@contrail/cli 3.5.4 → 3.5.5-alpha.270bb0b

package/dist/commands/feature-flags/import.spec.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const fs_1 = tslib_1.__importDefault(require("fs"));
+const import_1 = require("./import");
+const file_helpers_1 = require("../../helpers/file-helpers");
+const feature_flags_1 = require("../../api/feature-flags");
+const users_1 = require("../../api/users");
+const logger_1 = tslib_1.__importDefault(require("../../logger"));
+jest.mock('../../helpers/file-helpers');
+jest.mock('../../api/feature-flags');
+jest.mock('../../api/users');
+const mocked = (fn) => fn;
+describe('assertCanManageFeatureFlags', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+    });
+    it.each(['PLATFORM_ADMIN', 'PLATFORM_MANAGER'])('allows a %s', async (role) => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({ platformRoles: [role] });
+        await expect((0, import_1.assertCanManageFeatureFlags)()).resolves.toBeUndefined();
+    });
+    it('accepts platformRoles serialized as a JSON string', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: '["PLATFORM_MANAGER"]',
+        });
+        await expect((0, import_1.assertCanManageFeatureFlags)()).resolves.toBeUndefined();
+    });
+    it('rejects a user with no platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({ platformRoles: [] });
+        await expect((0, import_1.assertCanManageFeatureFlags)()).rejects.toThrow('requires the PLATFORM_ADMIN or PLATFORM_MANAGER platform role');
+    });
+    it('rejects a user holding only some other platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_USER'],
+        });
+        await expect((0, import_1.assertCanManageFeatureFlags)()).rejects.toThrow('Your roles: PLATFORM_USER.');
+    });
+    it('rejects when the roles could not be read', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockRejectedValue(new Error('Forbidden resource'));
+        await expect((0, import_1.assertCanManageFeatureFlags)()).rejects.toThrow('Could not read your platform roles. Forbidden resource');
+    });
+});
+describe('uploadFeatureFlags', () => {
+    let existsSyncSpy;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        existsSyncSpy = jest.spyOn(fs_1.default, 'existsSync').mockReturnValue(true);
+        mocked(feature_flags_1.createFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.deleteFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([]);
+    });
+    afterEach(() => {
+        existsSyncSpy.mockRestore();
+    });
+    it('skips when the export has no feature-flags.yml', async () => {
+        existsSyncSpy.mockReturnValue(false);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+    });
+    it('skips an export that lists no flags instead of disabling everything in the target org', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue([]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([
+            { id: '1', featureName: 'SHOWROOM' },
+            { id: '2', featureName: 'DEV_TABS' },
+        ]);
+        const infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('lists no feature flags'));
+        infoSpy.mockRestore();
+    });
+    it('treats a blank feature-flags.yml the same as an empty list', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue(undefined);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([{ id: '1', featureName: 'SHOWROOM' }]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+    });
+    it('enables every flag from the export that the target org is missing', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }, { featureName: 'PROMOTE' }]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([{ id: '1', featureName: 'SHOWROOM' }]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledTimes(1);
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('PROMOTE');
+    });
+    it('disables flags the target org has that the export does not, so the orgs match', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([
+            { id: '1', featureName: 'SHOWROOM' },
+            { id: '2', featureName: 'DEV_TABS' },
+        ]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).toHaveBeenCalledTimes(1);
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).toHaveBeenCalledWith('2');
+    });
+    it('summarizes what it removed, and why, at the end of the run', async () => {
+        const infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([
+            { id: '1', featureName: 'SHOWROOM' },
+            { id: '2', featureName: 'PROMOTE' },
+            { id: '3', featureName: 'DEV_TABS' },
+        ]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        const summary = infoSpy.mock.calls.map(([message]) => String(message)).at(-1);
+        expect(summary).toContain('2 flag(s) were enabled in this org but not in the source');
+        expect(summary).toContain('DEV_TABS, PROMOTE');
+        infoSpy.mockRestore();
+    });
+    it('does not print a removal summary when nothing was removed', async () => {
+        const infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([{ id: '1', featureName: 'SHOWROOM' }]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        const messages = infoSpy.mock.calls.map(([message]) => String(message));
+        expect(messages.some((message) => message.includes('so they were removed'))).toBe(false);
+        infoSpy.mockRestore();
+    });
+    it('accepts plain feature names and ignores entries with no featureName', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue(['SHOWROOM', { featureName: '  PROMOTE  ' }, {}, null]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag).mock.calls.map(([name]) => name)).toEqual([
+            'SHOWROOM',
+            'PROMOTE',
+        ]);
+    });
+    it('rejects when the file is not a list', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue({ featureName: 'SHOWROOM' });
+        await expect((0, import_1.uploadFeatureFlags)('export-dir')).rejects.toThrow('must contain a YAML list of feature flags');
+    });
+    it('applies what it can and then rejects, rather than reporting success', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }, { featureName: 'PROMOTE' }]);
+        mocked(feature_flags_1.createFeatureFlag).mockImplementation(async (featureName) => {
+            if (featureName === 'SHOWROOM') {
+                throw new Error('Forbidden resource');
+            }
+            return {};
+        });
+        await expect((0, import_1.uploadFeatureFlags)('export-dir')).rejects.toThrow('could not enable SHOWROOM: Forbidden resource');
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('PROMOTE');
+    });
+});
+describe('uploadFeatureFlagsIfPermitted', () => {
+    let existsSyncSpy;
+    let infoSpy;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        existsSyncSpy = jest.spyOn(fs_1.default, 'existsSync').mockReturnValue(true);
+        infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.createFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.deleteFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([]);
+    });
+    afterEach(() => {
+        existsSyncSpy.mockRestore();
+        infoSpy.mockRestore();
+    });
+    const messages = () => infoSpy.mock.calls.map(([message]) => String(message)).join('\n');
+    it('applies the flags when the user has a platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_MANAGER'],
+        });
+        await (0, import_1.uploadFeatureFlagsIfPermitted)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('SHOWROOM');
+    });
+    it('skips with a log instead of failing when the user has no platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({ platformRoles: [] });
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).resolves.toBeUndefined();
+        expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+        expect(messages()).toContain('Skipping feature flags');
+        expect(messages()).toContain('PLATFORM_ADMIN or PLATFORM_MANAGER');
+        expect(messages()).toContain('contrail feature-flags import -d export-dir');
+    });
+    it('skips with a log when the platform roles cannot be read', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockRejectedValue(new Error('Forbidden resource'));
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).resolves.toBeUndefined();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(messages()).toContain('Skipping feature flags');
+        expect(messages()).toContain('Forbidden resource');
+    });
+    it('still propagates a failure from the upload itself', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_ADMIN'],
+        });
+        mocked(feature_flags_1.createFeatureFlag).mockRejectedValue(new Error('boom'));
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).rejects.toThrow('could not enable SHOWROOM: boom');
+    });
+});

