@oxyhq/core 12.7.0 → 12.8.0

package/dist/cjs/mixins/OxyServices.utility.js

@@ -11,6 +11,7 @@ const jwt_decode_1 = require("jwt-decode");
 const protocol_1 = require("@oxyhq/protocol");
 const apiUtils_1 = require("../utils/apiUtils");
 const logger_1 = require("../logger");
+const oxyServiceEnvironment_1 = require("../utils/oxyServiceEnvironment");
 /**
  * Expected JWT audience for tokens issued by the Oxy auth service.
  */
@@ -42,6 +43,10 @@ class ServiceTokenClaimError extends Error {
         this.name = 'ServiceTokenClaimError';
     }
 }
+function isOxyServiceEnvironment(value) {
+    return (typeof value === 'string' &&
+        oxyServiceEnvironment_1.OXY_SERVICE_ENVIRONMENTS.includes(value));
+}
 function OxyServicesUtilityMixin(Base) {
     return class extends Base {
         // TypeScript's mixin pattern requires `(...args: any[])` here — the
@@ -338,7 +343,11 @@ function OxyServicesUtilityMixin(Base) {
                         // Validate required service token fields
                         const appId = decoded.appId;
                         const credentialId = decoded.credentialId;
-                        if (!appId || typeof credentialId !== 'string' || credentialId.length === 0) {
+                        const environment = decoded.environment;
+                        if (!appId ||
+                            typeof credentialId !== 'string' ||
+                            credentialId.length === 0 ||
+                            !isOxyServiceEnvironment(environment)) {
                             if (optional) {
                                 req.userId = null;
                                 req.user = null;
@@ -391,6 +400,7 @@ function OxyServicesUtilityMixin(Base) {
                             appName: decoded.appName || 'unknown',
                             credentialId,
                             scopes: Array.isArray(decoded.scopes) ? decoded.scopes : [],
+                            environment,
                         };
                         if (debug) {
                             logger_1.logger.debug(`[oxy.auth] Service token OK app=${decoded.appName} delegateUser=${oxyUserId || '(none)'}`, {

package/dist/cjs/server/auth.js

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.OXY_SERVICE_ENVIRONMENTS = void 0;
 exports.getOxyUserId = getOxyUserId;
 exports.isOxyAuthenticated = isOxyAuthenticated;
 exports.getRequiredOxyUserId = getRequiredOxyUserId;
 exports.requireOxyAuth = requireOxyAuth;
 exports.createOptionalOxyAuth = createOptionalOxyAuth;
 exports.createOxyAuthMiddleware = createOxyAuthMiddleware;
+const oxyServiceEnvironment_1 = require("../utils/oxyServiceEnvironment");
+Object.defineProperty(exports, "OXY_SERVICE_ENVIRONMENTS", { enumerable: true, get: function () { return oxyServiceEnvironment_1.OXY_SERVICE_ENVIRONMENTS; } });
 function normalizeId(value) {
     const normalized = value?.trim();
     return normalized && normalized.length > 0 ? normalized : null;

package/dist/cjs/server/index.js

@@ -16,7 +16,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isOfficialWebOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = exports.registrableApex = exports.verifySecret = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
+exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isOfficialWebOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = exports.registrableApex = exports.verifySecret = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.OXY_SERVICE_ENVIRONMENTS = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "createOptionalOxyAuth", { enumerable: true, get: function () { return auth_1.createOptionalOxyAuth; } });
 Object.defineProperty(exports, "createOxyAuthMiddleware", { enumerable: true, get: function () { return auth_1.createOxyAuthMiddleware; } });
@@ -24,6 +24,7 @@ Object.defineProperty(exports, "getOxyUserId", { enumerable: true, get: function
 Object.defineProperty(exports, "getRequiredOxyUserId", { enumerable: true, get: function () { return auth_1.getRequiredOxyUserId; } });
 Object.defineProperty(exports, "isOxyAuthenticated", { enumerable: true, get: function () { return auth_1.isOxyAuthenticated; } });
 Object.defineProperty(exports, "requireOxyAuth", { enumerable: true, get: function () { return auth_1.requireOxyAuth; } });
+Object.defineProperty(exports, "OXY_SERVICE_ENVIRONMENTS", { enumerable: true, get: function () { return auth_1.OXY_SERVICE_ENVIRONMENTS; } });
 var rateLimit_1 = require("./rateLimit");
 Object.defineProperty(exports, "createOxyRateLimit", { enumerable: true, get: function () { return rateLimit_1.createOxyRateLimit; } });
 // SSRF-safe upstream fetch + URL validation (Node-only).

package/dist/cjs/utils/oxyServiceEnvironment.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OXY_SERVICE_ENVIRONMENTS = void 0;
+/**
+ * Environment segregation for Oxy service-token JWTs (test/live isolation).
+ * Mirrors `ApplicationCredentialEnvironment` on the API's `ApplicationCredential`
+ * model (`packages/api/src/models/ApplicationCredential.ts`) as an INDEPENDENT
+ * literal union — `@oxyhq/core` has zero dependency on `@oxyhq/api`, so this is
+ * kept in sync by hand, not by import.
+ *
+ * Defined here (not in `server/auth.ts` or `mixins/OxyServices.utility.ts`
+ * directly) because BOTH of those files need it and neither may import from
+ * the other: `server/` types import `express` (Node-only, a peer dependency
+ * `mixins/` deliberately avoids so it stays safe to bundle into RN/browser
+ * consumers — see the "Local request/response/socket typing" comment in
+ * `OxyServices.utility.ts`). This file has zero imports, so both sides can
+ * depend on it without crossing that boundary.
+ */
+exports.OXY_SERVICE_ENVIRONMENTS = ['development', 'staging', 'production'];