martmull
8d84a0b9f3
## Context Follow-up to #22609. Lets a non-admin developer claim ownership of a public Twenty app they published to npm, then request a marketplace listing that a server admin reviews. Marketplace state is per-instance for now. ## Claiming - Developer tab gets a **Claim an application** section: look up an unclaimed npm app by package name or universal identifier. - Ownership is proven with GitHub OAuth against the package's npm provenance (trusted publishing): the connected account must own the GitHub account or organization the package was published from. - Errors from the GitHub callback come back as a code and are shown inline with a link to the relevant documentation. - The old one-click claim stays admin-only. - A **Sync catalog** button triggers a catalog refresh instead of waiting for the hourly cron. - Gated behind the `IS_APP_CLAIMING_ENABLED` feature flag. ## Listing requests - Catalog-synced apps are created **unlisted**; a data migration unlists previously auto-listed unclaimed npm apps (owned or vetted rows are left untouched). - Owners request a listing from the Distribution tab (logo + description required); a server admin approves or rejects it from a **Listing requests** section in the Admin Panel. ## Screenshots <img width="1512" height="829" alt="image" src="https://github.com/user-attachments/assets/788d4362-97c4-4e42-810c-ef1f11517bec"/> <img width="1512" height="829" alt="image" src="https://github.com/user-attachments/assets/d6246190-c82a-4f64-87be-3bb668527645"/> <img width="1512" height="828" alt="image" src="https://github.com/user-attachments/assets/21a8dad4-610b-4d1f-8948-b9acab40d373"/> <img width="1512" height="829" alt="image" src="https://github.com/user-attachments/assets/58246130-41f7-451e-ae7f-57bd21d04bb6"/> --------- Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
46 lines
1.8 KiB
Bash
46 lines
1.8 KiB
Bash
# Public site URL — canonical origin used by metadataBase, sitemap, robots,
|
|
# OG/Twitter card URLs, Stripe checkout success URL, and the billing portal
|
|
# return URL. No trailing slash. Defaults to https://twenty.com when unset.
|
|
NEXT_PUBLIC_WEBSITE_URL=
|
|
|
|
# Partner application — the form POSTs to /api/partner-application, which
|
|
# forwards the payload to this webhook with the secret as a bearer credential.
|
|
PARTNER_APPLICATION_WEBHOOK_URL=
|
|
PARTNER_APPLICATION_SECRET=
|
|
|
|
# Client brief — the form POSTs to /api/client-brief, which forwards the payload
|
|
# to this webhook with the secret as X-Application-Secret.
|
|
CLIENT_BRIEF_WEBHOOK_URL=
|
|
CLIENT_BRIEF_SECRET=
|
|
|
|
# Partners marketplace — the Twenty workspace the partner directory reads from
|
|
# (server-side only) via the /s/partners REST endpoint.
|
|
TWENTY_PARTNERS_API_URL=
|
|
TWENTY_PARTNERS_API_KEY=
|
|
|
|
# Apps marketplace — the apps directory reads the vetted marketplace catalog
|
|
# from the Twenty GraphQL API (public publicMarketplaceApps query), server-side.
|
|
# Defaults to https://api.twenty.com when unset.
|
|
TWENTY_MARKETPLACE_API_URL=
|
|
|
|
# Stripe — self-hosted enterprise checkout & subscription APIs.
|
|
STRIPE_SECRET_KEY=
|
|
STRIPE_ENTERPRISE_MONTHLY_PRICE_ID=
|
|
STRIPE_ENTERPRISE_YEARLY_PRICE_ID=
|
|
|
|
# RS256 key pair used to sign and verify enterprise license JWTs
|
|
# (use literal \n for newlines in the PEM values).
|
|
ENTERPRISE_JWT_PRIVATE_KEY=
|
|
ENTERPRISE_JWT_PUBLIC_KEY=
|
|
|
|
# Optional: enterprise validity token lifetime in days (default 30).
|
|
# ENTERPRISE_VALIDITY_TOKEN_DURATION_DAYS=
|
|
|
|
# Shared secret guarding the internal enterprise key reissue endpoint
|
|
# (POST /api/enterprise/reissue), used to regenerate an enterprise key.
|
|
ENTERPRISE_ADMIN_API_SECRET=
|
|
|
|
# Optional: GitHub Claim
|
|
# APP_CLAIM_GITHUB_CLIENT_ID=
|
|
# APP_CLAIM_GITHUB_CLIENT_SECRET=
|