nango/packages/frontend/lib · na/nango

GGitHubfix(frontend): route TWO_STEP credentials before OAuth2 client creden… (#7556)

文件	最后提交记录	最后更新时间
authModal.ts	feat(api): unify auth response types (#4283) ## Changes - Unify types of auth response, websocket, api calls, and frontend <!-- Summary by @propel-code-bot --> --- This major PR introduces canonical, strongly-typed authentication response types that are now used end-to-end: across backend API endpoints, WebSocket flows, the controllers, frontend SDK, and associated tests. It eliminates previously duplicated and ad hoc type definitions, refactors controllers and publisher logic to use the new unified types, and updates modal and UI handling for strict type consistency. As a result, authentication payloads (success, error, and ack) have strongly typed interfaces, reducing integration errors and improving maintainability throughout the codebase. <details> <summary><strong>Key Changes</strong></summary> • Introduced unified response and message types for authentication (success, error, ack) in @nangohq/types, used by all API, WebSocket, and frontend flows. • Refactored backend controllers and publisher logic to construct and transmit the new canonical response objects. • Frontend SDK, modal handling, and Connect UI refactored to accept, expect, and process strongly-typed authentication results. • All controller endpoint responses, including error/success/ack, now conform to canonical typings. • Tests updated throughout the stack to work with unified auth response types. • Removed duplicate and per-location response type definitions, centralizing type exports. • Improved maintainability and reduced potential for subtle API/WS/frontend contract drift. </details> <details> <summary><strong>Affected Areas</strong></summary> • Shared types: @nangohq/types/lib/auth/http.api.ts • Backend authentication controllers (API key, basic, JWT, TBA, app store, bill, two-step, signature, unauthenticated, OAuth outbound) • WebSocket publisher/client logic (publisher.client.ts) • Frontend SDK (index.ts, types.ts, authModal.ts, connectUI.js) • Unit/integration tests related to auth flows </details> This summary was automatically generated by @propel-code-bot	1 年前
connectUI.ts	feat(connect-ui): non-root base path via relative base + runtime basepath (#6802) ## Problem Connect UI's built assets are referenced from the domain root (`/assets/…`), so self-hosters serving it under a path prefix (e.g. `example.com/nango/connect/`) get 404s and a blank page. Replaces #6765, which rewrote `dist` in place at container startup — that required a writable `dist` at runtime and left the artifact broken until the rewrite ran. ## Solution The same prebuilt bundle now works under any base path: nothing is baked in at build time, there is no rewrite step, and read-only filesystems work. - Build with Vite `base: './'` so assets resolve relative to the document URL. - Derive the router basepath from `document.baseURI` at load. - Self-heal a slashless URL (`…/connect` → `…/connect/`) via an `onerror` retry on the entry script — fires only when the asset load actually failed. - Add `-s` (SPA fallback) to `serve:unsafe` so deep-route refreshes serve `index.html`. - Normalize the trailing slash wherever Nango produces a Connect UI URL: server links (new `buildConnectUiSessionLink` in utils), the frontend SDK iframe, and the dashboard preview iframe. - Send both the verbatim and trailing-slash forms of `NANGO_PUBLIC_CONNECT_URL` in the CSP (exact match for older SDKs, prefix match for assets and routes). - Fix two latent origin bugs that break any sub-path deployment: telemetry CORS and the dashboard preview compared the path-less browser `Origin` against the full URL. Fixes [NAN-6242](https://linear.app/nango/issue/NAN-6242) ## Testing - Browser e2e behind a prefix-stripping proxy: sub-path entry, slashless recovery (query preserved), deep-route refresh, and root deployment all boot with assets 200. - Unit and browser tests cover basepath derivation, link building, and the router under a basepath; build inspection confirms relative asset refs. ## Notes for self-hosters - The reverse proxy must strip the base path prefix before forwarding. - Custom static hosts need SPA fallback (rewrite unknown paths to `index.html`) if anyone does this at the moment — Nango's own static server and cloud CDN already have it. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2 个月前
index.ts	fix(frontend): route TWO_STEP credentials before OAuth2 client creden… (#7556) …tials convertCredentialsToConfig checked for client_id/client_secret before checking credentials.type === 'TWO_STEP'. TWO_STEP providers whose credential fields are named client_id/client_secret (netsapiens, ukg-pro-wfm-ropc) were therefore rewritten as OAuth2 client credentials, dropping type/username/password, and posted to /oauth2/auth, which rejects them with invalid_auth_mode. This made those providers impossible to connect through Connect UI. Move the TWO_STEP check above the client credentials check and add a unit test covering both paths. <!-- Describe the problem and your solution --> <!-- Issue ticket number and link (if applicable) --> <!-- Testing instructions (skip if just adding/editing providers) --> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/7556?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	5 天前
index.unit.test.ts	fix(frontend): route TWO_STEP credentials before OAuth2 client creden… (#7556) …tials convertCredentialsToConfig checked for client_id/client_secret before checking credentials.type === 'TWO_STEP'. TWO_STEP providers whose credential fields are named client_id/client_secret (netsapiens, ukg-pro-wfm-ropc) were therefore rewritten as OAuth2 client credentials, dropping type/username/password, and posted to /oauth2/auth, which rejects them with invalid_auth_mode. This made those providers impossible to connect through Connect UI. Move the TWO_STEP check above the client credentials check and add a unit test covering both paths. <!-- Describe the problem and your solution --> <!-- Issue ticket number and link (if applicable) --> <!-- Testing instructions (skip if just adding/editing providers) --> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/7556?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	5 天前
types.ts	feat(integrations): refractor apple-app-store and use JWT method instead (#6955) ## Describe the problem and your solution - `apple-app-store` used a bespoke `APP_STORE` auth mode that has been broken since it was originally introduced in #1464: it signed a JWT and then POSTed it to `https://api.appstoreconnect.apple.com/v1/apps` expecting a token back (`createCredentialsFromURL`). But App Store Connect has no token-exchange endpoint — the signed JWT is the access token, used directly as the Bearer credential on every request — and `/v1/apps` is a GET-only "list apps" endpoint, not something you can trade a JWT against. `tokenResponse.token` was always `undefined`, so no connection using this auth mode could ever have worked. - I checked prod and there are zero active `apple-app-store` connections, so there's no migration path to worry about, this removes the broken auth mode outright instead of patching it, and uses an auth mode we are currently using with other providers. <!-- Issue ticket number and link (if applicable) --> <!-- Testing instructions (skip if just adding/editing providers) --> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6955?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	1 个月前