@xignet/payload 0.1.0-beta.2 → 0.1.0-beta.3

package/README.md

@@ -165,7 +165,7 @@ Directory audit records use generated `x-request-id` correlation IDs, local acto
 
 ### REST access tokens and API-key migration
 
-REST is opt-in and uses a **separate audience**, normally `https://cms.example.com/api`; an MCP or Directory token is not a REST credential. Configure `rest.enabled`, `resource`, `admissionScopes`, explicit `collections` / `globals` operation scopes, and optional exact custom `endpoints`. Only document GET, collection POST, document PATCH and global GET/POST are supported. Delete, bulk update, auth, versions and GraphQL routes are denied for REST Bearer tokens.
+REST is opt-in and shares the CMS `resource` audience with MCP, normally `https://cms.example.com/api/mcp`. Directory has its own audience. Configure `rest.enabled`, `admissionScopes`, explicit `collections` / `globals` operation scopes, and optional exact custom `endpoints`. REST and MCP each enforce their own route, scope and local access policies. Only document GET, collection POST, document PATCH and global GET/POST are supported by the REST adapter. Delete, bulk update, auth, versions and GraphQL routes are denied for REST Bearer tokens.
 
 ```ts
 const integration = xignetPlugin({
@@ -173,7 +173,6 @@ const integration = xignetPlugin({
   legacyAPIKeys: true, // temporary migration bridge; default is false
   rest: {
     enabled: true,
-    resource: 'https://cms.example.com/api',
     admissionScopes: ['cms:access'],
     collections: {
       pages: { read: ['cms:read'], create: ['cms:write', 'cms:publish'], update: ['cms:write', 'cms:publish'] },
@@ -187,4 +186,4 @@ const integration = xignetPlugin({
 
 Human subjects resolve through the managed local binding and eligibility policy on every request. Services must have the reserved `service:` subject equal to `client_id` and match the local `rest.services` allowlist. Their principal has collection `xignet-services` and no human role, password or session; this is an in-memory principal, not a new database collection. Existing collection/global access control is preserved. Where appropriate, explicitly allow `isXignetService(req)` in the application's **content** access policy; the adapter still caps access to configured operation scopes. Never add this exception to user management or admin access. Field access rules also remain in force.
 
-Keep `legacyAPIKeys: true` only while existing consumers migrate. It does not re-enable passwords. Deploy REST validation first, register environment-specific machine clients for the REST audience and least required scopes, migrate consumers, verify their reads/writes/uploads, then set `legacyAPIKeys: false`. No automatic token-to-API-key fallback exists. Machine authorization revocation at the AS is bounded by the access token's lifetime; removing the local service allowlist entry takes effect with the new configuration. No remote introspection is performed.
+Keep `legacyAPIKeys: true` only while existing consumers migrate. It does not re-enable passwords. Deploy REST validation first, register environment-specific machine clients for the shared CMS audience and least required scopes, migrate consumers, verify their reads/writes/uploads, then set `legacyAPIKeys: false`. No automatic token-to-API-key fallback exists. Machine authorization revocation at the AS is bounded by the access token's lifetime; removing the local service allowlist entry takes effect with the new configuration. No remote introspection is performed.

package/dist/rest.d.ts

@@ -7,8 +7,6 @@ export interface RestEntityPolicy {
 }
 export interface RestOptions {
     readonly enabled: boolean;
-    /** Separate audience from MCP, e.g. https://cms.example.com/api. */
-    readonly resource: string;
     readonly admissionScopes: readonly string[];
     readonly collections: Readonly<Record<string, RestEntityPolicy>>;
     readonly globals?: Readonly<Record<string, Omit<RestEntityPolicy, 'create'>>>;

package/dist/rest.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
-import { createTokenVerifier, hasAllScopes, trustedUrl, } from '@xignet/core';
+import { createTokenVerifier, hasAllScopes, } from '@xignet/core';
 import { validateScopes } from '@xignet/core/oauth';
 const principals = new WeakMap();
 const key = '__xignetRest';
@@ -54,17 +54,14 @@ export function createRest(options) {
             if (!service.subject.startsWith('service:') ||
                 service.subject !== service.clientId)
                 throw new Error('Xignet service subject must equal its service client ID');
-        const resource = trustedUrl(rest.resource, options.allowInsecureLoopback);
-        if (resource.origin !== new URL(options.resource).origin ||
-            rest.resource === options.resource)
-            throw new Error('REST requires a separate audience on the CMS origin');
     }
-    const verifier = rest && createTokenVerifier({ ...options, audience: rest.resource });
+    const verifier = rest && createTokenVerifier({ ...options, audience: options.resource });
+    const apiRoot = new URL(options.resource).pathname.replace(/\/mcp$/, '');
     function route(request) {
         if (!rest)
             return;
         const path = new URL(request.url).pathname;
-        const root = new URL(rest.resource).pathname;
+        const root = apiRoot;
         if (!path.startsWith(`${root}/`) || /%|\\|\/\//.test(path))
             return;
         const relative = path.slice(root.length);
@@ -144,7 +141,7 @@ export function createRest(options) {
     };
     return {
         async handle(request, payload, next) {
-            // MCP owns its own Bearer validation and audience.
+            // MCP owns its own Bearer validation and route policy.
             if (!bearer(request.headers) ||
                 new URL(request.url).pathname === new URL(options.resource).pathname)
                 return next();
@@ -202,8 +199,8 @@ export function createRest(options) {
         enhance(config) {
             if (!rest?.enabled)
                 return config;
-            if (new URL(rest.resource).pathname !== (config.routes?.api ?? '/api'))
-                throw new Error('REST resource must equal the Payload API root');
+            if (apiRoot !== (config.routes?.api ?? '/api'))
+                throw new Error('REST API root must match the Payload API route');
             for (const slug of Object.keys(rest.collections)) {
                 const collection = config.collections?.find((c) => c.slug === slug);
                 if (!collection || collection.auth)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xignet/payload",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.3",
   "type": "module",
   "description": "Xignet OAuth resource and OIDC integration for Payload v3.",
   "license": "MIT",