package/dist/commands/instance/export.d.ts

@@ -10,3 +10,12 @@ export default class ExportInstance extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * Exports everything `contrail instance import` loads back: types, users, groups and the
+ * org's enabled feature flags. Org config (branding, sorting, admin-console settings) is
+ * written by getAllTypes, so it is not repeated here.
+ *
+ * Exporting feature flags is a plain read, so it works for any user — only the import side
+ * needs a platform role.
+ */
+export declare function exportInstance(outDir: string, overwrite: boolean): Promise<void>;

package/dist/commands/instance/export.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportInstance = void 0;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const core_1 = require("@oclif/core");
 const getAll_1 = require("../types/getAll");
 const export_1 = require("../users/export");
 const export_2 = require("../groups/export");
+const export_3 = require("../feature-flags/export");
 const basecommand_1 = require("../../basecommand");
 class ExportInstance extends basecommand_1.BaseCommand {
     static description = 'Exports an data of an instance including types and users';
@@ -29,9 +31,22 @@ class ExportInstance extends basecommand_1.BaseCommand {
         }),
     };
     async run() {
-        await (0, getAll_1.getAll)(this.flags.outDir, this.flags.overwrite);
-        await (0, export_1.exportUsers)(path.join(this.flags.outDir, 'users.yml'), this.flags.overwrite);
-        await (0, export_2.exportGroups)(path.join(this.flags.outDir, 'groups.yml'), this.flags.overwrite);
+        await exportInstance(this.flags.outDir, this.flags.overwrite);
     }
 }
 exports.default = ExportInstance;
+/**
+ * Exports everything `contrail instance import` loads back: types, users, groups and the
+ * org's enabled feature flags. Org config (branding, sorting, admin-console settings) is
+ * written by getAllTypes, so it is not repeated here.
+ *
+ * Exporting feature flags is a plain read, so it works for any user — only the import side
+ * needs a platform role.
+ */
+async function exportInstance(outDir, overwrite) {
+    await (0, getAll_1.getAll)(outDir, overwrite);
+    await (0, export_1.exportUsers)(path.join(outDir, 'users.yml'), overwrite);
+    await (0, export_2.exportGroups)(path.join(outDir, 'groups.yml'), overwrite);
+    await (0, export_3.exportFeatureFlags)(outDir, overwrite);
+}
+exports.exportInstance = exportInstance;

