@trackunit/serverside-utils 0.5.238-alpha-275bba7d3e1.0 → 0.5.239

package/index.cjs.js

@@ -241,6 +241,13 @@ const getAccountId = ({ context }) => {
 const SecretsResponseSchema = zod.z.object({
     secrets: zod.z.record(zod.z.string(), zod.z.string()),
 });
+const getAccountScope = ({ context }) => {
+    const userToken = getUserToken({ context });
+    if (!userToken) {
+        throw new Error("Missing user token");
+    }
+    return { accountId: getAccountId({ context }).accountId, userToken };
+};
 /**
  * Fetches a secret from the SDK Server.
  *
@@ -253,7 +260,7 @@ const SecretsResponseSchema = zod.z.object({
  * @param options - The options object
  * @param options.context - Hono request context
  * @param options.secretKey - Key name of the secret
- * @param options.accountScoped - When true, fetches account-scoped secrets (requires user token with accountId)
+ * @param options.accountScoped - When true, fetches account-scoped secrets (requires user token with accountId, which is sent to the SDK Server so it can verify the account)
  * @returns {Promise<string>} The secret value
  * @throws Error if required headers or env vars are missing, or secret not found
  * @example
@@ -284,10 +291,13 @@ const getSecret = async ({ context, secretKey, accountScoped = false, }) => {
     if (!sdkServerUrl) {
         throw new Error("Missing required environment variable: SDK_SERVER_URL");
     }
-    const secretsPath = accountScoped ? `/secrets/${getAccountId({ context }).accountId}` : "/secrets";
+    const accountScope = accountScoped ? getAccountScope({ context }) : undefined;
+    const secretsPath = accountScope ? `/secrets/${accountScope.accountId}` : "/secrets";
     const secretsUrl = new URL(secretsPath, sdkServerUrl).href;
     const res = await fetch(secretsUrl, {
-        headers: { Authorization: adminToken },
+        headers: accountScope
+            ? { Authorization: adminToken, [FORWARDED_AUTHORIZATION_HEADER]: `Bearer ${accountScope.userToken}` }
+            : { Authorization: adminToken },
     });
     if (!res.ok) {
         let errorBody = "";

package/index.esm.js

@@ -239,6 +239,13 @@ const getAccountId = ({ context }) => {
 const SecretsResponseSchema = z.object({
     secrets: z.record(z.string(), z.string()),
 });
+const getAccountScope = ({ context }) => {
+    const userToken = getUserToken({ context });
+    if (!userToken) {
+        throw new Error("Missing user token");
+    }
+    return { accountId: getAccountId({ context }).accountId, userToken };
+};
 /**
  * Fetches a secret from the SDK Server.
  *
@@ -251,7 +258,7 @@ const SecretsResponseSchema = z.object({
  * @param options - The options object
  * @param options.context - Hono request context
  * @param options.secretKey - Key name of the secret
- * @param options.accountScoped - When true, fetches account-scoped secrets (requires user token with accountId)
+ * @param options.accountScoped - When true, fetches account-scoped secrets (requires user token with accountId, which is sent to the SDK Server so it can verify the account)
  * @returns {Promise<string>} The secret value
  * @throws Error if required headers or env vars are missing, or secret not found
  * @example
@@ -282,10 +289,13 @@ const getSecret = async ({ context, secretKey, accountScoped = false, }) => {
     if (!sdkServerUrl) {
         throw new Error("Missing required environment variable: SDK_SERVER_URL");
     }
-    const secretsPath = accountScoped ? `/secrets/${getAccountId({ context }).accountId}` : "/secrets";
+    const accountScope = accountScoped ? getAccountScope({ context }) : undefined;
+    const secretsPath = accountScope ? `/secrets/${accountScope.accountId}` : "/secrets";
     const secretsUrl = new URL(secretsPath, sdkServerUrl).href;
     const res = await fetch(secretsUrl, {
-        headers: { Authorization: adminToken },
+        headers: accountScope
+            ? { Authorization: adminToken, [FORWARDED_AUTHORIZATION_HEADER]: `Bearer ${accountScope.userToken}` }
+            : { Authorization: adminToken },
     });
     if (!res.ok) {
         let errorBody = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trackunit/serverside-utils",
-  "version": "0.5.238-alpha-275bba7d3e1.0",
+  "version": "0.5.239",
   "repository": "https://github.com/Trackunit/manager",
   "license": "SEE LICENSE IN LICENSE.txt",
   "engines": {
@@ -8,7 +8,7 @@
   },
   "dependencies": {
     "@graphql-typed-document-node/core": "^3.2.0",
-    "@trackunit/server-graphql-client": "0.0.101-alpha-275bba7d3e1.0",
+    "@trackunit/server-graphql-client": "0.0.100",
     "jwt-decode": "^3.1.2",
     "zod": "^3.25.76"
   },

package/src/get-secret.d.ts

@@ -4,7 +4,10 @@ type GetSecretOptions<TSecretKey extends string> = {
     context: Context;
     /** Key name of the secret (also used as env var name for local dev) */
     secretKey: TSecretKey;
-    /** When true, fetches account-scoped secrets instead of app-level secrets. Requires a valid user token with an accountId. */
+    /**
+     * When true, fetches account-scoped secrets instead of app-level secrets. Requires a valid user token with an accountId.
+     * The user token is sent to the SDK Server so it can verify the account.
+     */
     accountScoped?: boolean;
 };
 /**
@@ -19,7 +22,7 @@ type GetSecretOptions<TSecretKey extends string> = {
  * @param options - The options object
  * @param options.context - Hono request context
  * @param options.secretKey - Key name of the secret
- * @param options.accountScoped - When true, fetches account-scoped secrets (requires user token with accountId)
+ * @param options.accountScoped - When true, fetches account-scoped secrets (requires user token with accountId, which is sent to the SDK Server so it can verify the account)
  * @returns {Promise<string>} The secret value
  * @throws Error if required headers or env vars are missing, or secret not found
  * @example