@vercel/connect 0.0.4-alpha.2 → 0.0.4-alpha.6

package/README.md

@@ -253,6 +253,27 @@ export default slackRoute({
 
 The `webhookVerifier` is set to `vercelOidc()`, which authenticates inbound webhooks using the Vercel OIDC token issued for the calling project.
 
+### `connectOAuth(options?)`
+
+```ts
+function connectOAuth(options?: ConnectOAuthOptions): AuthFn<Request>;
+```
+
+Returns an Ash route auth callback for Vercel Connect OAuth gateway access tokens. It verifies bearer JWTs issued by `https://connect.vercel.com`, requires the gateway access-token claim `typ: "at"`, and by default accepts Connect OAuth audiences shaped `teamId:VERCEL_PROJECT_ID:VERCEL_ENV`; the team id segment is ignored because project ids are globally unique.
+
+```ts
+import { httpRoute } from "experimental-ash/channels/http";
+import { connectOAuth } from "@vercel/connect/ash";
+
+export default httpRoute({
+  auth: connectOAuth({
+    connectors: ["slack/mybot"],
+  }),
+});
+```
+
+Pass `audiences` to accept explicit `aud` values, or pass `projectId` and `environment` to build the Connect OAuth audience manually. `connectors` accepts both `scl_...` connector ids and connector UIDs by checking each value against the `clientId` and `clientUid` claims; `tenantIds`, `installationIds`, `subjects`, and `claims` can further narrow accepted gateway tokens.
+
 ---
 
 ## `@vercel/connect/betterauth`
@@ -265,7 +286,7 @@ Better Auth provider for Vercel Connect's OAuth2 endpoints. Importing this subpa
 function connect(options: BetterAuthConnectOptions): GenericOAuthConfig;
 ```
 
-Returns a `GenericOAuthConfig` entry that drops into `genericOAuth({ config: [...] })` from `better-auth/plugins/generic-oauth`. Vercel Connect's OAuth client authentication is non-standard — the "client secret" is a Vercel OIDC token that has to be fetched per-request — so the helper overrides `getToken` and `getUserInfo` to inject the right `Authorization` headers.
+Returns a `GenericOAuthConfig` entry that drops into `genericOAuth({ config: [...] })` from `better-auth/plugins/generic-oauth`. Vercel Connect's OAuth client authentication is non-standard — the "client secret" is a Vercel OIDC token that has to be fetched per-request — so the helper overrides `getToken` to inject the token endpoint `Authorization` header.
 
 ```ts
 import { betterAuth } from "better-auth";
@@ -309,7 +330,7 @@ Auth.js (NextAuth core) provider for Vercel Connect's OAuth2 endpoints. Importin
 function connect(options: AuthJsConnectOptions): OAuth2Config<ConnectProfile>;
 ```
 
-Returns an `OAuth2Config` provider entry for `AuthConfig.providers`. Vercel Connect's token endpoint expects the Vercel OIDC token in place of a static client secret, so the helper declares `token_endpoint_auth_method: "none"` and injects the real `Authorization` headers via Auth.js's `customFetch` symbol on both the token and userinfo endpoints.
+Returns an `OAuth2Config` provider entry for `AuthConfig.providers`. Vercel Connect's token endpoint expects the Vercel OIDC token in place of a static client secret, so the helper declares `token_endpoint_auth_method: "none"` and injects the token endpoint `Authorization` header via Auth.js's `customFetch` symbol.
 
 ```ts
 import type { AuthConfig } from "@auth/core";