package/dist/commands/instance/export.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/instance/export.spec.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const export_1 = require("./export");
+const getAll_1 = require("../types/getAll");
+const export_2 = require("../users/export");
+const export_3 = require("../groups/export");
+const export_4 = require("../feature-flags/export");
+jest.mock('../types/getAll');
+jest.mock('../users/export');
+jest.mock('../groups/export');
+jest.mock('../feature-flags/export');
+const mocked = (fn) => fn;
+const STEPS = [getAll_1.getAll, export_2.exportUsers, export_3.exportGroups, export_4.exportFeatureFlags];
+describe('exportInstance', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+        for (const fn of STEPS) {
+            mocked(fn).mockResolvedValue(undefined);
+        }
+    });
+    it('exports everything the import loads back, including feature flags', async () => {
+        await (0, export_1.exportInstance)('out-dir', true);
+        expect(mocked(getAll_1.getAll)).toHaveBeenCalledWith('out-dir', true);
+        expect(mocked(export_2.exportUsers)).toHaveBeenCalledWith('out-dir/users.yml', true);
+        expect(mocked(export_3.exportGroups)).toHaveBeenCalledWith('out-dir/groups.yml', true);
+        expect(mocked(export_4.exportFeatureFlags)).toHaveBeenCalledWith('out-dir', true);
+    });
+    it('passes the overwrite flag through to the feature flags export', async () => {
+        await (0, export_1.exportInstance)('out-dir', false);
+        expect(mocked(export_4.exportFeatureFlags)).toHaveBeenCalledWith('out-dir', false);
+    });
+});

package/dist/commands/instance/import.d.ts

@@ -17,6 +17,9 @@ export default class ImportInstance extends BaseCommand {
  *   4. type overrides — after policies, because they reference policies, rule sets and option
  *      set hierarchies by slug and the API rejects the whole upload if any of them is missing
  *   5. org config
+ *   6. feature flags — skipped with a log message when the user has no platform role,
+ *      since applying them needs PLATFORM_ADMIN/PLATFORM_MANAGER but the rest of the
+ *      import does not, and org admins are expected to run this command
  *
  * Fails (rejects) if the type overrides could not be applied, so the import does not
  * report success while the org is missing customizations carried by overrides

package/dist/commands/instance/import.js

@@ -11,6 +11,7 @@ const uploadTypePropertyPolicies_1 = require("../types/uploadTypePropertyPolicie
 const uploadTypePolicies_1 = require("../types/uploadTypePolicies");
 const uploadTypeOverrides_1 = require("../types/uploadTypeOverrides");
 const import_3 = require("../org-config/import");
+const import_4 = require("../feature-flags/import");
 const basecommand_1 = require("../../basecommand");
 class ImportInstance extends basecommand_1.BaseCommand {
     static description = 'Import the data to an instance, including types and users';
@@ -40,6 +41,9 @@ exports.default = ImportInstance;
  *   4. type overrides — after policies, because they reference policies, rule sets and option
  *      set hierarchies by slug and the API rejects the whole upload if any of them is missing
  *   5. org config
+ *   6. feature flags — skipped with a log message when the user has no platform role,
+ *      since applying them needs PLATFORM_ADMIN/PLATFORM_MANAGER but the rest of the
+ *      import does not, and org admins are expected to run this command
  *
  * Fails (rejects) if the type overrides could not be applied, so the import does not
  * report success while the org is missing customizations carried by overrides
@@ -53,5 +57,6 @@ async function importInstance(dir) {
     await (0, uploadTypePolicies_1.uploadTypePolicies)(dir);
     await (0, uploadTypeOverrides_1.uploadTypeOverrides)(dir);
     await (0, import_3.uploadOrgConfig)(dir);
+    await (0, import_4.uploadFeatureFlagsIfPermitted)(dir);
 }
 exports.importInstance = importInstance;

