@ada-support/web-storage 1.4.5 → 1.4.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ada-support/web-storage",
-  "version": "1.4.5",
+  "version": "1.4.7",
   "description": "A package to provide access to Web Storage API",
   "main": "dist/index.js",
   "publishConfig": {
@@ -13,11 +13,12 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/AdaSupport/web-storage.git"
+    "url": "git+https://github.com/AdaSupport/monorepo.git",
+    "directory": "web-storage"
   },
   "author": "",
   "license": "ISC",
-  "homepage": "https://github.com/AdaSupport/web-storage#readme",
+  "homepage": "https://github.com/AdaSupport/monorepo/tree/main/web-storage#readme",
   "dependencies": {
     "ts-node": "^10.9.1",
     "typescript": "^4.8.4"

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -1,13 +0,0 @@
-### Changes
-
-> _List out the changes_
-
-### Why this is Important?
-
-> _A bit of context_
-
----
-
-### Checklist
-
-- [ ] [Security team](https://adasupport.slack.com/archives/C030WPEMRCZ) is notified about the changes and approves them.

package/.github/dependabot.yml

@@ -1,11 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "daily"
-      time: "15:15"
-      timezone: "America/Toronto"
-    open-pull-requests-limit: 0
-    assignees:
-      - AdaSupport/channels-and-handoffs

package/.github/workflows/dependabot-jira.yml

@@ -1,26 +0,0 @@
-on:
-  pull_request:
-    branches:
-      - main
-
-name: Open Jira Ticket for Dependabot PRs
-
-jobs:
-  create-jira-ticket:
-    runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
-    steps:
-      - name: Jira Login
-        uses: atlassian/gajira-login@v3
-        env:
-          JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
-          JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
-          JIRA_API_TOKEN: ${{ secrets.TEMP_JIRA_TOKEN }}
-      - name: Create Ticket
-        id: create
-        uses: atlassian/gajira-create@v3
-        with:
-          project: CH
-          issuetype: KTLO
-          summary: Vulnerable Package Upgrades
-          description: "Dependabot has opened a new PR: ${{ github.event.pull_request.html_url }}"

package/.github/workflows/deploy-html.yml

@@ -1,44 +0,0 @@
-name: "Deploy HTML page"
-
-on:
-  push:
-    branches: [ main ]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: "Checkout source code"
-        uses: "actions/checkout@v2"
-        env:
-          GITHUB_TOKEN: ${{ secrets.PUSH_ACCESS_TOKEN }}
-        with:
-          ref: ${{ github.ref }}
-
-      - uses: actions/setup-node@v2
-        with:
-          node-version: "16.x"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: "Compile"
-        run: |
-          yarn install
-          yarn compile
-
-      - name: "Upload ada-web-storage-list.html"
-        run: |
-          aws s3 cp dist/ada-web-storage-list.html s3://ada-static-cdn-prod/ada-web-storage-list.html
-
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ADA_STATIC_CDN_PROD_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ADA_STATIC_CDN_PROD_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: us-east-1
-
-      - name: "Create invalidation"
-        run: |
-          aws cloudfront create-invalidation --distribution-id ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }} --paths "/ada-web-storage-list.html"
-
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFRONT_INVALIDATION_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFRONT_INVALIDATION_SECRET_KEY }}
-          AWS_DEFAULT_REGION: us-east-1

package/.github/workflows/flag-cleanup.yml

@@ -1,45 +0,0 @@
-name: Notify Slack flag-cleanup channel on new "Vega" PR
-
-on:
-  pull_request:
-    types: [opened]
-
-permissions:
-  pull-requests: write
-
-jobs:
-  check-title:
-    runs-on: ubuntu-latest
-    if: contains(github.event.pull_request.title, '[Vega]')
-    steps:
-      - name: Build Slack payload
-        id: build-payload
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
-        with:
-          script: |
-            const payload = {
-              text: `New flag cleanup PR opened by Vega: <${process.env.PR_URL}|${process.env.PR_TITLE}>`
-            };
-            core.setOutput('payload', JSON.stringify(payload));
-
-      - name: Send Slack notification
-        uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0
-        with:
-          webhook: ${{ secrets.SLACK_WEBHOOK_FLAG_CLEANUP }}
-          webhook-type: incoming-webhook
-          payload: ${{ steps.build-payload.outputs.payload }}
-
-      - name: Request review from flag-cleanup team
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ secrets.FLAG_CLEANUP_PAT }}
-          script: |
-            await github.rest.pulls.requestReviewers({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.payload.pull_request.number,
-              team_reviewers: ['flag-cleanup']
-            });

