@vercel/connect 2.5.4 → 2.5.5

package/dist/chat/webhook-verifier.d.ts

@@ -33,9 +33,12 @@ export type ConnectWebhookVerifierOptions = Parameters<typeof verifyVercelOidcTo
  * current deployment's project and environment (`projectId` defaults to
  * `VERCEL_PROJECT_ID`, `environment` to `VERCEL_TARGET_ENV` then
  * `VERCEL_ENV`). Verification fails closed — if those values are absent
- * and not supplied via `options`, every request is rejected. The
- * accepted set is therefore "any Vercel OIDC token for this
- * project + environment"; it is not pinned to a specific Connect
+ * and not supplied via `options`, every request is rejected. Unless
+ * `options.audience` is supplied, tokens re-minted by Vercel's
+ * audience exchange (which carry an `act` claim) are rejected, so a token
+ * handed to a third-party audience cannot be replayed here. The accepted
+ * set is therefore "any unexchanged Vercel OIDC token for this project +
+ * environment"; it is not pinned to a specific Connect
  * connector or to a single deployment. To tighten or broaden it (extra
  * audiences, multiple environments, an explicit project id), pass
  * `options` through to {@link verifyVercelOidcToken}.

package/dist/chat/webhook-verifier.js

@@ -17,9 +17,12 @@ const BEARER_TOKEN_PATTERN = /^Bearer\s+(.+)$/i;
  * current deployment's project and environment (`projectId` defaults to
  * `VERCEL_PROJECT_ID`, `environment` to `VERCEL_TARGET_ENV` then
  * `VERCEL_ENV`). Verification fails closed — if those values are absent
- * and not supplied via `options`, every request is rejected. The
- * accepted set is therefore "any Vercel OIDC token for this
- * project + environment"; it is not pinned to a specific Connect
+ * and not supplied via `options`, every request is rejected. Unless
+ * `options.audience` is supplied, tokens re-minted by Vercel's
+ * audience exchange (which carry an `act` claim) are rejected, so a token
+ * handed to a third-party audience cannot be replayed here. The accepted
+ * set is therefore "any unexchanged Vercel OIDC token for this project +
+ * environment"; it is not pinned to a specific Connect
  * connector or to a single deployment. To tighten or broaden it (extra
  * audiences, multiple environments, an explicit project id), pass
  * `options` through to {@link verifyVercelOidcToken}.
@@ -41,7 +44,10 @@ export function createConnectWebhookVerifier(options) {
         if (!token) {
             throw new Error('Missing Authorization bearer token');
         }
-        await verifyVercelOidcToken(token, options);
+        const { payload } = await verifyVercelOidcToken(token, options);
+        if (options?.audience === undefined && payload.act !== undefined) {
+            throw new Error('Exchanged OIDC tokens are not accepted');
+        }
         return true;
     };
 }

package/dist/eve/discord-credentials.js

@@ -1,4 +1,4 @@
-import { vercelOidc } from 'eve/channels/auth';
+import { createConnectWebhookVerifier } from '../chat/webhook-verifier.js';
 import { getTokenResponse, } from '../index.js';
 /**
  * Build {@link DiscordChannelCredentials} backed by a Vercel Connect Discord
@@ -38,6 +38,6 @@ export function connectDiscordCredentials(connector, params = {}, options) {
     return {
         applicationId: async () => (await resolveCredentials()).applicationId,
         botToken: async () => (await resolveCredentials()).botToken,
-        webhookVerifier: vercelOidc(),
+        webhookVerifier: createConnectWebhookVerifier(),
     };
 }

package/dist/eve/github-credentials.js

@@ -1,4 +1,4 @@
-import { vercelOidc } from 'eve/channels/auth';
+import { createConnectWebhookVerifier } from '../chat/webhook-verifier.js';
 import { getConnectorMetadata, getToken, } from '../index.js';
 /**
  * Build {@link GitHubChannelCredentials} backed by a Vercel Connect
@@ -20,7 +20,7 @@ export function connectGitHubCredentials(connector, params = {}, options) {
     return {
         appSlug: () => getGitHubAppSlug(connector, options),
         installationToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
-        webhookVerifier: vercelOidc(),
+        webhookVerifier: createConnectWebhookVerifier(),
     };
 }
 async function getGitHubAppSlug(connector, options) {

package/dist/eve/linear-credentials.js

@@ -1,4 +1,4 @@
-import { vercelOidc } from 'eve/channels/auth';
+import { createConnectWebhookVerifier } from '../chat/webhook-verifier.js';
 import { getToken, } from '../index.js';
 /**
  * Build {@link LinearChannelCredentials} backed by a Vercel Connect
@@ -14,6 +14,6 @@ import { getToken, } from '../index.js';
 export function connectLinearCredentials(connector, params = {}, options) {
     return {
         accessToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
-        webhookVerifier: vercelOidc(),
+        webhookVerifier: createConnectWebhookVerifier(),
     };
 }

package/dist/eve/linq-credentials.d.ts

@@ -1,11 +1,11 @@
-import { vercelOidc } from 'eve/channels/auth';
+import { type ConnectWebhookVerifier } from '../chat/webhook-verifier.js';
 import { type ConnectOptions, type ConnectTokenParams } from '../index.js';
 /** Linq channel credentials returned by {@link connectLinqCredentials}. */
 export interface ConnectLinqCredentials {
     /** Short-lived API key for outbound Linq API calls. */
     apiKey: () => Promise<string>;
     /** Verifies webhooks forwarded by Vercel Connect. */
-    webhookVerifier: ReturnType<typeof vercelOidc>;
+    webhookVerifier: ConnectWebhookVerifier;
 }
 /**
  * Token parameters accepted by {@link connectLinqCredentials}.