package/dist/commands/instance/import.spec.js

@@ -8,6 +8,7 @@ const uploadTypePropertyPolicies_1 = require("../types/uploadTypePropertyPolicie
 const uploadTypePolicies_1 = require("../types/uploadTypePolicies");
 const uploadTypeOverrides_1 = require("../types/uploadTypeOverrides");
 const import_4 = require("../org-config/import");
+const import_5 = require("../feature-flags/import");
 jest.mock('../types/loadAll');
 jest.mock('../users/import');
 jest.mock('../groups/import');
@@ -15,6 +16,7 @@ jest.mock('../types/uploadTypePropertyPolicies');
 jest.mock('../types/uploadTypePolicies');
 jest.mock('../types/uploadTypeOverrides');
 jest.mock('../org-config/import');
+jest.mock('../feature-flags/import');
 const mocked = (fn) => fn;
 const STEPS = [
     loadAll_1.loadAll,
@@ -24,6 +26,7 @@ const STEPS = [
     uploadTypePolicies_1.uploadTypePolicies,
     uploadTypeOverrides_1.uploadTypeOverrides,
     import_4.uploadOrgConfig,
+    import_5.uploadFeatureFlagsIfPermitted,
 ];
 describe('importInstance', () => {
     beforeEach(() => {
@@ -37,6 +40,7 @@ describe('importInstance', () => {
         expect(mocked(loadAll_1.loadAll)).toHaveBeenCalledWith('export-dir', true, false);
         expect(mocked(uploadTypeOverrides_1.uploadTypeOverrides)).toHaveBeenCalledWith('export-dir');
         expect(mocked(import_4.uploadOrgConfig)).toHaveBeenCalledWith('export-dir');
+        expect(mocked(import_5.uploadFeatureFlagsIfPermitted)).toHaveBeenCalledWith('export-dir');
         const order = STEPS.map((fn) => mocked(fn).mock.invocationCallOrder[0]);
         // strictly increasing => called in exactly this order
         for (let i = 1; i < order.length; i++) {

package/dist/helpers/app/app-config-validators.d.ts

@@ -15,7 +15,12 @@ export declare const ERROR_MESSAGES: {
     ignoredAccessGrants: string;
     invalidPermission: (permission: string) => string;
     invalidAccessGrants: (error: string) => string;
+    invalidExtensionIcon: (identifier: string) => string;
+    invalidAppliesTo: (identifier: string, problem: string) => string;
 };
+export declare function isValidExtensionIcon(icon: unknown): boolean;
+/** Icons and appliesTo are checked here, since the apps service stores what it is given. */
+export declare function validateExtensionPlacement(appDeclaration: AppDeclaration): AppConfigValidationError;
 export declare function validateAppConfig(appConfig: AppDeclaration): void;
 export declare function appVersionValidator(appDeclaration: AppDeclaration): AppConfigValidationError;
 export declare function visibilityValidator(appDeclaration: AppDeclaration): AppConfigValidationError;

