@adobe/helix-config 4.11.2 → 4.12.1

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [4.12.1](https://github.com/adobe/helix-config/compare/v4.12.0...v4.12.1) (2025-01-21)
+
+
+### Bug Fixes
+
+* **deps:** update dependency @adobe/helix-shared-config to v11.0.15 ([#236](https://github.com/adobe/helix-config/issues/236)) ([92c5305](https://github.com/adobe/helix-config/commit/92c530559c34e881c53053de524886e90379c9da))
+
+# [4.12.0](https://github.com/adobe/helix-config/compare/v4.11.2...v4.12.0) (2025-01-16)
+
+
+### Features
+
+* respect secretId for site config ([#233](https://github.com/adobe/helix-config/issues/233)) ([00e252c](https://github.com/adobe/helix-config/commit/00e252c25720676259d3d093862db692004e6ecc))
+
 ## [4.11.2](https://github.com/adobe/helix-config/compare/v4.11.1...v4.11.2) (2025-01-14)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "4.11.2",
+  "version": "4.12.1",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -43,7 +43,7 @@
     "eslint": "8.57.1",
     "husky": "9.1.7",
     "junit-report-builder": "5.1.1",
-    "lint-staged": "15.3.0",
+    "lint-staged": "15.4.1",
     "mocha": "11.0.1",
     "mocha-multi-reporters": "1.5.1",
     "mocha-suppress-logs": "0.5.1",
@@ -56,7 +56,7 @@
   },
   "dependencies": {
     "@adobe/fetch": "4.1.11",
-    "@adobe/helix-shared-config": "11.0.14",
+    "@adobe/helix-shared-config": "11.0.15",
     "@adobe/helix-shared-utils": "3.0.2"
   }
 }

package/src/config-view.js

@@ -162,31 +162,33 @@ function resolveSecret(object, idProp, dstProp, siteConfig, orgConfig) {
 export async function getAccessConfig(ctx, config, orgConfig, partition, rso) {
   const { access } = config;
   const pAccess = access[partition] ?? {};
-  const apiKeyId = toArray(pAccess.apiKeyId ?? access.site?.apiKeyId);
+  const secretId = toArray(
+    pAccess.apiKeyId ?? pAccess.secretId ?? access.site?.apiKeyId ?? access.site?.secretId,
+  );
   const allow = toArray(pAccess.allow ?? access.site?.allow);
   const cfg = {
-    apiKeyId,
+    secretId,
     allow,
-    tokenHash: apiKeyId
+    tokenHash: secretId
       // token ids are always stored in base64url format, but legacy apiKeyIds are not
       .map((jti) => jti.replaceAll('/', '_').replaceAll('+', '-'))
       .map((id) => lookupSecret(config, orgConfig, id, true))
       .filter((hash) => !!hash),
   };
-  // if an allow is defined but no apiKeyId, create a fake one so that auth is still enforced.
-  if (allow.length && !cfg.apiKeyId.length) {
-    cfg.apiKeyId.push('dummy');
+  // if an allow is defined but no secretId, create a fake one so that auth is still enforced.
+  if (allow.length && !cfg.secretId.length) {
+    cfg.secretId.push('dummy');
   }
 
-  // if an apiKeyId is defined but no tokenHash, create a fake one so that auth is still enforced.
-  if (cfg.apiKeyId.length) {
+  // if an secretId is defined but no tokenHash, create a fake one so that auth is still enforced.
+  if (cfg.secretId.length) {
     // add global token hash if defined and needed
     const globalTokenHash = await getGlobalTokenHash(ctx, rso);
     if (cfg.tokenHash.length && globalTokenHash) {
       // augment the list of hashes with the global one if exists
       cfg.tokenHash.push(globalTokenHash);
     } else if (!cfg.tokenHash.length) {
-      // add a dummy or global hash if no tokens match the apiKeyIds.
+      // add a dummy or global hash if no tokens match the secretIds.
       if (!config.legacy || allow.length) {
         // but only add for non-legacy sites or legacy with allows
         cfg.tokenHash.push(globalTokenHash || 'n/a');
@@ -525,8 +527,8 @@ export async function getConfigResponse(ctx, opts) {
     delete config.access?.preview?.tokenHash;
     delete config.access?.live?.tokenHash;
   } else {
-    delete config.access?.preview?.apiKeyId;
-    delete config.access?.live?.apiKeyId;
+    delete config.access?.preview?.secretId;
+    delete config.access?.live?.secretId;
     delete config.access?.preview?.allow;
     delete config.access?.live?.allow;
   }