ltijs/services/launch/launch.schemas.js

Easily turn your web application into a LTI 1.3 Learning Tool.

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.LaunchCallbackPayloadSchema = exports.LoginRequestPayloadSchema = void 0;
const zod_1 = require("zod");
// An OIDC login-initiation request uses the spec's own snake_case query/body
// param names -- required fields (`iss`/`login_hint`/`target_link_uri`) are
// checked directly on those raw names, then `.transform()` reshapes the
// already-valid result into `LoginRequestParams`'s camelCase fields. This is
// the one place external input for this boundary is validated, so it
// validates on the structure that input actually has, not a structure it
// doesn't (there's no reason to route a raw snake_case request through a
// schema shaped for the internal camelCase DTO).
exports.LoginRequestPayloadSchema = zod_1.z
    .object({
    iss: zod_1.z.string().min(1),
    login_hint: zod_1.z.string().min(1),
    target_link_uri: zod_1.z.string().min(1),
    client_id: zod_1.z.string().optional(),
    lti_message_hint: zod_1.z.string().optional(),
    lti_deployment_id: zod_1.z.string().optional(),
    // Restricted to a safe frame-name charset -- this value ends up injected into a <script> context in
    // the login-redirect page, and rejecting anything unexpected outright is simpler and safer than
    // trying to sanitize an arbitrarily-shaped value.
    lti_storage_target: zod_1.z
        .string()
        .regex(/^[A-Za-z0-9_-]+$/)
        .optional(),
})
    .transform(raw => ({
    iss: raw.iss,
    loginHint: raw.login_hint,
    targetLinkUri: raw.target_link_uri,
    clientId: raw.client_id,
    ltiMessageHint: raw.lti_message_hint,
    ltiDeploymentId: raw.lti_deployment_id,
    storageTarget: raw.lti_storage_target,
}));
// The launch callback is the platform's `response_mode=form_post` submission
// -- `id_token`/`state` are the two fields the OIDC/LTI spec itself defines
// for it, both required. Reshapes to `rawIdToken`/`state`, matching this
// port's own naming (`id_token` is reserved for the raw JWT string, `rawIdToken`
// distinguishes it from the formatted `IdToken` type elsewhere in this port).
exports.LaunchCallbackPayloadSchema = zod_1.z
    .object({
    id_token: zod_1.z.string().min(1),
    state: zod_1.z.string().min(1),
})
    .transform(raw => ({
    rawIdToken: raw.id_token,
    stateToken: raw.state,
}));
//# sourceMappingURL=launch.schemas.js.map