package/dist/helpers/app/app-config-validators.js

@@ -1,10 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateAccessGrants = exports.visibilityValidator = exports.appVersionValidator = exports.validateAppConfig = exports.ERROR_MESSAGES = void 0;
+exports.validateAccessGrants = exports.visibilityValidator = exports.appVersionValidator = exports.validateAppConfig = exports.validateExtensionPlacement = exports.isValidExtensionIcon = exports.ERROR_MESSAGES = void 0;
 const tslib_1 = require("tslib");
 const interfaces_1 = require("../../interfaces");
 const logger_1 = tslib_1.__importDefault(require("../../logger"));
-const VALIDATORS = [appVersionValidator, visibilityValidator, validateAccessGrants];
+const VALIDATORS = [
+    appVersionValidator,
+    visibilityValidator,
+    validateAccessGrants,
+    validateExtensionPlacement,
+];
 exports.ERROR_MESSAGES = {
     missingVersionField: 'Missing "version" field". Semantic App Version looks like "1.0.0". Use "contrail app version [patch|minor|major]" to update the app version.',
     invalidVersionField: '"version" field is not a string. Expecting a version like "1.0.0". Manually update the "version" field to be a string in the app.yml file.',
@@ -17,7 +22,75 @@ exports.ERROR_MESSAGES = {
     ignoredAccessGrants: 'App is set to public. accessGrants will be ignored.',
     invalidPermission: (permission) => `Invalid permission found in one of the accessGrants objects: ${permission}.`,
     invalidAccessGrants: (error) => `Invalid accessGrants. ${error}`,
+    invalidExtensionIcon: (identifier) => `Extension ${identifier}: icon must be a default icon name (like "line-builder"), { material: <icon name> } or { url: <SVG path or http(s) URL> }.`,
+    invalidAppliesTo: (identifier, problem) => `Extension ${identifier}: appliesTo ${problem}.`,
 };
+const STRING_LIST_FIELDS = ['typePaths', 'excludeTypePaths', 'roles'];
+const APPLIES_TO_FIELDS = [...STRING_LIST_FIELDS, 'minSelected', 'maxSelected', 'label'];
+function isValidExtensionIcon(icon) {
+    if (icon === undefined || icon === null) {
+        return true;
+    }
+    if (typeof icon === 'string') {
+        return /^[a-z0-9-]+$/.test(icon);
+    }
+    if (typeof icon !== 'object' || Array.isArray(icon) || Object.keys(icon).length !== 1) {
+        return false;
+    }
+    const { material, url } = icon;
+    if ('material' in icon) {
+        return typeof material === 'string' && /^[a-z0-9_]+$/.test(material);
+    }
+    if ('url' in icon) {
+        return typeof url === 'string' && url.length > 0 && !/^(javascript|data):/i.test(url.trim());
+    }
+    return false;
+}
+exports.isValidExtensionIcon = isValidExtensionIcon;
+function appliesToProblem(appliesTo) {
+    if (typeof appliesTo !== 'object' || appliesTo === null || Array.isArray(appliesTo)) {
+        return 'must be an object';
+    }
+    const fields = appliesTo;
+    const unknownField = Object.keys(fields).find((field) => !APPLIES_TO_FIELDS.includes(field));
+    if (unknownField) {
+        return `has an unknown field "${unknownField}" (use ${APPLIES_TO_FIELDS.join(', ')})`;
+    }
+    for (const field of STRING_LIST_FIELDS) {
+        const value = fields[field];
+        if (value !== undefined &&
+            (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string'))) {
+            return `${field} must be a list of strings`;
+        }
+    }
+    for (const [field, min] of [
+        ['minSelected', 0],
+        ['maxSelected', 1],
+    ]) {
+        const value = fields[field];
+        if (value !== undefined && (!Number.isInteger(value) || value < min)) {
+            return `${field} must be a whole number of at least ${min}`;
+        }
+    }
+    return undefined;
+}
+/** Icons and appliesTo are checked here, since the apps service stores what it is given. */
+function validateExtensionPlacement(appDeclaration) {
+    const errors = [];
+    for (const extension of appDeclaration?.extensions ?? []) {
+        if (!isValidExtensionIcon(extension.icon)) {
+            errors.push(exports.ERROR_MESSAGES.invalidExtensionIcon(extension.identifier));
+        }
+        if (extension.appliesTo !== undefined) {
+            const problem = appliesToProblem(extension.appliesTo);
+            if (problem) {
+                errors.push(exports.ERROR_MESSAGES.invalidAppliesTo(extension.identifier, problem));
+            }
+        }
+    }
+    return { errors, warnings: [] };
+}
+exports.validateExtensionPlacement = validateExtensionPlacement;
 function validateAppConfig(appConfig) {
     const errors = [];
     const warnings = [];
@@ -30,7 +103,7 @@ function validateAppConfig(appConfig) {
         logger_1.default.warn(warnings);
     }
     if (errors.length) {
-        throw new Error(`Invalid app config: \n ${errors.map((x) => x.error).join('\n')}`);
+        throw new Error(`Invalid app config: \n ${errors.map((x) => x?.error ?? x).join('\n')}`);
     }
 }
 exports.validateAppConfig = validateAppConfig;

