@rstreamlabs/tunnels 3.10.2 → 4.0.1

package/dist/index.mjs

@@ -18,6 +18,8 @@ import {
   listWebTTYKeyGrantDecryptMaterialParamsSchema,
   listWebTTYSessionGroupsParamsSchema,
   listWebTTYSessionsParamsSchema,
+  listedClientSchema,
+  listedTunnelSchema,
   projectLogEventsSchema,
   readWebTTYSessionEventsParamsSchema,
   resolveWebTTYControlRequestParamsSchema,
@@ -48,7 +50,7 @@ import {
   webTTYTransportSchema,
   webhookEventsSchema,
   wsEventsSchema
-} from "./chunk-DQN5T7CI.mjs";
+} from "./chunk-TJNLK4CU.mjs";
 
 // src/auth-resource.ts
 import { createAuthTokenParamsSchema } from "@rstreamlabs/rstream/auth-token";
@@ -1843,7 +1845,7 @@ function validateWatchQueryToken(token) {
   }
   if (!hasWatchOnlyTunnelResources(parsed.data)) {
     throw new Error(
-      "Watch requires a fine-grained token limited to tunnel list resources for URL-based authentication."
+      "Watch requires a fine-grained token limited to client or tunnel list resources for URL-based authentication."
     );
   }
 }
@@ -1859,38 +1861,38 @@ function hasWatchOnlyTunnelResources(token) {
 }
 function hasWatchOnlyTunnelResource(resource) {
   return watchResourceBranches(resource).every(
-    (branch) => branch.hasList && !branch.hasMutationOrConnect
+    (branch) => (branch.clients || branch.tunnels) && !branch.create && !branch.connect
   );
 }
 function watchResourceBranches(resource) {
   if ("AND" in resource) {
     return resource.AND.reduce(
-      (branches, child) => combineWatchResourceBranches(branches, child),
-      [{ hasList: false, hasMutationOrConnect: false }]
+      (branches, child) => branches.flatMap(
+        (branch) => watchResourceBranches(child).map((other) => ({
+          clients: branch.clients && other.clients,
+          tunnels: branch.tunnels && other.tunnels,
+          create: branch.create && other.create,
+          connect: branch.connect && other.connect
+        }))
+      ),
+      [{ clients: true, tunnels: true, create: true, connect: true }]
     );
   }
-  if ("OR" in resource) {
-    return resource.OR.flatMap(watchResourceBranches);
-  }
-  const tunnels = resource.scopes?.tunnels;
-  if (tunnels === void 0) {
-    return [{ hasList: false, hasMutationOrConnect: false }];
+  if ("OR" in resource) return resource.OR.flatMap(watchResourceBranches);
+  if (resource.scopes === void 0) {
+    return [{ clients: true, tunnels: true, create: true, connect: true }];
   }
+  const { clients, tunnels } = resource.scopes;
+  const allows = (scope) => scope !== void 0 && scope !== false;
   return [
     {
-      hasList: tunnels.list !== void 0,
-      hasMutationOrConnect: tunnels.create !== void 0 || tunnels.connect !== void 0
+      clients: clients === void 0 || allows(clients.list),
+      tunnels: allows(tunnels?.list),
+      create: allows(tunnels?.create),
+      connect: allows(tunnels?.connect)
     }
   ];
 }
-function combineWatchResourceBranches(branches, child) {
-  return branches.flatMap(
-    (branch) => watchResourceBranches(child).map((childBranch) => ({
-      hasList: branch.hasList || childBranch.hasList,
-      hasMutationOrConnect: branch.hasMutationOrConnect || childBranch.hasMutationOrConnect
-    }))
-  );
-}
 function hasWatchOnlyPermissions(permissions) {
   if (!Array.isArray(permissions)) {
     return true;
@@ -2116,7 +2118,7 @@ function webTTYHasCapability(capabilities, capability) {
   return capabilities.includes(capability);
 }
 function parser(tunnel, includePrivate) {
-  if (tunnel.status !== "online") return null;
+  if (!tunnel.id || tunnel.status !== "online") return null;
   if (tunnel.publish !== true && !includePrivate) return null;
   const managedProtocol = tunnel.protocol === "webtty";
   if (tunnel.protocol !== void 0 && tunnel.protocol !== "http" && !managedProtocol)
@@ -2273,6 +2275,8 @@ export {
   listWebTTYKeyGrantDecryptMaterialParamsSchema,
   listWebTTYSessionGroupsParamsSchema,
   listWebTTYSessionsParamsSchema,
+  listedClientSchema,
+  listedTunnelSchema,
   normalizeEngineAddress,
   parseWebTTYServers,
   projectLogEventsSchema,

package/dist/openapi.d.mts

@@ -380,6 +380,7 @@ declare const engineOpenApiDocument: {
             get: {
                 tags: string[];
                 summary: string;
+                "x-rstream-token-scope": string;
                 operationId: string;
                 parameters: {
                     $ref: string;
@@ -458,7 +459,7 @@ declare const engineOpenApiDocument: {
                     };
                 };
                 "x-rstream-required-rules": readonly OpenApiRule[];
-                "x-rstream-token-metadata-scope": string;
+                "x-rstream-token-scope": string;
             };
         };
         "/api/sse": {

package/dist/openapi.d.ts

@@ -380,6 +380,7 @@ declare const engineOpenApiDocument: {
             get: {
                 tags: string[];
                 summary: string;
+                "x-rstream-token-scope": string;
                 operationId: string;
                 parameters: {
                     $ref: string;
@@ -458,7 +459,7 @@ declare const engineOpenApiDocument: {
                     };
                 };
                 "x-rstream-required-rules": readonly OpenApiRule[];
-                "x-rstream-token-metadata-scope": string;
+                "x-rstream-token-scope": string;
             };
         };
         "/api/sse": {