package/dist/ash/connect-oauth.d.ts

@@ -0,0 +1,67 @@
+import { type AuthFn, type VerifyOidcConfig } from "experimental-ash/channels/auth";
+export declare const CONNECT_OAUTH_ISSUER = "https://connect.vercel.com";
+export type ConnectOAuthEnvironment = "production" | "preview" | "development";
+export type ConnectOAuthAudienceEnvironment = ConnectOAuthEnvironment | "*";
+export interface ConnectOAuthOptions {
+    /**
+     * Exact `aud` claim values to accept. When omitted, the helper
+     * accepts Connect OAuth audiences shaped
+     * `teamId:projectId:environment` whose project id and environment
+     * match the current Vercel deployment.
+     */
+    readonly audiences?: readonly string[];
+    /**
+     * Vercel project id used when `audiences` is omitted. Defaults to
+     * `VERCEL_PROJECT_ID`.
+     */
+    readonly projectId?: string;
+    /**
+     * Vercel deployment environment used when `audiences` is omitted.
+     * Defaults to `VERCEL_TARGET_ENV`, then `VERCEL_ENV`. Use `"*"` to
+     * accept production, preview, and development audiences for the
+     * selected project.
+     */
+    readonly environment?: ConnectOAuthAudienceEnvironment;
+    /**
+     * Optional gateway session id (`sub`) matchers. Patterns use Ash's
+     * IAM-style `*` wildcard matching.
+     */
+    readonly subjects?: readonly string[];
+    /**
+     * Optional Connect connector ids / UIDs to accept. Each value is
+     * matched against both the `clientId` and `clientUid` claims.
+     */
+    readonly connectors?: readonly string[];
+    /** Optional upstream tenant ids (`tenantId` claim) to accept. */
+    readonly tenantIds?: readonly string[];
+    /**
+     * Optional connector installation ids (`installationId` claim) to
+     * accept.
+     */
+    readonly installationIds?: readonly string[];
+    /**
+     * Additional exact-match string claims to require. `typ` is always
+     * constrained to `"at"` for Connect OAuth gateway access tokens.
+     */
+    readonly claims?: VerifyOidcConfig["claims"];
+    /**
+     * Override the OIDC discovery URL. Defaults to
+     * `https://connect.vercel.com/.well-known/openid-configuration`.
+     */
+    readonly discoveryUrl?: string;
+    /** Clock skew in seconds. Defaults to Ash's OIDC verifier default. */
+    readonly clockSkewSeconds?: number;
+}
+/**
+ * Returns an Ash route auth callback for Vercel Connect OAuth gateway
+ * access tokens.
+ *
+ * The accepted token must be a bearer JWT issued by
+ * `https://connect.vercel.com`, have the gateway access-token marker
+ * `typ: "at"`, and target one of the configured audiences. By default
+ * the audience is a Connect OAuth audience for the current Vercel
+ * project:
+ *
+ * `teamId:VERCEL_PROJECT_ID:VERCEL_ENV`
+ */
+export declare function connectOAuth(opts?: ConnectOAuthOptions): AuthFn<Request>;

package/dist/ash/connect-oauth.js

@@ -0,0 +1,165 @@
+import { extractBearerToken, verifyOidc, } from "experimental-ash/channels/auth";
+export const CONNECT_OAUTH_ISSUER = "https://connect.vercel.com";
+/**
+ * Returns an Ash route auth callback for Vercel Connect OAuth gateway
+ * access tokens.
+ *
+ * The accepted token must be a bearer JWT issued by
+ * `https://connect.vercel.com`, have the gateway access-token marker
+ * `typ: "at"`, and target one of the configured audiences. By default
+ * the audience is a Connect OAuth audience for the current Vercel
+ * project:
+ *
+ * `teamId:VERCEL_PROJECT_ID:VERCEL_ENV`
+ */
+export function connectOAuth(opts = {}) {
+    const audiencePolicy = resolveAudiencePolicy(opts);
+    const connectorPolicy = resolveConnectorPolicy(opts);
+    const claims = buildClaimMatchers(opts);
+    return async (request) => {
+        const token = extractBearerToken(request.headers.get("authorization"));
+        if (token === null) {
+            return null;
+        }
+        const payload = decodeJwtPayload(token);
+        if (payload === null) {
+            return null;
+        }
+        const audiences = resolveRequestAudiences(payload, audiencePolicy);
+        if (audiences === null ||
+            !isConnectorAccepted(payload, connectorPolicy)) {
+            return null;
+        }
+        const result = await verifyOidc(token, {
+            audiences,
+            claims,
+            clockSkewSeconds: opts.clockSkewSeconds,
+            discoveryUrl: opts.discoveryUrl,
+            issuer: CONNECT_OAUTH_ISSUER,
+            subjects: opts.subjects,
+        });
+        return result.ok ? result.sessionAuth : null;
+    };
+}
+function resolveAudiencePolicy(opts) {
+    if (opts.audiences !== undefined) {
+        if (opts.audiences.length === 0) {
+            throw new Error("connectOAuth: audiences must not be empty.");
+        }
+        return { kind: "exact", audiences: opts.audiences };
+    }
+    const projectId = opts.projectId ?? readNonEmptyEnv("VERCEL_PROJECT_ID");
+    const environment = opts.environment ?? inferVercelEnvironment();
+    if (projectId === undefined) {
+        throw new Error("connectOAuth: could not infer projectId from VERCEL_PROJECT_ID; pass audiences or projectId explicitly.");
+    }
+    if (environment === undefined) {
+        throw new Error("connectOAuth: could not infer environment from VERCEL_TARGET_ENV or VERCEL_ENV; pass audiences or environment explicitly.");
+    }
+    const environments = environment === "*"
+        ? ["production", "preview", "development"]
+        : [environment];
+    return { kind: "project", environments, projectId };
+}
+function resolveRequestAudiences(payload, policy) {
+    if (policy.kind === "exact") {
+        return policy.audiences;
+    }
+    const audiences = extractAudiences(payload);
+    const accepted = audiences.filter((audience) => {
+        const parsed = parseConnectOAuthAudience(audience);
+        return (parsed !== null &&
+            parsed.projectId === policy.projectId &&
+            policy.environments.includes(parsed.environment));
+    });
+    return accepted.length === 0 ? null : accepted;
+}
+function resolveConnectorPolicy(opts) {
+    if (opts.connectors === undefined) {
+        return { kind: "any" };
+    }
+    if (opts.connectors.length === 0) {
+        throw new Error("connectOAuth: connectors must not be empty.");
+    }
+    return { kind: "connectors", connectors: opts.connectors };
+}
+function isConnectorAccepted(payload, policy) {
+    if (policy.kind === "any") {
+        return true;
+    }
+    const clientId = stringClaim(payload, "clientId");
+    if (clientId !== undefined && policy.connectors.includes(clientId)) {
+        return true;
+    }
+    const clientUid = stringClaim(payload, "clientUid");
+    return clientUid !== undefined && policy.connectors.includes(clientUid);
+}
+function inferVercelEnvironment() {
+    const value = readNonEmptyEnv("VERCEL_TARGET_ENV") ?? readNonEmptyEnv("VERCEL_ENV");
+    if (value === undefined)
+        return undefined;
+    assertEnvironment(value);
+    return value;
+}
+function buildClaimMatchers(opts) {
+    return {
+        ...opts.claims,
+        ...(opts.tenantIds === undefined ? {} : { tenantId: opts.tenantIds }),
+        ...(opts.installationIds === undefined
+            ? {}
+            : { installationId: opts.installationIds }),
+        typ: ["at"],
+    };
+}
+function readNonEmptyEnv(name) {
+    const value = typeof process === "undefined" ? undefined : process.env?.[name]?.trim();
+    return value === undefined || value.length === 0 ? undefined : value;
+}
+function extractAudiences(payload) {
+    const aud = payload.aud;
+    if (typeof aud === "string") {
+        return [aud];
+    }
+    if (Array.isArray(aud)) {
+        return aud.filter((value) => typeof value === "string");
+    }
+    return [];
+}
+function stringClaim(payload, claim) {
+    const value = payload[claim];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function decodeJwtPayload(token) {
+    try {
+        const payload = token.split(".")[1];
+        if (payload === undefined)
+            return null;
+        const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+        const decoded = JSON.parse(atob(padded));
+        return typeof decoded === "object" && decoded !== null ? decoded : null;
+    }
+    catch {
+        return null;
+    }
+}
+function parseConnectOAuthAudience(audience) {
+    const [teamId, projectId, environment, extra] = audience.split(":");
+    if (!teamId || !projectId || !environment || extra !== undefined) {
+        return null;
+    }
+    if (environment !== "production" &&
+        environment !== "preview" &&
+        environment !== "development") {
+        return null;
+    }
+    return { projectId, environment };
+}
+function assertEnvironment(value) {
+    if (value !== "production" &&
+        value !== "preview" &&
+        value !== "development" &&
+        value !== "*") {
+        throw new Error(`connectOAuth: invalid environment ${JSON.stringify(value)}; expected "production", "preview", "development", or "*".`);
+    }
+}

package/dist/ash/index.d.ts

@@ -7,4 +7,5 @@
  * everything from `@vercel/connect/ash`.
  */
 export { connect, type AshAuthorizationInput, type AshAuthorizationOptions, type ConnectAuthorizationPhase, type ConnectAuthorizationState, } from "./connection-authorization.js";
+export { CONNECT_OAUTH_ISSUER, connectOAuth, type ConnectOAuthAudienceEnvironment, type ConnectOAuthEnvironment, type ConnectOAuthOptions, } from "./connect-oauth.js";
 export { connectSlackCredentials } from "./slack-credentials.js";

package/dist/ash/index.js

@@ -7,4 +7,5 @@
  * everything from `@vercel/connect/ash`.
  */
 export { connect, } from "./connection-authorization.js";
+export { CONNECT_OAUTH_ISSUER, connectOAuth, } from "./connect-oauth.js";
 export { connectSlackCredentials } from "./slack-credentials.js";

package/dist/authjs/connect-provider.js

@@ -5,8 +5,8 @@
  * in `AuthConfig.providers`. Vercel Connect's OAuth client
  * authentication is non-standard — the "client secret" is a
  * per-request Vercel OIDC token — so we declare
- * `token_endpoint_auth_method: "none"` and inject the real
- * Authorization headers via the `customFetch` symbol.
+ * `token_endpoint_auth_method: "none"` and inject the token endpoint
+ * Authorization header via the `customFetch` symbol.
  *
  * ```ts
  * import type { AuthConfig } from "@auth/core";
@@ -26,9 +26,9 @@
 import { customFetch } from "@auth/core";
 import { getVercelOidcToken } from "@vercel/oidc";
 import { tryGetVercelTeamId, withTeamId } from "../internal/team-id.js";
-const CONNECT_AUTHORIZATION_URL = "https://vercel.com/api/connex/oauth/authorize";
-const CONNECT_TOKEN_URL = "https://vercel.com/api/connex/oauth/token";
-const CONNECT_USERINFO_URL = "https://vercel.com/api/connex/oauth/userinfo";
+const CONNECT_AUTHORIZATION_URL = "https://connect.vercel.com/oauth/authorize";
+const CONNECT_TOKEN_URL = "https://connect.vercel.com/oauth/token";
+const CONNECT_USERINFO_URL = "https://connect.vercel.com/oauth/userinfo";
 /**
  * Builds an Auth.js `OAuth2Config` for Vercel Connect. Push the
  * result into `AuthConfig.providers`.
@@ -43,9 +43,8 @@ export function connect(options) {
         clientId: options.connector,
         // The token endpoint expects client_secret_basic, but the secret
         // is a Vercel OIDC token that has to be fetched per-request. We
-        // rely on the customFetch hook below to inject the real
-        // Authorization header — Auth.js skips building one because we
-        // declared "none" here.
+        // rely on the customFetch hook below to inject the token endpoint
+        // Authorization header.
         client: { token_endpoint_auth_method: "none" },
         authorization: {
             // Best-effort: scope the Vercel Connect consent UI to the
@@ -79,16 +78,6 @@ export function connect(options) {
                 headers.set("authorization", `Basic ${btoa(credentials)}`);
                 return fetch(input, { ...init, headers });
             }
-            if (url.startsWith(CONNECT_USERINFO_URL)) {
-                const headers = new Headers(init?.headers);
-                const accessToken = (headers.get("authorization") ?? "").replace(/^Bearer\s+/i, "");
-                const vercelToken = await fetchVercelToken();
-                const triple = [options.connector, vercelToken, accessToken]
-                    .map(encodeURIComponent)
-                    .join(":");
-                headers.set("authorization", `Bearer ${btoa(triple)}`);
-                return fetch(input, { ...init, headers });
-            }
             return fetch(input, init);
         },
     };

package/dist/authorization.js

@@ -10,7 +10,7 @@ export async function startAuthorization(connector, params, options) {
