@sponson/adapters 0.7.0 → 0.9.0

package/recipes/resend.yaml

@@ -25,6 +25,11 @@ api:
   base_url: https://api.resend.com
   base_url_env: RESEND_API_URL
   auth: { bearer_env: RESEND_API_KEY }
+credential:
+  url: "https://resend.com/api-keys"
+  scope: "An API key with Full access: Sending access can only send email, not manage webhooks, domains or keys."
+  source: "https://resend.com/docs/dashboard/api-keys/introduction"
+  verify: "GET /domains"
 detect:
   deps: [resend]
   env: ["RESEND_*"]

package/recipes/s3.yaml

@@ -20,6 +20,10 @@ api:
   encoding: xml
   auth:
     aws_sigv4: { region: us-east-1, service: s3, access_key_id_env: AWS_ACCESS_KEY_ID, secret_access_key_env: AWS_SECRET_ACCESS_KEY }
+credential:
+  url: "https://console.aws.amazon.com/iam/home#/users"
+  scope: "AWS: an access key whose policy allows s3:GetBucketCORS and s3:PutBucketCORS on the bucket. R2: an API token with Admin Read & Write."
+  source: "https://developers.cloudflare.com/r2/api/tokens/"
 detect:
   deps: ["@aws-sdk/client-s3"]
   starter:

package/recipes/sendgrid.yaml

@@ -27,6 +27,11 @@ api:
   base_url: https://api.sendgrid.com
   base_url_env: SENDGRID_API_URL
   auth: { bearer_env: SENDGRID_API_KEY }
+credential:
+  url: "https://app.sendgrid.com/settings/api_keys"
+  scope: "A Restricted Access key with Mail Settings > Event Notification set to Full Access."
+  source: "https://www.twilio.com/docs/sendgrid/ui/account-and-settings/api-keys"
+  verify: "GET /v3/scopes"
 detect:
   deps: ["@sendgrid/"]
   env: ["SENDGRID_*"]

package/recipes/sentry.yaml

@@ -23,6 +23,10 @@ api:
   base_url: https://sentry.io/api/0
   base_url_env: SENTRY_API_URL
   auth: { bearer_env: SENTRY_AUTH_TOKEN }
+credential:
+  url: "https://docs.sentry.io/account/auth-tokens/"
+  scope: "An organization auth token (Settings > Auth Tokens), or a personal token with project:releases."
+  source: "https://docs.sentry.io/api/permissions/"
 detect:
   deps: ["@sentry/"]
   env: ["SENTRY_*"]

package/recipes/split.yaml

@@ -21,6 +21,11 @@ api:
   base_url: https://api.split.io/internal/api/v2
   base_url_env: SPLIT_API_URL
   auth: { bearer_env: SPLIT_ADMIN_API_KEY }
+credential:
+  url: "https://developer.harness.io/docs/feature-management-experimentation/api-keys/"
+  scope: "An Admin API key (Admin settings > API keys), restricted to the environments the lines change."
+  source: "https://docs.split.io/reference/authentication"
+  verify: "GET /workspaces"
 detect:
   deps: ["@splitsoftware/"]
   env: ["SPLIT_*"]

package/recipes/statsig.yaml

@@ -22,6 +22,11 @@ api:
   base_url_env: STATSIG_API_URL
   auth: { header: STATSIG-API-KEY, value_env: STATSIG_CONSOLE_API_KEY }
   headers: { STATSIG-API-VERSION: "20240601" }
+credential:
+  url: "https://console.statsig.com/api_keys"
+  scope: "A Console API key (Project Settings > API Keys) that can edit gates."
+  source: "https://docs.statsig.com/console-api/gates"
+  verify: "GET /gates?limit=1"
 detect:
   deps: [statsig-js, statsig-node, statsig-react, "@statsig/"]
   env: ["STATSIG_*"]

package/recipes/stripe.yaml

@@ -43,6 +43,11 @@ api:
   encoding: form
   # A preview must never create live-mode objects (ST2): live keys are refused unless this variable says otherwise.
   refuse_credential: { prefixes: [sk_live_, rk_live_], unless_env: SPONSON_STRIPE_ALLOW_LIVE }
+credential:
+  url: "https://dashboard.stripe.com/test/apikeys"
+  scope: "A test-mode restricted key (Create restricted key) with Webhook Endpoints set to Write and everything else None."
+  source: "https://docs.stripe.com/keys/restricted-api-keys"
+  verify: "GET /webhook_endpoints?limit=1"
 detect:
   deps: [stripe, "@stripe/"]
   env: ["STRIPE_*"]
@@ -50,6 +55,8 @@ detect:
     - op: webhook_endpoint
       preview_url: url
       values: { name: "preview-${ctx.scope}" }
+      check: [path]
+      env: { secret: STRIPE_WEBHOOK_SECRET }
 assumptions:
   - id: ST1
     verified: true
@@ -172,6 +179,9 @@ ops:
         description: { param: description }
       outputs:
         secret: { path: /secret, sensitive: true, once: true }
+    console_url:
+      template: https://dashboard.stripe.com/webhooks
+      source: https://docs.stripe.com/webhooks
     live:
       params: { url: SPONSON_LIVE_STRIPE_WEBHOOK_URL }
   product:

package/recipes/stytch.yaml

@@ -22,6 +22,11 @@ api:
   base_url: https://management.stytch.com
   base_url_env: STYTCH_MANAGEMENT_API_URL
   auth: { basic: { user_env: STYTCH_WORKSPACE_KEY_ID, password_env: STYTCH_WORKSPACE_KEY_SECRET } }
+credential:
+  url: "https://stytch.com/dashboard/settings/management-api"
+  scope: "A Workspace Management API key (Workspace settings > Management API); its key ID and secret, no finer scopes."
+  source: "https://stytch.com/docs/workspace-management/pwa/overview"
+  verify: "GET /pwa/v3/projects"
 detect:
   deps: [stytch, "@stytch/"]
   env: ["STYTCH_*"]

package/recipes/svix.yaml

@@ -16,6 +16,11 @@ api:
   base_url: https://api.us.svix.com
   base_url_env: SVIX_API_URL
   auth: { bearer_env: SVIX_AUTH_TOKEN }
+credential:
+  url: "https://dashboard.svix.com/api-access"
+  scope: "The environment's API key (API Access); keys have no finer scopes."
+  source: "https://docs.svix.com/api-keys"
+  verify: "GET /api/v1/app?limit=1"
 detect:
   deps: [svix]
   env: ["SVIX_*"]

package/recipes/turso.yaml

@@ -17,6 +17,11 @@ api:
   base_url: https://api.turso.tech/v1
   base_url_env: TURSO_API_URL
   auth: { bearer_env: TURSO_API_TOKEN }
+credential:
+  url: "https://docs.turso.tech/api-reference/authentication"
+  scope: "A platform API token for the organization (`turso auth api-tokens mint <name> --org <org>`)."
+  source: "https://docs.turso.tech/api-reference/authentication"
+  verify: "GET /auth/validate"
 detect:
   deps: ["@libsql/client", "@tursodatabase/"]
   env: ["TURSO_*"]

package/recipes/unleash.yaml

@@ -23,6 +23,11 @@ base_url_example: https://unleash.example.com
 api:
   base_url_env: UNLEASH_API_URL
   auth: { header: Authorization, value_env: UNLEASH_AUTH_TOKEN }
+credential:
+  url: "https://docs.getunleash.io/concepts/api-tokens-and-client-keys"
+  scope: "A personal access token (or an Enterprise service account token) whose role edits flags and strategies in the project; not a client or frontend token."
+  source: "https://docs.getunleash.io/concepts/api-tokens-and-client-keys"
+  verify: "GET /api/admin/projects"
 detect:
   deps: [unleash-client, unleash-proxy-client, "@unleash/"]
   env: ["UNLEASH_*"]

package/recipes/upstash.yaml

@@ -26,6 +26,11 @@ api:
   base_url: https://api.upstash.com/v2
   base_url_env: UPSTASH_API_URL
   auth: { basic: { user_env: UPSTASH_EMAIL, password_env: UPSTASH_API_KEY } }
+credential:
+  url: "https://console.upstash.com/account/api"
+  scope: "A Developer API key (Account > Developer API) with Read/Write; the account's email is its user name."
+  source: "https://upstash.com/docs/devops/developer-api/authentication"
+  verify: "GET /redis/databases"
 detect:
   deps: ["@upstash/redis"]
   env: ["UPSTASH_REDIS_*"]

package/recipes/vercel.yaml

@@ -24,6 +24,11 @@ api:
   base_url: https://api.vercel.com
   base_url_env: VERCEL_API_URL
   auth: { bearer_env: VERCEL_TOKEN }
+credential:
+  url: "https://vercel.com/account/tokens"
+  scope: "A token scoped to the team that owns the project, with an expiration."
+  source: "https://vercel.com/kb/guide/how-do-i-use-a-vercel-api-access-token"
+  verify: "GET /v2/user"
 assumptions:
   - id: VD1
     verified: true

package/recipes/workos.yaml

@@ -13,6 +13,11 @@ api:
   base_url: https://api.workos.com
   base_url_env: WORKOS_API_URL
   auth: { bearer_env: WORKOS_API_KEY }
+credential:
+  url: "https://dashboard.workos.com/api-keys"
+  scope: "The secret API key of the environment (staging for previews); WorkOS keys have no finer permissions."
+  source: "https://workos.com/docs/reference/api-keys"
+  verify: "GET /organizations?limit=1"
 detect:
   deps: ["@workos-inc/"]
   env: ["WORKOS_*"]