io/v1',
+        endpoint: 'https://platform.marcoapp.io/v1',
         oauthClientIds: {
             google: '338197922176-oml1o2iputhhu3vijgue9h8sbfq17qme.apps.googleusercontent.com',
             microsoft: 'd34106a5-5210-417e-bf38-6ddbe3aa91a7',

package/dist/appwrite/appwrite.test.js

@@ -180,7 +180,7 @@ const validRows = {
         operation: 'CONNECT',
         profile: 'user-1',
         provider: 'GMAIL',
-        returnUri: 'https://app.marcoapp.io/onboarding/provider-selection',
+        returnUri: 'https://app.marcoapp.io/onboarding/loading',
         userId: 'user-1',
     },
     pollShards: {
@@ -281,7 +281,7 @@ describe('appwrite', () => {
         expect(appwrite.environments).toEqual(['development', 'production', 'staging']);
         expect(appwrite.deployments.production).toEqual({
             applicationUrl: 'https://app.marcoapp.io',
-            endpoint: 'https://api.marcoapp.io/v1',
+            endpoint: 'https://platform.marcoapp.io/v1',
             oauthClientIds: {
                 google: '338197922176-oml1o2iputhhu3vijgue9h8sbfq17qme.apps.googleusercontent.com',
                 microsoft: 'd34106a5-5210-417e-bf38-6ddbe3aa91a7',
@@ -326,9 +326,24 @@ describe('appwrite', () => {
         expect(appwrite.oauth).toMatchObject({
             operations: ['CONNECT', 'REPLACE'],
             providers: ['GMAIL', 'OUTLOOK'],
-            returnUris: ['https://app.marcoapp.io/onboarding/provider-selection', 'https://app.staging.marcoapp.io/onboarding/provider-selection'],
+            returnUris: ['https://app.marcoapp.io/onboarding/loading'],
         });
     });
+    for (const operation of ['CONNECT', 'REPLACE']) {
+        it(`accepts a persisted ${operation} OAuth state completing at production loading`, () => {
+            expect(v.safeParse(appwrite.rowSchemas.oauthStates, { ...validRows.oauthStates, operation }).success).toBe(true);
+        });
+    }
+    for (const returnUri of [
+        'https://app.marcoapp.io/onboarding/provider-selection',
+        'https://app.staging.marcoapp.io/onboarding/loading',
+        'https://attacker.example/onboarding/loading',
+        'https://app.marcoapp.io/onboarding/loading/unexpected',
+    ]) {
+        it(`rejects persisted OAuth state with unapproved return URI ${returnUri}`, () => {
+            expect(v.safeParse(appwrite.rowSchemas.oauthStates, { ...validRows.oauthStates, returnUri }).success).toBe(false);
+        });
+    }
     it('exports the final polling-only mailbox contract', () => {
         expect(appwrite.mailboxSync).toEqual({
             laneStates: ['PENDING', 'RUNNING', 'COMPLETED', 'FAILED'],

package/dist/appwrite/functions.d.ts

@@ -18,7 +18,7 @@ export declare const appwriteFunctions: {
                         readonly email: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.EmailAction<string, undefined>]>;
                         readonly kind: v.LiteralSchema<"OAUTH", undefined>;
                         readonly provider: v.PicklistSchema<["GMAIL", "OUTLOOK"], undefined>;
-                        readonly returnUri: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/provider-selection", "https://app.staging.marcoapp.io/onboarding/provider-selection"], undefined>;
+                        readonly returnUri: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/loading"], undefined>;
                     }, undefined>, v.StrictObjectSchema<{
                         readonly imap: v.StrictObjectSchema<{
                             readonly host: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>]>, undefined>;
@@ -69,7 +69,7 @@ export declare const appwriteFunctions: {
                         readonly email: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.EmailAction<string, undefined>]>;
                         readonly kind: v.LiteralSchema<"OAUTH", undefined>;
                         readonly provider: v.PicklistSchema<["GMAIL", "OUTLOOK"], undefined>;
-                        readonly returnUri: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/provider-selection", "https://app.staging.marcoapp.io/onboarding/provider-selection"], undefined>;
+                        readonly returnUri: v.PicklistSchema<readonly ["https://app.marcoapp.io/onboarding/loading"], undefined>;
                     }, undefined>, v.StrictObjectSchema<{
                         readonly imap: v.StrictObjectSchema<{
                             readonly host: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>]>, undefined>;
@@ -497,7 +497,7 @@ export declare const appwriteFunctions: {
                 context: "webhook";
                 method: "GET";
                 path: "/v1/wh/oauth/callback";
-                requestSchema: v.StrictObjectSchema<{
+                requestSchema: v.ObjectSchema<{
                     readonly code: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>]>, undefined>;
                     readonly state: v.NonOptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.NonEmptyAction<string, undefined>, v.MaxLengthAction<string, number, undefined>]>, undefined>;
                 }, undefined>;

package/dist/appwrite/functions.js

@@ -134,7 +134,7 @@ const apiRoutes = {
         context: 'webhook',
         method: 'GET',
         path: oauth.redirectPath,
-        requestSchema: v.strictObject({
+        requestSchema: v.object({
             code: string.required(4096),
             state: string.required(4096),
         }),

