@playcademy/sandbox 0.12.2-beta.6 → 0.13.0

package/dist/cli.js

@@ -2517,7 +2517,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.12.2-beta.6",
+    version: "0.13.0",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -20906,11 +20906,14 @@ var init_table8 = __esm(() => {
     id: uuid("id").primaryKey().defaultRandom(),
     name: text("name").notNull(),
     clientId: text("client_id").notNull().unique(),
+    handle: text("handle").unique(),
     allowedOrigins: text("allowed_origins").array().notNull().default([]),
     enabled: boolean("enabled").notNull().default(true),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  });
+  }, (table) => [
+    check("embed_partners_handle_check", sql`${table.handle} ~ '^[a-z0-9]([a-z0-9-]*[a-z0-9])?([.][a-z0-9]([a-z0-9-]*[a-z0-9])?)+$'`)
+  ]);
   embedLaunches = pgTable("embed_launches", {
     id: uuid("id").primaryKey().defaultRandom(),
     partnerId: uuid("partner_id").notNull().references(() => embedPartners.id, { onDelete: "restrict" }),
@@ -20920,6 +20923,7 @@ var init_table8 = __esm(() => {
     timebackCourseId: text("timeback_course_id"),
     contextId: text("context_id"),
     contextRole: embedContextRoleEnum("context_role"),
+    contextAttributes: jsonb("context_attributes").$type(),
     passHash: text("pass_hash").unique(),
     passExpiresAt: timestamp("pass_expires_at", { withTimezone: true }).notNull(),
     redeemedAt: timestamp("redeemed_at", { withTimezone: true }),
@@ -50827,7 +50831,7 @@ function isCanonicalOrigin(value) {
   }
   return url.protocol === "https:" || url.protocol === "http:" && isLocalHostname(url.hostname);
 }
-var LOCAL_HOSTNAMES, EmbedOriginSchema, EmbedContextIdSchema, EmbedContextSchema, EmbedPartnerClientIdSchema, EnsureEmbedPartnerSchema, AddEmbedPartnerOriginSchema, CreateEmbedLaunchSchema, RedeemEmbedPassSchema;
+var LOCAL_HOSTNAMES, EmbedOriginSchema, EmbedContextIdSchema, MAX_CONTEXT_ATTRIBUTES = 10, EmbedContextAttributesSchema, EmbedContextSchema, EmbedPartnerClientIdSchema, EmbedPartnerHandleSchema, EnsureEmbedPartnerSchema, AddEmbedPartnerOriginSchema, CreateEmbedLaunchSchema, RedeemEmbedPassSchema;
 var init_schemas5 = __esm(() => {
   init_esm();
   init_table8();
@@ -50838,13 +50842,23 @@ var init_schemas5 = __esm(() => {
   EmbedContextIdSchema = stringType().regex(/^[A-Za-z0-9._~-]{1,128}$/, {
     message: "context.id must be 1-128 URL-safe characters (letters, digits, . _ ~ -)"
   });
+  EmbedContextAttributesSchema = recordType(stringType().regex(/^[A-Za-z][A-Za-z0-9_]{0,39}$/, {
+    message: "context.attributes keys must be 1-40 characters: a letter, then letters, digits or _"
+  }), stringType().regex(/^[A-Za-z0-9._~-]{1,100}$/, {
+    message: "context.attributes values must be 1-100 URL-safe characters (letters, digits, . _ ~ -)"
+  })).refine((attributes) => Object.keys(attributes).length <= MAX_CONTEXT_ATTRIBUTES, {
+    message: `context.attributes takes at most ${MAX_CONTEXT_ATTRIBUTES} keys`
+  });
   EmbedContextSchema = objectType({
     id: EmbedContextIdSchema,
-    role: enumType(embedContextRoleEnum.enumValues).optional()
+    role: enumType(embedContextRoleEnum.enumValues).optional(),
+    attributes: EmbedContextAttributesSchema.optional()
   }).strict();
   EmbedPartnerClientIdSchema = stringType().trim().min(1).max(200);
+  EmbedPartnerHandleSchema = stringType().max(253).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?([.][a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/);
   EnsureEmbedPartnerSchema = objectType({
-    name: stringType().trim().min(1).max(100)
+    name: stringType().trim().min(1).max(100),
+    handle: EmbedPartnerHandleSchema.optional()
   }).strict();
   AddEmbedPartnerOriginSchema = objectType({
     origin: EmbedOriginSchema
@@ -95650,15 +95664,28 @@ class EmbedPartnerService {
   constructor(deps) {
     this.deps = deps;
   }
-  async ensurePartner(clientId, name2) {
