@commercetools-frontend/application-config 25.0.0 → 25.2.0

package/dist/commercetools-frontend-application-config.cjs.dev.js

@@ -12,8 +12,8 @@ var _Object$defineProperties = require('@babel/runtime-corejs3/core-js-stable/ob
 var _Object$defineProperty = require('@babel/runtime-corejs3/core-js-stable/object/define-property');
 var _defineProperty = require('@babel/runtime-corejs3/helpers/defineProperty');
 var _includesInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/includes');
-var _concatInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/concat');
 var _URL = require('@babel/runtime-corejs3/core-js-stable/url');
+var _concatInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/concat');
 var fs$1 = require('node:fs');
 var path = require('node:path');
 var omitEmpty = require('omit-empty-es');
@@ -31,11 +31,13 @@ var _possibleConstructorReturn = require('@babel/runtime-corejs3/helpers/possibl
 var _getPrototypeOf = require('@babel/runtime-corejs3/helpers/getPrototypeOf');
 var _inherits = require('@babel/runtime-corejs3/helpers/inherits');
 var _wrapNativeSuper = require('@babel/runtime-corejs3/helpers/wrapNativeSuper');
+var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
 var _trimInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/trim');
 var _JSON$stringify = require('@babel/runtime-corejs3/core-js-stable/json/stringify');
-var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
+var path$1 = require('path');
 var _reduceInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/reduce');
-var formatters = require('./formatters-a09672cf.cjs.dev.js');
+var _bindInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/bind');
+var formatters = require('./formatters-5a68b5ac.cjs.dev.js');
 var _Set = require('@babel/runtime-corejs3/core-js-stable/set');
 var _Array$isArray = require('@babel/runtime-corejs3/core-js-stable/array/is-array');
 var Ajv = require('ajv');
@@ -57,8 +59,8 @@ var _Object$getOwnPropertyDescriptors__default = /*#__PURE__*/_interopDefault(_O
 var _Object$defineProperties__default = /*#__PURE__*/_interopDefault(_Object$defineProperties);
 var _Object$defineProperty__default = /*#__PURE__*/_interopDefault(_Object$defineProperty);
 var _includesInstanceProperty__default = /*#__PURE__*/_interopDefault(_includesInstanceProperty);
-var _concatInstanceProperty__default = /*#__PURE__*/_interopDefault(_concatInstanceProperty);
 var _URL__default = /*#__PURE__*/_interopDefault(_URL);
+var _concatInstanceProperty__default = /*#__PURE__*/_interopDefault(_concatInstanceProperty);
 var fs__default$1 = /*#__PURE__*/_interopDefault(fs$1);
 var path__default = /*#__PURE__*/_interopDefault(path);
 var omitEmpty__default = /*#__PURE__*/_interopDefault(omitEmpty);
@@ -66,10 +68,12 @@ var _mapInstanceProperty__default = /*#__PURE__*/_interopDefault(_mapInstancePro
 var _parseInt__default = /*#__PURE__*/_interopDefault(_parseInt);
 var fs__default = /*#__PURE__*/_interopDefault(fs);
 var _Reflect$construct__default = /*#__PURE__*/_interopDefault(_Reflect$construct);
+var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
 var _trimInstanceProperty__default = /*#__PURE__*/_interopDefault(_trimInstanceProperty);
 var _JSON$stringify__default = /*#__PURE__*/_interopDefault(_JSON$stringify);
-var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var path__default$1 = /*#__PURE__*/_interopDefault(path$1);
 var _reduceInstanceProperty__default = /*#__PURE__*/_interopDefault(_reduceInstanceProperty);
+var _bindInstanceProperty__default = /*#__PURE__*/_interopDefault(_bindInstanceProperty);
 var _Set__default = /*#__PURE__*/_interopDefault(_Set);
 var _Array$isArray__default = /*#__PURE__*/_interopDefault(_Array$isArray);
 var Ajv__default = /*#__PURE__*/_interopDefault(Ajv);
@@ -146,11 +150,10 @@ const isDynamicAwaitSupported = () => {
 const isEsmModule = async cwd => {
   const packagePath = path__default["default"].join(cwd, 'package.json');
   try {
-    var _JSON$parse;
     const packageJSON = await fs__default["default"].readFile(packagePath, {
       encoding: 'utf-8'
     });
-    return ((_JSON$parse = JSON.parse(packageJSON)) === null || _JSON$parse === void 0 ? void 0 : _JSON$parse.type) === 'module';
+    return JSON.parse(packageJSON)?.type === 'module';
   } catch (error) {
     return false;
   }
@@ -170,7 +173,7 @@ const createExplorerFor = async configFileName => {
   const loaders = isDynamicAwaitSupported() || (await isEsmModule(process.cwd())) ? cosmiconfig.defaultLoaders : cosmiconfig.defaultLoadersSync;
   return cosmiconfig.cosmiconfig(configFileName, {
     searchStrategy: 'project',
-    searchPlaces: ["".concat(configFileName, ".js"), "".concat(configFileName, ".cjs"), "".concat(configFileName, ".mjs"), "".concat(configFileName, ".ts")],
+    searchPlaces: [`${configFileName}.js`, `${configFileName}.cjs`, `${configFileName}.mjs`, `${configFileName}.ts`],
     loaders: {
       '.js': loaders['.js'],
       '.cjs': loaders['.cjs'],
@@ -185,9 +188,9 @@ const getConfigPath = async () => {
   const customApplicationConfigFile = await customApplicationExplorer.search();
   const customViewConfigFile = await customViewExplorer.search();
   if (!customApplicationConfigFile && !customViewConfigFile) {
-    throw new Error("Missing or invalid configuration file.");
+    throw new Error(`Missing or invalid configuration file.`);
   }
-  return (customApplicationConfigFile === null || customApplicationConfigFile === void 0 ? void 0 : customApplicationConfigFile.filepath) || (customViewConfigFile === null || customViewConfigFile === void 0 ? void 0 : customViewConfigFile.filepath);
+  return customApplicationConfigFile?.filepath || customViewConfigFile?.filepath;
 };
 const loadConfig = async applicationPath => {
   const customApplicationExplorer = await createExplorerFor('custom-application-config');
@@ -195,10 +198,10 @@ const loadConfig = async applicationPath => {
   const customApplicationConfigFile = await customApplicationExplorer.search(applicationPath);
   const customViewConfigFile = await customViewExplorer.search(applicationPath);
   if ((!customApplicationConfigFile || !customApplicationConfigFile.config) && (!customViewConfigFile || !customViewConfigFile.config)) {
-    throw new MissingOrInvalidConfigError("Missing or invalid configuration file.");
+    throw new MissingOrInvalidConfigError(`Missing or invalid configuration file.`);
   }
   if (customApplicationConfigFile && customViewConfigFile) {
-    throw new MissingOrInvalidConfigError("Found configuration files for both Custom Application and Custom View. Please remove one of them.");
+    throw new MissingOrInvalidConfigError(`Found configuration files for both Custom Application and Custom View. Please remove one of them.`);
   }
   return customViewConfigFile || customApplicationConfigFile;
 };
@@ -217,6 +220,11 @@ const variableSyntax = /\${([ ~:\w.'",\-/()@]+?)}/g;
 const envRefSyntax = /^env:/g;
 const intlRefSyntax = /^intl:/g;
 const filePathRefSyntax = /^path:/g;
+
+// Safe regex pattern escaping function
+const escapeRegExp = string => {
+  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+};
 const hasVariablePlaceholder = valueOfEnvConfig => typeof valueOfEnvConfig === 'string' &&
 // Using `{regex}.test()` might cause false positives if called multiple
 // times on a global regular expression:
@@ -227,72 +235,103 @@ Boolean(valueOfEnvConfig.match(variableSyntax));
 const isEnvVariablePlaceholder = valueOfPlaceholder => Boolean(valueOfPlaceholder.match(envRefSyntax));
 const isIntlVariablePlaceholder = valueOfPlaceholder => Boolean(valueOfPlaceholder.match(intlRefSyntax));
 const isFilePathVariablePlaceholder = valueOfPlaceholder => Boolean(valueOfPlaceholder.match(filePathRefSyntax));
-const isStructuredJson = message => (message === null || message === void 0 ? void 0 : message.string) !== undefined;
+const isStructuredJson = message => message?.string !== undefined;
 const substituteEnvVariablePlaceholder = (valueOfPlaceholder, matchedString, valueOfEnvConfig, loadingOptions) => {
   const _valueOfPlaceholder$s = valueOfPlaceholder.split(':'),
     _valueOfPlaceholder$s2 = _slicedToArray(_valueOfPlaceholder$s, 2),
     requestedEnvVar = _valueOfPlaceholder$s2[1];
   const hasEnvField = loadingOptions.processEnv.hasOwnProperty(requestedEnvVar);
   if (!hasEnvField) {
-    var _context;
-    throw new Error(_concatInstanceProperty__default["default"](_context = "Missing environment variable '".concat(requestedEnvVar, "' specified in config as 'env:")).call(_context, requestedEnvVar, "'."));
+    throw new Error(`Missing environment variable '${requestedEnvVar}' specified in config as 'env:${requestedEnvVar}'.`);
