@oxyhq/core 12.7.0 → 12.8.0

package/dist/esm/mixins/OxyServices.utility.js

@@ -8,6 +8,7 @@ import { jwtDecode } from 'jwt-decode';
 import { loadNodeCrypto } from '@oxyhq/protocol';
 import { buildUrl } from '../utils/apiUtils.js';
 import { logger } from '../logger/index.js';
+import { OXY_SERVICE_ENVIRONMENTS } from '../utils/oxyServiceEnvironment.js';
 /**
  * Expected JWT audience for tokens issued by the Oxy auth service.
  */
@@ -39,6 +40,10 @@ class ServiceTokenClaimError extends Error {
         this.name = 'ServiceTokenClaimError';
     }
 }
+function isOxyServiceEnvironment(value) {
+    return (typeof value === 'string' &&
+        OXY_SERVICE_ENVIRONMENTS.includes(value));
+}
 export function OxyServicesUtilityMixin(Base) {
     return class extends Base {
         // TypeScript's mixin pattern requires `(...args: any[])` here — the
@@ -335,7 +340,11 @@ export function OxyServicesUtilityMixin(Base) {
                         // Validate required service token fields
                         const appId = decoded.appId;
                         const credentialId = decoded.credentialId;
-                        if (!appId || typeof credentialId !== 'string' || credentialId.length === 0) {
+                        const environment = decoded.environment;
+                        if (!appId ||
+                            typeof credentialId !== 'string' ||
+                            credentialId.length === 0 ||
+                            !isOxyServiceEnvironment(environment)) {
                             if (optional) {
                                 req.userId = null;
                                 req.user = null;
@@ -388,6 +397,7 @@ export function OxyServicesUtilityMixin(Base) {
                             appName: decoded.appName || 'unknown',
                             credentialId,
                             scopes: Array.isArray(decoded.scopes) ? decoded.scopes : [],
+                            environment,
                         };
                         if (debug) {
                             logger.debug(`[oxy.auth] Service token OK app=${decoded.appName} delegateUser=${oxyUserId || '(none)'}`, {

package/dist/esm/server/auth.js

@@ -1,3 +1,5 @@
+import { OXY_SERVICE_ENVIRONMENTS } from '../utils/oxyServiceEnvironment.js';
+export { OXY_SERVICE_ENVIRONMENTS };
 function normalizeId(value) {
     const normalized = value?.trim();
     return normalized && normalized.length > 0 ? normalized : null;

package/dist/esm/server/index.js

@@ -14,7 +14,7 @@
  * app.use(createOxyRateLimit(oxy, { store: redisStore }));
  * ```
  */
-export { createOptionalOxyAuth, createOxyAuthMiddleware, getOxyUserId, getRequiredOxyUserId, isOxyAuthenticated, requireOxyAuth, } from './auth.js';
+export { createOptionalOxyAuth, createOxyAuthMiddleware, getOxyUserId, getRequiredOxyUserId, isOxyAuthenticated, requireOxyAuth, OXY_SERVICE_ENVIRONMENTS, } from './auth.js';
 export { createOxyRateLimit } from './rateLimit.js';
 // SSRF-safe upstream fetch + URL validation (Node-only).
 export { assertSafePublicUrl, isBlockedIp, safeFetch, SsrfRejection, UpstreamError, ALLOWED_PORTS, ALLOWED_PROTOCOLS, BLOCKED_HOSTNAMES, DEFAULT_USER_AGENT, MAX_REDIRECTS, MAX_URL_LENGTH, UPSTREAM_HEADERS_TIMEOUT_MS, } from './safeFetch.js';

package/dist/esm/utils/oxyServiceEnvironment.js

@@ -0,0 +1,16 @@
+/**
+ * Environment segregation for Oxy service-token JWTs (test/live isolation).
+ * Mirrors `ApplicationCredentialEnvironment` on the API's `ApplicationCredential`
+ * model (`packages/api/src/models/ApplicationCredential.ts`) as an INDEPENDENT
+ * literal union — `@oxyhq/core` has zero dependency on `@oxyhq/api`, so this is
+ * kept in sync by hand, not by import.
+ *
+ * Defined here (not in `server/auth.ts` or `mixins/OxyServices.utility.ts`
+ * directly) because BOTH of those files need it and neither may import from
+ * the other: `server/` types import `express` (Node-only, a peer dependency
+ * `mixins/` deliberately avoids so it stays safe to bundle into RN/browser
+ * consumers — see the "Local request/response/socket typing" comment in
+ * `OxyServices.utility.ts`). This file has zero imports, so both sides can
+ * depend on it without crossing that boundary.
+ */
+export const OXY_SERVICE_ENVIRONMENTS = ['development', 'staging', 'production'];