-    const [partner] = await this.deps.db.insert(embedPartners).values({ clientId, name: name2 }).onConflictDoUpdate({
+  async ensurePartner(clientId, name2, handle2) {
+    const [partner] = await this.deps.db.insert(embedPartners).values({ clientId, name: name2, handle: handle2 }).onConflictDoUpdate({
       target: embedPartners.clientId,
-      set: { name: name2, updatedAt: new Date }
-    }).returning();
-    if (!partner) {
-      throw new InternalError("Failed to ensure embed partner");
+      set: {
+        name: name2,
+        handle: sql`coalesce(${embedPartners.handle}, excluded.handle)`,
+        updatedAt: new Date
+      },
+      setWhere: sql`excluded.handle IS NULL OR ${embedPartners.handle} IS NULL OR ${embedPartners.handle} = excluded.handle`
+    }).returning().catch((error) => {
+      if (isUniqueViolation(error)) {
+        throw new ConflictError(`Another embed partner has the handle ${handle2}`);
+      }
+      throw error;
+    });
+    if (partner) {
+      return partner;
     }
-    return partner;
+    if (handle2) {
+      throw new ConflictError("This embed partner already has a different handle, and it never changes");
+    }
+    throw new InternalError("Failed to ensure embed partner");
   }
   addOrigin(clientId, origin) {
     return this.setOrigins(clientId, sql`CASE WHEN ${origin} = ANY(${embedPartners.allowedOrigins})
@@ -95699,14 +95726,16 @@ var init_embed_util = __esm(() => {
 async function scopedContextId(partnerId, contextId) {
   return sha256Hex(`${partnerId}:${contextId}`);
 }
-function launchTokenClaims(launch) {
+function launchTokenClaims(launch, partner) {
   if (!launch.contextId) {
     return {};
   }
   return {
     context: {
       id: launch.contextId,
-      ...launch.contextRole && { role: launch.contextRole }
+      ...launch.contextRole && { role: launch.contextRole },
+      ...launch.contextAttributes && { attributes: launch.contextAttributes },
+      ...partner.handle && { partner: partner.handle }
     }
   };
 }
@@ -95756,6 +95785,7 @@ class EmbedService {
       timebackCourseId: input.timebackCourseId ?? null,
       contextId: input.context ? await scopedContextId(partner.id, input.context.id) : null,
       contextRole: input.context?.role ?? null,
+      contextAttributes: input.context?.attributes ?? null,
       passHash: await sha256Hex(pass),
       passExpiresAt,
       expiresAt: new Date(now + EMBED_LAUNCH_TTL_MS)
@@ -95767,12 +95797,15 @@ class EmbedService {
       "app.launch.id": launch.id,
       "app.user.id": user.id,
       "app.embed.has_context": input.context !== undefined,
-      ...input.context?.role && { "app.embed.context_role": input.context.role }
+      ...input.context?.role && { "app.embed.context_role": input.context.role },
+      ...input.context?.attributes && {
+        "app.embed.context_attribute_keys": Object.keys(input.context.attributes).toSorted()
+      }
     });
     return { launchId: launch.id, pass, passExpiresAt, gameSlug: game.slug };
   }
   async redeemLaunch(input, timeZone) {
-    const launch = await this.consumePass(input);
+    const { launch, partner } = await this.consumePass(input);
     try {
       const user = await this.deps.db.query.users.findFirst({
         where: eq(users.id, launch.userId)
@@ -95783,7 +95816,7 @@ class EmbedService {
       const [game, profile, token] = await Promise.all([
         this.deps.getGameForStudent(launch.gameId, user),
         this.deps.getGameProfile(user, launch.gameId, timeZone),
-        this.deps.mintGameToken(launch.gameId, user.id, launchTokenClaims(launch))
+        this.deps.mintGameToken(launch.gameId, user.id, launchTokenClaims(launch, partner))
       ]);
       await this.deps.db.update(embedLaunches).set({ redeemedAt: new Date }).where(eq(embedLaunches.id, launch.id));
       return {
@@ -95815,7 +95848,7 @@ class EmbedService {
     if (outcome) {
       throw new AccessDeniedError("This launch has ended");
     }
-    return this.deps.mintGameToken(launch.gameId, launch.userId, launchTokenClaims(launch));
+    return this.deps.mintGameToken(launch.gameId, launch.userId, launchTokenClaims(launch, partner));
   }
   async endLaunch(launchId) {
     await this.deps.db.update(embedLaunches).set({ endedAt: sql`coalesce(${embedLaunches.endedAt}, now())`, passHash: null }).where(eq(embedLaunches.id, launchId));
@@ -95835,18 +95868,17 @@ class EmbedService {
     });
     const partner = await this.deps.db.query.embedPartners.findFirst({
       where: eq(embedPartners.id, launch.partnerId),
-      columns: { enabled: true, allowedOrigins: true }
+      columns: { enabled: true, allowedOrigins: true, handle: true }
     });
     const originMatches = launch.parentOrigin === input.parentOrigin;
-    const stillAllowed = partner !== undefined && canPartnerLaunch(partner, launch.parentOrigin);
-    if (!originMatches || !stillAllowed) {
+    if (!originMatches || !partner || !canPartnerLaunch(partner, launch.parentOrigin)) {
       await this.endLaunch(launch.id);
       setAttributes({
         "app.embed.outcome": originMatches ? "partner_disallowed" : "origin_mismatch"
       });
       throw new UnauthorizedError("This launch pass is not valid");
     }
-    return launch;
+    return { launch, partner };
   }
 }
 function renewalRefusal(launch, isAllowed) {
@@ -152662,7 +152694,7 @@ async function ensurePartner(ctx) {
   await requireEmbedAdmin(ctx);
   const clientId = requireClientIdParam(ctx);
   const body2 = await parseRequestBody(ctx.request, EnsureEmbedPartnerSchema);
-  return ctx.services.embedPartner.ensurePartner(clientId, body2.name);
+  return ctx.services.embedPartner.ensurePartner(clientId, body2.name, body2.handle);
 }
 async function addPartnerOrigin(ctx) {
   await requireEmbedAdmin(ctx);

package/dist/server.js

@@ -697,7 +697,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@playcademy/sandbox",
-    version: "0.12.2-beta.6",
+    version: "0.13.0",
     description: "Local development server for Playcademy game development",
     type: "module",
     exports: {
@@ -19086,11 +19086,14 @@ var init_table8 = __esm(() => {
     id: uuid("id").primaryKey().defaultRandom(),
     name: text("name").notNull(),
     clientId: text("client_id").notNull().unique(),
+    handle: text("handle").unique(),
     allowedOrigins: text("allowed_origins").array().notNull().default([]),
     enabled: boolean("enabled").notNull().default(true),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  });
+  }, (table) => [
+    check("embed_partners_handle_check", sql`${table.handle} ~ '^[a-z0-9]([a-z0-9-]*[a-z0-9])?([.][a-z0-9]([a-z0-9-]*[a-z0-9])?)+$'`)
+  ]);
   embedLaunches = pgTable("embed_launches", {
     id: uuid("id").primaryKey().defaultRandom(),
     partnerId: uuid("partner_id").notNull().references(() => embedPartners.id, { onDelete: "restrict" }),
@@ -19100,6 +19103,7 @@ var init_table8 = __esm(() => {
     timebackCourseId: text("timeback_course_id"),
     contextId: text("context_id"),
     contextRole: embedContextRoleEnum("context_role"),
+    contextAttributes: jsonb("context_attributes").$type(),
     passHash: text("pass_hash").unique(),
     passExpiresAt: timestamp("pass_expires_at", { withTimezone: true }).notNull(),
     redeemedAt: timestamp("redeemed_at", { withTimezone: true }),
@@ -49007,7 +49011,7 @@ function isCanonicalOrigin(value) {
   }
   return url.protocol === "https:" || url.protocol === "http:" && isLocalHostname(url.hostname);
 }
-var LOCAL_HOSTNAMES, EmbedOriginSchema, EmbedContextIdSchema, EmbedContextSchema, EmbedPartnerClientIdSchema, EnsureEmbedPartnerSchema, AddEmbedPartnerOriginSchema, CreateEmbedLaunchSchema, RedeemEmbedPassSchema;
+var LOCAL_HOSTNAMES, EmbedOriginSchema, EmbedContextIdSchema, MAX_CONTEXT_ATTRIBUTES = 10, EmbedContextAttributesSchema, EmbedContextSchema, EmbedPartnerClientIdSchema, EmbedPartnerHandleSchema, EnsureEmbedPartnerSchema, AddEmbedPartnerOriginSchema, CreateEmbedLaunchSchema, RedeemEmbedPassSchema;
