@teamkeel/testing-runtime 0.466.0 → 0.467.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teamkeel/testing-runtime",
-  "version": "0.466.0",
+  "version": "0.467.1",
   "description": "Internal package used by the generated @teamkeel/testing package",
   "exports": "./src/index.mjs",
   "typings": "src/index.d.ts",

package/src/FlowExecutor.mjs

@@ -66,6 +66,35 @@ export class FlowExecutor {
     return headers;
   }
 
+  // signedLinkHeaders builds the headers for a signed-link (share) request. Matching the production
+  // SDK, a bare call (no identity/authToken) defaults to a first-party `flows` service token that
+  // the runtime trusts, so minting/listing/revoking passes the flow's share permission without a
+  // user. An explicit withIdentity()/withAuthToken() opts into user-scoped auth, where the flow's
+  // @permission(actions: [share]) rule is enforced.
+  signedLinkHeaders() {
+    if (this._identity === null && this._authToken === null) {
+      const base64pk = process.env.KEEL_PRIVATE_KEY;
+      if (base64pk) {
+        const privateKey = Buffer.from(base64pk, "base64").toString("utf8");
+        return {
+          "Content-Type": "application/json",
+          Authorization:
+            "Bearer " +
+            jwt.sign({}, privateKey, {
+              algorithm: "RS256",
+              expiresIn: 60 * 60 * 24,
+              audience: "flows",
+              issuer: "https://keel.so",
+            }),
+        };
+      }
+      // No signing key available: fall through to an unauthenticated request.
+      return { "Content-Type": "application/json" };
+    }
+
+    return this.headers();
+  }
+
   async start(inputs) {
     return parseInputs(inputs).then((parsed) => {
       // Use the HTTP JSON API as that returns more friendly errors than
@@ -89,7 +118,7 @@ export class FlowExecutor {
   // generated testing types only expose `signedLinks` on flows declared with @externalAccess.
   get signedLinks() {
     const flowUrl = this._flowUrl;
-    const headers = () => this.headers();
+    const headers = () => this.signedLinkHeaders();
 
     return {
       async create(options = {}) {

package/src/index.d.ts

@@ -163,6 +163,9 @@ export declare class FlowExecutor<Input = {}> {
 }
 
 // The signed-link management namespace exposed on a shareable flow's executor as `signedLinks`.
+// By default every operation authenticates with a first-party `flows` service token the runtime
+// trusts, so links can be managed without satisfying the flow's `share` permission. Chaining
+// withIdentity()/withAuthToken() switches to user-scoped auth, where @permission is enforced.
 export interface SignedLinksAPI<Input = {}> {
   // Mint a signed link that lets an external, unauthenticated actor execute this flow.
   create(options?: {