   }
-  const escapedMatchedString = matchedString.replace(/[${}:]/g, '\\$&');
-  return valueOfEnvConfig.replace(new RegExp("(".concat(escapedMatchedString, ")+"), 'g'), loadingOptions.processEnv[requestedEnvVar]);
+  return valueOfEnvConfig.replace(new RegExp(escapeRegExp(matchedString), 'g'), loadingOptions.processEnv[requestedEnvVar]);
 };
 const substituteIntlVariablePlaceholder = (valueOfPlaceholder, matchedString, valueOfEnvConfig, loadingOptions) => {
   const _valueOfPlaceholder$s3 = valueOfPlaceholder.split(':'),
     _valueOfPlaceholder$s4 = _slicedToArray(_valueOfPlaceholder$s3, 3),
     locale = _valueOfPlaceholder$s4[1],
     requestedIntlMessageId = _valueOfPlaceholder$s4[2];
-  const translationsFilePath = require.resolve("./i18n/data/".concat(locale, ".json"), {
-    paths: ["".concat(loadingOptions.applicationPath, "/src"), loadingOptions.applicationPath]
+  const translationsFilePath = require.resolve(`./i18n/data/${locale}.json`, {
+    paths: [`${loadingOptions.applicationPath}/src`, loadingOptions.applicationPath]
   });
   const translations = require(translationsFilePath);
   const hasIntlMessage = translations.hasOwnProperty(requestedIntlMessageId);
   if (!hasIntlMessage) {
-    var _context2, _context3;
-    throw new Error(_concatInstanceProperty__default["default"](_context2 = _concatInstanceProperty__default["default"](_context3 = "Missing message key '".concat(requestedIntlMessageId, "' specified in config as 'intl:")).call(_context3, locale, ":")).call(_context2, requestedIntlMessageId, "'."));
+    throw new Error(`Missing message key '${requestedIntlMessageId}' specified in config as 'intl:${locale}:${requestedIntlMessageId}'.`);
   }
   const translation = translations[requestedIntlMessageId];
   const translationValue = isStructuredJson(translation) ? translation.string : translation;
-  const escapedMatchedString = matchedString.replace(/[${}:]/g, '\\$&');
-  return valueOfEnvConfig.replace(new RegExp("(".concat(escapedMatchedString, ")+"), 'g'), translationValue);
+  return valueOfEnvConfig.replace(new RegExp(escapeRegExp(matchedString), 'g'), translationValue);
 };
 const substituteFilePathVariablePlaceholder = (valueOfPlaceholder, matchedString, valueOfEnvConfig, loadingOptions) => {
   const _valueOfPlaceholder$s5 = valueOfPlaceholder.split(':'),
     _valueOfPlaceholder$s6 = _slicedToArray(_valueOfPlaceholder$s5, 2),
     filePathOrModule = _valueOfPlaceholder$s6[1];
-  const content = fs__default$1["default"].readFileSync(require.resolve(filePathOrModule, {
-    // Relative paths should be resolved from the application folder.
+  const resolvedPath = require.resolve(filePathOrModule, {
     paths: [loadingOptions.applicationPath]
-  }), {
+  });
+
+  // Security check: Prevent path traversal attacks.
+  // require.resolve() already provides protection by only resolving modules
+  // accessible from the applicationPath. However, we add an extra layer to
+  // prevent access to sensitive system files outside the workspace.
+  const normalizedPath = path__default$1["default"].normalize(resolvedPath);
+  const applicationPath = path__default$1["default"].normalize(loadingOptions.applicationPath);
+
+  // Find workspace root by traversing up from applicationPath until we find
+  // package.json, pnpm-workspace.yaml, or reach root
+  let workspaceRoot = applicationPath;
+  let currentPath = applicationPath;
+  const rootPath = path__default$1["default"].parse(currentPath).root;
+  while (currentPath !== rootPath) {
+    const hasPackageJson = fs__default$1["default"].existsSync(path__default$1["default"].join(currentPath, 'package.json'));
+    const hasWorkspaceConfig = fs__default$1["default"].existsSync(path__default$1["default"].join(currentPath, 'pnpm-workspace.yaml')) || fs__default$1["default"].existsSync(path__default$1["default"].join(currentPath, 'lerna.json'));
+    if (hasPackageJson) {
+      workspaceRoot = currentPath;
+      if (hasWorkspaceConfig) {
+        // Found workspace root
+        break;
+      }
+    }
+    currentPath = path__default$1["default"].dirname(currentPath);
+  }
+  const relativePath = path__default$1["default"].relative(workspaceRoot, normalizedPath);
+
+  // Path is safe if it's within the workspace root.
