@tesouro/embedded-components-widget-token 0.0.1 → 0.2.130
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +40 -16
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -31,6 +31,7 @@ const { widgetToken, exp } = await createWidgetToken({
|
|
|
31
31
|
widgetSecret: process.env.TESOURO_WIDGET_SECRET!,
|
|
32
32
|
userId: 'user_123',
|
|
33
33
|
userEmail: 'user@example.com',
|
|
34
|
+
organizationReference: 'partner-org-123',
|
|
34
35
|
});
|
|
35
36
|
```
|
|
36
37
|
|
|
@@ -49,6 +50,7 @@ const mintWidgetToken = configureCreateWidgetToken({
|
|
|
49
50
|
clientId: process.env.TESOURO_CLIENT_ID!,
|
|
50
51
|
clientSecret: process.env.TESOURO_CLIENT_SECRET!,
|
|
51
52
|
widgetSecret: process.env.TESOURO_WIDGET_SECRET!,
|
|
53
|
+
organizationReference: 'partner-org-123',
|
|
52
54
|
});
|
|
53
55
|
|
|
54
56
|
const { widgetToken, exp } = await mintWidgetToken({
|
|
@@ -68,27 +70,47 @@ const mintWidgetToken = configureCreateWidgetToken({
|
|
|
68
70
|
clientId: process.env.TESOURO_CLIENT_ID!,
|
|
69
71
|
clientSecret: process.env.TESOURO_CLIENT_SECRET!,
|
|
70
72
|
widgetSecret: process.env.TESOURO_WIDGET_SECRET!,
|
|
73
|
+
organizationReference: process.env.TESOURO_ORGANIZATION_REFERENCE!,
|
|
71
74
|
});
|
|
72
75
|
|
|
73
76
|
export async function POST(req: NextRequest) {
|
|
74
|
-
|
|
75
|
-
|
|
77
|
+
// Resolve the user from YOUR authenticated session — NEVER from the request
|
|
78
|
+
// body. This route hands back a valid widget token for whatever identity you
|
|
79
|
+
// pass in, so reading `userId` / `userEmail` from `req.json()` would let any
|
|
80
|
+
// caller mint a token impersonating someone else. Swap `getSession` for your
|
|
81
|
+
// own server-side session verification (signed cookie, bearer token, etc.).
|
|
82
|
+
const session = await getSession(req);
|
|
83
|
+
if (!session) {
|
|
84
|
+
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
|
|
85
|
+
}
|
|
86
|
+
|
|
87
|
+
const { widgetToken, exp } = await mintWidgetToken({
|
|
88
|
+
userId: session.userId,
|
|
89
|
+
userEmail: session.userEmail,
|
|
90
|
+
});
|
|
76
91
|
return NextResponse.json({ widgetToken, exp });
|
|
77
92
|
}
|
|
78
93
|
```
|
|
79
94
|
|
|
95
|
+
> **Identity must come from the server, not the caller.** Resolve `userId`,
|
|
96
|
+
> `userEmail`, and `organizationReference` from your authenticated session and
|
|
97
|
+
> partner config — never from the request body. This endpoint mints a valid
|
|
98
|
+
> token for whatever identity it receives, so trusting client-supplied identity
|
|
99
|
+
> lets any caller impersonate another user.
|
|
100
|
+
|
|
80
101
|
## API
|
|
81
102
|
|
|
82
103
|
### `createWidgetToken(params): Promise<WidgetTokenResult>`
|
|
83
104
|
|
|
84
|
-
| Param
|
|
85
|
-
|
|
|
86
|
-
| `clientId`
|
|
87
|
-
| `clientSecret`
|
|
88
|
-
| `widgetSecret`
|
|
89
|
-
| `userId`
|
|
90
|
-
| `userEmail`
|
|
91
|
-
| `
|
|
105
|
+
| Param | Type | Required | Description |
|
|
106
|
+
| ----------------------- | -------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
107
|
+
| `clientId` | `string` | yes | Tesouro-issued client identifier. Used as JWE `kid` and as `iss`/`client_id` in the payload. |
|
|
108
|
+
| `clientSecret` | `string` | yes | Tesouro-issued client secret. Carried as `client_secret` inside the encrypted payload. |
|
|
109
|
+
| `widgetSecret` | `string` | yes | Shared symmetric key used to encrypt the JWE. |
|
|
110
|
+
| `userId` | `string` | yes | Subject (`sub`) of the inner identity token. |
|
|
111
|
+
| `userEmail` | `string` | yes | Email claim of the inner identity token. |
|
|
112
|
+
| `organizationReference` | `string` | no | Partner-resolved organization/business reference. Carried as `organization_reference` in the outer encrypted payload. Resolve this server-side, not from request body input. |
|
|
113
|
+
| `expirationInSeconds` | `number` | no | Token TTL in seconds. Defaults to `DEFAULT_EXPIRATION_IN_SECONDS` (480 — 8 minutes). |
|
|
92
114
|
|
|
93
115
|
Returns:
|
|
94
116
|
|
|
@@ -103,10 +125,10 @@ Throws if `clientId`, `clientSecret`, or `widgetSecret` is missing or empty.
|
|
|
103
125
|
|
|
104
126
|
### `configureCreateWidgetToken(creds)`
|
|
105
127
|
|
|
106
|
-
Binds `clientId`, `clientSecret`, `widgetSecret`, and
|
|
107
|
-
`expirationInSeconds`, and returns a function that
|
|
108
|
-
`userId` / `userEmail`
|
|
109
|
-
|
|
128
|
+
Binds `clientId`, `clientSecret`, `widgetSecret`, and optional defaults for
|
|
129
|
+
`organizationReference` and `expirationInSeconds`, and returns a function that
|
|
130
|
+
only takes per-request `userId` / `userEmail` plus optional per-call overrides
|
|
131
|
+
for `organizationReference` and `expirationInSeconds`.
|
|
110
132
|
|
|
111
133
|
### `DEFAULT_EXPIRATION_IN_SECONDS`
|
|
112
134
|
|
|
@@ -128,8 +150,10 @@ overrides the bound default).
|
|
|
128
150
|
|
|
129
151
|
The encrypted payload is an RFC 8693 token-exchange request whose
|
|
130
152
|
`subject_token` is an unsigned identity JWT (`alg: none`) bearing the user's
|
|
131
|
-
`sub`, `email`, `iss`, `aud`, `iat`, and `exp` claims.
|
|
153
|
+
`sub`, `email`, `iss`, `aud`, `iat`, and `exp` claims. When supplied,
|
|
154
|
+
`organizationReference` is minted at the outer encrypted payload level as
|
|
155
|
+
`organization_reference`; it is not added to the inner `subject_token`.
|
|
132
156
|
|
|
133
157
|
## License
|
|
134
158
|
|
|
135
|
-
|
|
159
|
+
Apache-2.0
|