@adobedjangir/commerce-admin-management 0.0.14 → 0.0.16

package/README.md

@@ -40,6 +40,7 @@ and an extension point for host apps to add their own pages and actions.
 | App Builder Database (ABDB) auto-provisioning on deploy | `ext.config.yaml` |
 | Host-extensible nav and pages | `configureWeb({ extraNav, extraPages })` |
 | Auto-scaffolded host scaffold on `npm install` | `scripts/setup.js` (postinstall hook) |
+| Auto-bump host React/Spectrum/Adobe deps to React-18 floor | `scripts/setup.js` mutates host `package.json` |
 
 ---
 
@@ -50,14 +51,15 @@ and an extension point for host apps to add their own pages and actions.
 aio app init my-commerce-admin
 cd my-commerce-admin
 
-# 2. Install the package — postinstall scaffolds everything
+# 2. Install. The postinstall bumps the host's package.json to the
+#    React 18 / Spectrum 4 floor and re-runs `npm install` automatically.
 npm install @adobedjangir/commerce-admin-management
 
 # 3. Fill in .env (see required values below)
 cp env.dist .env
 $EDITOR .env
 
-# 4. Deploy. ABDB is auto-provisioned; 11 actions + web assets ship to CDN.
+# 4. Deploy. ABDB is auto-provisioned; actions + web assets ship to CDN.
 aio app deploy
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobedjangir/commerce-admin-management",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "description": "Schema-driven system configuration for Adobe Commerce App Builder sync apps. Magento-style scoped config in Adobe App Builder Database (ABDB) with encryption, Commerce REST helpers, and React Admin UI.",
   "license": "Apache-2.0",
   "author": "Adobe Inc.",
@@ -53,26 +53,20 @@
     "@adobe/aio-lib-core-auth": ">=1.1.0",
     "@adobe/aio-lib-db": ">=1.0.0",
     "@adobe/aio-lib-ims": ">=7.0.0",
-    "@adobe/aio-sdk": ">=5.0.0",
-    "@adobe/exc-app": ">=1.0.0",
-    "@adobe/react-spectrum": ">=3.30.0",
-    "@adobe/uix-guest": ">=0.8.0",
-    "@spectrum-icons/workflow": ">=3.0.0 <5.0.0",
-    "dotenv": ">=16.0.0",
-    "react": ">=18.0.0",
-    "react-dom": ">=18.0.0",
-    "react-error-boundary": ">=3.1.0",
-    "react-router-dom": ">=6.0.0"
+    "dotenv": ">=16.0.0"
   },
   "peerDependenciesMeta": {
     "@adobe/aio-lib-core-auth": {
-      "optional": false
+      "optional": true
     },
     "@adobe/aio-lib-db": {
-      "optional": false
+      "optional": true
     },
     "@adobe/aio-lib-ims": {
-      "optional": false
+      "optional": true
+    },
+    "dotenv": {
+      "optional": true
     }
   },
   "dependencies": {

package/scripts/setup.js

@@ -553,6 +553,35 @@ function satisfiesFloor (currentSpec, floorSpec) {
   return compareVersions(cur, min) >= 0
 }
 
+/**
+ * Re-run `npm install` after bumping host package.json so the upgraded
+ * versions actually land in node_modules. Without this, the consumer
+ * would have to run `npm install` manually after our postinstall.
+ *
+ * Recursion is prevented by setting COMMERCE_ADMIN_MANAGEMENT_SKIP_SETUP=1
+ * in the child npm's env — main() bails immediately when it sees that
+ * flag, so the inner install doesn't loop back through this code.
+ *
+ * Failures here don't throw — we print a fallback hint and let the
+ * outer install report success. The consumer can re-run `npm install`
+ * manually if our auto-invocation can't reach the network.
+ */
+function autoRunNpmInstall (projectRoot) {
+  const { execSync } = require('child_process')
+  console.log('[@adobedjangir/commerce-admin-management] running `npm install` to apply the bumped versions…')
+  try {
+    execSync('npm install --no-audit --no-fund --silent --legacy-peer-deps', {
+      cwd: projectRoot,
+      stdio: 'inherit',
+      env: { ...process.env, COMMERCE_ADMIN_MANAGEMENT_SKIP_SETUP: '1' }
+    })
+    console.log('[@adobedjangir/commerce-admin-management] dependency upgrade complete ✓')
+  } catch (e) {
+    console.warn('[@adobedjangir/commerce-admin-management] auto-install failed. Run `npm install` manually.')
+    console.warn(`  reason: ${e.message}`)
+  }
+}
+
 function ensureHostDeps (projectRoot) {
   const pkgPath = path.join(projectRoot, 'package.json')
   if (!fs.existsSync(pkgPath)) {
@@ -583,6 +612,90 @@ function ensureHostDeps (projectRoot) {
   return { changed: true, bumped }
 }
 
