Security News
RubyGems.org Adds New Maintainer Role
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
@knocklabs/node
Advanced tools
Knock API access for applications written in server-side Javascript. This package is compatible with the Vercel Edge runtime.
See the documentation for Node.js usage examples.
npm install @knocklabs/node
To use the library you must provide a secret API key, provided in the Knock dashboard.
If you are using enhanced security mode you will also need to provide your signing key.
You can set both as environment variables:
KNOCK_API_KEY="sk_12345"
KNOCK_SIGNING_KEY="S25vY2sga25vY2sh..."
You can also pass the Knock API key in the constructor. The signing key is passed separately to the signUserToken
method (see below):
import { Knock } from "@knocklabs/node";
const knockClient = new Knock("sk_12345");
import { Knock } from "@knocklabs/node";
const knockClient = new Knock("sk_12345");
// The key of the workflow (from Knock dashboard)
await knockClient.workflows.trigger("dinosaurs-loose", {
// user id of who performed the action
actor: "dnedry",
// list of user ids for who should receive the notification
recipients: ["jhammond", "agrant", "imalcolm", "esattler"],
// data payload to send through
data: {
type: "trex",
priority: 1,
},
// an optional identifier for the tenant that the notifications belong to
tenant: "jurassic-park",
// an optional key to provide to cancel a workflow
cancellationKey: triggerAlert.id,
});
import { Knock } from "@knocklabs/node";
const knockClient = new Knock("sk_12345");
await knockClient.workflows.cancel("dinosaurs-loose", triggerAlert.id, {
// optionally you can specify recipients here
recipients: ["jhammond"],
});
import { Knock } from "@knocklabs/node";
const knockClient = new Knock("sk_12345");
await knockClient.users.identify("jhammond", {
name: "John Hammond",
email: "jhammond@ingen.net",
});
import { Knock } from "@knocklabs/node";
const knockClient = new Knock("sk_12345");
await knockClient.users.get("jhammond");
import { Knock } from "@knocklabs/node";
const knockClient = new Knock("sk_12345");
await knockClient.users.delete("jhammond");
import { Knock } from "@knocklabs/node";
const knockClient = new Knock("sk_12345");
// Set an entire preference set
await knockClient.users.setPreferences("jhammond", {
channel_types: { email: true, sms: false },
workflows: {
"dinosaurs-loose": {
channel_types: { email: false, in_app_feed: true },
},
},
});
// Retrieve a whole preference set
const preferences = await knockClient.users.getPreferences("jhammond");
import { Knock } from "@knocklabs/node";
const knockClient = new Knock("sk_12345");
// Setting channel data for an APNS
await knockClient.users.setChannelData("jhammond", KNOCK_APNS_CHANNEL_ID, {
tokens: [apnsToken],
});
// Getting channel data for the APNS channel
await knockClient.users.getChannelData("jhammond", KNOCK_APNS_CHANNEL_ID);
import { Knock } from "@knocklabs/node";
const knockClient = new Knock("sk_12345");
const tenantId = "tenant-123";
const knockSlackChannelId = "7c1e0042-5ef2-411a-a43b-e541acb139ed";
// An optional object containing the query options passed to Slack:
// https://api.slack.com/methods/conversations.list#arg_cursor
const queryOptions = {
cursor: null,
limit: 200,
exclude_archived: true,
team_id: null,
types: "public_channel",
};
// Retrieve a list of Slack channels
const channelsInput = {
tenant: tenantId,
knockChannelId: knockSlackChannelId,
queryOptions,
};
await knockClient.slack.getChannels(channelsInput);
// Check Slack connection
const authInput = { tenant: tenantId, knockChannelId: knockSlackChannelId };
await knockClient.slack.authCheck(authInput);
// Revoke access token
const revokeInput = { tenant: tenantId, knockChannelId: knockSlackChannelId };
await knockClient.slack.revokeAccessToken(revokeInput);
When using enhanced security mode (recommended in production), you will need to sign JWTs server-side to authenticate your users.
You will need to generate an environment specific signing key in the Knock dashboard under "API Keys", and then enable enhanced security mode for your environment.
import { Knock } from "@knocklabs/node";
// When signing user tokens, you do not need to instantiate a Knock client.
// jhammond is the user id for which to sign this token
const token = await Knock.signUserToken("jhammond", {
// The signing key from the Knock Dashboard in base-64 or PEM-encoded format.
// If not provided, the key will be read from the KNOCK_SIGNING_KEY environment variable.
signingKey: "S25vY2sga25vY2sh...",
// Optional: How long the token should be valid for, in seconds (default 1 hour)
// For long-lived connections, you will need to refresh the token before it expires.
expiresInSeconds: 60 * 60,
});
// This token can now be safely passed to your client e.g. in a cookie or API response.
FAQs
Library for interacting with the Knock API
The npm package @knocklabs/node receives a total of 211,029 weekly downloads. As such, @knocklabs/node popularity was classified as popular.
We found that @knocklabs/node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.
Security News
Research
Socket's threat research team has detected five malicious npm packages targeting Roblox developers, deploying malware to steal credentials and personal data.