sdarbinyan/vitanovaPackages
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth: gate ed25519 exports, resolve CORS changeset, add backend TODO

Browse Source
This commit is contained in:
sdarbinyan
2026-08-24 00:00:29 +04:00
parent f6a58a9a3e
commit 8a954916e1
5 changed files with 43 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
.changeset/gate-ed25519-exports.md Normal file
View File

@@ -0,0 +1,7 @@
---
"@marketplaces/auth": minor
---
Remove `ed25519/*` exports from the public API (`index.ts`). The Ed25519 challenge/response admin auth flow has no backend yet (per ADR-0001) and was shipping fully in every consumer's bundle, unused. Source stays in `src/ed25519/` untouched — this only stops it being part of the published package's public surface; re-export it once that backend exists.
Breaking for any consumer importing `Ed25519AuthService`, `AuthFacade`, `AuthApiService`, `SessionService`, `JwtService`, `Ed25519KeypairService`, `PermissionService`, `Ed25519VerificationService`, `NoopEd25519VerificationService`, or related types from `@marketplaces/auth` — none confirmed to exist at the time of this change.

8
.changeset/legacy-cors-context.md Normal file
View File

@@ -0,0 +1,8 @@
---
"@marketplaces/auth": minor
"@marketplaces/payment": minor
---
Superseded 2026-08-23: this changeset originally proposed keeping legacy-CORS-compatible request parameters as the default transport for `marketplaceDomain`. That direction is reversed — both packages now send `X-Marketplace-Domain` as a header exclusively; the query/body-parameter transport mode (`contextTransport: 'parameter'`) has been removed entirely, not just de-defaulted.
Reason for the reversal: the `feat/auth-admin-credentials-login` branch dropped param-transport while adding credentials-login, and that direction was kept rather than restoring the legacy fallback. **Backend must allow `X-Marketplace-Domain` in CORS preflight for both the Auth API and Payment API before this ships** — tracked in `BACKEND-TODO.md`. If that turns out not to be feasible, this decision needs revisiting, not silently worked around.

1
.gitattributes vendored Normal file
View File

@@ -0,0 +1 @@
* text=auto

19
BACKEND-TODO.md Normal file
View File

@@ -0,0 +1,19 @@
# vitanovaPackages — backend team TODO
Everything here needs a decision or confirmation from whoever owns the central Auth API / Payment API. Nothing in this list can be resolved from the frontend side alone. Hand this file to them directly.
## 1. Confirm `X-Marketplace-Domain` CORS support (blocking)
As of 2026-08-23, `@marketplaces/auth` and `@marketplaces/payment` send the marketplace domain as a request header (`X-Marketplace-Domain`) exclusively. The previous query-parameter/body fallback (`contextTransport: 'parameter'`, kept for backends that hadn't allowed the header in CORS preflight) has been **removed**, not just de-defaulted.
**Backend must confirm**: both the Auth API and the Payment API allow `X-Marketplace-Domain` in CORS preflight (`Access-Control-Allow-Headers`), and reject requests with an unknown/disabled domain in that header. See `docs/BACKEND-CONTRACT.md` for the full contract.
If either service can't allow that header for some environment (legacy proxy, CDN stripping custom headers, etc.), say so before this ships — the frontend has no fallback for it anymore.
## 2. `@marketplaces/payment` version discipline
`@marketplaces/payment` changed the same way as auth (dropped param-transport) but was never version-bumped past 0.2.0, even though it's a behavior-breaking change for anyone integrating against it. Not a backend question exactly, but flagging since payment's release process seems to have skipped a changeset for this — worth a process check.
## 3. Rate-limiting on admin credentials login
`AdminAuthService.loginWithCredentials()` (new in `@marketplaces/auth` 0.3.0) expects `429` with a `Retry-After` header (seconds) for rate-limited attempts, and maps that to a `rate_limited` failure code with `retryAfterSeconds`. Confirm the Auth API actually returns `Retry-After` on 429 for `POST {credentialsPath}` — if it uses a different mechanism (custom header, response body field), the frontend's parsing needs to match.
## 4. Ed25519 admin auth — still just future work
No change requested here, just a status check: `packages/auth/src/ed25519/` (challenge/response admin auth) has never had a backend. As of 2026-08-23 it's also no longer exported from the package's public API (dead code in the bundle otherwise). If/when that backend gets built, this needs re-exporting and a real integration pass — flag when that's on the roadmap so the frontend side can be scheduled.

35
packages/auth/src/index.ts
View File

@@ -3,6 +3,14 @@
// docs/context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md):
// - telegram/ — live Telegram QR/session auth (customer + admin)
// - ed25519/ — future Ed25519 challenge/response admin auth (backend not shipped yet)
//
// ed25519/ is intentionally NOT exported below (2026-08-23) — its backend has
// never shipped, so it was dead weight in every consumer's bundle. Source
// stays in src/ed25519/ untouched; re-add the export block (removed here,
// see git history / .changeset/gate-ed25519-exports.md) once that backend
// is real. Breaking change for any consumer importing ed25519 symbols —
// none confirmed to exist at the time of this change.
//
// Provide AUTH_API_URL (and optionally TELEGRAM_BOT_USERNAME) from the consuming app's config.
export { AUTH_API_URL, TELEGRAM_BOT_USERNAME, MARKETPLACES_AUTH_CONFIG, provideMarketplacesAuth } from './config';
@@ -20,30 +28,3 @@ export { AuthService } from './telegram/auth.service';
export { AdminAuthService } from './telegram/admin-auth.service';
export { adminAuthGuard } from './telegram/admin-auth.guard';
export { adminAuthHeadersInterceptor } from './telegram/admin-auth-headers.interceptor';
// Ed25519 module (namespaced re-exports to avoid colliding with the telegram module's AuthService)
export { AuthService as Ed25519AuthService } from './ed25519/auth.service';
export { AuthFacade } from './ed25519/auth-facade.service';
export { AuthApiService } from './ed25519/auth-api.service';
export { SessionService } from './ed25519/session.service';
export { JwtService } from './ed25519/jwt.service';
export { Ed25519KeypairService } from './ed25519/ed25519-keypair.service';
export { PermissionService } from './ed25519/permission.service';
export {
Ed25519VerificationService,
Ed25519Challenge,
Ed25519SignedResponse,
Ed25519VerificationResult
} from './ed25519/ed25519-verification.model';
export { NoopEd25519VerificationService } from './ed25519/noop-ed25519-verification.service';
export {
AuthChallenge,
VerifySignatureRequest,
AuthTokenPair,
RefreshTokenRequest,
JwtClaims
} from './ed25519/models/auth-api.model';
export { AuthErrorCode, AuthError, authErrorCodeFromBackendCode, authErrorCodeFromStatus } from './ed25519/models/auth-error.model';
export { AdminRole, Permission, ROLE_PERMISSIONS } from './ed25519/models/permission.model';
export type { LoginPhase } from './ed25519/auth.service';
export type { SessionStatus } from './ed25519/session.service';