@continuous-excellence/ze-great-dashboard-aws 0.29.0 → 0.30.0

package/dist/cli.js

@@ -327,11 +327,22 @@ var authSchema = z2.strictObject({
   /** A deliberately portable, explicit identity boundary for the first direct-OIDC release. */
   allow: z2.strictObject({ subjects: z2.array(z2.string().min(1)).min(1) })
 });
+var securityPolicies = ["warn", "required", "unsecured"];
+var securityPolicySchema = z2.enum(securityPolicies);
 var boardConfigSchema = z2.object({
   sources: z2.record(z2.string().min(1), sourceSchema).default({}),
   boards: z2.record(z2.string().min(1), boardSchema),
-  auth: authSchema.optional()
+  auth: authSchema.optional(),
+  security: securityPolicySchema.optional()
 }).superRefine((config, ctx) => {
+  if (config.security === "unsecured" && config.auth) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["security"],
+      message: "security: unsecured cannot be combined with auth",
+      params: { constraint: "Remove auth or select warn or required." }
+    });
+  }
   for (const [sourceName, source] of Object.entries(config.sources)) {
     const sourceSchema2 = source.type === "azure-devops" ? azureDevOpsSourceSchema : source.type === "gitlab-ci" ? gitlabCiSourceSchema : void 0;
     if (!sourceSchema2) continue;
@@ -397,6 +408,8 @@ var boardSchemaFileName = SCHEMA_FILE;
 
 // packages/shared/src/client-env.ts
 import { z as z3 } from "zod";
+var clientSecurityStates = ["warning", "blocked"];
+var clientSecurityStateSchema = z3.enum(clientSecurityStates);
 var clientEnvSchema = z3.object({
   /** Where the immutable client assets live. The one variable that repoints the whole client. */
   assetPath: z3.string().min(1),
@@ -411,7 +424,9 @@ var clientEnvSchema = z3.object({
     issuer: z3.string().min(1),
     clientId: z3.string().min(1),
     audience: z3.string().min(1)
-  }).optional()
+  }).optional(),
+  /** Public deployment posture; it contains no board, source, or credential details. */
+  security: clientSecurityStateSchema.optional()
 });
 var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: z3.string().min(1) });
 

package/dist/index.js

@@ -1008,11 +1008,22 @@ var authSchema = z2.strictObject({
   /** A deliberately portable, explicit identity boundary for the first direct-OIDC release. */
   allow: z2.strictObject({ subjects: z2.array(z2.string().min(1)).min(1) })
 });
+var securityPolicies = ["warn", "required", "unsecured"];
+var securityPolicySchema = z2.enum(securityPolicies);
 var boardConfigSchema = z2.object({
   sources: z2.record(z2.string().min(1), sourceSchema).default({}),
   boards: z2.record(z2.string().min(1), boardSchema),
-  auth: authSchema.optional()
+  auth: authSchema.optional(),
+  security: securityPolicySchema.optional()
 }).superRefine((config, ctx) => {
+  if (config.security === "unsecured" && config.auth) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["security"],
+      message: "security: unsecured cannot be combined with auth",
+      params: { constraint: "Remove auth or select warn or required." }
+    });
+  }
   for (const [sourceName, source] of Object.entries(config.sources)) {
     const sourceSchema2 = source.type === "azure-devops" ? azureDevOpsSourceSchema : source.type === "gitlab-ci" ? gitlabCiSourceSchema : void 0;
     if (!sourceSchema2) continue;
@@ -1078,6 +1089,8 @@ var boardSchemaFileName = SCHEMA_FILE;
 
 // packages/shared/src/client-env.ts
 import { z as z3 } from "zod";
+var clientSecurityStates = ["warning", "blocked"];
+var clientSecurityStateSchema = z3.enum(clientSecurityStates);
 var clientEnvSchema = z3.object({
   /** Where the immutable client assets live. The one variable that repoints the whole client. */
   assetPath: z3.string().min(1),
@@ -1092,7 +1105,9 @@ var clientEnvSchema = z3.object({
     issuer: z3.string().min(1),
     clientId: z3.string().min(1),
     audience: z3.string().min(1)
-  }).optional()
+  }).optional(),
+  /** Public deployment posture; it contains no board, source, or credential details. */
+  security: clientSecurityStateSchema.optional()
 });
 var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: z3.string().min(1) });
 

package/dist/lambda.mjs

@@ -69364,11 +69364,22 @@ var authSchema = external_exports.strictObject({
   /** A deliberately portable, explicit identity boundary for the first direct-OIDC release. */
   allow: external_exports.strictObject({ subjects: external_exports.array(external_exports.string().min(1)).min(1) })
 });
+var securityPolicies = ["warn", "required", "unsecured"];
+var securityPolicySchema = external_exports.enum(securityPolicies);
 var boardConfigSchema = external_exports.object({
   sources: external_exports.record(external_exports.string().min(1), sourceSchema).default({}),
   boards: external_exports.record(external_exports.string().min(1), boardSchema),
-  auth: authSchema.optional()
+  auth: authSchema.optional(),
+  security: securityPolicySchema.optional()
 }).superRefine((config2, ctx) => {
+  if (config2.security === "unsecured" && config2.auth) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["security"],
+      message: "security: unsecured cannot be combined with auth",
+      params: { constraint: "Remove auth or select warn or required." }
+    });
+  }
   for (const [sourceName, source] of Object.entries(config2.sources)) {
     const sourceSchema2 = source.type === "azure-devops" ? azureDevOpsSourceSchema : source.type === "gitlab-ci" ? gitlabCiSourceSchema : void 0;
     if (!sourceSchema2) continue;
@@ -69435,6 +69446,8 @@ function boardSchemaModeline(url2) {
 }
 
