@commercetools-frontend/application-config 25.0.0 → 25.2.0

package/dist/commercetools-frontend-application-config.esm.js

@@ -8,8 +8,8 @@ import _Object$defineProperties from '@babel/runtime-corejs3/core-js-stable/obje
 import _Object$defineProperty from '@babel/runtime-corejs3/core-js-stable/object/define-property';
 import _defineProperty from '@babel/runtime-corejs3/helpers/esm/defineProperty';
 import _includesInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/includes';
-import _concatInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/concat';
 import _URL from '@babel/runtime-corejs3/core-js-stable/url';
+import _concatInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/concat';
 import fs$1 from 'node:fs';
 import path, { parse } from 'node:path';
 import omitEmpty from 'omit-empty-es';
@@ -28,11 +28,13 @@ import _possibleConstructorReturn from '@babel/runtime-corejs3/helpers/esm/possi
 import _getPrototypeOf from '@babel/runtime-corejs3/helpers/esm/getPrototypeOf';
 import _inherits from '@babel/runtime-corejs3/helpers/esm/inherits';
 import _wrapNativeSuper from '@babel/runtime-corejs3/helpers/esm/wrapNativeSuper';
+import _startsWithInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/starts-with';
 import _trimInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/trim';
 import _JSON$stringify from '@babel/runtime-corejs3/core-js-stable/json/stringify';
-import _startsWithInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/starts-with';
+import path$1 from 'path';
 import _reduceInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/reduce';
-import { f as formatEntryPointUriPathToResourceAccessKey, e as entryPointUriPathToResourceAccesses } from './formatters-80a6c235.esm.js';
+import _bindInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/bind';
+import { f as formatEntryPointUriPathToResourceAccessKey, e as entryPointUriPathToResourceAccesses } from './formatters-5629a23b.esm.js';
 import _Set from '@babel/runtime-corejs3/core-js-stable/set';
 import _Array$isArray from '@babel/runtime-corejs3/core-js-stable/array/is-array';
 import Ajv from 'ajv';
@@ -112,11 +114,10 @@ const isDynamicAwaitSupported = () => {
 const isEsmModule = async cwd => {
   const packagePath = path.join(cwd, 'package.json');
   try {
-    var _JSON$parse;
     const packageJSON = await fs.readFile(packagePath, {
       encoding: 'utf-8'
     });
-    return ((_JSON$parse = JSON.parse(packageJSON)) === null || _JSON$parse === void 0 ? void 0 : _JSON$parse.type) === 'module';
+    return JSON.parse(packageJSON)?.type === 'module';
   } catch (error) {
     return false;
   }
@@ -136,7 +137,7 @@ const createExplorerFor = async configFileName => {
   const loaders = isDynamicAwaitSupported() || (await isEsmModule(process.cwd())) ? defaultLoaders : defaultLoadersSync;
   return cosmiconfig(configFileName, {
     searchStrategy: 'project',
-    searchPlaces: ["".concat(configFileName, ".js"), "".concat(configFileName, ".cjs"), "".concat(configFileName, ".mjs"), "".concat(configFileName, ".ts")],
+    searchPlaces: [`${configFileName}.js`, `${configFileName}.cjs`, `${configFileName}.mjs`, `${configFileName}.ts`],
     loaders: {
       '.js': loaders['.js'],
       '.cjs': loaders['.cjs'],
@@ -151,9 +152,9 @@ const getConfigPath = async () => {
   const customApplicationConfigFile = await customApplicationExplorer.search();
   const customViewConfigFile = await customViewExplorer.search();
   if (!customApplicationConfigFile && !customViewConfigFile) {
-    throw new Error("Missing or invalid configuration file.");
+    throw new Error(`Missing or invalid configuration file.`);
   }
-  return (customApplicationConfigFile === null || customApplicationConfigFile === void 0 ? void 0 : customApplicationConfigFile.filepath) || (customViewConfigFile === null || customViewConfigFile === void 0 ? void 0 : customViewConfigFile.filepath);
+  return customApplicationConfigFile?.filepath || customViewConfigFile?.filepath;
 };
 const loadConfig = async applicationPath => {
   const customApplicationExplorer = await createExplorerFor('custom-application-config');
@@ -161,10 +162,10 @@ const loadConfig = async applicationPath => {
   const customApplicationConfigFile = await customApplicationExplorer.search(applicationPath);
   const customViewConfigFile = await customViewExplorer.search(applicationPath);
   if ((!customApplicationConfigFile || !customApplicationConfigFile.config) && (!customViewConfigFile || !customViewConfigFile.config)) {
-    throw new MissingOrInvalidConfigError("Missing or invalid configuration file.");
+    throw new MissingOrInvalidConfigError(`Missing or invalid configuration file.`);
   }
   if (customApplicationConfigFile && customViewConfigFile) {
-    throw new MissingOrInvalidConfigError("Found configuration files for both Custom Application and Custom View. Please remove one of them.");
+    throw new MissingOrInvalidConfigError(`Found configuration files for both Custom Application and Custom View. Please remove one of them.`);
   }
   return customViewConfigFile || customApplicationConfigFile;
 };
@@ -183,6 +184,11 @@ const variableSyntax = /\${([ ~:\w.'",\-/()@]+?)}/g;
 const envRefSyntax = /^env:/g;
 const intlRefSyntax = /^intl:/g;
 const filePathRefSyntax = /^path:/g;
+
+// Safe regex pattern escaping function
+const escapeRegExp = string => {
+  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+};
 const hasVariablePlaceholder = valueOfEnvConfig => typeof valueOfEnvConfig === 'string' &&
 // Using `{regex}.test()` might cause false positives if called multiple
 // times on a global regular expression:
@@ -193,72 +199,103 @@ Boolean(valueOfEnvConfig.match(variableSyntax));
 const isEnvVariablePlaceholder = valueOfPlaceholder => Boolean(valueOfPlaceholder.match(envRefSyntax));
 const isIntlVariablePlaceholder = valueOfPlaceholder => Boolean(valueOfPlaceholder.match(intlRefSyntax));
 const isFilePathVariablePlaceholder = valueOfPlaceholder => Boolean(valueOfPlaceholder.match(filePathRefSyntax));
-const isStructuredJson = message => (message === null || message === void 0 ? void 0 : message.string) !== undefined;
+const isStructuredJson = message => message?.string !== undefined;
 const substituteEnvVariablePlaceholder = (valueOfPlaceholder, matchedString, valueOfEnvConfig, loadingOptions) => {
   const _valueOfPlaceholder$s = valueOfPlaceholder.split(':'),
     _valueOfPlaceholder$s2 = _slicedToArray(_valueOfPlaceholder$s, 2),
     requestedEnvVar = _valueOfPlaceholder$s2[1];
   const hasEnvField = loadingOptions.processEnv.hasOwnProperty(requestedEnvVar);
   if (!hasEnvField) {
-    var _context;
-    throw new Error(_concatInstanceProperty(_context = "Missing environment variable '".concat(requestedEnvVar, "' specified in config as 'env:")).call(_context, requestedEnvVar, "'."));
+    throw new Error(`Missing environment variable '${requestedEnvVar}' specified in config as 'env:${requestedEnvVar}'.`);
   }
-  const escapedMatchedString = matchedString.replace(/[${}:]/g, '\\$&');
-  return valueOfEnvConfig.replace(new RegExp("(".concat(escapedMatchedString, ")+"), 'g'), loadingOptions.processEnv[requestedEnvVar]);
+  return valueOfEnvConfig.replace(new RegExp(escapeRegExp(matchedString), 'g'), loadingOptions.processEnv[requestedEnvVar]);
 };
 const substituteIntlVariablePlaceholder = (valueOfPlaceholder, matchedString, valueOfEnvConfig, loadingOptions) => {
   const _valueOfPlaceholder$s3 = valueOfPlaceholder.split(':'),
     _valueOfPlaceholder$s4 = _slicedToArray(_valueOfPlaceholder$s3, 3),
     locale = _valueOfPlaceholder$s4[1],
     requestedIntlMessageId = _valueOfPlaceholder$s4[2];
-  const translationsFilePath = require.resolve("./i18n/data/".concat(locale, ".json"), {
-    paths: ["".concat(loadingOptions.applicationPath, "/src"), loadingOptions.applicationPath]
+  const translationsFilePath = require.resolve(`./i18n/data/${locale}.json`, {
+    paths: [`${loadingOptions.applicationPath}/src`, loadingOptions.applicationPath]
   });
   const translations = require(translationsFilePath);
   const hasIntlMessage = translations.hasOwnProperty(requestedIntlMessageId);
   if (!hasIntlMessage) {
-    var _context2, _context3;
-    throw new Error(_concatInstanceProperty(_context2 = _concatInstanceProperty(_context3 = "Missing message key '".concat(requestedIntlMessageId, "' specified in config as 'intl:")).call(_context3, locale, ":")).call(_context2, requestedIntlMessageId, "'."));
+    throw new Error(`Missing message key '${requestedIntlMessageId}' specified in config as 'intl:${locale}:${requestedIntlMessageId}'.`);
   }
   const translation = translations[requestedIntlMessageId];
   const translationValue = isStructuredJson(translation) ? translation.string : translation;
-  const escapedMatchedString = matchedString.replace(/[${}:]/g, '\\$&');
-  return valueOfEnvConfig.replace(new RegExp("(".concat(escapedMatchedString, ")+"), 'g'), translationValue);
+  return valueOfEnvConfig.replace(new RegExp(escapeRegExp(matchedString), 'g'), translationValue);
 };
 const substituteFilePathVariablePlaceholder = (valueOfPlaceholder, matchedString, valueOfEnvConfig, loadingOptions) => {
   const _valueOfPlaceholder$s5 = valueOfPlaceholder.split(':'),
     _valueOfPlaceholder$s6 = _slicedToArray(_valueOfPlaceholder$s5, 2),
     filePathOrModule = _valueOfPlaceholder$s6[1];
-  const content = fs$1.readFileSync(require.resolve(filePathOrModule, {
-    // Relative paths should be resolved from the application folder.
+  const resolvedPath = require.resolve(filePathOrModule, {
     paths: [loadingOptions.applicationPath]
-  }), {
+  });
+
+  // Security check: Prevent path traversal attacks.
+  // require.resolve() already provides protection by only resolving modules
+  // accessible from the applicationPath. However, we add an extra layer to
+  // prevent access to sensitive system files outside the workspace.
+  const normalizedPath = path$1.normalize(resolvedPath);
+  const applicationPath = path$1.normalize(loadingOptions.applicationPath);
+
+  // Find workspace root by traversing up from applicationPath until we find
+  // package.json, pnpm-workspace.yaml, or reach root
+  let workspaceRoot = applicationPath;
+  let currentPath = applicationPath;
+  const rootPath = path$1.parse(currentPath).root;
+  while (currentPath !== rootPath) {
+    const hasPackageJson = fs$1.existsSync(path$1.join(currentPath, 'package.json'));
+    const hasWorkspaceConfig = fs$1.existsSync(path$1.join(currentPath, 'pnpm-workspace.yaml')) || fs$1.existsSync(path$1.join(currentPath, 'lerna.json'));
+    if (hasPackageJson) {
+      workspaceRoot = currentPath;
+      if (hasWorkspaceConfig) {
+        // Found workspace root
+        break;
+      }
+    }
+    currentPath = path$1.dirname(currentPath);
+  }
+  const relativePath = path$1.relative(workspaceRoot, normalizedPath);
+
+  // Path is safe if it's within the workspace root.
+  // Use path.relative() to avoid string prefix vulnerabilities (e.g., "/app" vs "/app-evil")
+  const isSafePath = !_startsWithInstanceProperty(relativePath).call(relativePath, '..') && !path$1.isAbsolute(relativePath);
+  if (!isSafePath) {
+    throw new Error(`Access to files outside workspace directory is not allowed: ${filePathOrModule}`);
+  }
+  const content = fs$1.readFileSync(normalizedPath, {
     encoding: 'utf-8'
   });
-  const escapedMatchedString = matchedString.replace(/[${}:]/g, '\\$&');
-  return valueOfEnvConfig.replace(new RegExp("(".concat(escapedMatchedString, ")+"), 'g'), content);
+  return valueOfEnvConfig.replace(new RegExp(escapeRegExp(matchedString), 'g'), content);
 };
 const getValueOfPlaceholder = valueWithPlaceholder => valueWithPlaceholder.replace(variableSyntax, (_match, varName) => _trimInstanceProperty(varName).call(varName)).replace(/\s/g, '');
-const substituteVariablePlaceholders = (config, loadingOptions) => JSON.parse(_JSON$stringify(config), (_key, value) => {
-  // Only strings are allowed
-  let substitutedValue = value;
-  if (hasVariablePlaceholder(substitutedValue)) {
-    const matchResult = substitutedValue.match(variableSyntax);
-    if (matchResult) {
-      _forEachInstanceProperty(matchResult).call(matchResult, matchedString => {
-        const valueOfPlaceholder = getValueOfPlaceholder(matchedString);
-        if (isEnvVariablePlaceholder(valueOfPlaceholder)) {
-          substitutedValue = substituteEnvVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
-        } else if (isIntlVariablePlaceholder(valueOfPlaceholder)) {
-          substitutedValue = substituteIntlVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
-        } else if (isFilePathVariablePlaceholder(valueOfPlaceholder)) {
-          substitutedValue = substituteFilePathVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
-        }
-      });
+const substituteVariablePlaceholders = (config, loadingOptions) => {
+  const result = JSON.parse(_JSON$stringify(config), (_key, value) => {
+    // Only strings are allowed
+    let substitutedValue = value;
+    if (hasVariablePlaceholder(substitutedValue)) {
+      const matchResult = substitutedValue.match(variableSyntax);
+      if (matchResult) {
+        _forEachInstanceProperty(matchResult).call(matchResult, matchedString => {
+          const valueOfPlaceholder = getValueOfPlaceholder(matchedString);
+          if (isEnvVariablePlaceholder(valueOfPlaceholder)) {
+            substitutedValue = substituteEnvVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
+          } else if (isIntlVariablePlaceholder(valueOfPlaceholder)) {
+            substitutedValue = substituteIntlVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
+          } else if (isFilePathVariablePlaceholder(valueOfPlaceholder)) {
+            substitutedValue = substituteFilePathVariablePlaceholder(valueOfPlaceholder, matchedString, substitutedValue, loadingOptions);
+          }
+        });
+      }
     }
-  }
-  return substitutedValue;
-});
+    return substitutedValue;
+  });
+  return result;
+};
 
 var customApplicationSchemaJson = {
 	$schema: "http://json-schema.org/draft-07/schema",
@@ -929,13 +966,12 @@ const printErrors = errors => {
     return 'No errors';
   }
   return _mapInstanceProperty(errors).call(errors, error => {
-    var _context, _context2, _context3;
-    const baseMessage = _concatInstanceProperty(_context = "".concat(error.instancePath, " ")).call(_context, error.message);
+    const baseMessage = `${error.instancePath} ${error.message}`;
     switch (error.keyword) {
       case 'additionalProperties':
-        return _concatInstanceProperty(_context2 = "".concat(baseMessage, ": ")).call(_context2, error.params.additionalProperty);
+        return `${baseMessage}: ${error.params.additionalProperty}`;
       case 'enum':
-        return _concatInstanceProperty(_context3 = "".concat(baseMessage, ": ")).call(_context3, error.params.allowedValues.toString());
+        return `${baseMessage}: ${error.params.allowedValues.toString()}`;
       default:
         return baseMessage;
     }
@@ -948,8 +984,7 @@ const validateConfig = (configType, config) => {
   } else if (configType === LOADED_CONFIG_TYPES.CUSTOM_VIEW) {
     validation = validateCustomViewConfig;
   } else {
-    var _context4;
-    throw new Error(_concatInstanceProperty(_context4 = "Invalid config type \"".concat(configType, "\", expected ")).call(_context4, _Object$keys(LOADED_CONFIG_TYPES).toString()));
+    throw new Error(`Invalid config type "${configType}", expected ${_Object$keys(LOADED_CONFIG_TYPES).toString()}`);
   }
   const isValid = validation(config);
   if (!isValid) {
@@ -962,9 +997,9 @@ const validateEntryPointUriPath = config => {
   }
 };
 const validateSubmenuLinks = config => {
-  var _context5;
+  var _context;
   const uriPathSet = new _Set();
-  _forEachInstanceProperty(_context5 = config.submenuLinks).call(_context5, _ref => {
+  _forEachInstanceProperty(_context = config.submenuLinks).call(_context, _ref => {
     let uriPath = _ref.uriPath;
     if (uriPathSet.has(uriPath)) {
       throw new Error('Duplicate URI path. Every submenu link must have a unique URI path value');
@@ -973,64 +1008,63 @@ const validateSubmenuLinks = config => {
   });
 };
 const validateAdditionalOAuthScopes = config => {
-  var _config$additionalOAu;
+  var _context2, _context3;
   const additionalPermissionNames = new _Set();
-  (_config$additionalOAu = config.additionalOAuthScopes) === null || _config$additionalOAu === void 0 || _forEachInstanceProperty(_config$additionalOAu).call(_config$additionalOAu, _ref2 => {
+  ((_context2 = config.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty(_context3 = Function.call).call(_context3, _forEachInstanceProperty(_context2), _context2))?.(_ref2 => {
     let name = _ref2.name,
       view = _ref2.view,
       manage = _ref2.manage;
     if ((_Array$isArray(view) && view.length === 0 || !view) && (_Array$isArray(manage) && manage.length === 0 || !manage)) {
-      throw new Error("At least one OAuth Scope for permission group name \"".concat(name, "\" is required"));
+      throw new Error(`At least one OAuth Scope for permission group name "${name}" is required`);
     } else if (additionalPermissionNames.has(name)) {
-      throw new Error("Duplicate additional permission group name \"".concat(name, "\". Every additional permission must have a unique name"));
+      throw new Error(`Duplicate additional permission group name "${name}". Every additional permission must have a unique name`);
     }
     if (!name.match(PERMISSION_GROUP_NAME_REGEX)) {
-      throw new Error("Additional permission group name \"".concat(name, "\" is invalid. The value may be between 2 and 64 characters and only contain alphabetic lowercase characters and non-consecutive hyphens. Leading and trailing hyphens are also not allowed"));
+      throw new Error(`Additional permission group name "${name}" is invalid. The value may be between 2 and 64 characters and only contain alphabetic lowercase characters and non-consecutive hyphens. Leading and trailing hyphens are also not allowed`);
     }
     additionalPermissionNames.add(name);
   });
 };
 
 function ownKeys$1(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context5, _context6; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context5 = ownKeys$1(Object(t), !0)).call(_context5, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context6 = ownKeys$1(Object(t))).call(_context6, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _objectSpread$1(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context6 = ownKeys$1(Object(t), !0)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context7 = ownKeys$1(Object(t))).call(_context7, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
 
 // The `uriPath` of each submenu link is supposed to be defined relative
 // to the `entryPointUriPath`. Computing the full path is done internally to keep
 // the configuration simple.
 const computeUriPath = (uriPath, entryPointUriPath) => {
-  var _context;
   // In case the `uriPath` is only `/`, it means that the link is supposed to be
   // treated the same as the main application path. In this case, the return value
   // should not contain any unnecessary trailing slash and therefore we use the `entryPointUriPath`.
   if (uriPath === '/') return entryPointUriPath;
   // In case the `uriPath` is already configured including the `entryPointUriPath`,
   // we return the `uriPath` as-is.
-  if (_startsWithInstanceProperty(uriPath).call(uriPath, "".concat(entryPointUriPath, "/"))) return uriPath;
+  if (_startsWithInstanceProperty(uriPath).call(uriPath, `${entryPointUriPath}/`)) return uriPath;
   // Return the full path including the `entryPointUriPath` as a prefix.
