@adobe/helix-config 3.4.4 → 3.6.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [3.6.0](https://github.com/adobe/helix-config/compare/v3.5.0...v3.6.0) (2024-07-11)
+
+
+### Features
+
+* allow to specify access.site ([#129](https://github.com/adobe/helix-config/issues/129)) ([83f7142](https://github.com/adobe/helix-config/commit/83f714215903315158ccacbf3ecfdb14d9d97c31)), closes [#62](https://github.com/adobe/helix-config/issues/62)
+
+# [3.5.0](https://github.com/adobe/helix-config/compare/v3.4.4...v3.5.0) (2024-07-10)
+
+
+### Features
+
+* refine roles ([#128](https://github.com/adobe/helix-config/issues/128)) ([4550be1](https://github.com/adobe/helix-config/commit/4550be179e6b0fe6bcc65742500bae6bb3c82486))
+
 ## [3.4.4](https://github.com/adobe/helix-config/compare/v3.4.3...v3.4.4) (2024-07-09)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "3.4.4",
+  "version": "3.6.0",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/config-view.js

@@ -111,8 +111,9 @@ async function getGlobalTokenHash(ctx, rso) {
  */
 export async function getAccessConfig(ctx, config, partition, rso) {
   const { access, tokens = {} } = config;
-  const apiKeyId = toArray(access[partition]?.apiKeyId ?? access.apiKeyId);
-  const allow = toArray(access[partition]?.allow ?? access.allow);
+  const pAccess = access[partition] ?? {};
+  const apiKeyId = toArray(pAccess.apiKeyId ?? access.site?.apiKeyId ?? access.apiKeyId);
+  const allow = toArray(pAccess.allow ?? access.allow);
   const cfg = {
     apiKeyId,
     tokenHash: apiKeyId
@@ -120,7 +121,7 @@ export async function getAccessConfig(ctx, config, partition, rso) {
       .map((jti) => jti.replaceAll('/', '_').replaceAll('+', '-'))
       .map((id) => tokens[id]?.hash)
       .filter((hash) => !!hash),
-    clientCertDN: toArray(access[partition]?.clientCertDN ?? access.clientCertDN),
+    clientCertDN: toArray(pAccess.clientCertDN ?? access.site?.clientCertDN ?? access.clientCertDN),
   };
   // if an allow is defined but no apiKeyId, create a fake one so that auth is still enforced.
   if (allow.length && !cfg.apiKeyId.length) {

package/src/schemas/access-admin.schema.json

@@ -43,7 +43,19 @@
     "defaultRole": {
       "description": "the default roles assigned to the users. defaults to `basic_publish` for unauthenticated setups.",
       "type": "array",
-      "items": {"type": "string"}
+      "items": {
+        "type": "string",
+        "enum": [
+          "admin",
+          "author",
+          "publish",
+          "develop",
+          "basic_author",
+          "basic_publish",
+          "config",
+          "config_admin"
+        ]
+      }
     },
     "apiKeyId": {
       "description": "the id of the API key(s). this is used to validate the API KEYS and allows to invalidate them.",

package/src/schemas/access.schema.json

@@ -18,6 +18,9 @@
     "admin": {
       "$ref": "https://ns.adobe.com/helix/config/access/admin"
     },
+    "site": {
+      "$ref": "https://ns.adobe.com/helix/config/access/site"
+    },
     "preview": {
       "$ref": "https://ns.adobe.com/helix/config/access/site"
     },

package/src/schemas/user.schema.json

@@ -33,6 +33,9 @@
           "admin",
           "author",
           "publish",
+          "develop",
+          "basic_author",
+          "basic_publish",
           "config",
           "config_admin"
         ]

package/types/org-config.d.ts

@@ -43,7 +43,7 @@ export interface HttpsNsAdobeComHelixConfigUser {
   id: string;
   email: string;
   name?: string;
-  roles: ('admin' | 'author' | 'publish' | 'config' | 'config_admin')[];
+  roles: ('admin' | 'author' | 'publish' | 'develop' | 'basic_author' | 'basic_publish' | 'config' | 'config_admin')[];
 }
 export interface Groups {
   [k: string]: Group;

package/types/profile-config.d.ts

@@ -208,6 +208,7 @@ export interface EmptyConfig {
 }
 export interface Access {
   admin?: AdminAccessConfig;
+  site?: SiteAccessConfig;
   preview?: SiteAccessConfig;
   live?: SiteAccessConfig;
 }
@@ -220,7 +221,16 @@ export interface AdminAccessConfig {
   /**
    * the default roles assigned to the users. defaults to `basic_publish` for unauthenticated setups.
    */
-  defaultRole?: string[];
+  defaultRole?: (
+    | 'admin'
+    | 'author'
+    | 'publish'
+    | 'develop'
+    | 'basic_author'
+    | 'basic_publish'
+    | 'config'
+    | 'config_admin'
+  )[];
   /**
    * the id of the API key(s). this is used to validate the API KEYS and allows to invalidate them.
    */

package/types/site-config.d.ts

@@ -216,6 +216,7 @@ export interface EmptyConfig {
 }
 export interface Access {
   admin?: AdminAccessConfig;
+  site?: SiteAccessConfig;
   preview?: SiteAccessConfig;
   live?: SiteAccessConfig;
 }
@@ -228,7 +229,16 @@ export interface AdminAccessConfig {
   /**
    * the default roles assigned to the users. defaults to `basic_publish` for unauthenticated setups.
    */
-  defaultRole?: string[];
+  defaultRole?: (
+    | 'admin'
+    | 'author'
+    | 'publish'
+    | 'develop'
+    | 'basic_author'
+    | 'basic_publish'
+    | 'config'
+    | 'config_admin'
+  )[];
   /**
    * the id of the API key(s). this is used to validate the API KEYS and allows to invalidate them.
    */