@unoverse-platform/studio 0.1.99 → 0.1.100

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/vendor/base/src/auth/auth.ts +5 -2
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@unoverse-platform/studio",
3
- "version": "0.1.99",
3
+ "version": "0.1.100",
4
4
  "type": "module",
5
5
  "description": "Unoverse Studio: the local authoring app. Reads your own rx/ folder, no backend.",
6
6
  "scripts": {
package/vendor/base/src/auth/auth.ts CHANGED
@@ -166,8 +166,11 @@ async function verifyJWT(token: string): Promise<AuthUser | null> {
166
166
  const { payload } = await jwtVerify(token, jwksSet, { issuer: issuers });
167
167
  const expected = getAudience();
168
168
  if (expected) {
169
- const claimed = payload.aud ?? (payload as Record<string, unknown>).client_id;
170
- const values = Array.isArray(claimed) ? claimed.map(String) : claimed ? [String(claimed)] : [];
169
+ // Both places are read, not the first one present: WorkOS sends its environment in `aud`
170
+ // and the signed-in app in `client_id`, and a cell names its own app.
171
+ const aud = payload.aud;
172
+ const clientId = (payload as Record<string, unknown>).client_id;
173
+ const values = [...(Array.isArray(aud) ? aud : aud ? [aud] : []), ...(clientId ? [clientId] : [])].map(String);
171
174
  if (!values.includes(expected)) {
172
175
  console.error(
173
176
  `[auth] JWT validation failed: audience mismatch (expected ${expected}, token had ${values.join(", ") || "none"})`,