+  // Use path.relative() to avoid string prefix vulnerabilities (e.g., "/app" vs "/app-evil")
+  const isSafePath = !_startsWithInstanceProperty__default["default"](relativePath).call(relativePath, '..') && !path__default$1["default"].isAbsolute(relativePath);
+  if (!isSafePath) {
+    throw new Error(`Access to files outside workspace directory is not allowed: ${filePathOrModule}`);
+  }
+  const content = fs__default$1["default"].readFileSync(normalizedPath, {
     encoding: 'utf-8'
   });
-  const escapedMatchedString = matchedString.replace(/[${}:]/g, '\\$&');
-  return valueOfEnvConfig.replace(new RegExp("(".concat(escapedMatchedString, ")+"), 'g'), content);
+  return valueOfEnvConfig.replace(new RegExp(escapeRegExp(matchedString), 'g'), content);
 };
 const getValueOfPlaceholder = valueWithPlaceholder => valueWithPlaceholder.replace(variableSyntax, (_match, varName) => _trimInstanceProperty__default["default"](varName).call(varName)).replace(/\s/g, '');
-const substituteVariablePlaceholders = (config, loadingOptions) => JSON.parse(_JSON$stringify__default["default"](config), (_key, value) => {
-  // Only strings are allowed
-  let substitutedValue = value;
-  if (hasVariablePlaceholder(substitutedValue)) {
-    const matchResult = substitutedValue.match(variableSyntax);
-    if (matchResult) {
-      _forEachInstanceProperty__default["default"](matchResult).call(matchResult, matchedString => {
-        const valueOfPlaceholder = getValueOfPlaceholder(matchedString);
-        if (isEnvVariablePlaceholder(valueOfPlaceholder)) {
-          substitutedValue = substituteEnvVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
-        } else if (isIntlVariablePlaceholder(valueOfPlaceholder)) {
-          substitutedValue = substituteIntlVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
-        } else if (isFilePathVariablePlaceholder(valueOfPlaceholder)) {
-          substitutedValue = substituteFilePathVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
-        }
-      });
+const substituteVariablePlaceholders = (config, loadingOptions) => {
+  const result = JSON.parse(_JSON$stringify__default["default"](config), (_key, value) => {
+    // Only strings are allowed
+    let substitutedValue = value;
+    if (hasVariablePlaceholder(substitutedValue)) {
+      const matchResult = substitutedValue.match(variableSyntax);
+      if (matchResult) {
+        _forEachInstanceProperty__default["default"](matchResult).call(matchResult, matchedString => {
+          const valueOfPlaceholder = getValueOfPlaceholder(matchedString);
+          if (isEnvVariablePlaceholder(valueOfPlaceholder)) {
+            substitutedValue = substituteEnvVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
+          } else if (isIntlVariablePlaceholder(valueOfPlaceholder)) {
+            substitutedValue = substituteIntlVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
+          } else if (isFilePathVariablePlaceholder(valueOfPlaceholder)) {
+            substitutedValue = substituteFilePathVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
+          }
+        });
+      }
     }
-  }
-  return substitutedValue;
-});
+    return substitutedValue;
+  });
+  return result;
+};
 
 var customApplicationSchemaJson = {
 	$schema: "http://json-schema.org/draft-07/schema",
@@ -963,13 +1002,12 @@ const printErrors = errors => {
     return 'No errors';
   }
   return _mapInstanceProperty__default["default"](errors).call(errors, error => {
-    var _context, _context2, _context3;
-    const baseMessage = _concatInstanceProperty__default["default"](_context = "".concat(error.instancePath, " ")).call(_context, error.message);
+    const baseMessage = `${error.instancePath} ${error.message}`;
     switch (error.keyword) {
       case 'additionalProperties':
-        return _concatInstanceProperty__default["default"](_context2 = "".concat(baseMessage, ": ")).call(_context2, error.params.additionalProperty);
+        return `${baseMessage}: ${error.params.additionalProperty}`;
       case 'enum':
-        return _concatInstanceProperty__default["default"](_context3 = "".concat(baseMessage, ": ")).call(_context3, error.params.allowedValues.toString());
+        return `${baseMessage}: ${error.params.allowedValues.toString()}`;
       default:
         return baseMessage;
     }
@@ -982,8 +1020,7 @@ const validateConfig = (configType, config) => {
   } else if (configType === LOADED_CONFIG_TYPES.CUSTOM_VIEW) {
     validation = validateCustomViewConfig;
   } else {
-    var _context4;