package/.github/workflows/migrate-secrets-to-doppler.yml

@@ -1,87 +0,0 @@
-# One-time migration: copy web-storage's CI Actions secrets into the shared `api`
-# Doppler project, so the migrated monorepo workflows can fetch them over OIDC
-# (see .github/workflows/web-storage-{deploy-html,notify-people}.yml).
-#
-# WHERE TO RUN: commit and run this in the STANDALONE `AdaSupport/web-storage`
-# repo. The source secrets it reads are only readable there — running it in the
-# monorepo would read empty values (the guard below blocks that). Trigger it
-# manually from the Actions tab (workflow_dispatch), confirm success in the
-# Doppler dashboard, then delete this workflow and the DOPPLER_TOKEN secret.
-#
-# MIGRATED: the 5 repo-level AWS/CloudFront secrets, plus SLACK_WEBHOOK_URL
-# (org-level, but readable in this repo's workflow context — notify-people now
-# fetches it from Doppler too).
-#
-# EXCLUDED on purpose (do NOT migrate):
-#   - NPM_TOKEN          -> publish now uses npm OIDC trusted publishing.
-#   - JIRA_* / TEMP_JIRA -> the dependabot-jira workflow was dropped.
-#   - SONAR_TOKEN        -> not used by any migrated workflow.
-#
-# NAMING: values are written to Doppler with a `WEB_STORAGE_` prefix (e.g.
-# WEB_STORAGE_CLOUDFRONT_DISTRIBUTION_ID) to avoid collisions in the shared `api`
-# project. The consuming workflow reads them as steps.doppler.outputs.WEB_STORAGE_*.
-#
-# PREREQUISITE: a Doppler token with WRITE access to api/ci_github_actions,
-# stored as the `DOPPLER_TOKEN` Actions secret on this repo (remove it after).
-
-name: "Migrate web-storage repo secrets to Doppler (one-time)"
-
-on:
-  workflow_dispatch:
-
-jobs:
-  migrate:
-    runs-on: ubuntu-latest
-    env:
-      DOPPLER_PROJECT: api
-      DOPPLER_CONFIG: ci_github_actions
-      DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
-      ADA_STATIC_CDN_PROD_ACCESS_KEY_ID: ${{ secrets.ADA_STATIC_CDN_PROD_ACCESS_KEY_ID }}
-      ADA_STATIC_CDN_PROD_SECRET_ACCESS_KEY: ${{ secrets.ADA_STATIC_CDN_PROD_SECRET_ACCESS_KEY }}
-      CLOUDFRONT_DISTRIBUTION_ID: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
-      CLOUDFRONT_INVALIDATION_ACCESS_KEY_ID: ${{ secrets.CLOUDFRONT_INVALIDATION_ACCESS_KEY_ID }}
-      CLOUDFRONT_INVALIDATION_SECRET_KEY: ${{ secrets.CLOUDFRONT_INVALIDATION_SECRET_KEY }}
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-    steps:
-      - name: Install Doppler CLI
-        uses: dopplerhq/cli-action@v3
-
-      - name: Guard — refuse to run without the source secrets present
-        run: |
-          set -euo pipefail
-          if [ -z "${DOPPLER_TOKEN:-}" ]; then
-            echo "::error::DOPPLER_TOKEN is not set — add a Doppler token with write access to api/ci_github_actions."
-            exit 1
-          fi
-          missing=0
-          for name in \
-            ADA_STATIC_CDN_PROD_ACCESS_KEY_ID \
-            ADA_STATIC_CDN_PROD_SECRET_ACCESS_KEY \
-            CLOUDFRONT_DISTRIBUTION_ID \
-            CLOUDFRONT_INVALIDATION_ACCESS_KEY_ID \
-            CLOUDFRONT_INVALIDATION_SECRET_KEY \
-            SLACK_WEBHOOK_URL; do
-            if [ -z "${!name:-}" ]; then
-              echo "::error::$name is empty — are you running this in AdaSupport/web-storage?"
-              missing=1
-            fi
-          done
-          [ "$missing" -eq 0 ] || exit 1
-
-      - name: Push repo-level secrets to Doppler (api / ci_github_actions)
-        run: |
-          set -euo pipefail
-          for name in \
-            ADA_STATIC_CDN_PROD_ACCESS_KEY_ID \
-            ADA_STATIC_CDN_PROD_SECRET_ACCESS_KEY \
-            CLOUDFRONT_DISTRIBUTION_ID \
-            CLOUDFRONT_INVALIDATION_ACCESS_KEY_ID \
-            CLOUDFRONT_INVALIDATION_SECRET_KEY \
-            SLACK_WEBHOOK_URL; do
-            echo "Setting WEB_STORAGE_$name in $DOPPLER_PROJECT/$DOPPLER_CONFIG"
-            # Value piped via stdin so it never appears in argv/process list.
-            # Read from the unprefixed GitHub secret, write with the WEB_STORAGE_ prefix.
-            printf '%s' "${!name}" | doppler secrets set "WEB_STORAGE_$name" \
-              --project "$DOPPLER_PROJECT" --config "$DOPPLER_CONFIG" --silent
-          done
-          echo "Done. Verify in the Doppler dashboard, then delete this workflow and the DOPPLER_TOKEN secret."

