@oondemand/oon-core-back 0.4.17 → 0.4.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.4.17",
+  "version": "0.4.19",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/api/auth.routes.js

@@ -4,7 +4,7 @@ const auth = require("../core/middlewares/auth");
 const ctx = require("../core/context");
 const GenericError = require("../core/errors/GenericError");
 const { asyncHandler, sendResponse } = require("../core/utils/helpers");
-const { ensureInstance } = require("../core/utils/instanceActivation");
+const { ensureInstance, operationalRequestHeaders } = require("../core/utils/instanceActivation");
 const { findAccessForUser, audit } = require("../core/rbac/storage");
 const { changeFirstAccessPassword } = require("../core/rbac/identityProvider");
 const {
@@ -16,6 +16,8 @@ const {
 
 const DEV_ACTIVATION_PATH = "/integracao/dev-local/ativar-central";
 const TENANT_HEADER = "x-oon-tenant-id";
+const SESSION_SCOPE_HEADER = "x-oon-session-scope";
+const LAUNCH_EXCHANGE_PATH = "/integracao/app-access/launch/exchange";
 const router = express.Router();
 
 function readBasicAuthorization(req) {
@@ -50,6 +52,11 @@ function translateProviderError(error) {
   });
 }
 
+function configuredSessionScope() {
+  const value = String(ctx.config.auth?.sessionScope || "").trim().toLowerCase();
+  return value === "ecosystem" ? value : undefined;
+}
+
 function tenantForLogin(req, instance) {
   const tenancyModel =
     ctx.config.tenancyModel || ctx.config.ecosystem?.tenancyModel;
@@ -95,6 +102,7 @@ router.post(
             Authorization: authorization,
             "Content-Type": "application/json",
             "x-app-code": appCode,
+            ...(configuredSessionScope() ? { [SESSION_SCOPE_HEADER]: configuredSessionScope() } : {}),
             ...(tenantId ? { [TENANT_HEADER]: tenantId } : {}),
           },
         },
@@ -107,6 +115,40 @@ router.post(
   }),
 );
 
+router.post(
+  "/launch/exchange",
+  asyncHandler(async (req, res) => {
+    const code = String(req.body?.code || "").trim();
+    if (code.length < 32 || code.length > 512) {
+      throw new GenericError("Código de abertura inválido.", {
+        statusCode: 400,
+        code: "APP_LAUNCH_CODE_INVALID",
+      });
+    }
+    const baseUrl = getBaseUrl(req);
+    try {
+      const correlationId = String(req.headers["x-correlation-id"] || req.id || "");
+      const headers = await operationalRequestHeaders({ correlationId });
+      const response = await axios.post(
+        `${baseUrl}${LAUNCH_EXCHANGE_PATH}`,
+        { code },
+        {
+          timeout: getTimeout(),
+          maxRedirects: 0,
+          headers: {
+            ...headers,
+            "Content-Type": "application/json",
+          },
+        },
+      );
+      res.set("Cache-Control", "no-store");
+      res.status(response.status).json(response.data);
+    } catch (error) {
+      throw translateProviderError(error);
+    }
+  }),
+);
+
 router.post(
   "/ativar-dev-local",
   asyncHandler(async (req, res) => {

package/src/manifest/appManifest.js

@@ -220,7 +220,7 @@ function validateAppManifest(input, { coreVersion = corePackage.version } = {})
   const allowedTopLevel = new Set([
     "$schema", "schemaVersion", "id", "name", "slug", "appKind",
     "tenancyModel", "availability", "accessMode", "authorizationMode", "accessPolicy", "deploymentMode",
-    "modules", "capabilities", "capabilitySettings", "compatibility", "activation", "rbac",
+    "modules", "capabilities", "capabilitySettings", "compatibility", "activation", "auth", "rbac",
   ]);
   for (const key of Object.keys(input)) {
     if (!allowedTopLevel.has(key)) addIssue(issues, key, "propriedade não suportada.");
@@ -286,6 +286,18 @@ function validateAppManifest(input, { coreVersion = corePackage.version } = {})
   validateCapabilitySettings(input.capabilitySettings, input.capabilities, issues);
   validateCompatibility(input.compatibility, issues, coreVersion);
   validateActivation(input.activation, issues);
+  if (input.auth !== undefined) {
+    if (!isPlainObject(input.auth)) {
+      addIssue(issues, "auth", "deve ser um objeto.");
+    } else {
+      for (const key of Object.keys(input.auth)) {
+        if (key !== "sessionScope") addIssue(issues, `auth.${key}`, "propriedade não suportada.");
+      }
+      if (input.auth.sessionScope !== undefined && input.auth.sessionScope !== "ecosystem") {
+        addIssue(issues, "auth.sessionScope", "deve ser ecosystem.");
+      }
+    }
+  }
   validateRbac(input.rbac, issues);
   if (issues.length) throw new AppManifestError("central.app.json inválido.", issues);
   return JSON.parse(JSON.stringify(input));
@@ -320,6 +332,7 @@ function appManifestToConfig(manifest, manifestPath) {
     modules: { ...manifest.modules },
     capabilities: [...manifest.capabilities],
     capabilitySettings: JSON.parse(JSON.stringify(manifest.capabilitySettings || {})),
+    auth: manifest.auth ? JSON.parse(JSON.stringify(manifest.auth)) : undefined,
     rbac: manifest.rbac ? JSON.parse(JSON.stringify(manifest.rbac)) : undefined,
     appManifest: manifest,
     appManifestPath: manifestPath,