@workos-inc/widgets 1.20.0-next.1791237372282 → 1.20.0-next.1791398947580

package/CHANGELOG.md

@@ -1,11 +1,13 @@
 # Changelog
 
-## 1.20.0-next.1791237372282
+## 1.20.0-next.1791398947580
 
 ### Minor Changes
 
 - Prepare the sectioned `<Pipes>` and `<PipesAdmin>` experiences (`enableSharedConnections`) for multiple connections per provider. Nothing changes until multiple connections are enabled for your environment; until then each provider keeps its single connection and looks as it did before. Once enabled, a provider with several connections renders as a group with one row per connection, oldest first, each with its own status and actions. "Add connection" and "Connect another account" add one (asking for an optional name) when the API reports it available, and connections can be renamed. Repairs target the exact connection, and adds are retry-safe.
 
+- Add the optional PipesAdmin `userId` prop for attributing shared API-key and client-credentials writes with application credential tokens. User sessions send their authenticated user automatically. Block missing actors and mismatched session actors with configuration guidance instead of actor-entry UI. Application-token hosts must supply an acting WorkOS user before upgrading; publish only after the API accepts attribution.
+
 - Surface data integration connection failures in the Pipes widget
 
   When an OAuth handoff popup fails or closes without completing, the widget now

package/README.md

@@ -3,3 +3,47 @@
 A suite of React components providing functionality for enterprise app workflows.
 
 [Read the documentation](https://workos.com/docs/widgets)
+
+## Shared Pipes credentials
+
+`PipesAdmin` defaults to provider settings only. Opt in to shared connections
+with `enableSharedConnections`. User-backed widget sessions and AuthKit user
+access tokens attribute shared API-key and client-credentials writes to the
+signed-in user without any new host prop.
+
+Hosts using an application credential token must pass the acting person's
+WorkOS user ID programmatically when connecting, rotating, or repairing shared
+credentials:
+
+```tsx
+<PipesAdmin
+  authToken={applicationCredentialToken}
+  enableSharedConnections
+  userId={authenticatedWorkOsUser.id}
+/>
+```
+
+Source `authenticatedWorkOsUser.id` from the host's authenticated user context
+or an existing mapping to that WorkOS user (`user_...`), not an arbitrary
+application-local ID or the credential token's subject. `userId` is an optional
+React prop, never a rendered field or member picker. A missing actor blocks
+these shared credential writes with configuration guidance, while reads,
+provider configuration, and OAuth flows remain available. User-session hosts
+should omit the prop; a different ID is rejected. Standalone widget sessions
+cannot supply an actor through this prop.
+
+An authorized application caller asserts whom it acts on behalf of. Passing
+`userId` does not authenticate that person or grant write access: the API still
+validates permissions, identity, and active membership of the token-scoped
+organization. If there is no acting person, do not fabricate one; machine-managed
+credentials require separate policy support.
+
+### Upgrade and rollout
+
+Before upgrading application-token hosts, supply `userId` from their authenticated
+user context for shared credential actions. User-session hosts require no changes.
+Publish this widget change only after the deployed Widgets GraphQL API accepts
+`userId` on both organization credential inputs (PVIT-1079). Subsequent server-side
+required-actor enforcement (PVIT-1081) also requires operator confirmation of the
+affected hosts' upgrade and communication plan; publication alone does not prove
+adoption.

package/dist/cjs/api/claims.cjs

@@ -1,9 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/api/claims.ts
+function getAuthenticatedUserId(claims) {
+	return (claims.sub_profile === void 0 || claims.sub_profile === "user") && (claims.sub_type === "authkit" || claims.sub_type === void 0 && !!claims.sid && typeof claims.auth_time === "number") && claims.sub?.startsWith("user_") ? claims.sub : void 0;
+}
 function getClaims(accessToken) {
 	return JSON.parse(atob(accessToken.split(".")[1]));
 }
 //#endregion
+exports.getAuthenticatedUserId = getAuthenticatedUserId;
 exports.getClaims = getClaims;
 
 //# sourceMappingURL=claims.cjs.map

package/dist/cjs/api/claims.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"claims.cjs","names":[],"sources":["../../../src/api/claims.ts"],"sourcesContent":["interface Claims {\n  sid: string;\n  permissions?: string[];\n  exp?: number;\n}\n\nexport function getClaims(accessToken: string): Claims {\n  return JSON.parse(atob(accessToken.split(\".\")[1]));\n}\n"],"mappings":";;AAMA,SAAgB,UAAU,aAA6B;CACrD,OAAO,KAAK,MAAM,KAAK,YAAY,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACnD"}
+{"version":3,"file":"claims.cjs","names":[],"sources":["../../../src/api/claims.ts"],"sourcesContent":["interface Claims {\n  sid?: string;\n  sub?: string;\n  sub_type?: string;\n  sub_profile?: string;\n  auth_time?: number;\n  permissions?: string[];\n  exp?: number;\n}\n\nexport function getAuthenticatedUserId(claims: Claims): string | undefined {\n  const isUserSession =\n    (claims.sub_profile === undefined || claims.sub_profile === \"user\") &&\n    (claims.sub_type === \"authkit\" ||\n      (claims.sub_type === undefined &&\n        !!claims.sid &&\n        typeof claims.auth_time === \"number\"));\n\n  return isUserSession && claims.sub?.startsWith(\"user_\")\n    ? claims.sub\n    : undefined;\n}\n\nexport function getClaims(accessToken: string): Claims {\n  return JSON.parse(atob(accessToken.split(\".\")[1]));\n}\n"],"mappings":";;AAUA,SAAgB,uBAAuB,QAAoC;CAQzE,QANG,OAAO,gBAAgB,UAAa,OAAO,gBAAgB,YAC3D,OAAO,aAAa,aAClB,OAAO,aAAa,UACnB,CAAC,CAAC,OAAO,OACT,OAAO,OAAO,cAAc,aAEV,OAAO,KAAK,WAAW,OAAO,IAClD,OAAO,MACP;AACN;AAEA,SAAgB,UAAU,aAA6B;CACrD,OAAO,KAAK,MAAM,KAAK,YAAY,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACnD"}

package/dist/cjs/api/claims.d.cts

@@ -1,9 +1,14 @@
 //#region src/api/claims.d.ts
 interface Claims {
-  sid: string;
+  sid?: string;
+  sub?: string;
+  sub_type?: string;
+  sub_profile?: string;
+  auth_time?: number;
   permissions?: string[];
   exp?: number;
 }
+export declare function getAuthenticatedUserId(claims: Claims): string | undefined;
 export declare function getClaims(accessToken: string): Claims;
 //#endregion
 //# sourceMappingURL=claims.d.cts.map