@tula-tech/contract 0.1.1 → 0.3.0

package/dist/headers.d.ts

@@ -39,7 +39,7 @@ declare const CLIENT_HEADER = "x-tula-client";
 * It is a request, not a choice: the session gets that profile only when the environment marks
 * it `clientSelectable`. Any other name (unknown, not offered, a built-in) is ignored and the
 * session gets the profile of its client kind, so a client can never give itself a
-* longer-lived session than the operator offered (ADR 0028).
+* longer-lived session than the operator offered.
 *
 * @example
 * ```ts
@@ -96,7 +96,7 @@ declare const CAN_STILL_SIGN_IN_HEADER = "x-tula-can-still-sign-in";
 * Sent together with {@link CONFIG_HASH_HEADER}. The API records both with the settings and
 * returns them as `managedBy`, so a dashboard can say "these settings come from a config file"
 * and warn when they were changed around it. A replace without the header keeps the record,
-* which then shows as drifted. See ADR 0030.
+* which then shows as drifted.
 *
 * @example
 * ```ts
@@ -127,7 +127,7 @@ declare const CONFIG_HASH_HEADER = "x-tula-config-hash";
 declare const CONFIG_UNMANAGED = "none";
 /**
 * Request header every call the dashboard makes with its session cookie must carry, with the
-* value {@link DASHBOARD_HEADER_VALUE} (ADR 0032).
+* value {@link DASHBOARD_HEADER_VALUE}.
 *
 * A browser attaches a cookie whoever wrote the page. This header is what a form cannot send
 * and what a cross-origin `fetch` may send only after a preflight, which the API answers for
@@ -187,6 +187,20 @@ declare const DASHBOARD_SESSION_COOKIE = "tula_dashboard";
 */
 declare const EMAIL_LINK_TOKEN_PARAM = "tula_link";
 /**
+* Name of the URL-fragment parameter carrying an organization invitation's token.
+*
+* The link in the invitation email is the app's own redirect URL followed by
+* `#tula_invitation=<token>`. A fragment is never sent to a server, a proxy or in `Referer`,
+* so the token reaches only the page's own script, which posts it to the invitation routes
+* (`preview`, `accept`, `decline`) and removes it from the URL.
+*
+* @example
+* ```ts
+* const token = new URLSearchParams(location.hash.slice(1)).get(ORGANIZATION_INVITATION_TOKEN_PARAM)
+* ```
+*/
+declare const ORGANIZATION_INVITATION_TOKEN_PARAM = "tula_invitation";
+/**
 * Name of the URL-fragment parameter carrying the id of the sign-in an emailed link belongs to.
 *
 * @example
@@ -197,7 +211,7 @@ declare const EMAIL_LINK_TOKEN_PARAM = "tula_link";
 declare const EMAIL_LINK_ATTEMPT_PARAM = "tula_attempt";
 /**
 * Name of the URL-fragment parameter carrying the single-use ticket an OAuth sign-in returns to
-* the app's page with (ADR 0026).
+* the app's page with.
 *
 * The API redirects to the app's URL followed by `#tula_ticket=<ticket>&tula_attempt=<attempt
 * id>`. The page's script removes the fragment from the address and posts the ticket, with the
@@ -220,4 +234,10 @@ declare const OAUTH_TICKET_PARAM = "tula_ticket";
 * ```
 */
 declare const OAUTH_ERROR_PARAM = "tula_error";
-export { CAN_STILL_SIGN_IN_HEADER, CLIENT_HEADER, CONFIG_HASH_HEADER, CONFIG_MANAGED_BY_HEADER, CONFIG_UNMANAGED, DASHBOARD_HEADER, DASHBOARD_HEADER_VALUE, DASHBOARD_SESSION_COOKIE, EMAIL_LINK_ATTEMPT_PARAM, EMAIL_LINK_TOKEN_PARAM, ENVIRONMENT_HEADER, FLOW_ATTEMPT_HEADER, OAUTH_ERROR_PARAM, OAUTH_TICKET_PARAM, PUBLISHABLE_KEY_HEADER, SESSION_PROFILE_HEADER };
+/**
+* The header that carries a setup link's token to `/v1/setup/*`. The portal reads
+* the token from the page address's fragment, which a browser never sends, and puts it here:
+* it is never in a path or a query, so no access log or `Referer` holds it.
+*/
+declare const SETUP_LINK_HEADER = "x-tula-setup-token";
+export { CAN_STILL_SIGN_IN_HEADER, CLIENT_HEADER, CONFIG_HASH_HEADER, CONFIG_MANAGED_BY_HEADER, CONFIG_UNMANAGED, DASHBOARD_HEADER, DASHBOARD_HEADER_VALUE, DASHBOARD_SESSION_COOKIE, EMAIL_LINK_ATTEMPT_PARAM, EMAIL_LINK_TOKEN_PARAM, ENVIRONMENT_HEADER, FLOW_ATTEMPT_HEADER, OAUTH_ERROR_PARAM, OAUTH_TICKET_PARAM, ORGANIZATION_INVITATION_TOKEN_PARAM, PUBLISHABLE_KEY_HEADER, SESSION_PROFILE_HEADER, SETUP_LINK_HEADER };

package/dist/headers.js

@@ -12,10 +12,12 @@ import {
   ENVIRONMENT_HEADER2,
   DASHBOARD_SESSION_COOKIE2,
   EMAIL_LINK_TOKEN_PARAM2,
+  ORGANIZATION_INVITATION_TOKEN_PARAM2,
   EMAIL_LINK_ATTEMPT_PARAM2,
   OAUTH_TICKET_PARAM2,
-  OAUTH_ERROR_PARAM2
-} from "./shared/chunk-q309e9bk.js";
+  OAUTH_ERROR_PARAM2,
+  SETUP_LINK_HEADER2
+} from "./shared/chunk-4hytq4je.js";
 export {
   CAN_STILL_SIGN_IN_HEADER2 as CAN_STILL_SIGN_IN_HEADER,
   CLIENT_HEADER2 as CLIENT_HEADER,
@@ -31,6 +33,8 @@ export {
   FLOW_ATTEMPT_HEADER2 as FLOW_ATTEMPT_HEADER,
   OAUTH_ERROR_PARAM2 as OAUTH_ERROR_PARAM,
   OAUTH_TICKET_PARAM2 as OAUTH_TICKET_PARAM,
+  ORGANIZATION_INVITATION_TOKEN_PARAM2 as ORGANIZATION_INVITATION_TOKEN_PARAM,
   PUBLISHABLE_KEY_HEADER2 as PUBLISHABLE_KEY_HEADER,
-  SESSION_PROFILE_HEADER2 as SESSION_PROFILE_HEADER
+  SESSION_PROFILE_HEADER2 as SESSION_PROFILE_HEADER,
+  SETUP_LINK_HEADER2 as SETUP_LINK_HEADER
 };