-    throw new Error(_concatInstanceProperty__default["default"](_context4 = "Invalid config type \"".concat(configType, "\", expected ")).call(_context4, _Object$keys__default["default"](LOADED_CONFIG_TYPES).toString()));
+    throw new Error(`Invalid config type "${configType}", expected ${_Object$keys__default["default"](LOADED_CONFIG_TYPES).toString()}`);
   }
   const isValid = validation(config);
   if (!isValid) {
@@ -996,9 +1033,9 @@ const validateEntryPointUriPath = config => {
   }
 };
 const validateSubmenuLinks = config => {
-  var _context5;
+  var _context;
   const uriPathSet = new _Set__default["default"]();
-  _forEachInstanceProperty__default["default"](_context5 = config.submenuLinks).call(_context5, _ref => {
+  _forEachInstanceProperty__default["default"](_context = config.submenuLinks).call(_context, _ref => {
     let uriPath = _ref.uriPath;
     if (uriPathSet.has(uriPath)) {
       throw new Error('Duplicate URI path. Every submenu link must have a unique URI path value');
@@ -1007,64 +1044,63 @@ const validateSubmenuLinks = config => {
   });
 };
 const validateAdditionalOAuthScopes = config => {
-  var _config$additionalOAu;
+  var _context2, _context3;
   const additionalPermissionNames = new _Set__default["default"]();
-  (_config$additionalOAu = config.additionalOAuthScopes) === null || _config$additionalOAu === void 0 || _forEachInstanceProperty__default["default"](_config$additionalOAu).call(_config$additionalOAu, _ref2 => {
+  ((_context2 = config.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default["default"](_context3 = Function.call).call(_context3, _forEachInstanceProperty__default["default"](_context2), _context2))?.(_ref2 => {
     let name = _ref2.name,
       view = _ref2.view,
       manage = _ref2.manage;
     if ((_Array$isArray__default["default"](view) && view.length === 0 || !view) && (_Array$isArray__default["default"](manage) && manage.length === 0 || !manage)) {
-      throw new Error("At least one OAuth Scope for permission group name \"".concat(name, "\" is required"));
+      throw new Error(`At least one OAuth Scope for permission group name "${name}" is required`);
     } else if (additionalPermissionNames.has(name)) {
-      throw new Error("Duplicate additional permission group name \"".concat(name, "\". Every additional permission must have a unique name"));
+      throw new Error(`Duplicate additional permission group name "${name}". Every additional permission must have a unique name`);
     }
     if (!name.match(constants.PERMISSION_GROUP_NAME_REGEX)) {
-      throw new Error("Additional permission group name \"".concat(name, "\" is invalid. The value may be between 2 and 64 characters and only contain alphabetic lowercase characters and non-consecutive hyphens. Leading and trailing hyphens are also not allowed"));
+      throw new Error(`Additional permission group name "${name}" is invalid. The value may be between 2 and 64 characters and only contain alphabetic lowercase characters and non-consecutive hyphens. Leading and trailing hyphens are also not allowed`);
     }
     additionalPermissionNames.add(name);
   });
 };
 
 function ownKeys$1(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context5, _context6; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context5 = ownKeys$1(Object(t), !0)).call(_context5, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context6 = ownKeys$1(Object(t))).call(_context6, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context6 = ownKeys$1(Object(t), !0)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context7 = ownKeys$1(Object(t))).call(_context7, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
 
 // The `uriPath` of each submenu link is supposed to be defined relative
 // to the `entryPointUriPath`. Computing the full path is done internally to keep
 // the configuration simple.
 const computeUriPath = (uriPath, entryPointUriPath) => {
-  var _context;
   // In case the `uriPath` is only `/`, it means that the link is supposed to be
   // treated the same as the main application path. In this case, the return value
   // should not contain any unnecessary trailing slash and therefore we use the `entryPointUriPath`.
   if (uriPath === '/') return entryPointUriPath;
   // In case the `uriPath` is already configured including the `entryPointUriPath`,
   // we return the `uriPath` as-is.
-  if (_startsWithInstanceProperty__default["default"](uriPath).call(uriPath, "".concat(entryPointUriPath, "/"))) return uriPath;
+  if (_startsWithInstanceProperty__default["default"](uriPath).call(uriPath, `${entryPointUriPath}/`)) return uriPath;
   // Return the full path including the `entryPointUriPath` as a prefix.