-  return _concatInstanceProperty(_context = "".concat(entryPointUriPath, "/")).call(_context, uriPath);
+  return `${entryPointUriPath}/${uriPath}`;
 };
 const getPermissions = appConfig => {
-  var _context2, _appConfig$additional, _context3;
-  const additionalResourceAccessKeyToOauthScopeMap = _reduceInstanceProperty(_context2 = appConfig.additionalOAuthScopes || []).call(_context2, (previousOauthScope, _ref) => {
+  var _context, _context2, _context3, _context4;
+  const additionalResourceAccessKeyToOauthScopeMap = _reduceInstanceProperty(_context = appConfig.additionalOAuthScopes || []).call(_context, (previousOauthScope, _ref) => {
     let name = _ref.name,
       view = _ref.view,
       manage = _ref.manage;
     const formattedResourceKey = formatEntryPointUriPathToResourceAccessKey(name);
     return _objectSpread$1(_objectSpread$1({}, previousOauthScope), {}, {
-      ["view".concat(formattedResourceKey)]: view,
-      ["manage".concat(formattedResourceKey)]: manage
+      [`view${formattedResourceKey}`]: view,
+      [`manage${formattedResourceKey}`]: manage
     });
   }, {});
-  const additionalPermissionNames = ((_appConfig$additional = appConfig.additionalOAuthScopes) === null || _appConfig$additional === void 0 ? void 0 : _mapInstanceProperty(_appConfig$additional).call(_appConfig$additional, _ref2 => {
+  const additionalPermissionNames = ((_context2 = appConfig.additionalOAuthScopes) == null ? void 0 : _bindInstanceProperty(_context3 = Function.call).call(_context3, _mapInstanceProperty(_context2), _context2))?.(_ref2 => {
     let name = _ref2.name;
     return name;
-  })) || [];
+  }) || [];
   const permissionKeys = entryPointUriPathToResourceAccesses(appConfig.entryPointUriPath ||
   // In case the `entryPointUriPath` is not defined it is because the
   // configuration is for a custom view. In this case we use the
   // default entry point uri path.
   CUSTOM_VIEW_HOST_ENTRY_POINT_URI_PATH, additionalPermissionNames);
-  const additionalPermissions = _mapInstanceProperty(_context3 = _Object$keys(additionalResourceAccessKeyToOauthScopeMap)).call(_context3, additionalResourceAccessKey => ({
+  const additionalPermissions = _mapInstanceProperty(_context4 = _Object$keys(additionalResourceAccessKeyToOauthScopeMap)).call(_context4, additionalResourceAccessKey => ({
     name: permissionKeys[additionalResourceAccessKey],
     oAuthScopes: additionalResourceAccessKeyToOauthScopeMap[additionalResourceAccessKey]
   }));
@@ -1043,7 +1077,7 @@ const getPermissions = appConfig => {
   }, ...additionalPermissions];
 };
 function transformCustomApplicationConfigToData(appConfig) {
-  var _context4;
+  var _context5;
   validateEntryPointUriPath(appConfig);
   validateSubmenuLinks(appConfig);
   validateAdditionalOAuthScopes(appConfig);
@@ -1056,7 +1090,7 @@ function transformCustomApplicationConfigToData(appConfig) {
     permissions: getPermissions(appConfig),
     icon: appConfig.icon,
     mainMenuLink: appConfig.mainMenuLink,
-    submenuLinks: _mapInstanceProperty(_context4 = appConfig.submenuLinks).call(_context4, submenuLink => _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {
+    submenuLinks: _mapInstanceProperty(_context5 = appConfig.submenuLinks).call(_context5, submenuLink => _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {
       uriPath: computeUriPath(submenuLink.uriPath, appConfig.entryPointUriPath)
     }))
   };
@@ -1081,12 +1115,11 @@ function transformConfigurationToData(configType, configuration) {
   } else if (configType === LOADED_CONFIG_TYPES.CUSTOM_VIEW) {
     return transformCustomViewConfigToData(configuration);
   } else {
-    throw new Error("Invalid config type: ".concat(configType));
+    throw new Error(`Invalid config type: ${configType}`);
   }
 }
 
 const mapCloudIdentifierToApiUrl = key => {
-  var _context;
   switch (key) {
     case CLOUD_IDENTIFIERS.GCP_AU:
       return MC_API_URLS[CLOUD_IDENTIFIERS.GCP_AU];
@@ -1103,7 +1136,7 @@ const mapCloudIdentifierToApiUrl = key => {
     default:
       // We would probably never get to this point, as the JSON schema validation
       // kicks in before.
