@newhomestar/sdk 0.8.11 → 0.8.13

package/dist/index.js

@@ -1,4 +1,5 @@
 import dotenv from "dotenv";
+import cors from "cors";
 import { createClient } from "@supabase/supabase-js";
 import { OpenFgaClient } from "@openfga/sdk";
 import { createServer } from "node:http";
@@ -648,6 +649,17 @@ import { auth } from "express-oauth2-jwt-bearer";
  */
 export function runHttpServer(def, opts = {}) {
     const app = express();
+    // ── CORS (must be registered BEFORE auth so OPTIONS preflight bypasses JWKS) ──
+    // Permissive by default — integrations are called by the Odyssey admin UI
+    // from browser origins (localhost:3000, admin dashboards, etc.). The actual
+    // security boundary is the JWT Bearer token verified by JWKS below.
+    app.use(cors({
+        origin: true, // reflect request origin
+        credentials: true,
+        methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+        allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],
+        maxAge: 86400,
+    }));
     app.use(bodyParser.json());
     // ── Determine whether auth is enabled ──
     const skipAuth = opts.skipAuth ??
@@ -894,12 +906,29 @@ export function runHttpServer(def, opts = {}) {
                         // Resolve credentials (same flow as action handlers)
                         const credCtx = buildCredentialCtx(def.name, authToken);
                         const credentials = await credCtx.resolveCredentials();
-                        // Build OptionsContext for the handler
+                        // Extract and normalize the scope identifiers from the request body.
+                        // The UI posts `{ config, remoteId, remoteType }`. Both may be null
+                        // for legacy / unscoped lookups. We keep them typed so handlers
+                        // using `ctx.remoteId` get proper autocomplete.
+                        const rawRemoteId = req.body?.remoteId;
+                        const rawRemoteType = req.body?.remoteType;
+                        const remoteId = typeof rawRemoteId === 'string' && rawRemoteId.trim() !== ''
+                            ? rawRemoteId
+                            : null;
+                        const remoteType = rawRemoteType === 'account' || rawRemoteType === 'company'
+                            ? rawRemoteType
+                            : null;
+                        // Build OptionsContext for the handler. `remoteId`/`remoteType`
+                        // let the handler scope its lookup to the currently-selected
+                        // ticketing account / HRIS company (e.g. list only Jira
+                        // projects tied to *this* account's connection).
                         const optionsCtx = {
                             fetch: credCtx.fetch,
                             config: req.body?.config ?? {},
                             credentials,
                             tenantId: req.auth?.sub ?? 'unknown',
+                            remoteId,
+                            remoteType,
                         };
                         // Run the optionsFetcher handler
                         console.log(`[nova] 🔧 Running optionsFetcher for config field "${field.key}"`);

package/dist/integration.d.ts

@@ -144,6 +144,26 @@ export interface OptionsContext {
     credentials: ResolvedCredentials;
     /** Tenant ID for calling internal Nova platform services */
     tenantId: string;
+    /**
+     * Scope UUID this options lookup belongs to. For ticketing integrations
+     * this is the `TicketingAccount.id`; for HRIS integrations it's the
+     * `HrisCompany.id`. May be null/undefined when the caller hasn't
+     * selected a scope yet (legacy / unscoped lookups).
+     *
+     * Use this to filter the options query when the same user administers
+     * multiple accounts — e.g. only list Jira projects linked to this
+     * specific ticketing account's connection, not all of the user's
+     * accessible projects.
+     */
+    remoteId?: string | null;
+    /**
+     * Scope type discriminator so the handler knows which domain the
+     * `remoteId` came from without having to infer it from the integration
+     * category.
+     *   • "account" → ticketing (TicketingAccount.id)
+     *   • "company" → HRIS (HrisCompany.id)
+     */
+    remoteType?: 'account' | 'company' | null;
 }
 /**
  * A handler function that fetches select options dynamically.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newhomestar/sdk",
-  "version": "0.8.11",
+  "version": "0.8.13",
   "description": "Type-safe SDK for building Nova pipelines (workers & functions)",
   "homepage": "https://github.com/newhomestar/nova-node-sdk#readme",
   "bugs": {
@@ -41,6 +41,7 @@
     "@orpc/server": "1.7.4",
     "@supabase/supabase-js": "^2.39.0",
     "body-parser": "^1.20.2",
+    "cors": "^2.8.6",
     "dotenv": "^16.4.3",
     "express": "^4.18.2",
     "express-oauth2-jwt-bearer": "^1.7.4",
@@ -51,6 +52,7 @@
     "zod": ">=4.0.0"
   },
   "devDependencies": {
+    "@types/cors": "^2.8.19",
     "@types/node": "^20.11.17",
     "typescript": "^5.4.4",
     "zod": "^4.3.0"