+/**
+ * Seed the host's .env with the two values our actions can't run without:
+ *   - AIO_DB_REGION   defaults to "emea" (override after install if needed)
+ *   - SYSTEM_CONFIG_CRYPT_KEY   freshly generated AES-256 key, base64-encoded
+ *
+ * Never overwrites an existing value. The crypt key in particular must
+ * remain stable for the life of the workspace — rotating it makes every
+ * encrypted value already in ABDB undecryptable. So we only write it
+ * when the key is missing or empty.
+ *
+ * Returns { changed, set: [{key, source}], file }.
+ */
+function ensureEnvDefaults (projectRoot) {
+  const envPath = path.join(projectRoot, '.env')
+  let lines = []
+  let existed = false
+  if (fs.existsSync(envPath)) {
+    existed = true
+    try {
+      lines = fs.readFileSync(envPath, 'utf8').split(/\r?\n/)
+    } catch (_) {
+      return { changed: false, set: [], file: envPath, reason: 'unreadable' }
+    }
+  }
+
+  // Read current values (ignore comments + blanks). Treat KEY=  (empty)
+  // as missing so a half-stubbed .env still gets populated.
+  const current = new Map()
+  for (const raw of lines) {
+    const line = raw.trim()
+    if (!line || line.startsWith('#')) continue
+    const eq = line.indexOf('=')
+    if (eq === -1) continue
+    const k = line.slice(0, eq).trim()
+    const v = line.slice(eq + 1).trim()
+    if (k) current.set(k, v)
+  }
+
+  const set = []
+  const defaults = [
+    { key: 'AIO_DB_REGION',           value: 'emea',
+      comment: '# App Builder Database region — one of: amer | emea | apac | aus' },
+    { key: 'SYSTEM_CONFIG_CRYPT_KEY', value: () => require('crypto').randomBytes(32).toString('base64'),
+      comment: '# AES-256 master key for at-rest encryption.\n# DO NOT rotate — values already in ABDB become undecryptable if you do.\n# Auto-generated on install; back this up like a database password.' }
+  ]
+
+  // Build additions for keys that are missing OR empty.
+  const additions = []
+  for (const def of defaults) {
+    const cur = current.get(def.key)
+    if (cur && cur !== '' && cur !== '""' && cur !== "''") continue
+    const v = typeof def.value === 'function' ? def.value() : def.value
+    additions.push({ key: def.key, value: v, comment: def.comment })
+    set.push({ key: def.key, source: cur === undefined ? 'added' : 'filled-empty' })
+  }
+
+  if (additions.length === 0) return { changed: false, set: [], file: envPath }
+
+  // If the file existed, we either replace empty assignments in place
+  // (preserves user comments / ordering) or append at the bottom.
+  let next = existed ? lines.slice() : []
+  for (const add of additions) {
+    const cur = current.get(add.key)
+    if (cur === '' || cur === '""' || cur === "''") {
+      // Replace the empty line in place.
+      for (let i = 0; i < next.length; i++) {
+        const trimmed = next[i].trim()
+        if (trimmed.startsWith(add.key + '=') || trimmed.startsWith(add.key + ' =')) {
+          next[i] = `${add.key}=${add.value}`
+          break
+        }
+      }
+    } else {
+      // Append.
+      if (next.length && next[next.length - 1].trim() !== '') next.push('')
+      next.push(add.comment)
+      next.push(`${add.key}=${add.value}`)
+    }
+  }
+
+  fs.writeFileSync(envPath, next.join('\n') + (next[next.length - 1] === '' ? '' : '\n'), 'utf8')
+  return { changed: true, set, file: envPath, existed }
+}
+
 function setupAppConfig (projectRoot) {
   const appConfigPath = path.join(projectRoot, 'app.config.yaml')
   if (!fs.existsSync(appConfigPath)) {
@@ -606,9 +719,12 @@ function setupAppConfig (projectRoot) {
 }
 
 function main () {
-  if (process.env.CONFIGURATION_MANAGEMENT_SKIP_SETUP === '1') {
-    return
-  }
+  // Two opt-outs:
+  //   - CONFIGURATION_MANAGEMENT_SKIP_SETUP: legacy name kept for compat.
+  //   - COMMERCE_ADMIN_MANAGEMENT_SKIP_SETUP: set by autoRunNpmInstall to
+  //     prevent the recursive postinstall from re-running this code.
+  if (process.env.CONFIGURATION_MANAGEMENT_SKIP_SETUP === '1') return
+  if (process.env.COMMERCE_ADMIN_MANAGEMENT_SKIP_SETUP === '1') return
 
   const projectRoot = resolveProjectRoot()
   if (!projectRoot) {
@@ -626,18 +742,32 @@ function main () {
     console.log('[@adobedjangir/commerce-admin-management] removed src/dx-excshell-1/ (replaced by commerce/backend-ui/1)')
   }
 
+  // Seed .env with AIO_DB_REGION + SYSTEM_CONFIG_CRYPT_KEY so the consumer
+  // doesn't have to. Never overwrites an existing crypt key — see
+  // ensureEnvDefaults for why.
+  const env = ensureEnvDefaults(projectRoot)
+  if (env.changed) {
+    for (const s of env.set) {
+      console.log(`[@adobedjangir/commerce-admin-management] .env ${s.source}: ${s.key}`)
+    }
+  }
+
   // Bump host package.json so React-18 + Spectrum-4 peers are satisfied
   // without the consumer running a long `npm install --save react@^18 ...`
-  // chant. They still need to run `npm install` once more for npm to
-  // resolve the new versions — we can't safely re-shell-out to npm from
-  // inside a postinstall.
+  // chant. If anything was bumped, automatically re-run npm install so the
+  // new versions actually land in node_modules. A guard env var prevents
+  // the recursive postinstall from re-running this step.
   const deps = ensureHostDeps(projectRoot)
   if (deps.changed) {
     console.log('[@adobedjangir/commerce-admin-management] bumped host package.json:')
     for (const b of deps.bumped) {
       console.log(`  • ${b.name}: ${b.was} → ${b.now}`)
     }
-    console.log('[@adobedjangir/commerce-admin-management] run `npm install` once more to apply the upgrades.')
+    if (process.env.COMMERCE_ADMIN_MANAGEMENT_NO_AUTO_INSTALL === '1') {
+      console.log('[@adobedjangir/commerce-admin-management] auto-install disabled; run `npm install` to apply.')
+    } else {
+      autoRunNpmInstall(projectRoot)
+    }
   }
 
   const app = setupAppConfig(projectRoot)