package/.github/workflows/notify-people.yml

@@ -1,42 +0,0 @@
-name: "Notify people"
-
-on:
-  pull_request:
-    types: [opened, reopened, ready_for_review]
-    paths:
-      - "src/storage-keys.ts"
-      - "src/third-party-items.ts"
-
-jobs:
-  notify:
-    runs-on: ubuntu-latest
-    env:
-      SLACK_CHANNEL: "#t-messaging-experience" #default
-      SLACK_USERNAME: "`@ada-support/web-storage` package updates"
-      SLACK_ICON_EMOJI: ":sparkles:"
-      SLACK_COLOR: "#f5e512"
-      SLACK_TITLE: "Changes have been made to Ada's `web-storage`. Please review the pull request below."
-      SLACK_MESSAGE: "${{github.event.pull_request.title}}\n ${{ github.server_url }}/${{ github.repository }}/pull/${{ github.event.number }}\n\n *REMINDER: Ada Security is expected to approve this PR 30 days after affected customers have been notified by their respective CSM. Details steps can be found within the README (https://github.com/AdaSupport/web-storage#contributing)*"
-      SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
-      MSG_MINIMAL: true
-
-    steps:
-      - name: "Notify messaging-experience team"
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_CHANNEL: "#t-messaging-experience"
-
-      - name: "Notify #p-cookies-updates-management"
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_CHANNEL: "#p-cookies-updates-management"
-
-      - name: "Notify security team"
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_CHANNEL: "#t-security"
-
-      - name: "Notify Canva CSM"
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_CHANNEL: "#canva-internal"

package/.github/workflows/npm-publish.yml

@@ -1,45 +0,0 @@
-name: "NPM publish"
-
-on:
-  push:
-    branches: [ main ]
-
-jobs:
-  npm-publish:
-    name: "NPM publish"
-    runs-on: ubuntu-latest
-    # Trusted publishing (OIDC) mints a short-lived token from this workflow's
-    # identity instead of a long-lived NPM_TOKEN. `id-token: write` is required
-    # for npm to request the OIDC token; `contents: read` is least-privilege for
-    # checkout.
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: "Checkout source code"
-        uses: "actions/checkout@v4"
-        with:
-          ref: ${{ github.ref }}
-
-      # NOTE: deliberately no `registry-url` here. setup-node's `registry-url`
-      # writes an .npmrc with `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`
-      # (resolving to setup-node's placeholder token). npm only uses OIDC trusted
-      # publishing when NO auth is configured, so that placeholder token shadows
-      # OIDC and the publish 404s. Without registry-url npm uses the default
-      # registry (registry.npmjs.org) with no token, so OIDC engages.
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20.x"
-
-      # OIDC trusted publishing requires npm >= 11.5.1; the npm bundled with Node
-      # 20 is older, so upgrade before publishing. Pin to npm@11 (not @latest):
-      # npm@12 dropped Node 20 support (requires Node >= 22), so @latest now
-      # EBADENGINE-fails on this runner. npm@11 supports Node 20 and satisfies the
-      # OIDC minimum.
-      - run: npm install -g npm@11
-
-      - run: |
-          yarn install
-          yarn compile
-          mv "README_NPM.md" "README.md"
-          npm publish

package/.github/workflows/verify-code.yml

@@ -1,34 +0,0 @@
-name: "Verify code"
-
-on: 
-  pull_request:
-jobs:
-  verify:
-    name: "Verify code"
-    runs-on: ubuntu-latest
-    steps:
-      - name: "Checkout source code"
-        uses: "actions/checkout@v3"
-        env:
-          GITHUB_TOKEN: ${{ secrets.PUSH_ACCESS_TOKEN }}
-        with:
-          ref: ${{ github.ref }}
-          fetch-depth: 0 # We need this to be able to run `diff` with `main` branch
-
-      - uses: actions/setup-node@v3
-        with:
-          node-version: "16"
-          registry-url: "https://registry.npmjs.org"
-          cache: "npm"
-
-      - name: "Yarn install"
-        run: yarn install
-
-      - name: "Check package version"
-        run: yarn check-package-version
-
-      - name: "Lint"
-        run: yarn lint
-
-      - name: "Compile"
-        run: yarn compile