-  return _concatInstanceProperty__default["default"](_context = "".concat(entryPointUriPath, "/")).call(_context, uriPath);
+  return `${entryPointUriPath}/${uriPath}`;
 };
 const getPermissions = appConfig => {
-  var _context2, _appConfig$additional, _context3;
-  const additionalResourceAccessKeyToOauthScopeMap = _reduceInstanceProperty__default["default"](_context2 = appConfig.additionalOAuthScopes || []).call(_context2, (previousOauthScope, _ref) => {
+  var _context, _context2, _context3, _context4;
+  const additionalResourceAccessKeyToOauthScopeMap = _reduceInstanceProperty__default["default"](_context = appConfig.additionalOAuthScopes || []).call(_context, (previousOauthScope, _ref) => {
     let name = _ref.name,
       view = _ref.view,
       manage = _ref.manage;
     const formattedResourceKey = formatters.formatEntryPointUriPathToResourceAccessKey(name);
     return _objectSpread$1(_objectSpread$1({}, previousOauthScope), {}, {
-      ["view".concat(formattedResourceKey)]: view,
-      ["manage".concat(formattedResourceKey)]: manage
+      [`view${formattedResourceKey}`]: view,
+      [`manage${formattedResourceKey}`]: manage
     });
   }, {});
-  const additionalPermissionNames = ((_appConfig$additional = appConfig.additionalOAuthScopes) === null || _appConfig$additional === void 0 ? void 0 : _mapInstanceProperty__default["default"](_appConfig$additional).call(_appConfig$additional, _ref2 => {
+  const additionalPermissionNames = ((_context2 = appConfig.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty__default["default"](_context3 = Function.call).call(_context3, _mapInstanceProperty__default["default"](_context2), _context2))?.(_ref2 => {
     let name = _ref2.name;
     return name;
-  })) || [];
+  }) || [];
   const permissionKeys = formatters.entryPointUriPathToResourceAccesses(appConfig.entryPointUriPath ||
   // In case the `entryPointUriPath` is not defined it is because the
   // configuration is for a custom view. In this case we use the
   // default entry point uri path.
   constants.CUSTOM_VIEW_HOST_ENTRY_POINT_URI_PATH, additionalPermissionNames);
-  const additionalPermissions = _mapInstanceProperty__default["default"](_context3 = _Object$keys__default["default"](additionalResourceAccessKeyToOauthScopeMap)).call(_context3, additionalResourceAccessKey => ({
+  const additionalPermissions = _mapInstanceProperty__default["default"](_context4 = _Object$keys__default["default"](additionalResourceAccessKeyToOauthScopeMap)).call(_context4, additionalResourceAccessKey => ({
     name: permissionKeys[additionalResourceAccessKey],
     oAuthScopes: additionalResourceAccessKeyToOauthScopeMap[additionalResourceAccessKey]
   }));
@@ -1077,7 +1113,7 @@ const getPermissions = appConfig => {
   }, ...additionalPermissions];
 };
 function transformCustomApplicationConfigToData(appConfig) {
-  var _context4;
+  var _context5;
   validateEntryPointUriPath(appConfig);
   validateSubmenuLinks(appConfig);
   validateAdditionalOAuthScopes(appConfig);
@@ -1090,7 +1126,7 @@ function transformCustomApplicationConfigToData(appConfig) {
     permissions: getPermissions(appConfig),
     icon: appConfig.icon,
     mainMenuLink: appConfig.mainMenuLink,
-    submenuLinks: _mapInstanceProperty__default["default"](_context4 = appConfig.submenuLinks).call(_context4, submenuLink => _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {
+    submenuLinks: _mapInstanceProperty__default["default"](_context5 = appConfig.submenuLinks).call(_context5, submenuLink => _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {
       uriPath: computeUriPath(submenuLink.uriPath, appConfig.entryPointUriPath)
     }))
   };
@@ -1115,12 +1151,11 @@ function transformConfigurationToData(configType, configuration) {
   } else if (configType === LOADED_CONFIG_TYPES.CUSTOM_VIEW) {
     return transformCustomViewConfigToData(configuration);
   } else {
-    throw new Error("Invalid config type: ".concat(configType));
+    throw new Error(`Invalid config type: ${configType}`);
   }
 }
 
 const mapCloudIdentifierToApiUrl = key => {
-  var _context;
   switch (key) {
     case CLOUD_IDENTIFIERS.GCP_AU:
       return MC_API_URLS[CLOUD_IDENTIFIERS.GCP_AU];
@@ -1137,7 +1172,7 @@ const mapCloudIdentifierToApiUrl = key => {
     default:
       // We would probably never get to this point, as the JSON schema validation
       // kicks in before.
-      throw new Error(_concatInstanceProperty__default["default"](_context = "Unknown cloud identifier \"".concat(key, "\". Supported values: ")).call(_context, _Object$values__default["default"](CLOUD_IDENTIFIERS).toString()));
+      throw new Error(`Unknown cloud identifier "${key}". Supported values: ${_Object$values__default["default"](CLOUD_IDENTIFIERS).toString()}`);
   }
 };
 const getUniqueValues = function () {
@@ -1161,10 +1196,10 @@ const getOrThrow = (fn, errorMessage) => {
 };
 
 function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context4, _context5; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context4 = ownKeys(Object(t), !0)).call(_context4, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context5 = ownKeys(Object(t))).call(_context5, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t), !0)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
 // TODO: make it configurable.