package/dist/helpers/app/app-config-validators.spec.js

@@ -308,3 +308,38 @@ describe('validateAccessGrants', () => {
         expect(validationResult).toEqual(expectedError);
     });
 });
+describe('validateExtensionPlacement', () => {
+    const declarationWith = (extension) => ({
+        extensions: [{ identifier: 'line-builder', name: 'Line builder', ...extension }],
+    });
+    it('should accept default, Material and SVG icons, appliesTo, and extensions with neither', () => {
+        for (const icon of [
+            'line-builder',
+            { material: 'grid_on' },
+            { url: 'assets/icons/line-builder.svg' },
+            undefined,
+        ]) {
+            expect((0, app_config_validators_1.validateExtensionPlacement)(declarationWith({ icon }))).toEqual(validResult);
+        }
+        expect((0, app_config_validators_1.validateExtensionPlacement)(declarationWith({
+            appliesTo: {
+                typePaths: ['custom-entity:silhouette', 'item:product'],
+                excludeTypePaths: ['item:material'],
+                roles: ['family'],
+                maxSelected: 20,
+                label: 'Designs or BOMs',
+            },
+        }))).toEqual(validResult);
+    });
+    it('should name the extension whose icon or appliesTo is wrong', () => {
+        expect((0, app_config_validators_1.validateExtensionPlacement)(declarationWith({ icon: { url: 'javascript:alert(1)' } })).errors).toEqual([app_config_validators_1.ERROR_MESSAGES.invalidExtensionIcon('line-builder')]);
+        expect((0, app_config_validators_1.validateExtensionPlacement)(declarationWith({ appliesTo: { typePath: 'item' } })).errors[0]).toContain('unknown field "typePath"');
+        expect((0, app_config_validators_1.validateExtensionPlacement)(declarationWith({ appliesTo: { maxSelected: 0 } })).errors[0]).toContain('maxSelected must be a whole number of at least 1');
+    });
+    it('should show the message when validation fails', () => {
+        expect(() => (0, app_config_validators_1.validateAppConfig)({
+            version: '1.0.0',
+            ...declarationWith({ icon: 'Bad Icon' }),
+        })).toThrow(app_config_validators_1.ERROR_MESSAGES.invalidExtensionIcon('line-builder'));
+    });
+});

package/dist/helpers/app/extensions-deployer.d.ts

@@ -1,9 +1,17 @@
 import { AppExtensionDefinition } from '@contrail/entity-types';
-import { App, AppDeclaration, ExtensionDefinitionDeclaration } from '../../interfaces';
+import { App, AppDeclaration, ExtensionAppliesToDeclaration, ExtensionDefinitionDeclaration, ExtensionIconDeclaration } from '../../interfaces';
 export declare function getExtensionDefinitionsForAppVersion(app: App): Promise<AppExtensionDefinition[]>;
+/** Entity-types' definition plus placement, which the apps service stores as declared. */
+export type PlacedExtensionDefinition = AppExtensionDefinition & {
+    icon?: ExtensionIconDeclaration;
+    appliesTo?: ExtensionAppliesToDeclaration;
+    group?: string;
+};
+/** The definition published for an app.yml extension, for a new version or an update alike. */
+export declare function buildExtensionDefinition(extension: ExtensionDefinitionDeclaration, app: App, appName?: string): PlacedExtensionDefinition;
 export declare class ExtensionsDeployer {
     deployExtensions(appDeclaration: AppDeclaration, app: App): Promise<void>;
-    deployExtension(extension: ExtensionDefinitionDeclaration, app: App, existingExtensions: Array<any>): Promise<void>;
+    deployExtension(extension: ExtensionDefinitionDeclaration, app: App, existingExtensions: Array<any>, appName?: string): Promise<void>;
     private createNewExtensionDefinition;
     private updateActionDefinition;
 }