 var init_schemas5 = __esm(() => {
   init_esm();
   init_table8();
@@ -49018,13 +49022,23 @@ var init_schemas5 = __esm(() => {
   EmbedContextIdSchema = stringType().regex(/^[A-Za-z0-9._~-]{1,128}$/, {
     message: "context.id must be 1-128 URL-safe characters (letters, digits, . _ ~ -)"
   });
+  EmbedContextAttributesSchema = recordType(stringType().regex(/^[A-Za-z][A-Za-z0-9_]{0,39}$/, {
+    message: "context.attributes keys must be 1-40 characters: a letter, then letters, digits or _"
+  }), stringType().regex(/^[A-Za-z0-9._~-]{1,100}$/, {
+    message: "context.attributes values must be 1-100 URL-safe characters (letters, digits, . _ ~ -)"
+  })).refine((attributes) => Object.keys(attributes).length <= MAX_CONTEXT_ATTRIBUTES, {
+    message: `context.attributes takes at most ${MAX_CONTEXT_ATTRIBUTES} keys`
+  });
   EmbedContextSchema = objectType({
     id: EmbedContextIdSchema,
-    role: enumType(embedContextRoleEnum.enumValues).optional()
+    role: enumType(embedContextRoleEnum.enumValues).optional(),
+    attributes: EmbedContextAttributesSchema.optional()
   }).strict();
   EmbedPartnerClientIdSchema = stringType().trim().min(1).max(200);
+  EmbedPartnerHandleSchema = stringType().max(253).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?([.][a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/);
   EnsureEmbedPartnerSchema = objectType({
-    name: stringType().trim().min(1).max(100)
+    name: stringType().trim().min(1).max(100),
+    handle: EmbedPartnerHandleSchema.optional()
   }).strict();
   AddEmbedPartnerOriginSchema = objectType({
     origin: EmbedOriginSchema
@@ -93830,15 +93844,28 @@ class EmbedPartnerService {
   constructor(deps) {
     this.deps = deps;
   }
-  async ensurePartner(clientId, name2) {
-    const [partner] = await this.deps.db.insert(embedPartners).values({ clientId, name: name2 }).onConflictDoUpdate({
+  async ensurePartner(clientId, name2, handle2) {
+    const [partner] = await this.deps.db.insert(embedPartners).values({ clientId, name: name2, handle: handle2 }).onConflictDoUpdate({
       target: embedPartners.clientId,
-      set: { name: name2, updatedAt: new Date }
-    }).returning();
-    if (!partner) {
-      throw new InternalError("Failed to ensure embed partner");
+      set: {
+        name: name2,
+        handle: sql`coalesce(${embedPartners.handle}, excluded.handle)`,
+        updatedAt: new Date
+      },
+      setWhere: sql`excluded.handle IS NULL OR ${embedPartners.handle} IS NULL OR ${embedPartners.handle} = excluded.handle`
+    }).returning().catch((error) => {
+      if (isUniqueViolation(error)) {
+        throw new ConflictError(`Another embed partner has the handle ${handle2}`);
+      }
+      throw error;
+    });
+    if (partner) {
+      return partner;
     }
-    return partner;
+    if (handle2) {
+      throw new ConflictError("This embed partner already has a different handle, and it never changes");
+    }
+    throw new InternalError("Failed to ensure embed partner");
   }
   addOrigin(clientId, origin) {
     return this.setOrigins(clientId, sql`CASE WHEN ${origin} = ANY(${embedPartners.allowedOrigins})
@@ -93879,14 +93906,16 @@ var init_embed_util = __esm(() => {
 async function scopedContextId(partnerId, contextId) {
   return sha256Hex(`${partnerId}:${contextId}`);
 }
-function launchTokenClaims(launch) {
+function launchTokenClaims(launch, partner) {
   if (!launch.contextId) {
     return {};
   }
   return {
     context: {
       id: launch.contextId,
-      ...launch.contextRole && { role: launch.contextRole }
+      ...launch.contextRole && { role: launch.contextRole },
+      ...launch.contextAttributes && { attributes: launch.contextAttributes },
+      ...partner.handle && { partner: partner.handle }
     }
   };
 }
@@ -93936,6 +93965,7 @@ class EmbedService {
       timebackCourseId: input.timebackCourseId ?? null,
