@tesouro/embedded-components-widget-token 0.5.223 → 0.5.224

package/README.md

@@ -109,7 +109,7 @@ export async function POST(req: NextRequest) {
 | `widgetSecret`          | `string` | yes      | Shared symmetric key used to encrypt the JWE.                                                                                                                                |
 | `userId`                | `string` | yes      | Subject (`sub`) of the inner identity token.                                                                                                                                 |
 | `userEmail`             | `string` | yes      | Email claim of the inner identity token.                                                                                                                                     |
-| `organizationReference` | `string` | no       | Partner-resolved organization/business reference. Carried as `organization_reference` in the outer encrypted payload. Resolve this server-side, not from request body input. |
+| `organizationReference` | `string` | yes      | Partner-resolved organization/business reference. Carried as `organization_reference` in the outer encrypted payload. Resolve this server-side, not from request body input. |
 | `expirationInSeconds`   | `number` | no       | Token TTL in seconds. Defaults to `DEFAULT_EXPIRATION_IN_SECONDS` (480 — 8 minutes).                                                                                         |
 
 Returns:
@@ -121,14 +121,16 @@ interface WidgetTokenResult {
 }
 ```
 
-Throws if `clientId`, `clientSecret`, or `widgetSecret` is missing or empty.
+Throws if `clientId`, `clientSecret`, `widgetSecret`, or `organizationReference` is missing or empty.
 
 ### `configureCreateWidgetToken(creds)`
 
 Binds `clientId`, `clientSecret`, `widgetSecret`, and optional defaults for
 `organizationReference` and `expirationInSeconds`, and returns a function that
 only takes per-request `userId` / `userEmail` plus optional per-call overrides
-for `organizationReference` and `expirationInSeconds`.
+for `organizationReference` and `expirationInSeconds`. `organizationReference`
+is still required: the returned function throws unless it is bound here or
+passed per call.
 
 ### `DEFAULT_EXPIRATION_IN_SECONDS`
 
@@ -150,9 +152,9 @@ for `organizationReference` and `expirationInSeconds`.
 
 The encrypted payload is an RFC 8693 token-exchange request whose
 `subject_token` is an unsigned identity JWT (`alg: none`) bearing the user's
-`sub`, `email`, `iss`, `aud`, `iat`, and `exp` claims. When supplied,
-`organizationReference` is minted at the outer encrypted payload level as
-`organization_reference`; it is not added to the inner `subject_token`.
+`sub`, `email`, `iss`, `aud`, `iat`, and `exp` claims. `organizationReference`
+is minted at the outer encrypted payload level as `organization_reference`; it
+is not added to the inner `subject_token`.
 
 ## License
 

package/dist/index2.js

@@ -4,6 +4,7 @@ import { EncryptJWT as t } from "jose";
 var n = 480;
 async function r({ clientId: n, clientSecret: r, widgetSecret: i, userId: a, userEmail: o, organizationReference: s, expirationInSeconds: c = 480 }) {
 	if (!i || !n || !r) throw Error("Missing required parameters for widget token generation: clientId, clientSecret, and widgetSecret are required");
+	if (typeof s != "string" || !s.trim()) throw Error("Missing required parameter for widget token generation: organizationReference is required");
 	let l = Math.floor(Date.now() / 1e3), u = l + c, d = new TextEncoder().encode(i), f = {
 		sub: a,
 		email: o,
@@ -23,7 +24,7 @@ async function r({ clientId: n, clientSecret: r, widgetSecret: i, userId: a, use
 		iat: l,
 		iss: n,
 		jti: e.randomUUID(),
-		...s ? { organization_reference: s } : {},
+		organization_reference: s,
 		subject_token: p,
 		subject_token_type: "urn:ietf:params:oauth:token-type:access_token"
