@bongos/core 1.19.428 → 1.19.430

package/src/bongos/serve-internal.js

@@ -41,6 +41,7 @@ const { attachFail } = require('./middleware/error-envelope');
 const metrics = require('./metrics');
 const { logger } = require('./logger');
 const gdsAuth = require('./auth');
+const { loadIdpConfig } = require('./auth-config');
 const { buildStampedHtml } = require('../asset-version');
 const { buildInfo } = require('../build-info');
 const { buildDevboxDownloads } = require('../devbox-downloads');
@@ -164,7 +165,7 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
 // fill cannot reach them, and a baked one would make every instance advertise
 // whichever instance happened to author the file (task 1002748, direction C5/C6).
 // Pure + exported for the test; both origins are injectable so it drives with zero I/O.
-function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl(), instanceBase = safeInstanceBase()) {
+function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl(), instanceBase = safeInstanceBase(), hubOrigin = safeHubOrigin()) {
   const world = (brand.identity && brand.identity.worldName) || '';
   const product = (brand.identity && brand.identity.productName) || '';
   const tagline = (brand.copy && brand.copy.tagline) || '';
@@ -182,7 +183,13 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
     // whichever instance authored the file
     .split('{{buildersOrigin}}').join(esc(hall))
     .split('{{sourceRepoUrl}}').join(esc(sourceRepo || ''))
-    .split('{{instanceBase}}').join(esc(instanceBase || ''));
+    .split('{{instanceBase}}').join(esc(instanceBase || ''))
+    // The PLATFORM HUB's apex — where a builder's canonical cross-project
+    // profile lives (P08, task 1002804 / ADR 0214 D2). Empty on a vanilla
+    // instance, and a page that reads it MUST render nothing rather than fall
+    // back: never write this token straight into an href, because an empty
+    // value would leave a same-host relative URL claiming to be the hub.
+    .split('{{hubOrigin}}').join(esc(hubOrigin || ''));
 }
 // A link whose href is a BARE origin token that resolves empty is dropped whole,
 // server-side (task 1003242; the branding contract): a pack that names no domains
@@ -231,6 +238,25 @@ function safeBuildersOrigin() {
 function safeInstanceBase() {
   try { return branding().domains.instanceBase || ''; } catch { return ''; }
 }
+// The PLATFORM HUB's apex — the origin a builder's canonical cross-project
+// profile is addressed on (P08, task 1002804; ADR 0171 D1 named this gap, ADR
+// 0214 D2 fills it). Three cases, in the order they are asked:
+//   * THIS instance IS the hub — `platform-identity` enabled is the hub flag
+//     itself (src/platform-server.js), not a proxy for it — so the hub apex is
+//     its own publicOrigin;
+//   * a FEDERATED instance — the hub it signs in through, from the same
+//     `<PREFIX>_HUB_ORIGIN` env that auth-config's loadIdpConfig resolves; there
+//     is no second source of truth for "which hub am I on";
+//   * a VANILLA instance — no hub, so '' and every consumer renders nothing.
+// Best-effort like its four siblings above: a branding or env hiccup must resolve
+// to "no hub", never break every served page.
+function safeHubOrigin() {
+  try {
+    if (isModuleEnabled('platform-identity')) return safePublicOrigin();
+    const idp = loadIdpConfig();
+    return (idp && idp.origin) || '';
+  } catch { return ''; }
+}
 // The instance's own source repo, from the pack's `repo: {owner, name}` binding —
 // another server-only field (the branding contract keeps repo off clientBranding
 // alongside domains). A page that wants to link "read the source" must take it

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.428'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.430'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');