@adobe/helix-config 4.3.2 → 4.4.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [4.4.0](https://github.com/adobe/helix-config/compare/v4.3.3...v4.4.0) (2024-09-05)
+
+
+### Features
+
+* provide transient site token ([#180](https://github.com/adobe/helix-config/issues/180)) ([ca8161b](https://github.com/adobe/helix-config/commit/ca8161be26f1476af5f2b7c3c3894ae80546dbf7))
+
+## [4.3.3](https://github.com/adobe/helix-config/compare/v4.3.2...v4.3.3) (2024-09-03)
+
+
+### Bug Fixes
+
+* respect access.allow correctly ([#179](https://github.com/adobe/helix-config/issues/179)) ([398064e](https://github.com/adobe/helix-config/commit/398064e42b338b31d1717aed2f05a47ceae74c7c))
+
 ## [4.3.2](https://github.com/adobe/helix-config/compare/v4.3.1...v4.3.2) (2024-08-24)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "4.3.2",
+  "version": "4.4.0",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/config-legacy.js

@@ -158,7 +158,13 @@ export async function resolveLegacyConfig(ctx, rso, scope) {
   const configAllLive = await fetchConfigAll(ctx, config.content.contentBusId, 'live');
   const { access, admin } = configAllPreview?.config?.data || {};
   if (access) {
-    config.access = access;
+    config.access = {
+      preview: access.preview,
+      live: access.live,
+    };
+    delete access.preview;
+    delete access.live;
+    config.access.site = access;
   }
   if (admin) {
     if (!config.access) {

package/src/config-view.js

@@ -112,10 +112,11 @@ async function getGlobalTokenHash(ctx, rso) {
 export async function getAccessConfig(ctx, config, partition, rso) {
   const { access, tokens = {} } = config;
   const pAccess = access[partition] ?? {};
-  const apiKeyId = toArray(pAccess.apiKeyId ?? access.site?.apiKeyId ?? access.apiKeyId);
-  const allow = toArray(pAccess.allow ?? access.allow);
+  const apiKeyId = toArray(pAccess.apiKeyId ?? access.site?.apiKeyId);
+  const allow = toArray(pAccess.allow ?? access.site?.allow);
   const cfg = {
     apiKeyId,
+    allow,
     tokenHash: apiKeyId
       // token ids are always stored in base64url format, but legacy apiKeyIds are not
       .map((jti) => jti.replaceAll('/', '_').replaceAll('+', '-'))
@@ -301,6 +302,12 @@ export async function loadOrgConfig(ctx, org) {
   return res.body ? res.json() : null;
 }
 
+export async function loadTransientSiteToken(ctx, org, site) {
+  const key = `orgs/${org}/sites/${site}/transient-site-tokens.json`;
+  const res = await ctx.loader.getObject(HELIX_CONFIG_BUS, key);
+  return res.body ? res.json() : null;
+}
+
 /**
  * Computes the access.admin.role arrays for the org users.
  * @param adminConfig
@@ -430,6 +437,13 @@ export async function getConfigResponse(ctx, opts) {
     if (opts.scope === SCOPE_ADMIN || opts.scope === SCOPE_RAW) {
       // eslint-disable-next-line max-len
       config.access.admin = computeSiteAdminRoles(admin, config.groups, orgConfig?.groups, orgConfig?.users);
+    } else {
+      // for pipeline and delivery, also load the site tokens
+      const tst = await loadTransientSiteToken(ctx, rso.org, rso.site);
+      if (tst) {
+        config.access.preview.transientSiteToken = tst.tokens.preview;
+        config.access.live.transientSiteToken = tst.tokens.live;
+      }
     }
   }
 
@@ -453,9 +467,11 @@ export async function getConfigResponse(ctx, opts) {
         'x-hlx-owner': config.code.owner,
         'x-hlx-repo': config.code.repo,
         'x-hlx-auth-clientdn-preview': canonicalArrayString(config.access, 'preview', 'clientCertDN'),
-        'x-hlx-auth-hash-preview': canonicalArrayString(config.access, 'preview', 'tokenHash'),
         'x-hlx-auth-clientdn-live': canonicalArrayString(config.access, 'live', 'clientCertDN'),
+        'x-hlx-auth-hash-preview': canonicalArrayString(config.access, 'preview', 'tokenHash'),
         'x-hlx-auth-hash-live': canonicalArrayString(config.access, 'live', 'tokenHash'),
+        'x-hlx-auth-tst-preview': config.access?.preview?.transientSiteToken?.value || '',
+        'x-hlx-auth-tst-live': config.access?.live?.transientSiteToken?.value || '',
       },
     });
   }
@@ -468,6 +484,8 @@ export async function getConfigResponse(ctx, opts) {
   } else {
     delete config.access?.preview?.apiKeyId;
     delete config.access?.live?.apiKeyId;
+    delete config.access?.preview?.allow;
+    delete config.access?.live?.allow;
   }
 
   if (opts.scope === SCOPE_ADMIN) {