-      throw new Error(_concatInstanceProperty(_context = "Unknown cloud identifier \"".concat(key, "\". Supported values: ")).call(_context, _Object$values(CLOUD_IDENTIFIERS).toString()));
+      throw new Error(`Unknown cloud identifier "${key}". Supported values: ${_Object$values(CLOUD_IDENTIFIERS).toString()}`);
   }
 };
 const getUniqueValues = function () {
@@ -1127,10 +1160,10 @@ const getOrThrow = (fn, errorMessage) => {
 };
 
 function ownKeys(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context4, _context5; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context4 = ownKeys(Object(t), !0)).call(_context4, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context5 = ownKeys(Object(t))).call(_context5, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context2 = ownKeys(Object(t), !0)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
 // TODO: make it configurable.
 const developmentPort = 3001;
-const developmentAppUrl = "http://localhost:".concat(developmentPort);
+const developmentAppUrl = `http://localhost:${developmentPort}`;
 const getLoadedConfigurationType = configFileName => {
   if (_includesInstanceProperty(configFileName).call(configFileName, 'custom-view-config')) {
     return LOADED_CONFIG_TYPES.CUSTOM_VIEW;
@@ -1146,7 +1179,6 @@ const omitDevConfigIfEmpty = devConfig => {
 };
 const isCustomViewData = data => data.entryPointUriPath === undefined;
 const getRuntimeEnvironmentConfigForDevelopment = _ref => {
-  var _appConfig$env$develo;
   let isProd = _ref.isProd,
     configurationData = _ref.configurationData,
     mcApiUrl = _ref.mcApiUrl,
@@ -1163,7 +1195,7 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
     initialProjectKey:
     // For the `account` application, we should unset the projectKey.
     entryPointUriPath === 'account' ? undefined : appConfig.env.development.initialProjectKey
-  }, ((_appConfig$env$develo = appConfig.env.development) === null || _appConfig$env$develo === void 0 ? void 0 : _appConfig$env$develo.teamId) && _objectSpread({
+  }, appConfig.env.development?.teamId && _objectSpread({
     teamId: appConfig.env.development.teamId
   }, isCustomViewData(configurationData) ? {
     customViewId: configurationData.id
@@ -1171,12 +1203,11 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
     applicationId: configurationData.id
   })), {}, {
     oAuthScopes: appConfig.oAuthScopes,
-    additionalOAuthScopes: appConfig === null || appConfig === void 0 ? void 0 : appConfig.additionalOAuthScopes
+    additionalOAuthScopes: appConfig?.additionalOAuthScopes
   }));
   if (isCustomViewData(configurationData)) {
-    var _context;
     const hostUriPath = appConfig.env.development.hostUriPath;
-    const defaultHostUriPath = oidcConfig.initialProjectKey ? _concatInstanceProperty(_context = "/".concat(oidcConfig.initialProjectKey, "/")).call(_context, entryPointUriPath) : "/".concat(entryPointUriPath);
+    const defaultHostUriPath = oidcConfig.initialProjectKey ? `/${oidcConfig.initialProjectKey}/${entryPointUriPath}` : `/${entryPointUriPath}`;
     const hostUrl = new _URL(hostUriPath || defaultHostUriPath, developmentAppUrl);
     return omitDevConfigIfEmpty({
       oidc: oidcConfig,
@@ -1198,7 +1229,6 @@ const getRuntimeEnvironmentConfigForDevelopment = _ref => {
   });
 };
 const getRuntimeEnvironmentConfig = _ref2 => {
-  var _context2;
   let isProd = _ref2.isProd,
     configurationData = _ref2.configurationData,
     additionalAppEnv = _ref2.additionalAppEnv,
@@ -1217,7 +1247,7 @@ const getRuntimeEnvironmentConfig = _ref2 => {
   // In development, we prefix the entry point with the "__local" prefix.
   // This is important to determine to which URL the MC should redirect to
   // after successful login.
-  const applicationIdentifier = isProd ? _concatInstanceProperty(_context2 = "".concat(configurationData.id, ":")).call(_context2, entryPointUriPath) : "__local:".concat(entryPointUriPath);
+  const applicationIdentifier = isProd ? `${configurationData.id}:${entryPointUriPath}` : `__local:${entryPointUriPath}`;
   const developmentConfig = getRuntimeEnvironmentConfigForDevelopment({
     isProd,
     configurationData,
@@ -1249,7 +1279,7 @@ const getRuntimeEnvironmentConfig = _ref2 => {
 // again will result in returning the cached value.
 let cachedConfig;
 const processConfig = async function () {
-  var _ref4, _processEnv$MC_APP_EN, _appConfig$additional, _ref5, _appConfig$headers, _appConfig$headers2, _context3, _appConfig$headers3, _appConfig$headers4;
+  var _context;
   let _ref3 = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {},
     _ref3$disableCache = _ref3.disableCache,
     disableCache = _ref3$disableCache === void 0 ? false : _ref3$disableCache,
@@ -1268,22 +1298,22 @@ const processConfig = async function () {
     processEnv
   });
   const configurationData = transformConfigurationToData(configType, appConfig);
-  const appEnvKey = (_ref4 = (_processEnv$MC_APP_EN = processEnv.MC_APP_ENV) !== null && _processEnv$MC_APP_EN !== void 0 ? _processEnv$MC_APP_EN : processEnv.NODE_ENV) !== null && _ref4 !== void 0 ? _ref4 : 'development';
+  const appEnvKey = processEnv.MC_APP_ENV ?? processEnv.NODE_ENV ?? 'development';
   const isProd = getIsProd(processEnv);
-  const additionalAppEnv = (_appConfig$additional = appConfig.additionalEnv) !== null && _appConfig$additional !== void 0 ? _appConfig$additional : {};
-  const revision = (_ref5 = additionalAppEnv.revision) !== null && _ref5 !== void 0 ? _ref5 : '';
+  const additionalAppEnv = appConfig.additionalEnv ?? {};
+  const revision = additionalAppEnv.revision ?? '';
 
   // Parse all the supported URLs, which gets implicitly validated
 
   const envAppUrl = isProd ? configurationData.url : developmentAppUrl;
-  const appUrl = getOrThrow(() => new _URL(envAppUrl), "Invalid application URL: \"".concat(envAppUrl, "\""));
+  const appUrl = getOrThrow(() => new _URL(envAppUrl), `Invalid application URL: "${envAppUrl}"`);
 
   // Use `||` instead of `??` to include empty string values.
