@adobe/helix-config 4.1.1 → 4.3.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [4.3.0](https://github.com/adobe/helix-config/compare/v4.2.0...v4.3.0) (2024-08-20)
+
+
+### Features
+
+* include org users in admin access config ([#173](https://github.com/adobe/helix-config/issues/173)) ([427d254](https://github.com/adobe/helix-config/commit/427d254e39b701529cdcd915469cbaa414e0afa7)), closes [#167](https://github.com/adobe/helix-config/issues/167)
+
+# [4.2.0](https://github.com/adobe/helix-config/compare/v4.1.1...v4.2.0) (2024-08-19)
+
+
+### Features
+
+* remove original-site check (move to admin) ([#172](https://github.com/adobe/helix-config/issues/172)) ([ac915b7](https://github.com/adobe/helix-config/commit/ac915b714d4fc33163d1860a90263f5ff5962e1d))
+
 ## [4.1.1](https://github.com/adobe/helix-config/compare/v4.1.0...v4.1.1) (2024-08-17)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "4.1.1",
+  "version": "4.3.0",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/config-view.js

@@ -185,27 +185,6 @@ async function loadMetadata(ctx, config, partition) {
   };
 }
 
-/**
- * loads the original site information from the `.hlx.json` file
- * @param ctx the context
- * @param contentBusId the content bus id
- * @param legacy if true, the original-repository is returned, otherwise the original-site.
- * @returns {Promise<string>} the original site.
- */
-async function fetchOriginalSite(ctx, contentBusId, legacy) {
-  const key = `${contentBusId}/.hlx.json`;
-  const res = await ctx.loader.getObject(HELIX_CONTENT_BUS, key);
-  if (res.body) {
-    const json = res.json();
-    if (legacy) {
-      return json['original-repository'];
-    }
-    return json['original-site'];
-  }
-  ctx.log.error(`failed to load ${key}: ${res.status}`);
-  return '';
-}
-
 async function loadHeadHtml(ctx, config, ref) {
   const key = `${config.code.owner}/${config.code.repo}/${ref}/head.html`;
   const res = await ctx.loader.getObject(HELIX_CODE_BUS, key);
@@ -352,13 +331,11 @@ function resolveGroup(groups, name) {
  * @param admin
  * @param configGroups
  * @param orgGroups
+ * @param orgUsers
  */
-function computeSiteAdminRoles(admin, configGroups = {}, orgGroups = {}) {
-  if (!admin.role) {
-    return admin;
-  }
+function computeSiteAdminRoles(admin, configGroups = {}, orgGroups = {}, orgUsers = []) {
   const roles = {};
-  for (const [roleName, role] of Object.entries(admin.role)) {
+  for (const [roleName, role] of Object.entries(admin.role ?? {})) {
     const users = new Set();
     for (const /* @type string */ entry of role) {
       if (entry.indexOf('@') > 0) {
@@ -375,10 +352,30 @@ function computeSiteAdminRoles(admin, configGroups = {}, orgGroups = {}) {
     }
     roles[roleName] = Array.from(users);
   }
-  return {
+  // add org users
+  const hasRoles = Object.keys(roles).length > 0;
+  let hasOrgUsers = false;
+  for (const user of orgUsers) {
+    for (const role of user.roles) {
+      if (!(role in roles)) {
+        roles[role] = [];
+      }
+      if (!roles[role].includes(user.email)) {
+        roles[role].push(user.email);
+        hasOrgUsers = true;
+      }
+    }
+  }
+
+  const ret = {
     ...admin,
     role: roles,
   };
+  // if there are only roles from the org, ensure that they don't enforce auth
+  if (hasOrgUsers && !hasRoles && (!admin.requireAuth || admin.requireAuth === 'auto')) {
+    ret.requireAuth = false;
+  }
+  return ret;
 }
 
 export async function getConfigResponse(ctx, opts) {
@@ -408,21 +405,6 @@ export async function getConfigResponse(ctx, opts) {
       },
     });
   }
-  // validate original-site
-  const originalSite = await fetchOriginalSite(ctx, config.content.contentBusId, config.legacy);
-  if (originalSite && originalSite !== `${org}/${site}`) {
-    ctx.log.error(`original site ${originalSite} does not match requested ${org}/${site}.`);
-    if (scope === SCOPE_ADMIN) {
-      return new PipelineResponse('', {
-        status: 403,
-        headers: {
-          'x-error': 'original site mismatch',
-          ...surrogateHeaders,
-        },
-      });
-    }
-    // todo: also send 403 for all scopes....but first observe only
-  }
 
   if (config.extends && scope !== SCOPE_RAW) {
     delete config.extends;
@@ -438,7 +420,8 @@ export async function getConfigResponse(ctx, opts) {
       // access.require.repository ?
     };
     if (opts.scope === SCOPE_ADMIN || opts.scope === SCOPE_RAW) {
-      config.access.admin = computeSiteAdminRoles(admin, config.groups, orgConfig?.groups);
+      // eslint-disable-next-line max-len
+      config.access.admin = computeSiteAdminRoles(admin, config.groups, orgConfig?.groups, orgConfig?.users);
     }
   }