@wix/auto_sdk_app-components_components-catalog 1.0.76 → 1.0.77

package/build/cjs/index.typings.d.ts

@@ -21967,8 +21967,8 @@ interface WebhookConfig {
      */
     callbackTokenHeader?: string;
     /**
-     * Endpoint publishing the provider's public keys, used to verify a PUBLIC_KEY signature.
-     * Required for PUBLIC_KEY and must be empty for every other method.
+     * Endpoint publishing the provider's public keys. Required for PUBLIC_KEY and must be empty for
+     * every other method.
      *
      * Deliberately has no (wix.api.format), following revoke_url above: WEB_URL rejects the empty
      * value this field carries for every other method. HTTPS and a parseable endpoint are enforced
@@ -22100,6 +22100,32 @@ interface WebhookConfig {
      * @immutable
      */
     deliveryTopic?: string;
+    /**
+     * Expected `aud` claim of an OIDC_BEARER token. An OIDC issuer's audience is chosen by whoever
+     * requested the token, not by the issuer, so pinning the value expected here is what stops a
+     * bearer token minted for a different audience — a different Pub/Sub push subscription, for
+     * instance — from authenticating against this one. Required for OIDC_BEARER and must be empty
+     * for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedAudience?: string;
+    /**
+     * Expected `iss` claim of an OIDC_BEARER token, for example "https://accounts.google.com".
+     * Required for OIDC_BEARER and must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedIssuer?: string;
+    /**
+     * Expected `sub` claim of an OIDC_BEARER token — the stable identifier of the specific caller
+     * trusted to send this connector's deliveries, for example a Pub/Sub push subscription's
+     * service account. iss and aud alone do not identify the sender: aud is a value the token
+     * *requester* chooses, not the issuer, so any principal able to mint a same-issuer,
+     * same-audience token — a different Google service account with permission to request an ID
+     * token for this audience, for instance — would otherwise pass. Required for OIDC_BEARER and
+     * must be empty for every other method.
+     * @maxLength 2000
+     */
+    oidcExpectedSubject?: string;
 }
 /**
  * Declares the connector's MCP (Model Context Protocol) surface: the endpoint connector dispatch