         validateWebhookUrl(options.webhook);
     }
     const vercelToken = options?.vercelToken ?? (await getVercelOidcToken());
-    const endpoint = `https://api.vercel.com/v1/connex/authorize/${encodeURIComponent(connector)}`;
+    const endpoint = `https://api.vercel.com/v1/connect/authorize/${encodeURIComponent(connector)}`;
     const body = {
         ...params,
         ...(options?.callbackUrl !== undefined && {

package/dist/betterauth/connect-provider.js

@@ -6,8 +6,7 @@
  * `better-auth/plugins/generic-oauth`. Vercel Connect's OAuth client
  * authentication is non-standard — the "client secret" is a Vercel
  * OIDC token that has to be fetched per-request — so we override
- * `getToken` and `getUserInfo` to inject the right Authorization
- * headers instead of relying on Better Auth's built-in flow.
+ * `getToken` to inject the token endpoint Authorization header.
  *
  * ```ts
  * import { betterAuth } from "better-auth";
@@ -31,9 +30,9 @@
 import { getVercelOidcToken } from "@vercel/oidc";
 import { getOAuth2Tokens } from "better-auth/oauth2";
 import { tryGetVercelTeamId, withTeamId } from "../internal/team-id.js";
-const CONNECT_AUTHORIZATION_URL = "https://vercel.com/api/connex/oauth/authorize";
-const CONNECT_TOKEN_URL = "https://vercel.com/api/connex/oauth/token";
-const CONNECT_USERINFO_URL = "https://vercel.com/api/connex/oauth/userinfo";
+const CONNECT_AUTHORIZATION_URL = "https://connect.vercel.com/oauth/authorize";
+const CONNECT_TOKEN_URL = "https://connect.vercel.com/oauth/token";
+const CONNECT_USERINFO_URL = "https://connect.vercel.com/oauth/userinfo";
 /**
  * Builds a `GenericOAuthConfig` entry for Vercel Connect. Pass the
  * result into `genericOAuth({ config: [...] })`.
@@ -83,13 +82,8 @@ export function connect(options) {
             if (!tokens.accessToken) {
                 throw new Error("Missing access token for Vercel Connect userinfo request");
             }
-            const vercelToken = await fetchVercelToken();
-            const triple = [options.connector, vercelToken, tokens.accessToken]
-                .map(encodeURIComponent)
-                .join(":");
-            const bearerToken = btoa(triple);
             const response = await fetch(CONNECT_USERINFO_URL, {
-                headers: { Authorization: `Bearer ${bearerToken}` },
+                headers: { Authorization: `Bearer ${tokens.accessToken}` },
             });
             if (!response.ok) {
                 throw new Error(`Failed to fetch Vercel Connect user info: ${response.status} ${response.statusText}: ${await response.text()}`);

package/dist/internal/team-id.js

@@ -1,7 +1,7 @@
 /**
  * Best-effort Vercel team-id extraction for the OAuth adapters.
  *
- * Vercel Connect's `/api/connex/oauth/authorize` endpoint accepts an
+ * Vercel Connect's `/oauth/authorize` endpoint accepts an
  * optional `?teamId=...` query parameter that scopes the consent UI
  * to a specific team. The team id lives inside the Vercel OIDC
  * token's `owner_id` claim, so we decode the JWT payload (no

package/dist/token.js

@@ -34,7 +34,7 @@ export async function getTokenResponse(connector, params, options) {
         cache.delete(cacheKey);
     }
     const vercelToken = options?.vercelToken ?? (await getVercelOidcToken());
-    const endpoint = `https://api.vercel.com/v1/connex/token/${encodeURIComponent(connector)}`;
+    const endpoint = `https://api.vercel.com/v1/connect/token/${encodeURIComponent(connector)}`;
     const response = await fetch(endpoint, {
         method: "POST",
         headers: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "0.0.4-alpha.2",
+  "version": "0.0.4-alpha.6",
   "type": "module",
   "exports": {
     ".": {