From 8a954916e1ed44d7133269f1e1d616fa7d33b3e6 Mon Sep 17 00:00:00 2001 From: sdarbinyan Date: Mon, 24 Aug 2026 00:00:29 +0400 Subject: [PATCH] auth: gate ed25519 exports, resolve CORS changeset, add backend TODO --- .changeset/gate-ed25519-exports.md | 7 ++++++ .changeset/legacy-cors-context.md | 8 +++++++ .gitattributes | 1 + BACKEND-TODO.md | 19 ++++++++++++++++ packages/auth/src/index.ts | 35 +++++++----------------------- 5 files changed, 43 insertions(+), 27 deletions(-) create mode 100644 .changeset/gate-ed25519-exports.md create mode 100644 .changeset/legacy-cors-context.md create mode 100644 .gitattributes create mode 100644 BACKEND-TODO.md diff --git a/.changeset/gate-ed25519-exports.md b/.changeset/gate-ed25519-exports.md new file mode 100644 index 0000000..3488456 --- /dev/null +++ b/.changeset/gate-ed25519-exports.md @@ -0,0 +1,7 @@ +--- +"@marketplaces/auth": minor +--- + +Remove `ed25519/*` exports from the public API (`index.ts`). The Ed25519 challenge/response admin auth flow has no backend yet (per ADR-0001) and was shipping fully in every consumer's bundle, unused. Source stays in `src/ed25519/` untouched — this only stops it being part of the published package's public surface; re-export it once that backend exists. + +Breaking for any consumer importing `Ed25519AuthService`, `AuthFacade`, `AuthApiService`, `SessionService`, `JwtService`, `Ed25519KeypairService`, `PermissionService`, `Ed25519VerificationService`, `NoopEd25519VerificationService`, or related types from `@marketplaces/auth` — none confirmed to exist at the time of this change. diff --git a/.changeset/legacy-cors-context.md b/.changeset/legacy-cors-context.md new file mode 100644 index 0000000..456905c --- /dev/null +++ b/.changeset/legacy-cors-context.md @@ -0,0 +1,8 @@ +--- +"@marketplaces/auth": minor +"@marketplaces/payment": minor +--- + +Superseded 2026-08-23: this changeset originally proposed keeping legacy-CORS-compatible request parameters as the default transport for `marketplaceDomain`. That direction is reversed — both packages now send `X-Marketplace-Domain` as a header exclusively; the query/body-parameter transport mode (`contextTransport: 'parameter'`) has been removed entirely, not just de-defaulted. + +Reason for the reversal: the `feat/auth-admin-credentials-login` branch dropped param-transport while adding credentials-login, and that direction was kept rather than restoring the legacy fallback. **Backend must allow `X-Marketplace-Domain` in CORS preflight for both the Auth API and Payment API before this ships** — tracked in `BACKEND-TODO.md`. If that turns out not to be feasible, this decision needs revisiting, not silently worked around. diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..176a458 --- /dev/null +++ b/.gitattributes @@ -0,0 +1 @@ +* text=auto diff --git a/BACKEND-TODO.md b/BACKEND-TODO.md new file mode 100644 index 0000000..5bcc063 --- /dev/null +++ b/BACKEND-TODO.md @@ -0,0 +1,19 @@ +# vitanovaPackages — backend team TODO + +Everything here needs a decision or confirmation from whoever owns the central Auth API / Payment API. Nothing in this list can be resolved from the frontend side alone. Hand this file to them directly. + +## 1. Confirm `X-Marketplace-Domain` CORS support (blocking) +As of 2026-08-23, `@marketplaces/auth` and `@marketplaces/payment` send the marketplace domain as a request header (`X-Marketplace-Domain`) exclusively. The previous query-parameter/body fallback (`contextTransport: 'parameter'`, kept for backends that hadn't allowed the header in CORS preflight) has been **removed**, not just de-defaulted. + +**Backend must confirm**: both the Auth API and the Payment API allow `X-Marketplace-Domain` in CORS preflight (`Access-Control-Allow-Headers`), and reject requests with an unknown/disabled domain in that header. See `docs/BACKEND-CONTRACT.md` for the full contract. + +If either service can't allow that header for some environment (legacy proxy, CDN stripping custom headers, etc.), say so before this ships — the frontend