 const developmentPort = 3001;
-const developmentAppUrl = "http://localhost:".concat(developmentPort);
+const developmentAppUrl = `http://localhost:${developmentPort}`;
 const getLoadedConfigurationType = configFileName => {
   if (_includesInstanceProperty__default["default"](configFileName).call(configFileName, 'custom-view-config')) {
     return LOADED_CONFIG_TYPES.CUSTOM_VIEW;
@@ -1180,7 +1215,6 @@ const omitDevConfigIfEmpty = devConfig => {
 };
 const isCustomViewData = data => data.entryPointUriPath === undefined;
 const getRuntimeEnvironmentConfigForDevelopment = _ref => {
-  var _appConfig$env$develo;
   let isProd = _ref.isProd,
     configurationData = _ref.configurationData,
     mcApiUrl = _ref.mcApiUrl,
@@ -1197,7 +1231,7 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
     initialProjectKey:
     // For the `account` application, we should unset the projectKey.
     entryPointUriPath === 'account' ? undefined : appConfig.env.development.initialProjectKey
-  }, ((_appConfig$env$develo = appConfig.env.development) === null || _appConfig$env$develo === void 0 ? void 0 : _appConfig$env$develo.teamId) && _objectSpread({
+  }, appConfig.env.development?.teamId && _objectSpread({
     teamId: appConfig.env.development.teamId
   }, isCustomViewData(configurationData) ? {
     customViewId: configurationData.id
@@ -1205,12 +1239,11 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
     applicationId: configurationData.id
   })), {}, {
     oAuthScopes: appConfig.oAuthScopes,
-    additionalOAuthScopes: appConfig === null || appConfig === void 0 ? void 0 : appConfig.additionalOAuthScopes
+    additionalOAuthScopes: appConfig?.additionalOAuthScopes
   }));
   if (isCustomViewData(configurationData)) {
-    var _context;
     const hostUriPath = appConfig.env.development.hostUriPath;
-    const defaultHostUriPath = oidcConfig.initialProjectKey ? _concatInstanceProperty__default["default"](_context = "/".concat(oidcConfig.initialProjectKey, "/")).call(_context, entryPointUriPath) : "/".concat(entryPointUriPath);
+    const defaultHostUriPath = oidcConfig.initialProjectKey ? `/${oidcConfig.initialProjectKey}/${entryPointUriPath}` : `/${entryPointUriPath}`;
     const hostUrl = new _URL__default["default"](hostUriPath || defaultHostUriPath, developmentAppUrl);
     return omitDevConfigIfEmpty({
       oidc: oidcConfig,
@@ -1232,7 +1265,6 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
   });
 };
 const getRuntimeEnvironmentConfig = _ref2 => {
-  var _context2;
   let isProd = _ref2.isProd,
     configurationData = _ref2.configurationData,
     additionalAppEnv = _ref2.additionalAppEnv,
@@ -1251,7 +1283,7 @@ const getRuntimeEnvironmentConfig = _ref2 => {
   // In development, we prefix the entry point with the "__local" prefix.
   // This is important to determine to which URL the MC should redirect to
   // after successful login.
-  const applicationIdentifier = isProd ? _concatInstanceProperty__default["default"](_context2 = "".concat(configurationData.id, ":")).call(_context2, entryPointUriPath) : "__local:".concat(entryPointUriPath);
+  const applicationIdentifier = isProd ? `${configurationData.id}:${entryPointUriPath}` : `__local:${entryPointUriPath}`;
   const developmentConfig = getRuntimeEnvironmentConfigForDevelopment({
     isProd,
     configurationData,
@@ -1283,7 +1315,7 @@ const getRuntimeEnvironmentConfig = _ref2 => {
 // again will result in returning the cached value.
 let cachedConfig;
 const processConfig = async function () {
-  var _ref4, _processEnv$MC_APP_EN, _appConfig$additional, _ref5, _appConfig$headers, _appConfig$headers2, _context3, _appConfig$headers3, _appConfig$headers4;
+  var _context;
   let _ref3 = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {},
     _ref3$disableCache = _ref3.disableCache,
     disableCache = _ref3$disableCache === void 0 ? false : _ref3$disableCache,
@@ -1302,22 +1334,22 @@ const processConfig = async function () {
     processEnv
   });
   const configurationData = transformConfigurationToData(configType, appConfig);
-  const appEnvKey = (_ref4 = (_processEnv$MC_APP_EN = processEnv.MC_APP_ENV) !== null && _processEnv$MC_APP_EN !== void 0 ? _processEnv$MC_APP_EN : processEnv.NODE_ENV) !== null && _ref4 !== void 0 ? _ref4 : 'development';
+  const appEnvKey = processEnv.MC_APP_ENV ?? processEnv.NODE_ENV ?? 'development';
   const isProd = getIsProd(processEnv);
-  const additionalAppEnv = (_appConfig$additional = appConfig.additionalEnv) !== null && _appConfig$additional !== void 0 ? _appConfig$additional : {};
-  const revision = (_ref5 = additionalAppEnv.revision) !== null && _ref5 !== void 0 ? _ref5 : '';
+  const additionalAppEnv = appConfig.additionalEnv ?? {};
+  const revision = additionalAppEnv.revision ?? '';
 
   // Parse all the supported URLs, which gets implicitly validated
 
   const envAppUrl = isProd ? configurationData.url : developmentAppUrl;
-  const appUrl = getOrThrow(() => new _URL__default["default"](envAppUrl), "Invalid application URL: \"".concat(envAppUrl, "\""));
+  const appUrl = getOrThrow(() => new _URL__default["default"](envAppUrl), `Invalid application URL: "${envAppUrl}"`);
 
   // Use `||` instead of `??` to include empty string values.
