@adobe/helix-config 4.2.0 → 4.3.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [4.3.0](https://github.com/adobe/helix-config/compare/v4.2.0...v4.3.0) (2024-08-20)
+
+
+### Features
+
+* include org users in admin access config ([#173](https://github.com/adobe/helix-config/issues/173)) ([427d254](https://github.com/adobe/helix-config/commit/427d254e39b701529cdcd915469cbaa414e0afa7)), closes [#167](https://github.com/adobe/helix-config/issues/167)
+
 # [4.2.0](https://github.com/adobe/helix-config/compare/v4.1.1...v4.2.0) (2024-08-19)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/config-view.js

@@ -331,13 +331,11 @@ function resolveGroup(groups, name) {
  * @param admin
  * @param configGroups
  * @param orgGroups
+ * @param orgUsers
  */
-function computeSiteAdminRoles(admin, configGroups = {}, orgGroups = {}) {
-  if (!admin.role) {
-    return admin;
-  }
+function computeSiteAdminRoles(admin, configGroups = {}, orgGroups = {}, orgUsers = []) {
   const roles = {};
-  for (const [roleName, role] of Object.entries(admin.role)) {
+  for (const [roleName, role] of Object.entries(admin.role ?? {})) {
     const users = new Set();
     for (const /* @type string */ entry of role) {
       if (entry.indexOf('@') > 0) {
@@ -354,10 +352,30 @@ function computeSiteAdminRoles(admin, configGroups = {}, orgGroups = {}) {
     }
     roles[roleName] = Array.from(users);
   }
-  return {
+  // add org users
+  const hasRoles = Object.keys(roles).length > 0;
+  let hasOrgUsers = false;
+  for (const user of orgUsers) {
+    for (const role of user.roles) {
+      if (!(role in roles)) {
+        roles[role] = [];
+      }
+      if (!roles[role].includes(user.email)) {
+        roles[role].push(user.email);
+        hasOrgUsers = true;
+      }
+    }
+  }
+
+  const ret = {
     ...admin,
     role: roles,
   };
+  // if there are only roles from the org, ensure that they don't enforce auth
+  if (hasOrgUsers && !hasRoles && (!admin.requireAuth || admin.requireAuth === 'auto')) {
+    ret.requireAuth = false;
+  }
+  return ret;
 }
 
 export async function getConfigResponse(ctx, opts) {
@@ -402,7 +420,8 @@ export async function getConfigResponse(ctx, opts) {
       // access.require.repository ?
     };
     if (opts.scope === SCOPE_ADMIN || opts.scope === SCOPE_RAW) {
-      config.access.admin = computeSiteAdminRoles(admin, config.groups, orgConfig?.groups);
+      // eslint-disable-next-line max-len
+      config.access.admin = computeSiteAdminRoles(admin, config.groups, orgConfig?.groups, orgConfig?.users);
     }
   }