@tryvitris/website-admin-contracts 1.2.0 → 1.3.1

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export * from './client-onboarding.js';
 export * from './scheduling.js';
 export * from './webmaster.js';
 export * from './pairing.js';
+export * from './signon.js';
 export declare const contractVersion = 1;
 export declare const coreSections: readonly ["overview", "leads", "analytics", "settings", "access", "activity"];
 export declare const permissions: readonly ["leads:read", "leads:write", "analytics:read", "settings:write", "access:read", "access:write", "activity:read", "tasks:read", "tasks:write", "appointments:read", "appointments:write", "availability:write", "scheduling:configure", "calendar-connections:manage", "clients:read", "client-changes:request", "client-releases:publish", "prospects:read", "prospects:write", "billing:read", "billing:customers:write", "billing:catalog:read", "billing:subscriptions:write", "billing:invoices:write", "billing:collect", "billing:connection:manage", "account-billing:read", "account-billing:manage"];
@@ -13,6 +14,7 @@ export type Role = 'owner' | 'administrator' | 'editor' | 'analyst';
 export declare const roles: Record<Role, readonly Permission[]>;
 export declare function can(role: Role, permission: Permission): boolean;
 export interface AdminManifest {
+    webmasterSignOn?: import('./signon.js').SignOnConfiguration;
     reportingPairing?: import('./pairing.js').PairingConfiguration;
     schemaVersion: 1;
     installationId: string;

package/dist/index.js

@@ -9,6 +9,7 @@ export * from "./client-onboarding.js";
 export * from "./scheduling.js";
 export * from "./webmaster.js";
 export * from "./pairing.js";
+export * from "./signon.js";
 const contractVersion = 1;
 const coreSections = ["overview", "leads", "analytics", "settings", "access", "activity"];
 const permissions = ["leads:read", "leads:write", "analytics:read", "settings:write", "access:read", "access:write", "activity:read", "tasks:read", "tasks:write", ...schedulingPermissions, ...clientPortfolioPermissions, ...clientOnboardingPermissions, ...billingPermissions];
@@ -131,6 +132,17 @@ function parseManifest(value) {
     if (new Set(trustedWebmasters.map((p) => p.adminOrigin)).size !== trustedWebmasters.length) throw new Error("Duplicate trusted webmaster origin");
     reportingPairing = { trustedWebmasters };
   }
+  let webmasterSignOn;
+  if (v.webmasterSignOn !== void 0) {
+    const c = object(v.webmasterSignOn);
+    if (c.mode === "broker") webmasterSignOn = { mode: "broker" };
+    else if (c.mode === "client") {
+      const b = object(c.broker), k = object(c.publicKey), adminOrigin = origin(b.adminOrigin, "sign-on broker origin");
+      if (isLoopback(adminOrigin) && !isLoopback(String(v.adminOrigin))) throw Error("A production client cannot trust a local sign-on broker");
+      if (k.kty !== "EC" || k.crv !== "P-256" || typeof k.x !== "string" || typeof k.y !== "string" || !/^[-\w]{43}$/.test(k.x) || !/^[-\w]{43}$/.test(k.y) || k.d !== void 0) throw Error("Pin the broker public P-256 key");
+      webmasterSignOn = { mode: "client", broker: { installationId: id(b.installationId, "broker installation ID"), siteId: id(b.siteId, "broker site ID"), adminOrigin }, subjectId: text(c.subjectId, "approved broker subject", 100), organizationId: id(c.organizationId, "webmaster organization ID"), publicKey: { kty: "EC", crv: "P-256", x: k.x, y: k.y } };
+    } else throw Error("Unsupported webmaster sign-on mode");
+  }
   return {
     schemaVersion: 1,
     installationId: id(v.installationId, "installation ID"),
@@ -140,7 +152,8 @@ function parseManifest(value) {
     modules,
     ...backend ? { backend } : {},
     ...v.theme ? { theme: v.theme } : {},
-    ...reportingPairing ? { reportingPairing } : {}
+    ...reportingPairing ? { reportingPairing } : {},
+    ...webmasterSignOn ? { webmasterSignOn } : {}
   };
 }
 function validateModules(manifest, modules) {

package/dist/signon.d.ts

@@ -0,0 +1,51 @@
+import type { PairingIdentity } from './pairing.js';
+export declare const signOnVersion = 1;
+export declare const signOnBase = "/api/webmaster-sso/v1";
+export declare const signOnPolicy: {
+    flowSeconds: number;
+    codeSeconds: number;
+    approvalSeconds: number;
+    sessionSeconds: number;
+    uiCheckMilliseconds: number;
+};
+export type SignOnConfiguration = {
+    mode: 'broker';
+} | {
+    mode: 'client';
+    broker: PairingIdentity;
+    subjectId: string;
+    organizationId: string;
+    publicKey: {
+        kty: 'EC';
+        crv: 'P-256';
+        x: string;
+        y: string;
+    };
+};
+export interface SignOnAssertion {
+    version: 1;
+    issuer: PairingIdentity;
+    audience: PairingIdentity;
+    subject: {
+        id: string;
+        email: string;
+    };
+    lease: string;
+    expiresAt: number;
+    flowId: string;
+}
+export interface SignOnStatus {
+    version: 1;
+    issuer: PairingIdentity;
+    audience: PairingIdentity;
+    nonce: string;
+    leaseHash: string;
+    subjectId: string;
+    active: boolean;
+    expiresAt: number;
+    time: number;
+}
+export interface SignedSignOn {
+    payload: string;
+    signature: string;
+}

package/dist/signon.js

@@ -0,0 +1,9 @@
+// packages/contracts/src/signon.ts
+var signOnVersion = 1;
+var signOnBase = "/api/webmaster-sso/v1";
+var signOnPolicy = { flowSeconds: 300, codeSeconds: 60, approvalSeconds: 600, sessionSeconds: 28800, uiCheckMilliseconds: 5e3 };
+export {
+  signOnBase,
+  signOnPolicy,
+  signOnVersion
+};

package/package.json

@@ -1,36 +1,36 @@
-{
-  "name": "@tryvitris/website-admin-contracts",
-  "version": "1.2.0",
-  "type": "module",
-  "license": "MIT",
-  "description": "Validated installation and module contracts for Cloudflare business admin apps",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
-    "./scheduling": {
-      "types": "./dist/scheduling.d.ts",
-      "default": "./dist/scheduling.js"
-    }
-  },
-  "files": [
-    "dist"
-  ],
-  "publishConfig": {
-    "access": "public",
-    "tag": "latest"
-  },
-  "engines": {
-    "node": ">=24"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jackperrotta/website-admin-harness.git",
-    "directory": "packages/contracts"
-  },
-  "homepage": "https://github.com/jackperrotta/website-admin-harness#readme",
-  "bugs": {
-    "url": "https://github.com/jackperrotta/website-admin-harness/issues"
-  }
-}
+{
+  "name": "@tryvitris/website-admin-contracts",
+  "version": "1.3.1",
+  "type": "module",
+  "license": "MIT",
+  "description": "Validated installation and module contracts for Cloudflare business admin apps",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./scheduling": {
+      "types": "./dist/scheduling.d.ts",
+      "default": "./dist/scheduling.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jackperrotta/website-admin-harness.git",
+    "directory": "packages/contracts"
+  },
+  "homepage": "https://github.com/jackperrotta/website-admin-harness#readme",
+  "bugs": {
+    "url": "https://github.com/jackperrotta/website-admin-harness/issues"
+  }
+}