@vercel/connect 2.3.3 → 2.3.5

package/dist/authjs/connect-provider.js

@@ -25,7 +25,7 @@
  */
 import { customFetch } from '@auth/core';
 import { getVercelOidcToken } from '@vercel/oidc';
-import { tryGetVercelTeamId, withTeamId } from '../internal/team-id.js';
+import { tryGetVercelAuthorizationContext, withAuthorizationContext, } from '../internal/authorization-context.js';
 const CONNECT_AUTHORIZATION_URL = 'https://connect.vercel.com/oauth/authorize';
 const CONNECT_TOKEN_URL = 'https://connect.vercel.com/oauth/token';
 const CONNECT_USERINFO_URL = 'https://connect.vercel.com/oauth/userinfo';
@@ -49,10 +49,10 @@ export function connect(options) {
         client: { token_endpoint_auth_method: 'none' },
         authorization: {
             // Best-effort: scope the Vercel Connect consent UI to the
-            // deployment's Vercel team when we can read it from the OIDC
-            // token. Falls back to the unqualified URL when the token isn't
-            // present (e.g. running outside Vercel).
-            url: withTeamId(CONNECT_AUTHORIZATION_URL, tryGetVercelTeamId()),
+            // deployment's team, project, and environment from the OIDC token.
+            // Falls back to the unqualified URL when the token isn't present
+            // (e.g. running outside Vercel).
+            url: withAuthorizationContext(CONNECT_AUTHORIZATION_URL, tryGetVercelAuthorizationContext()),
             params: { scope },
         },
         token: CONNECT_TOKEN_URL,

package/dist/betterauth/connect-provider.js

@@ -29,7 +29,7 @@
  */
 import { getVercelOidcToken } from '@vercel/oidc';
 import { getOAuth2Tokens } from 'better-auth/oauth2';
-import { tryGetVercelTeamId, withTeamId } from '../internal/team-id.js';
+import { tryGetVercelAuthorizationContext, withAuthorizationContext, } from '../internal/authorization-context.js';
 import { ConnectError, createConnectErrorFromResponse } from '../token.js';
 const CONNECT_AUTHORIZATION_URL = 'https://connect.vercel.com/oauth/authorize';
 const CONNECT_TOKEN_URL = 'https://connect.vercel.com/oauth/token';
@@ -46,10 +46,10 @@ export function connect(options) {
         providerId: options.providerId,
         clientId: options.connector,
         // Best-effort: scope the Vercel Connect consent UI to the
-        // deployment's Vercel team when we can read it from the OIDC
-        // token. Falls back to the unqualified URL when the token isn't
-        // present (e.g. running outside Vercel).
-        authorizationUrl: withTeamId(CONNECT_AUTHORIZATION_URL, tryGetVercelTeamId()),
+        // deployment's team, project, and environment from the OIDC token.
+        // Falls back to the unqualified URL when the token isn't present
+        // (e.g. running outside Vercel).
+        authorizationUrl: withAuthorizationContext(CONNECT_AUTHORIZATION_URL, tryGetVercelAuthorizationContext()),
         scopes,
         pkce: true,
         tokenUrl: CONNECT_TOKEN_URL,

package/dist/internal/authorization-context.d.ts

@@ -0,0 +1,9 @@
+interface AuthorizationContext {
+    teamId?: string;
+    projectId?: string;
+    environment?: string;
+}
+export declare function tryGetVercelAuthorizationContext(): AuthorizationContext | undefined;
+export declare function extractAuthorizationContextFromOidcToken(token: string): AuthorizationContext | undefined;
+export declare function withAuthorizationContext(baseUrl: string, context: AuthorizationContext | undefined): string;
+export {};