       contextId: input.context ? await scopedContextId(partner.id, input.context.id) : null,
       contextRole: input.context?.role ?? null,
+      contextAttributes: input.context?.attributes ?? null,
       passHash: await sha256Hex(pass),
       passExpiresAt,
       expiresAt: new Date(now + EMBED_LAUNCH_TTL_MS)
@@ -93947,12 +93977,15 @@ class EmbedService {
       "app.launch.id": launch.id,
       "app.user.id": user.id,
       "app.embed.has_context": input.context !== undefined,
-      ...input.context?.role && { "app.embed.context_role": input.context.role }
+      ...input.context?.role && { "app.embed.context_role": input.context.role },
+      ...input.context?.attributes && {
+        "app.embed.context_attribute_keys": Object.keys(input.context.attributes).toSorted()
+      }
     });
     return { launchId: launch.id, pass, passExpiresAt, gameSlug: game.slug };
   }
   async redeemLaunch(input, timeZone) {
-    const launch = await this.consumePass(input);
+    const { launch, partner } = await this.consumePass(input);
     try {
       const user = await this.deps.db.query.users.findFirst({
         where: eq(users.id, launch.userId)
@@ -93963,7 +93996,7 @@ class EmbedService {
       const [game, profile, token] = await Promise.all([
         this.deps.getGameForStudent(launch.gameId, user),
         this.deps.getGameProfile(user, launch.gameId, timeZone),
-        this.deps.mintGameToken(launch.gameId, user.id, launchTokenClaims(launch))
+        this.deps.mintGameToken(launch.gameId, user.id, launchTokenClaims(launch, partner))
       ]);
       await this.deps.db.update(embedLaunches).set({ redeemedAt: new Date }).where(eq(embedLaunches.id, launch.id));
       return {
@@ -93995,7 +94028,7 @@ class EmbedService {
     if (outcome) {
       throw new AccessDeniedError("This launch has ended");
     }
-    return this.deps.mintGameToken(launch.gameId, launch.userId, launchTokenClaims(launch));
+    return this.deps.mintGameToken(launch.gameId, launch.userId, launchTokenClaims(launch, partner));
   }
   async endLaunch(launchId) {
     await this.deps.db.update(embedLaunches).set({ endedAt: sql`coalesce(${embedLaunches.endedAt}, now())`, passHash: null }).where(eq(embedLaunches.id, launchId));
@@ -94015,18 +94048,17 @@ class EmbedService {
     });
     const partner = await this.deps.db.query.embedPartners.findFirst({
       where: eq(embedPartners.id, launch.partnerId),
-      columns: { enabled: true, allowedOrigins: true }
+      columns: { enabled: true, allowedOrigins: true, handle: true }
     });
     const originMatches = launch.parentOrigin === input.parentOrigin;
-    const stillAllowed = partner !== undefined && canPartnerLaunch(partner, launch.parentOrigin);
-    if (!originMatches || !stillAllowed) {
+    if (!originMatches || !partner || !canPartnerLaunch(partner, launch.parentOrigin)) {
       await this.endLaunch(launch.id);
       setAttributes({
         "app.embed.outcome": originMatches ? "partner_disallowed" : "origin_mismatch"
       });
       throw new UnauthorizedError("This launch pass is not valid");
     }
-    return launch;
+    return { launch, partner };
   }
 }
 function renewalRefusal(launch, isAllowed) {
@@ -150842,7 +150874,7 @@ async function ensurePartner(ctx) {
   await requireEmbedAdmin(ctx);
   const clientId = requireClientIdParam(ctx);
   const body2 = await parseRequestBody(ctx.request, EnsureEmbedPartnerSchema);
-  return ctx.services.embedPartner.ensurePartner(clientId, body2.name);
+  return ctx.services.embedPartner.ensurePartner(clientId, body2.name, body2.handle);
 }
 async function addPartnerOrigin(ctx) {
   await requireEmbedAdmin(ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@playcademy/sandbox",
-    "version": "0.12.2-beta.6",
+    "version": "0.13.0",
     "description": "Local development server for Playcademy game development",
     "type": "module",
     "exports": {