@adobe/helix-config 5.7.0 → 5.9.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [5.9.0](https://github.com/adobe/helix-config/compare/v5.8.0...v5.9.0) (2026-01-07)
+
+
+### Features
+
+* add trusted origins header in delivery and pipeline scope ([#349](https://github.com/adobe/helix-config/issues/349)) ([0a4a8c1](https://github.com/adobe/helix-config/commit/0a4a8c1b39a597f1b43fd11ca5978c0e167db9e3))
+
+# [5.8.0](https://github.com/adobe/helix-config/compare/v5.7.0...v5.8.0) (2025-12-17)
+
+
+### Features
+
+* include code bus sidekick in admin config ([#345](https://github.com/adobe/helix-config/issues/345)) ([6837ece](https://github.com/adobe/helix-config/commit/6837ece3169bc0d4863dd796e49b493fa1933859))
+
 # [5.7.0](https://github.com/adobe/helix-config/compare/v5.6.11...v5.7.0) (2025-11-11)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "5.7.0",
+  "version": "5.9.0",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -35,20 +35,20 @@
     "reporter-options": "configFile=.mocha-multi.json"
   },
   "devDependencies": {
-    "@adobe/eslint-config-helix": "3.0.13",
-    "@eslint/config-helpers": "0.4.1",
+    "@adobe/eslint-config-helix": "3.0.15",
+    "@eslint/config-helpers": "0.5.0",
     "@semantic-release/changelog": "6.0.3",
     "@semantic-release/git": "10.0.1",
-    "@semantic-release/npm": "13.1.1",
+    "@semantic-release/npm": "13.1.3",
     "c8": "10.1.3",
     "eslint": "9.4.0",
     "husky": "9.1.7",
     "junit-report-builder": "5.1.1",
-    "lint-staged": "16.2.6",
-    "mocha": "11.7.4",
+    "lint-staged": "16.2.7",
+    "mocha": "11.7.5",
     "mocha-multi-reporters": "1.5.1",
     "mocha-suppress-logs": "0.6.0",
-    "semantic-release": "25.0.1"
+    "semantic-release": "25.0.2"
   },
   "lint-staged": {
     "*.js": "eslint",

package/src/config-merge.js

@@ -14,7 +14,7 @@
 /**
  * @typedef RootProperty
  * @property {boolean} atomic whether the property should be overwritten atomically
- * @property {boolean} isModified whether the property need special merging
+ * @property {boolean} isModifier whether the property need special merging
  */
 
 const ROOT_PROPERTIES = {

package/src/config-view.js

@@ -243,6 +243,20 @@ async function loadHeadHtml(ctx, config, ref) {
   return {};
 }
 
+async function loadSidekickConfig(ctx, config) {
+  const key = `${config.code.owner}/${config.code.repo}/main/tools/sidekick/config.json`;
+  const res = await ctx.loader.getObject(HELIX_CODE_BUS, key);
+  if (res.body) {
+    const sidekick = new ConfigObject();
+    sidekick.data = JSON.parse(res.body);
+    sidekick.updateLastModified(res.headers);
+    // remove deprecated properties
+    delete sidekick.data.extends;
+    return sidekick;
+  }
+  return {};
+}
+
 function retainProperty(obj, prop) {
   if (!obj || Array.isArray(obj)) {
     return;
@@ -338,10 +352,15 @@ async function resolveConfig(ctx, rso, scope) {
     }
   }
   if (scope === SCOPE_PIPELINE || scope === SCOPE_RAW || scope === SCOPE_DELIVERY) {
-    // although not used in delivery, load in order to set correct last-modified
+    // although not used in raw, or delivery, load in order to set correct last-modified
     ctx.timer?.update('head.html');
     config.head = await loadHeadHtml(ctx, config, rso.ref);
   }
+  if (scope === SCOPE_ADMIN || scope === SCOPE_RAW) {
+    // although not used in raw, in order to set correct last-modified
+    ctx.timer?.update('sidekick.json');
+    site.sidekick = await loadSidekickConfig(ctx, config);
+  }
 
   return site;
 }
@@ -535,6 +554,40 @@ async function computeSiteAdminRoles(ctx, siteConfig, admin, orgConfig, configGr
   return ret;
 }
 
+/**
+ * Compute the trusted hosts for the given site.
+ * @param {string} org The org name
+ * @param {strinf} site The site name
+ * @param {SiteConfig} siteConfig The site config
+ * @returns {string[]} The trusted hosts
+ */
+function computeTrustedHosts(org, site, siteConfig) {
+  const trustedHosts = [
+    `*--${site}--${org}.aem.page`,
+    `*--${site}--${org}.aem.live`,
+    `*--${site}--${org}.aem.reviews`,
+    `*--${site}--${org}.aem.network`,
+  ];
+
+  if (siteConfig.cdn?.preview?.host) {
+    trustedHosts.push(siteConfig.cdn.preview.host);
+  }
+
+  if (siteConfig.cdn?.live?.host) {
+    trustedHosts.push(siteConfig.cdn.live.host);
+  }
+
+  if (siteConfig.cdn?.prod?.host) {
+    trustedHosts.push(siteConfig.cdn.prod.host);
+  }
+
+  if (siteConfig.sidekick?.trustedHosts) {
+    trustedHosts.push(...siteConfig.sidekick.trustedHosts);
+  }
+
+  return trustedHosts;
+}
+
 export async function getConfigResponse(ctx, opts) {
   const {
     ref, site, org, scope,
@@ -609,6 +662,7 @@ export async function getConfigResponse(ctx, opts) {
 
   // todo: improve
   siteConfig.updateLastModified(config.head);
+  siteConfig.updateLastModified(siteConfig.sidekick);
   siteConfig.updateLastModified(config.robots);
   siteConfig.updateLastModified(config.metadata?.preview);
   siteConfig.updateLastModified(config.metadata?.live);
@@ -627,6 +681,7 @@ export async function getConfigResponse(ctx, opts) {
         'x-hlx-repo': config.code.repo,
         'x-hlx-auth-hash-preview': canonicalArrayString(config.access, 'preview', 'tokenHash'),
         'x-hlx-auth-hash-live': canonicalArrayString(config.access, 'live', 'tokenHash'),
+        'x-hlx-trusted-hosts': computeTrustedHosts(org, site, config).join(','),
       },
     });
   }
@@ -650,6 +705,7 @@ export async function getConfigResponse(ctx, opts) {
   if (opts.scope === SCOPE_ADMIN) {
     const adminConfig = {
       ...rso,
+      sidekick: siteConfig.sidekick?.data,
       ...config,
       content: {
         ...config.content,
@@ -695,6 +751,7 @@ export async function getConfigResponse(ctx, opts) {
       access: config.access,
       legacy: config.legacy,
       lastModified: siteConfig.lastModified,
+      trustedHosts: computeTrustedHosts(org, site, config),
     };
     if (config.features) {
       pipelineConfig.features = config.features;