package/dist/eve/linq-credentials.js

@@ -1,4 +1,4 @@
-import { vercelOidc } from 'eve/channels/auth';
+import { createConnectWebhookVerifier, } from '../chat/webhook-verifier.js';
 import { getToken, } from '../index.js';
 /**
  * Build Linq channel credentials backed by a Vercel Connect connector.
@@ -19,6 +19,6 @@ import { getToken, } from '../index.js';
 export function connectLinqCredentials(connector, params = {}, options) {
     return {
         apiKey: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
-        webhookVerifier: vercelOidc(),
+        webhookVerifier: createConnectWebhookVerifier(),
     };
 }

package/dist/eve/microsoft-teams-credentials.js

@@ -1,4 +1,4 @@
-import { vercelOidc } from 'eve/channels/auth';
+import { createConnectWebhookVerifier } from '../chat/webhook-verifier.js';
 import { getConnectorMetadata, getTokenResponse, } from '../index.js';
 const BOT_FRAMEWORK_SCOPE = 'https://api.botframework.com/.default';
 /**
@@ -31,7 +31,7 @@ export function connectTeamsCredentials(connector, params = {}, options) {
             }, options);
             return { accessToken: response.token, expiresAt: response.expiresAt };
         },
-        webhookVerifier: vercelOidc(),
+        webhookVerifier: createConnectWebhookVerifier(),
     };
 }
 async function getTeamsAppId(connector, options) {

package/dist/eve/sendblue-credentials.d.ts

@@ -1,6 +1,6 @@
 import type { ConnectOptions } from '../index.js';
 import { type ConnectSendblueParams } from '../internal/sendblue-lines.js';
-import { vercelOidc } from 'eve/channels/auth';
+import { type ConnectWebhookVerifier } from '../chat/webhook-verifier.js';
 /** Managed Sendblue channel credentials returned by {@link connectSendblueCredentials}. */
 export interface ConnectSendblueCredentials {
     /** Short-lived bearer token for outbound Sendblue API calls. */
@@ -10,7 +10,7 @@ export interface ConnectSendblueCredentials {
     /** Every Sendblue line authorized for this connector. */
     allowedFromNumbers: () => Promise<readonly string[]>;
     /** Verifies webhooks forwarded by Vercel Connect. */
-    webhookVerifier: ReturnType<typeof vercelOidc>;
+    webhookVerifier: ConnectWebhookVerifier;
 }
 /** Token parameters accepted by {@link connectSendblueCredentials}. */
 export type ConnectSendblueCredentialsParams = ConnectSendblueParams;

package/dist/eve/sendblue-credentials.js

@@ -1,5 +1,5 @@
 import { createConnectSendblueConfig, } from '../internal/sendblue-lines.js';
-import { vercelOidc } from 'eve/channels/auth';
+import { createConnectWebhookVerifier, } from '../chat/webhook-verifier.js';
 /**
  * Builds managed Sendblue channel credentials backed by a Vercel Connect
  * connector. The access-token resolver and managed line resolvers keep token
@@ -9,6 +9,6 @@ import { vercelOidc } from 'eve/channels/auth';
 export function connectSendblueCredentials(connector, params = {}, options) {
     return {
         ...createConnectSendblueConfig(connector, params, options),
-        webhookVerifier: vercelOidc(),
+        webhookVerifier: createConnectWebhookVerifier(),
     };
 }

package/dist/eve/slack-credentials.js

@@ -1,5 +1,5 @@
 import { getToken, } from '../index.js';
-import { vercelOidc } from 'eve/channels/auth';
+import { createConnectWebhookVerifier } from '../chat/webhook-verifier.js';
 /**
  * Build {@link SlackChannelCredentials} backed by a Vercel Connect
  * connector that stores a Slack workspace's bot token.
@@ -37,7 +37,7 @@ import { vercelOidc } from 'eve/channels/auth';
 export function connectSlackCredentials(connector, params = {}, options) {
     return {
         botToken: () => getToken(connector, { ...params, subject: { type: 'app' } }, options),
-        webhookVerifier: vercelOidc(),
+        webhookVerifier: createConnectWebhookVerifier(),
         vercelConnect: {
             connector,
             requirement: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/connect",
-  "version": "2.5.4",
+  "version": "2.5.5",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {