@adobe/helix-config 3.2.14 → 3.2.15

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [3.2.15](https://github.com/adobe/helix-config/compare/v3.2.14...v3.2.15) (2024-06-20)
+
+
+### Bug Fixes
+
+* legacy sites with apiKey but no allow must not authenticate ([#109](https://github.com/adobe/helix-config/issues/109)) ([421575e](https://github.com/adobe/helix-config/commit/421575eb9093820a824031695f26bbc568dd4505)), closes [#91](https://github.com/adobe/helix-config/issues/91)
+
 ## [3.2.14](https://github.com/adobe/helix-config/compare/v3.2.13...v3.2.14) (2024-06-20)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "3.2.14",
+  "version": "3.2.15",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/config-legacy.js

@@ -131,6 +131,7 @@ export async function resolveLegacyConfig(ctx, rso, scope) {
   }
   const config = {
     version: 1,
+    legacy: true,
     code: {
       owner: rso.org,
       repo: rso.site,

package/src/config-view.js

@@ -122,8 +122,7 @@ export async function getAccessConfig(ctx, config, partition, rso) {
       .filter((hash) => !!hash),
     clientCertDN: toArray(access[partition]?.clientCertDN ?? access.clientCertDN),
   };
-  // if an allow is defined but no apiKeyId, create a fake one so that auth is still
-  // enforced. later we can remove the allow and the apiKeyId in favor of the tokenHash
+  // if an allow is defined but no apiKeyId, create a fake one so that auth is still enforced.
   if (allow.length && !cfg.apiKeyId.length) {
     cfg.apiKeyId.push('dummy');
   }
@@ -137,7 +136,10 @@ export async function getAccessConfig(ctx, config, partition, rso) {
       cfg.tokenHash.push(globalTokenHash);
     } else if (!cfg.tokenHash.length) {
       // add a dummy or global hash if no tokens match the apiKeyIds.
-      cfg.tokenHash.push(globalTokenHash || 'n/a');
+      if (!config.legacy || allow.length) {
+        // but only add for non-legacy sites or legacy with allows
+        cfg.tokenHash.push(globalTokenHash || 'n/a');
+      }
     }
   }