@sentry/junior 0.101.0 → 0.102.1

package/dist/{chunk-TPTJEHUE.js → chunk-X2IPNCB5.js}

@@ -3,14 +3,14 @@ import {
   isConversationScopedChannel,
   isDmChannel,
   normalizeSlackConversationId
-} from "./chunk-FP5N5OWZ.js";
+} from "./chunk-IQ36I3DF.js";
 import {
   createPluginLogger,
   createPluginState
-} from "./chunk-PWC24W5F.js";
+} from "./chunk-ZSHL44IQ.js";
 import {
   getDb
-} from "./chunk-VHRM6GNH.js";
+} from "./chunk-QZGVPPIJ.js";
 import {
   SANDBOX_WORKSPACE_ROOT
 } from "./chunk-G3E7SCME.js";
@@ -18,13 +18,13 @@ import {
   botConfig,
   completeObject,
   embedTexts
-} from "./chunk-A7X2FDUO.js";
+} from "./chunk-SHBPSE7A.js";
 import {
   isActorUserId,
   logInfo,
   logWarn,
   parseActorUserId
-} from "./chunk-I35CTGPO.js";
+} from "./chunk-AEWZ7F65.js";
 import {
   parseSlackChannelReferenceId,
   parseSlackMessageTs,
@@ -108,14 +108,8 @@ var CREDENTIAL_SUBJECT_SIGNATURE_VERSION = "v1";
 function getCredentialSubjectSecret() {
   return process.env.JUNIOR_SECRET?.trim() || void 0;
 }
-function buildPayload(input) {
-  return [
-    CREDENTIAL_SUBJECT_HMAC_CONTEXT,
-    input.allowedWhen,
-    input.teamId,
-    input.channelId,
-    input.userId
-  ].join("\0");
+function buildPayload(parts) {
+  return [CREDENTIAL_SUBJECT_HMAC_CONTEXT, ...parts].join("\0");
 }
 function signPayload(secret, payload) {
   const digest = createHmac("sha256", secret).update(payload).digest("hex");
@@ -161,12 +155,7 @@ function bindSlackDirectCredentialSubject(input) {
       channelId,
       signature: signPayload(
         secret,
-        buildPayload({
-          allowedWhen: subject.allowedWhen,
-          teamId,
-          channelId,
-          userId
-        })
+        buildPayload([subject.allowedWhen, teamId, channelId, userId])
       )
     }
   };
@@ -184,12 +173,57 @@ function verifySlackDirectCredentialSubject(input) {
   }
   const expected = signPayload(
     secret,
-    buildPayload({
-      allowedWhen: subject.allowedWhen,
-      teamId: binding.teamId,
-      channelId: binding.channelId,
-      userId: subject.userId
-    })
+    buildPayload([
+      subject.allowedWhen,
+      binding.teamId,
+      binding.channelId,
+      subject.userId
+    ])
+  );
+  return timingSafeMatch(expected, binding.signature);
+}
+function bindScheduledTaskCredentialSubject(input) {
+  const secret = getCredentialSubjectSecret();
+  const plugin = input.plugin.trim();
+  const userId = parseActorUserId(input.subject.userId);
+  if (!secret || plugin !== "scheduler" || !userId || input.subject.allowedWhen !== "scheduled-task") {
+    return void 0;
+  }
+  const taskId = input.subject.taskId;
+  if (!taskId || taskId !== taskId.trim()) {
+    return void 0;
+  }
+  return {
+    type: "user",
+    userId,
+    allowedWhen: "scheduled-task",
+    taskId,
+    binding: {
+      type: "scheduled-task",
+      plugin,
+      taskId,
+      signature: signPayload(
+        secret,
+        buildPayload(["scheduled-task", plugin, taskId, userId])
+      )
+    }
+  };
+}
+function verifyScheduledTaskCredentialSubject(input) {
+  const secret = getCredentialSubjectSecret();
+  const { subject } = input;
+  const binding = subject.binding;
+  if (!secret || input.plugin !== "scheduler" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "scheduled-task" || !subject.taskId || binding.type !== "scheduled-task" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) {
+    return false;
+  }
+  const expected = signPayload(
+    secret,
+    buildPayload([
+      "scheduled-task",
+      binding.plugin,
+      binding.taskId,
+      subject.userId
+    ])
   );
   return timingSafeMatch(expected, binding.signature);
 }
@@ -1008,6 +1042,8 @@ export {
   getSlackToolContext,
   bindSlackDirectCredentialSubject,
   verifySlackDirectCredentialSubject,
+  bindScheduledTaskCredentialSubject,
+  verifyScheduledTaskCredentialSubject,
   resolveChannelCapabilities,
   PluginHookDeniedError,
   validatePlugins,