package/dist/appwrite/functions.test.js

@@ -54,7 +54,7 @@ const routeFixtures = [
                 email: 'test-user@example.com',
                 kind: 'OAUTH',
                 provider: 'GMAIL',
-                returnUri: 'https://app.marcoapp.io/onboarding/provider-selection',
+                returnUri: 'https://app.marcoapp.io/onboarding/loading',
             },
         },
         response: {
@@ -190,9 +190,36 @@ describe('appwriteFunctions', () => {
             expect(v.safeParse(route().requestSchema, request).success).toBe(true);
             expect(v.safeParse(route().responseSchema, response).success).toBe(true);
         });
-        it(`rejects caller ownership in the ${name} request and response`, () => {
-            expect(v.safeParse(route().requestSchema, { ...request, userId: 'another-user' }).success).toBe(false);
-            expect(v.safeParse(route().responseSchema, { ...response, userId: 'another-user' }).success).toBe(false);
+        if (name !== 'OAuth webhook') {
+            it(`rejects caller ownership in the ${name} request and response`, () => {
+                expect(v.safeParse(route().requestSchema, { ...request, userId: 'another-user' }).success).toBe(false);
+                expect(v.safeParse(route().responseSchema, { ...response, userId: 'another-user' }).success).toBe(false);
+            });
+        }
+    }
+    it('accepts provider-owned OAuth callback parameters without passing them to the handler', () => {
+        const result = v.safeParse(appwriteFunctions.api.routes.oauthWebhook.requestSchema, {
+            authuser: '0',
+            code: 'test-authorisation-code-1',
+            iss: 'https://accounts.google.com',
+            scope: 'openid email profile',
+            state: 'test-state-1',
+        });
+        expect(result.success).toBe(true);
+        if (result.success) {
+            expect(result.output).toEqual({ code: 'test-authorisation-code-1', state: 'test-state-1' });
+        }
+    });
+    for (const { description, request } of [
+        { description: 'missing code', request: { state: 'test-state-1' } },
+        { description: 'empty code', request: { code: '', state: 'test-state-1' } },
+        { description: 'oversized code', request: { code: 'a'.repeat(4097), state: 'test-state-1' } },
+        { description: 'missing state', request: { code: 'test-authorisation-code-1' } },
+        { description: 'empty state', request: { code: 'test-authorisation-code-1', state: '' } },
+        { description: 'oversized state', request: { code: 'test-authorisation-code-1', state: 'a'.repeat(4097) } },
+    ]) {
+        it(`rejects an OAuth callback with ${description}`, () => {
+            expect(v.safeParse(appwriteFunctions.api.routes.oauthWebhook.requestSchema, request).success).toBe(false);
         });
     }
     it('rejects caller-selected accounts for manual polling', () => {
@@ -287,16 +314,12 @@ describe('appwriteFunctions', () => {
             description: 'a malformed mailbox email',
             expected: false,
         },
-        {
-            connection: {
-                email: 'test-user@example.com',
-                kind: 'OAUTH',
-                provider: 'GMAIL',
-                returnUri: 'https://attacker.example/onboarding/provider-selection',
-            },
-            description: 'an unapproved return destination',
-            expected: false,
-        },
+    ];
+    const forbiddenOAuthReturnUris = [
+        { description: 'provider-selection', returnUri: 'https://app.marcoapp.io/onboarding/provider-selection' },
+        { description: 'staging loading', returnUri: 'https://app.staging.marcoapp.io/onboarding/loading' },
+        { description: 'arbitrary origin', returnUri: 'https://attacker.example/onboarding/loading' },
+        { description: 'arbitrary path', returnUri: 'https://app.marcoapp.io/onboarding/loading/unexpected' },
     ];
     const oauthConnectionRoutes = [
         {
@@ -310,6 +333,18 @@ describe('appwriteFunctions', () => {
             requestSchema: appwriteFunctions.api.routes.accountConnection.requestSchema,
         },
     ];
+    for (const { description, includesAccountId, requestSchema } of oauthConnectionRoutes) {
+        it(`accepts ${description} OAuth connection completing at production loading`, () => {
+            const connection = {
+                email: 'test-user@example.com',
+                kind: 'OAUTH',
+                provider: 'GMAIL',
+                returnUri: 'https://app.marcoapp.io/onboarding/loading',
+            };
+            const request = includesAccountId ? { accountId: 'account_1', connection } : { connection };
+            expect(v.safeParse(requestSchema, request).success).toBe(true);
+        });
+    }
     for (const { connection, description, expected } of invalidOAuthConnections) {
         for (const { description: routeDescription, includesAccountId, requestSchema } of oauthConnectionRoutes) {
             it(`rejects ${routeDescription} OAuth connection with ${description}`, () => {
@@ -318,4 +353,18 @@ describe('appwriteFunctions', () => {
             });
         }
     }
+    for (const { description, returnUri } of forbiddenOAuthReturnUris) {
+        for (const { description: routeDescription, includesAccountId, requestSchema } of oauthConnectionRoutes) {
+            it(`rejects ${routeDescription} OAuth connection with ${description} return URI`, () => {
+                const connection = {
+                    email: 'test-user@example.com',
+                    kind: 'OAUTH',
+                    provider: 'GMAIL',
+                    returnUri,
+                };
+                const request = includesAccountId ? { accountId: 'account_1', connection } : { connection };
+                expect(v.safeParse(requestSchema, request).success).toBe(false);
+            });
+        }
+    }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcoappio/marco-config",
-  "version": "4.0.1",
+  "version": "4.0.3",
   "author": "team@marcoapp.io",
   "main": "dist/index.js",
   "repository": "git@github.com:marcoappio/marco-config.git",