   const envCdnUrl = isProd ? appConfig.env.production.cdnUrl || appUrl.href : developmentAppUrl;
-  const cdnUrl = getOrThrow(() => new _URL(envCdnUrl), "Invalid application CDN URL: \"".concat(envCdnUrl, "\""));
+  const cdnUrl = getOrThrow(() => new _URL(envCdnUrl), `Invalid application CDN URL: "${envCdnUrl}"`);
   const mcApiUrl = getOrThrow(() => new _URL(
   // Use `||` instead of `??` to include empty string values.
-  appConfig.mcApiUrl || mapCloudIdentifierToApiUrl(appConfig.cloudIdentifier)), "Invalid MC API URL: \"".concat(appConfig.mcApiUrl, "\""));
+  appConfig.mcApiUrl || mapCloudIdentifierToApiUrl(appConfig.cloudIdentifier)), `Invalid MC API URL: "${appConfig.mcApiUrl}"`);
   cachedConfig = {
     data: configurationData,
     env: getRuntimeEnvironmentConfig({
@@ -1298,16 +1328,16 @@ const processConfig = async function () {
       revision
     }),
     headers: _objectSpread(_objectSpread({}, appConfig.headers), {}, {
-      csp: _objectSpread(_objectSpread({}, (_appConfig$headers = appConfig.headers) === null || _appConfig$headers === void 0 ? void 0 : _appConfig$headers.csp), {}, {
+      csp: _objectSpread(_objectSpread({}, appConfig.headers?.csp), {}, {
         // We need to make sure the URL we use in these CSP headers have a slash in the end,
         // otherwise it might create an invalid value when application/CDN URL points to a
         // non-root directory (ex: https://www.my-domain.com/app). This is a valid URL but from
         // the CSP point of view, it will say only the file `app` can be used as a source, so
         // any other file from that domain will be forbidden. Using the slash (ex: https://www.my-domain.com/app/)
         // at the end it's like using a wildcard so anything 'below' `app` will be allowed.
-        'connect-src': getUniqueValues((_appConfig$headers2 = appConfig.headers) === null || _appConfig$headers2 === void 0 || (_appConfig$headers2 = _appConfig$headers2.csp) === null || _appConfig$headers2 === void 0 ? void 0 : _appConfig$headers2['connect-src'], _concatInstanceProperty(_context3 = [mcApiUrl.origin]).call(_context3, isProd ? ["".concat(trimTrailingSlash(appUrl.href), "/"), "".concat(trimTrailingSlash(cdnUrl.href), "/")] : [])),
-        'script-src': getUniqueValues((_appConfig$headers3 = appConfig.headers) === null || _appConfig$headers3 === void 0 || (_appConfig$headers3 = _appConfig$headers3.csp) === null || _appConfig$headers3 === void 0 ? void 0 : _appConfig$headers3['script-src'], isProd ? ["".concat(trimTrailingSlash(appUrl.href), "/"), "".concat(trimTrailingSlash(cdnUrl.href), "/")] : []),
-        'style-src': getUniqueValues((_appConfig$headers4 = appConfig.headers) === null || _appConfig$headers4 === void 0 || (_appConfig$headers4 = _appConfig$headers4.csp) === null || _appConfig$headers4 === void 0 ? void 0 : _appConfig$headers4['style-src'], isProd ? ["".concat(trimTrailingSlash(appUrl.href), "/"), "".concat(trimTrailingSlash(cdnUrl.href), "/")] : [])
+        'connect-src': getUniqueValues(appConfig.headers?.csp?.['connect-src'], _concatInstanceProperty(_context = [mcApiUrl.origin]).call(_context, isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])),
+        'script-src': getUniqueValues(appConfig.headers?.csp?.['script-src'], isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : []),
+        'style-src': getUniqueValues(appConfig.headers?.csp?.['style-src'], isProd ? [`${trimTrailingSlash(appUrl.href)}/`, `${trimTrailingSlash(cdnUrl.href)}/`] : [])
       })
     })
   };

package/dist/{formatters-2a857809.cjs.prod.js → formatters-4515015b.cjs.prod.js}

@@ -12,7 +12,6 @@ var _slicedToArray = require('@babel/runtime-corejs3/helpers/slicedToArray');
 var _defineProperty = require('@babel/runtime-corejs3/helpers/defineProperty');
 var _mapInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/map');
 var _reduceInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/reduce');
-var _concatInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/concat');
 var _Object$entries = require('@babel/runtime-corejs3/core-js-stable/object/entries');
 var upperFirst = require('lodash/upperFirst');
 var constants = require('@commercetools-frontend/constants');
@@ -29,12 +28,11 @@ var _Object$defineProperties__default = /*#__PURE__*/_interopDefault(_Object$def
 var _Object$defineProperty__default = /*#__PURE__*/_interopDefault(_Object$defineProperty);
 var _mapInstanceProperty__default = /*#__PURE__*/_interopDefault(_mapInstanceProperty);
 var _reduceInstanceProperty__default = /*#__PURE__*/_interopDefault(_reduceInstanceProperty);
-var _concatInstanceProperty__default = /*#__PURE__*/_interopDefault(_concatInstanceProperty);
 var _Object$entries__default = /*#__PURE__*/_interopDefault(_Object$entries);
 var upperFirst__default = /*#__PURE__*/_interopDefault(upperFirst);
 
 function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context8, _context9; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context8 = ownKeys(Object(t), !0)).call(_context8, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context9 = ownKeys(Object(t))).call(_context9, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context6, _context7; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context6 = ownKeys(Object(t), !0)).call(_context6, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context7 = ownKeys(Object(t))).call(_context7, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
 /**
  * The function formats the `entryPointUriPath` to a resource access key.