has no fallback for it anymore. + +## 2. `@marketplaces/payment` version discipline +`@marketplaces/payment` changed the same way as auth (dropped param-transport) but was never version-bumped past 0.2.0, even though it's a behavior-breaking change for anyone integrating against it. Not a backend question exactly, but flagging since payment's release process seems to have skipped a changeset for this — worth a process check. + +## 3. Rate-limiting on admin credentials login +`AdminAuthService.loginWithCredentials()` (new in `@marketplaces/auth` 0.3.0) expects `429` with a `Retry-After` header (seconds) for rate-limited attempts, and maps that to a `rate_limited` failure code with `retryAfterSeconds`. Confirm the Auth API actually returns `Retry-After` on 429 for `POST {credentialsPath}` — if it uses a different mechanism (custom header, response body field), the frontend's parsing needs to match. + +## 4. Ed25519 admin auth — still just future work +No change requested here, just a status check: `packages/auth/src/ed25519/` (challenge/response admin auth) has never had a backend. As of 2026-08-23 it's also no longer exported from the package's public API (dead code in the bundle otherwise). If/when that backend gets built, this needs re-exporting and a real integration pass — flag when that's on the roadmap so the frontend side can be scheduled. diff --git a/packages/auth/src/index.ts b/packages/auth/src/index.ts index afef2a7..e4f5bb1 100644 --- a/packages/auth/src/index.ts +++ b/packages/auth/src/index.ts @@ -3,6 +3,14 @@ // docs/context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md): // - telegram/ — live Telegram QR/session auth (customer + admin) // - ed25519/ — future Ed25519 challenge/response admin auth (backend not shipped yet) +// +// ed25519/ is intentionally NOT exported below (2026-08-23) — its backend has +// never shipped, so it was dead weight in every consumer's bundle. Source +// stays in src/ed25519/ untouched; re-add the export block (removed here, +// see git history / .changeset/gate-ed25519-exports.md) once that backend +// is real. Breaking change for any consumer importing ed25519 symbols — +// none confirmed to exist at the time of this change. +// // Provide AUTH_API_URL (and optionally TELEGRAM_BOT_USERNAME) from the consuming app's config. export { AUTH_API_URL, TELEGRAM_BOT_USERNAME, MARKETPLACES_AUTH_CONFIG, provideMarketplacesAuth } from './config'; @@ -20,30 +28,3 @@ export { AuthService } from './telegram/auth.service'; export { AdminAuthService } from './telegram/admin-auth.service'; export { adminAuthGuard } from './telegram/admin-auth.guard'; export { adminAuthHeadersInterceptor } from './telegram/admin-auth-headers.interceptor'; - -// Ed25519 module (namespaced re-exports to avoid colliding with the telegram module's AuthService) -export { AuthService as Ed25519AuthService } from './ed25519/auth.service'; -export { AuthFacade } from './ed25519/auth-facade.service'; -export { AuthApiService } from './ed25519/auth-api.service'; -export { SessionService } from './ed25519/session.service'; -export { JwtService } from './ed25519/jwt.service'; -export { Ed25519KeypairService } from './ed25519/ed25519-keypair.service'; -export { PermissionService } from './ed25519/permission.service'; -export { - Ed25519VerificationService, - Ed25519Challenge, - Ed25519SignedResponse, - Ed25519VerificationResult -} from './ed25519/ed25519-verification.model'; -export { NoopEd25519VerificationService } from './ed25519/noop-ed25519-verification.service'; -export { - AuthChallenge, - VerifySignatureRequest, - AuthTokenPair, - RefreshTokenRequest, - JwtClaims -} from './ed25519/models/auth-api.model'; -export { AuthErrorCode, AuthError, authErrorCodeFromBackendCode, authErrorCodeFromStatus } from './ed25519/models/auth-error.model'; -export { AdminRole, Permission, ROLE_PERMISSIONS } from './ed25519/models/permission.model'; -export type { LoginPhase } from './ed25519/auth.service'; -export type { SessionStatus } from './ed25519/session.service';