@rebuy/rebuy 3.53.0 → 3.54.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/routes.cjs +1 -1
- package/dist/routes.d.ts +5 -3
- package/dist/routes.mjs +1 -1
- package/package.json +1 -1
package/dist/routes.cjs
CHANGED
|
@@ -41,4 +41,4 @@ var apiRoutes = {
|
|
|
41
41
|
sections: { method: "get", path: "/cab/sections" }
|
|
42
42
|
}
|
|
43
43
|
};
|
|
44
|
-
var UPSTREAM_SUFFIXES = ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com"
|
|
44
|
+
var UPSTREAM_SUFFIXES = ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com"];
|
package/dist/routes.d.ts
CHANGED
|
@@ -42,7 +42,9 @@ export declare const apiRoutes: {
|
|
|
42
42
|
* Hosts a non-production upstream override may point at (suffix match; subdomains allowed). The single
|
|
43
43
|
* allowlist consumed by BOTH rebuy-api's `resolveUpstream` (the `X-Rebuy-Upstream` header guard) and the
|
|
44
44
|
* checkout extension's `resolveUpstream` (the `hostName` block setting), so the two can never drift — a
|
|
45
|
-
* host only one side accepts is silently dropped to production on the other.
|
|
46
|
-
*
|
|
45
|
+
* host only one side accepts is silently dropped to production on the other. This list is the SSRF boundary:
|
|
46
|
+
* only Rebuy-owned zones belong on it. `trycloudflare.com` was removed (REB-24999) because anyone can mint a
|
|
47
|
+
* `cloudflared` quick tunnel under it, which let any caller point our pods at a host they control. To expose a
|
|
48
|
+
* local engine, run a named Cloudflare tunnel on a `rebuycloud.dev` hostname instead.
|
|
47
49
|
*/
|
|
48
|
-
export declare const UPSTREAM_SUFFIXES: readonly ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com"
|
|
50
|
+
export declare const UPSTREAM_SUFFIXES: readonly ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com"];
|
package/dist/routes.mjs
CHANGED
|
@@ -16,7 +16,7 @@ var apiRoutes = {
|
|
|
16
16
|
sections: { method: "get", path: "/cab/sections" }
|
|
17
17
|
}
|
|
18
18
|
};
|
|
19
|
-
var UPSTREAM_SUFFIXES = ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com"
|
|
19
|
+
var UPSTREAM_SUFFIXES = ["enigneyuber.com", "rebuycloud.dev", "rebuyengine.com"];
|
|
20
20
|
export {
|
|
21
21
|
UPSTREAM_SUFFIXES,
|
|
22
22
|
apiRoutes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@rebuy/rebuy",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.54.0",
|
|
4
4
|
"description": "Shared zod schemas, legacy-to-CAB widget transforms, and server orchestrators for Rebuy's Shopify consumers (rebuy-api, admin-nextjs, rebuy-shopify-extensions)",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "Rebuy, Inc.",
|