nylas - npm Package Compare versions

Comparing version 7.0.0-canary.2 to 7.0.0-canary.3

lib/server-bindings/express-binding.js

@@ -101,23 +101,46 @@ "use strict";
         });
-        router.post('/generate-auth-url', function (req, res) {
-            var authUrl = _this.nylasClient.urlForAuthentication({
-                loginHint: req.body.email_address,
-                redirectURI: (_this.clientUri || '') + req.body.success_url,
-                scopes: _this.defaultScopes,
+        router.post('/generate-auth-url', function (req, res) { return __awaiter(_this, void 0, void 0, function () {
+            var state, authUrl;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        state = '';
+                        if (!this.csrfTokenExchangeOpts) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.csrfTokenExchangeOpts.generateCsrfToken(req)];
+                    case 1:
+                        state = _a.sent();
+                        _a.label = 2;
+                    case 2:
+                        authUrl = this.nylasClient.urlForAuthentication({
+                            loginHint: req.body.email_address,
+                            redirectURI: (this.clientUri || '') + req.body.success_url,
+                            scopes: this.defaultScopes,
+                            state: state,
+                        });
+                        res.status(200).send(authUrl);
+                        return [2 /*return*/];
+                }
             });
-            res.status(200).send(authUrl);
-        });
+        }); });
         router.post('/exchange-mailbox-token', function (req, res) { return __awaiter(_this, void 0, void 0, function () {
-            var accessTokenObj, e_1;
+            var csrfToken, isValidToken, accessTokenObj, e_1;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        _a.trys.push([0, 2, , 3]);
-                        return [4 /*yield*/, this.nylasClient.exchangeCodeForToken(req.body.token)];
+                        _a.trys.push([0, 5, , 6]);
+                        if (!this.csrfTokenExchangeOpts) return [3 /*break*/, 2];
+                        csrfToken = req.body.csrfToken;
+                        return [4 /*yield*/, this.csrfTokenExchangeOpts.validateCsrfToken(csrfToken, req)];
                     case 1:
+                        isValidToken = _a.sent();
+                        if (!isValidToken) {
+                            return [2 /*return*/, res.status(401).send('Invalid CSRF State Token')];
+                        }
+                        _a.label = 2;
+                    case 2: return [4 /*yield*/, this.nylasClient.exchangeCodeForToken(req.body.token)];
+                    case 3:
                         accessTokenObj = _a.sent();
-                        this.emit(server_binding_1.ServerEvents.TokenExchange, {
-                            accessTokenObj: accessTokenObj,
-                            res: res,
-                        });
+                        return [4 /*yield*/, this.exchangeMailboxTokenCallback(accessTokenObj, res)];
+                    case 4:
+                        _a.sent();
                         // If the callback event already sent a response then we don't need to do anything
@@ -127,8 +150,8 @@ if (!res.writableEnded) {
                         }
-                        return [3 /*break*/, 3];
-                    case 2:
+                        return [3 /*break*/, 6];
+                    case 5:
                         e_1 = _a.sent();
                         res.status(500).send(e_1.message);
-                        return [3 /*break*/, 3];
-                    case 3: return [2 /*return*/];
+                        return [3 /*break*/, 6];
+                    case 6: return [2 /*return*/];
                 }
@@ -135,0 +158,0 @@ });

lib/server-bindings/server-binding.d.ts

 /// <reference types="node" />
-import { Response, Router } from 'express';
+import { Request, Response, Router } from 'express';
 import { Scope } from '../models/connect';
@@ -11,7 +11,13 @@ import { EventEmitter } from 'events';
 declare type Middleware = Router;
-export declare enum ServerEvents {
-    TokenExchange = "token-exchange"
-}
+declare type ServerRequest = Request;
+declare type ServerResponse = Response;
+declare type ExchangeMailboxTokenCallback = (accessToken: AccessToken, res: ServerResponse) => void;
+declare type CsrfTokenExchangeOptions = {
+    generateCsrfToken: (req: ServerRequest) => Promise<string>;
+    validateCsrfToken: (csrfToken: string, req: ServerRequest) => Promise<boolean>;
+};
 export declare type ServerBindingOptions = {
     defaultScopes: Scope[];
+    exchangeMailboxTokenCallback: ExchangeMailboxTokenCallback;
+    csrfTokenExchangeOpts?: CsrfTokenExchangeOptions;
     clientUri?: string;
@@ -22,2 +28,4 @@ };
     defaultScopes: Scope[];
+    exchangeMailboxTokenCallback: ExchangeMailboxTokenCallback;
+    csrfTokenExchangeOpts?: CsrfTokenExchangeOptions;
     clientUri?: string;
@@ -29,10 +37,4 @@ static NYLAS_SIGNATURE_HEADER: string;
     abstract buildMiddleware(): Middleware;
-    on: <K extends WebhookTriggers | ServerEvents>(event: K, listener: (payload: K extends WebhookTriggers ? WebhookDelta : {
-        accessTokenObj: AccessToken;
-        res: Response<any, Record<string, any>>;
-    }) => void) => this;
-    emit: <K extends WebhookTriggers | ServerEvents>(event: K, payload: K extends WebhookTriggers ? WebhookDelta : {
-        accessTokenObj: AccessToken;
-        res: Response<any, Record<string, any>>;
-    }) => boolean;
+    on: <K extends WebhookTriggers>(event: K, listener: (payload: WebhookDelta) => void) => this;
+    emit: <K extends WebhookTriggers>(event: K, payload: WebhookDelta) => boolean;
     /**
@@ -39,0 +41,0 @@ * Verify incoming webhook signature came from Nylas

lib/server-bindings/server-binding.js

@@ -22,6 +22,2 @@ "use strict";
 var tunnel_1 = require("../services/tunnel");
-var ServerEvents;
-(function (ServerEvents) {
-    ServerEvents["TokenExchange"] = "token-exchange";
-})(ServerEvents = exports.ServerEvents || (exports.ServerEvents = {}));
 var ServerBinding = /** @class */ (function (_super) {
@@ -45,2 +41,4 @@ __extends(ServerBinding, _super);
         _this.defaultScopes = options.defaultScopes;
+        _this.exchangeMailboxTokenCallback = options.exchangeMailboxTokenCallback;
+        _this.csrfTokenExchangeOpts = options.csrfTokenExchangeOpts;
         _this.clientUri = options.clientUri;
@@ -47,0 +45,0 @@ return _this;

package.json

 {
   "name": "nylas",
-  "version": "7.0.0-canary.2",
+  "version": "7.0.0-canary.3",
   "description": "A NodeJS wrapper for the Nylas REST API for email, contacts, and calendar.",
@@ -5,0 +5,0 @@ "main": "lib/nylas.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

402844

increased by0.38%

Lines of code

10141

increased by0.23%

No dependency changes