 // packages/shared/src/client-env.ts
+var clientSecurityStates = ["warning", "blocked"];
+var clientSecurityStateSchema = external_exports.enum(clientSecurityStates);
 var clientEnvSchema = external_exports.object({
   /** Where the immutable client assets live. The one variable that repoints the whole client. */
   assetPath: external_exports.string().min(1),
@@ -69449,7 +69462,9 @@ var clientEnvSchema = external_exports.object({
     issuer: external_exports.string().min(1),
     clientId: external_exports.string().min(1),
     audience: external_exports.string().min(1)
-  }).optional()
+  }).optional(),
+  /** Public deployment posture; it contains no board, source, or credential details. */
+  security: clientSecurityStateSchema.optional()
 });
 var clientIdentityResponseSchema = clientEnvSchema.pick({ assetPath: true, assetPathId: true }).extend({ serverVersion: external_exports.string().min(1) });
 
@@ -73042,7 +73057,9 @@ var configSchema = external_exports.object({
    * because it starts the server and the Vite dev server at the same moment, and without this the
    * local loop is a race the developer loses about half the time.
    */
-  templateWaitMillis: external_exports.coerce.number().int().min(0).default(0)
+  templateWaitMillis: external_exports.coerce.number().int().min(0).default(0),
+  /** Explicitly suppresses only the deployed authless warning, never required mode. */
+  allowUnprotectedDashboard: external_exports.enum(["true"]).optional().transform((value) => value === "true")
 });
 function loadConfig2(env2 = process.env) {
   const result = configSchema.safeParse({
@@ -73054,7 +73071,8 @@ function loadConfig2(env2 = process.env) {
     serverRelease: env2.SERVER_RELEASE,
     port: env2.PORT,
     host: env2.HOST,
-    templateWaitMillis: env2.TEMPLATE_WAIT_MS
+    templateWaitMillis: env2.TEMPLATE_WAIT_MS,
+    allowUnprotectedDashboard: env2.ALLOW_UNPROTECTED_DASHBOARD
   });
   if (!result.success) {
     throw new Error(`Invalid server configuration:
@@ -73945,6 +73963,7 @@ function serializeForScriptTag(value) {
 // packages/server/src/app.ts
 function createApp(deps) {
   const { config: config2 } = deps;
+  const app = new Hono2();
   const templates = new TemplateCache(deps.fetcher ?? globalThis.fetch);
   const selectedBoard = config2.board ?? Object.keys(deps.boardConfig?.boards ?? {})[0] ?? "ze-great-team";
   const allowlist = deps.allowlist ?? (deps.boardConfig ? deriveAllowlist(deps.boardConfig) : /* @__PURE__ */ new Map());
@@ -73955,7 +73974,6 @@ function createApp(deps) {
     config2.serverRelease,
     assetPathId(config2.assetPath)
   );
-  const app = new Hono2();
   app.use("/api/*", async (c5, next) => {
     const id = requestId();
     c5.set("dashboardRequestId", id);
@@ -74036,6 +74054,7 @@ function createApp(deps) {
     const outputConfig = {
       sources,
       boards: { [boardName]: outputBoard },
+      ...deps.boardConfig.security ? { security: deps.boardConfig.security } : {},
       ...deps.boardConfig.auth ? { auth: deps.boardConfig.auth } : {}
     };
     const filenameBoard = safeDownloadFilename(boardName);
@@ -74298,7 +74317,8 @@ ${(0, import_yaml.stringify)(outputConfig, { sortMapEntries: true })}`,
           clientId: deps.boardConfig.auth.client_id,
           audience: deps.boardConfig.auth.audience
         }
-      } : {}
+      } : {},
+      ...deps.securityState === "warning" ? { security: "warning" } : {}
     };
     return new Response(renderIndexHtml(template, env2), {
       headers: {
@@ -74316,6 +74336,28 @@ function safeDownloadFilename(value) {
   return sanitized || "board";
 }
 
+// packages/server/src/blocked-app.ts
+function createBlockedApp() {
+  const app = new Hono2();
+  app.get("/health", (c5) => c5.json({ status: "ok" }));
+  app.all(
+    "/api/*",
+    (c5) => c5.json({ error: "Dashboard authentication is required but is not configured." }, 503, {
+      "cache-control": "no-store"
+    })
+  );
+  const blocked = () => new Response(blockedEntrypoint(), {
+    status: 503,
+    headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }
+  });
+  app.get("/", blocked);
+  app.get("/boards/:board", blocked);
+  return app;
+}
+function blockedEntrypoint() {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Dashboard unavailable</title><style>body{margin:0;background:#12140f;color:#f4f2e8;font:clamp(18px,2vw,28px)/1.45 system-ui,sans-serif}main{max-width:42rem;margin:12vh auto;padding:2rem;border:4px solid #e05252;background:#1c1f18}h1{margin-top:0;color:#ff9b8e}a{color:#f4f2e8}</style></head><body><main role="alert"><h1>\u26A0 Authentication configuration required</h1><p>This dashboard is blocked because authentication is required but has not been configured.</p><p>No dashboard data was loaded.</p><p>Configure the board\u2019s <code>auth</code> block, then restart the dashboard. <a href="https://github.com/robertfmurdock/ze-great-dashboard/blob/main/docs/oidc-authentication.md">Read the authentication setup guide</a>.</p></main></body></html>`;
+}
+
 // packages/server/src/board-config.ts
 import { readFile as readFile4 } from "node:fs/promises";
 var import_yaml2 = __toESM(require_dist(), 1);
@@ -74374,6 +74416,14 @@ async function fetchBoardConfig(url2, fetcher) {
   return response.text();
 }
 
+// packages/server/src/security-posture.ts
+function deploymentSecurityState(config2, boardConfig) {
+  if (boardConfig.auth || boardConfig.security === "unsecured" || isLocalHost(config2.host))
+    return "normal";
+  if (boardConfig.security === "required") return "blocked";
+  return config2.allowUnprotectedDashboard ? "normal" : "warning";
+}
+
 // packages/server/src/startup-failure.ts
 var StartupFailure = class extends Error {
   diagnostic;
@@ -74399,21 +74449,41 @@ async function startup(options = {}) {
   try {
     const config2 = loadConfig2();
     const fetcher = options.fetcher ?? globalThis.fetch;
-    const [, boardConfig] = await Promise.all([
-      waitForTemplate(config2, fetcher).catch((error63) => {
-        throw new StartupFailure("template", error63);
-      }),
-      loadBoardConfig(
-        config2.boardConfigUrl,
-        fetcher,
-        config2.assetPath.includes("__ASSET_PATH__") ? void 0 : schemaUrlForAssetPath(config2.assetPath)
-      ).catch((error63) => {
-        throw new StartupFailure("board-config", error63);
-      })
-    ]);
+    const localTemplate = isLocalHost(config2.host) ? waitForTemplate(config2, fetcher).then(
+      () => void 0,
+      (error63) => new StartupFailure("template", error63)
+    ) : void 0;
+    const boardConfig = await loadBoardConfig(
+      config2.boardConfigUrl,
+      fetcher,
+      config2.assetPath.includes("__ASSET_PATH__") ? void 0 : schemaUrlForAssetPath(config2.assetPath)
+    ).catch((error63) => {
+      throw new StartupFailure("board-config", error63);
+    });
     category = "board-config";
     const board = selectBoard(config2.board, boardConfig);
     const resolvedConfig = { ...config2, board };
+    const securityState = deploymentSecurityState(resolvedConfig, boardConfig);
+    if (securityState === "blocked") {
+      logger2.log({
+        event: "server.required_auth_missing",
+        serverVersion: config2.serverRelease,
+        host: config2.host,
+        port: config2.port
+      });
+      return {
+        app: createBlockedApp(),
+        config: resolvedConfig
+      };
+    }
+    if (localTemplate) {
+      const failure3 = await localTemplate;
+      if (failure3) throw failure3;
+    } else {
+      await waitForTemplate(config2, fetcher).catch((error63) => {
+        throw new StartupFailure("template", error63);
+      });
+    }
     const allowlist = deriveValidatedAllowlist(boardConfig);
     const credentialNames = Object.values(boardConfig.sources).flatMap(credentialEnvironmentNames);
     category = "credentials";
@@ -74424,7 +74494,7 @@ async function startup(options = {}) {
     category = "authentication";
     const accessTokenVerifier = boardConfig.auth ? await createAccessTokenVerifier(boardConfig.auth, fetcher) : void 0;
     category = "unknown";
-    warnAboutMissingAuth(resolvedConfig, logger2);
+    if (securityState === "warning") warnAboutMissingAuth(resolvedConfig, logger2);
     return {
       app: createApp({
         config: resolvedConfig,
@@ -74497,7 +74567,6 @@ async function waitForTemplate(config2, fetcher) {
 }
 var RETRY_INTERVAL_MILLIS = 250;
 function warnAboutMissingAuth(config2, logger2) {
-  if (isLocalHost(config2.host)) return;
   logger2.log({
     event: "server.no_auth_warning",
     serverVersion: config2.serverRelease,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "type": "module",
   "description": "AWS server runtime and CloudFormation deployment tooling for Ze Great Dashboard.",
   "keywords": [