 	};

package/dist/lib/createWidgetToken.d.ts

@@ -8,13 +8,10 @@ export interface CreateWidgetTokenParams {
     /**
      * The partner's stable, opaque identifier for the business/organization
      * (SMB grouping) the applicant belongs to. Minted into the outer JWE payload
-     * as `organization_reference` so the widget proxy can call
-     * embedded-banking/v1/application-status to drive widget visibility.
-     *
-     * MUST be resolved server-side from the partner's organization config — never
-     * accept this value from the browser.
+     * as the required `organization_reference` claim. Resolve it server-side,
+     * never from the browser.
      */
-    organizationReference?: string;
+    organizationReference: string;
     expirationInSeconds?: number;
 }
 export interface WidgetTokenResult {
@@ -22,5 +19,5 @@ export interface WidgetTokenResult {
     exp: number;
 }
 export declare function createWidgetToken({ clientId, clientSecret, widgetSecret, userId, userEmail, organizationReference, expirationInSeconds, }: CreateWidgetTokenParams): Promise<WidgetTokenResult>;
-export declare function configureCreateWidgetToken({ clientId, clientSecret, widgetSecret, organizationReference: defaultOrganizationReference, expirationInSeconds: defaultExpiration, }: Pick<CreateWidgetTokenParams, 'clientId' | 'clientSecret' | 'widgetSecret' | 'organizationReference' | 'expirationInSeconds'>): ({ userId, userEmail, organizationReference, expirationInSeconds, }: Pick<CreateWidgetTokenParams, "userId" | "userEmail" | "organizationReference" | "expirationInSeconds">) => Promise<WidgetTokenResult>;
+export declare function configureCreateWidgetToken({ clientId, clientSecret, widgetSecret, organizationReference: defaultOrganizationReference, expirationInSeconds: defaultExpiration, }: Pick<CreateWidgetTokenParams, 'clientId' | 'clientSecret' | 'widgetSecret' | 'expirationInSeconds'> & Partial<Pick<CreateWidgetTokenParams, 'organizationReference'>>): ({ userId, userEmail, organizationReference, expirationInSeconds, }: Pick<CreateWidgetTokenParams, "userId" | "userEmail" | "expirationInSeconds"> & Partial<Pick<CreateWidgetTokenParams, "organizationReference">>) => Promise<WidgetTokenResult>;
 //# sourceMappingURL=createWidgetToken.d.ts.map

package/dist/lib/createWidgetToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createWidgetToken.d.ts","sourceRoot":"","sources":["../../src/lib/createWidgetToken.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAsB,iBAAiB,CAAC,EACtC,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,EACT,qBAAqB,EACrB,mBAAmD,GACpD,EAAE,uBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6DtD;AAED,wBAAgB,0BAA0B,CAAC,EACzC,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,qBAAqB,EAAE,4BAA4B,EACnD,mBAAmB,EAAE,iBAAiB,GACvC,EAAE,IAAI,CACL,uBAAuB,EACrB,UAAU,GACV,cAAc,GACd,cAAc,GACd,uBAAuB,GACvB,qBAAqB,CACxB,IACS,oEAQL,IAAI,CACL,uBAAuB,EACvB,QAAQ,GAAG,WAAW,GAAG,uBAAuB,GAAG,qBAAqB,CACzE,gCAUF"}
+{"version":3,"file":"createWidgetToken.d.ts","sourceRoot":"","sources":["../../src/lib/createWidgetToken.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAsB,iBAAiB,CAAC,EACtC,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,EACT,qBAAqB,EACrB,mBAAmD,GACpD,EAAE,uBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmEtD;AAGD,wBAAgB,0BAA0B,CAAC,EACzC,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,qBAAqB,EAAE,4BAA4B,EACnD,mBAAmB,EAAE,iBAAiB,GACvC,EAAE,IAAI,CACL,uBAAuB,EACvB,UAAU,GAAG,cAAc,GAAG,cAAc,GAAG,qBAAqB,CACrE,GACC,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,IACvD,oEAQL,IAAI,CACL,uBAAuB,EACvB,QAAQ,GAAG,WAAW,GAAG,qBAAqB,CAC/C,GACC,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,gCAUlE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tesouro/embedded-components-widget-token",
-  "version": "0.5.223",
+  "version": "0.5.224",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {