@pylonsync/sdk 0.3.78 → 0.3.83
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/index.ts +14 -1
package/package.json
CHANGED
package/src/index.ts
CHANGED
|
@@ -518,6 +518,12 @@ export function policiesToManifest(
|
|
|
518
518
|
* (User entity named "User", strip `passwordHash`, 30-day sessions,
|
|
519
519
|
* no cookie cache, trusted origins from `PYLON_TRUSTED_ORIGINS` env).
|
|
520
520
|
*
|
|
521
|
+
* `trustedOrigins` is the unified source for **all three gates** —
|
|
522
|
+
* CORS, CSRF, and OAuth-redirect. Loopback origins
|
|
523
|
+
* (`http://localhost`, `127.0.0.1`, `[::1]`, any port) are always
|
|
524
|
+
* auto-trusted across all three gates so `pylon dev` works without
|
|
525
|
+
* any allowlist config.
|
|
526
|
+
*
|
|
521
527
|
* @example
|
|
522
528
|
* auth({
|
|
523
529
|
* user: {
|
|
@@ -590,7 +596,14 @@ export type AuthConfig = {
|
|
|
590
596
|
*/
|
|
591
597
|
disabled?: boolean;
|
|
592
598
|
};
|
|
593
|
-
/**
|
|
599
|
+
/**
|
|
600
|
+
* Per-app trusted origins. Single declarative source for the three
|
|
601
|
+
* browser-facing gates: CORS, CSRF, OAuth `?callback=` validation.
|
|
602
|
+
* Merged with `PYLON_TRUSTED_ORIGINS` (OAuth) / `PYLON_CORS_ORIGIN`
|
|
603
|
+
* (CORS) / `PYLON_CSRF_ORIGINS` (CSRF) env vars when ops need to
|
|
604
|
+
* split per-gate. Loopback (`http://localhost`, `127.0.0.1`, `[::1]`,
|
|
605
|
+
* any port) is always auto-trusted at every gate.
|
|
606
|
+
*/
|
|
594
607
|
trustedOrigins?: string[];
|
|
595
608
|
};
|
|
596
609
|
|