   const envCdnUrl = isProd ? appConfig.env.production.cdnUrl || appUrl.href : developmentAppUrl;
-  const cdnUrl = getOrThrow(() => new _URL__default["default"](envCdnUrl), "Invalid application CDN URL: \"".concat(envCdnUrl, "\""));
+  const cdnUrl = getOrThrow(() => new _URL__default["default"](envCdnUrl), `Invalid application CDN URL: "${envCdnUrl}"`);
   const mcApiUrl = getOrThrow(() => new _URL__default["default"](
   // Use `||` instead of `??` to include empty string values.
-  appConfig.mcApiUrl || mapCloudIdentifierToApiUrl(appConfig.cloudIdentifier)), "Invalid MC API URL: \"".concat(appConfig.mcApiUrl, "\""));
+  appConfig.mcApiUrl || mapCloudIdentifierToApiUrl(appConfig.cloudIdentifier)), `Invalid MC API URL: "${appConfig.mcApiUrl}"`);
   cachedConfig = {
     data: configurationData,
     env: getRuntimeEnvironmentConfig({
@@ -1332,16 +1364,16 @@ const processConfig = async function () {
       revision
     }),
     headers: _objectSpread(_objectSpread({}, appConfig.headers), {}, {
-      csp: _objectSpread(_objectSpread({}, (_appConfig$headers = appConfig.headers) === null || _appConfig$headers === void 0 ? void 0 : _appConfig$headers.csp), {}, {
+      csp: _objectSpread(_objectSpread({}, appConfig.headers?.csp), {}, {
         // We need to make sure the URL we use in these CSP headers have a slash in the end,
         // otherwise it might create an invalid value when application/CDN URL points to a
         // non-root directory (ex: https://www.my-domain.com/app). This is a valid URL but from
         // the CSP point of view, it will say only the file `app` can be used as a source, so
         // any other file from that domain will be forbidden. Using the slash (ex: https://www.my-domain.com/app/)
         // at the end it's like using a wildcard so anything 'below' `app` will be allowed.
-        'connect-src': getUniqueValues((_appConfig$headers2 = appConfig.headers) === null || _appConfig$headers2 === void 0 || (_appConfig$headers2 = _appConfig$headers2.csp) === null || _appConfig$headers2 === void 0 ? void 0 : _appConfig$headers2['connect-src'], _concatInstanceProperty__default["default"](_context3 = [mcApiUrl.origin]).call(_context3, isProd ? ["".concat(trimTrailingSlash(appUrl.href), "/"), "".concat(trimTrailingSlash(cdnUrl.href), "/")] : [])),
-        'script-src': getUniqueValues((_appConfig$headers3 = appConfig.headers) === null || _appConfig$headers3 === void 0 || (_appConfig$headers3 = _appConfig$headers3.csp) === null || _appConfig$headers3 === void 0 ? void 0 : _appConfig$headers3['script-src'], isProd ? ["".concat(trimTrailingSlash(appUrl.href), "/"), "".concat(trimTrailingSlash(cdnUrl.href), "/")] : []),
-        'style-src': getUniqueValues((_appConfig$headers4 = appConfig.headers) === null || _appConfig$headers4 === void 0 || (_appConfig$headers4 = _appConfig$headers4.csp) === null || _appConfig$headers4 === void 0 ? void 0 : _appConfig$headers4['style-src'], isProd ? ["".concat(trimTrailingSlash(appUrl.href), "/"), "".concat(trimTrailingSlash(cdnUrl.href), "/")] : [])
+        'connect-src': getUniqueValues(appConfig.headers?.csp?.['connect-src'], _concatInstanceProperty__default["default"](_context = [mcApiUrl.origin]).call(_context, isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])),
+        'script-src': getUniqueValues(appConfig.headers?.csp?.['script-src'], isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : []),
+        'style-src': getUniqueValues(appConfig.headers?.csp?.['style-src'], isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])
       })
     })
   };