  * It makes the first character of the string and the next character after a special character an uppercase.
@@ -61,8 +59,8 @@ const formatEntryPointUriPathToResourceAccessKey = entryPointUriPath => {
     // Regex below checking if the character is numeric.
     // If the word after the hyphen is numeric, replace the hyphen with a forward slash.
     // If not, omit the hyphen and uppercase the first character
-    if (i > 0 && /^-?\d+$/.test(word[0])) {
-      return "/".concat(word);
+    if (i > 0 && /^\d+$/.test(word[0])) {
+      return `/${word}`;
     }
     return upperFirst__default["default"](word);
   }).join('');
@@ -86,15 +84,14 @@ function entryPointUriPathToResourceAccesses(entryPointUriPath, permissionGroupN
   var _context4;
   const resourceAccessKey = constants.CUSTOM_VIEW_HOST_ENTRY_POINT_URI_PATH === entryPointUriPath ? '' : formatEntryPointUriPathToResourceAccessKey(entryPointUriPath);
   const defaultResourceAccesses = {
-    view: "view".concat(resourceAccessKey),
-    manage: "manage".concat(resourceAccessKey)
+    view: `view${resourceAccessKey}`,
+    manage: `manage${resourceAccessKey}`
   };
-  const additionalResourceAccesses = _reduceInstanceProperty__default["default"](_context4 = permissionGroupNames !== null && permissionGroupNames !== void 0 ? permissionGroupNames : []).call(_context4, (resourceAccesses, permissionGroupName) => {
-    var _context5, _context6;
+  const additionalResourceAccesses = _reduceInstanceProperty__default["default"](_context4 = permissionGroupNames ?? []).call(_context4, (resourceAccesses, permissionGroupName) => {
     const additionalResourceAccessKey = formatPermissionGroupNameToResourceAccessKey(permissionGroupName);
     return _objectSpread(_objectSpread({}, resourceAccesses), {}, {
-      ["view".concat(additionalResourceAccessKey)]: _concatInstanceProperty__default["default"](_context5 = "".concat(defaultResourceAccesses.view)).call(_context5, additionalResourceAccessKey),
-      ["manage".concat(additionalResourceAccessKey)]: _concatInstanceProperty__default["default"](_context6 = "".concat(defaultResourceAccesses.manage)).call(_context6, additionalResourceAccessKey)
+      [`view${additionalResourceAccessKey}`]: `${defaultResourceAccesses.view}${additionalResourceAccessKey}`,
+      [`manage${additionalResourceAccessKey}`]: `${defaultResourceAccesses.manage}${additionalResourceAccessKey}`
     });
   }, {});
   return _objectSpread(_objectSpread({}, defaultResourceAccesses), additionalResourceAccesses);
@@ -106,9 +103,9 @@ function computeCustomViewPermissionsKeys(permissionGroupNames) {
   return entryPointUriPathToPermissionKeys(constants.CUSTOM_VIEW_HOST_ENTRY_POINT_URI_PATH, permissionGroupNames || []);
 }
 function entryPointUriPathToPermissionKeys(entryPointUriPath, permissionGroupNames) {
-  var _context7;
-  const resourceAccesses = entryPointUriPathToResourceAccesses(entryPointUriPath, permissionGroupNames !== null && permissionGroupNames !== void 0 ? permissionGroupNames : []);
-  return _reduceInstanceProperty__default["default"](_context7 = _Object$entries__default["default"](resourceAccesses)).call(_context7, (permissionKeys, _ref) => {
+  var _context5;
+  const resourceAccesses = entryPointUriPathToResourceAccesses(entryPointUriPath, permissionGroupNames ?? []);
+  return _reduceInstanceProperty__default["default"](_context5 = _Object$entries__default["default"](resourceAccesses)).call(_context5, (permissionKeys, _ref) => {
     let _ref2 = _slicedToArray(_ref, 2),
       resourceAccessKey = _ref2[0],
       resourceAccessValue = _ref2[1];