package/dist/internal/authorization-context.js

@@ -0,0 +1,57 @@
+/**
+ * Best-effort Vercel authorization context extraction for the OAuth adapters.
+ *
+ * Vercel Connect's `/oauth/authorize` endpoint accepts an
+ * optional team id, project id, and environment to scope the consent UI.
+ * These values come from the Vercel OIDC token's `owner_id`, `project_id`,
+ * and `custom_environment_id` or `environment` claims. We decode the JWT
+ * payload without signature verification — we're reading our own token.
+ *
+ * Failure is silent: the helper returns `undefined` if the token
+ * isn't available (e.g. running outside Vercel) or the payload can't
+ * be decoded. Adapters then fall back to an unqualified
+ * authorization URL.
+ */
+import { getVercelOidcTokenSync } from '@vercel/oidc';
+export function tryGetVercelAuthorizationContext() {
+    let token;
+    try {
+        token = getVercelOidcTokenSync();
+    }
+    catch {
+        return undefined;
+    }
+    return extractAuthorizationContextFromOidcToken(token);
+}
+export function extractAuthorizationContextFromOidcToken(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length < 2)
+            return undefined;
+        const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const padLen = (4 - (padded.length % 4)) % 4;
+        const claims = JSON.parse(atob(padded + '='.repeat(padLen)));
+        const environment = claims.custom_environment_id || claims.environment;
+        return {
+            teamId: typeof claims.owner_id === 'string' ? claims.owner_id : undefined,
+            projectId: typeof claims.project_id === 'string' ? claims.project_id : undefined,
+            environment: typeof environment === 'string' ? environment : undefined,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function withAuthorizationContext(baseUrl, context) {
+    if (!context)
+        return baseUrl;
+    const url = new URL(baseUrl);
+    if (context.teamId)
+        url.searchParams.set('teamId', context.teamId);
+    if (context.projectId)
+        url.searchParams.set('projectId', context.projectId);
+    if (context.environment) {
+        url.searchParams.set('environment', context.environment);
+    }
+    return url.toString();
+}

package/dist/token.d.ts

@@ -8,6 +8,15 @@ export interface ConnectUserTokenSubject {
     type: 'user';
     id: string;
     issuer?: string;
+    /**
+     * When specified, `id` and `issuer` identify the user in the namespace of
+     * this IDP connector. The connector must be configured as an IDP.
+     * The XAA/ID-JAG protocol is used to resolve the target access token when
+     * configured by the target connector.
+     *
+     * @experimental Subject to change.
+     */
+    experimental_idp?: string;
 }
 export interface ConnectJwtBearerTokenSubject {
     type: 'jwt-bearer';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "2.3.3",
+  "version": "2.3.5",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {

package/dist/internal/team-id.d.ts

@@ -1,3 +0,0 @@
-export declare function tryGetVercelTeamId(): string | undefined;
-export declare function extractTeamIdFromOidcToken(token: string): string | undefined;
-export declare function withTeamId(baseUrl: string, teamId: string | undefined): string;

package/dist/internal/team-id.js

@@ -1,47 +0,0 @@
-/**
- * Best-effort Vercel team-id extraction for the OAuth adapters.
- *
- * Vercel Connect's `/oauth/authorize` endpoint accepts an
- * optional `?teamId=...` query parameter that scopes the consent UI
- * to a specific team. The team id lives inside the Vercel OIDC
- * token's `owner_id` claim, so we decode the JWT payload (no
- * signature verification — we're reading our own token) and pull it
- * out.
- *
- * Failure is silent: the helper returns `undefined` if the token
- * isn't available (e.g. running outside Vercel) or the payload can't
- * be decoded. Adapters then fall back to an unqualified
- * authorization URL.
- */
-import { getVercelOidcTokenSync } from '@vercel/oidc';
-export function tryGetVercelTeamId() {
-    let token;
-    try {
-        token = getVercelOidcTokenSync();
-    }
-    catch {
-        return undefined;
-    }
-    return extractTeamIdFromOidcToken(token);
-}
-export function extractTeamIdFromOidcToken(token) {
-    try {
-        const parts = token.split('.');
-        if (parts.length < 2)
-            return undefined;
-        const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');
-        const padLen = (4 - (padded.length % 4)) % 4;
-        const claims = JSON.parse(atob(padded + '='.repeat(padLen)));
-        return typeof claims.owner_id === 'string' ? claims.owner_id : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-export function withTeamId(baseUrl, teamId) {
-    if (!teamId)
-        return baseUrl;
-    const url = new URL(baseUrl);
-    url.searchParams.set('teamId', teamId);
-    return url.toString();
-}