package/dist/helpers/app/extensions-deployer.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ExtensionsDeployer = exports.getExtensionDefinitionsForAppVersion = void 0;
+exports.ExtensionsDeployer = exports.buildExtensionDefinition = exports.getExtensionDefinitionsForAppVersion = void 0;
 const tslib_1 = require("tslib");
 const sdk_1 = require("@contrail/sdk");
 const chalk_1 = tslib_1.__importDefault(require("chalk"));
@@ -13,6 +13,28 @@ async function getExtensionDefinitionsForAppVersion(app) {
     });
 }
 exports.getExtensionDefinitionsForAppVersion = getExtensionDefinitionsForAppVersion;
+/** The definition published for an app.yml extension, for a new version or an update alike. */
+function buildExtensionDefinition(extension, app, appName) {
+    return {
+        identifier: util_1.AppUtil.createExtensionIdentifier({
+            extensionIdentifier: extension?.identifier,
+            appIdentifier: app.identifier,
+        }),
+        name: extension.name,
+        appId: app.id,
+        appVersionId: app.latestAppVersionId,
+        extensionType: extension.extensionType,
+        userApps: extension.userApps,
+        /** @deprecated since entity-types v1.5.1, use display instead */
+        modalDimensions: extension.modalDimensions,
+        display: extension.display,
+        iframeUrl: extension.iframeUrl,
+        icon: extension.icon,
+        appliesTo: extension.appliesTo,
+        group: extension.group ?? appName,
+    };
+}
+exports.buildExtensionDefinition = buildExtensionDefinition;
 class ExtensionsDeployer {
     async deployExtensions(appDeclaration, app) {
         // FETCH ALL EXTENSIONS FROM THE API.
@@ -26,11 +48,11 @@ class ExtensionsDeployer {
         logger_1.default.debug(appDeclaration.extensions);
         if (appDeclaration.extensions) {
             for (const extension of appDeclaration?.extensions ?? []) {
-                await this.deployExtension(extension, app, existingExtensions);
+                await this.deployExtension(extension, app, existingExtensions, appDeclaration.appName);
             }
         }
     }
-    async deployExtension(extension, app, existingExtensions) {
+    async deployExtension(extension, app, existingExtensions, appName) {
         logger_1.default.info(`${chalk_1.default.yellow.bold('EXTENSION')} \tDeploying extension: ${extension?.identifier}`);
         const identifier = util_1.AppUtil.createExtensionIdentifier({
             appIdentifier: app.identifier,
@@ -38,28 +60,14 @@ class ExtensionsDeployer {
         });
         const existingDefinition = existingExtensions.find((ad) => ad.identifier === identifier);
         if (!existingDefinition) {
-            await this.createNewExtensionDefinition(extension, app);
+            await this.createNewExtensionDefinition(extension, app, appName);
         }
         else {
-            await this.updateActionDefinition(existingDefinition, extension, app);
+            await this.updateActionDefinition(existingDefinition, extension, app, appName);
         }
     }
-    async createNewExtensionDefinition(extension, app) {
-        const newObject = {
-            identifier: util_1.AppUtil.createExtensionIdentifier({
-                extensionIdentifier: extension?.identifier,
-                appIdentifier: app.identifier,
-            }),
-            name: extension.name,
-            appId: app.id,
-            appVersionId: app.latestAppVersionId,
-            extensionType: extension.extensionType,
-            userApps: extension.userApps,
-            /** @deprecated since entity-types v1.5.1, use display instead */
-            modalDimensions: extension.modalDimensions,
-            display: extension.display,
-            iframeUrl: extension.iframeUrl,
-        };
+    async createNewExtensionDefinition(extension, app, appName) {
+        const newObject = buildExtensionDefinition(extension, app, appName);
         const actionDefinition = await new sdk_1.Entities().create({
             entityName: 'app-extension-definition',
             object: newObject,
@@ -67,22 +75,8 @@ class ExtensionsDeployer {
         logger_1.default.info(`${chalk_1.default.yellow.bold('EXTENSION')}     Created new extension definition: ${extension?.identifier}`);
         return actionDefinition;
     }
-    async updateActionDefinition(existingActionDefinition, extension, app) {
-        const updates = {
-            identifier: util_1.AppUtil.createExtensionIdentifier({
-                extensionIdentifier: extension?.identifier,
-                appIdentifier: app.identifier,
-            }),
-            name: extension.name,
-            appId: app.id,
-            appVersionId: app.latestAppVersionId,
-            extensionType: extension.extensionType,
-            userApps: extension.userApps,
-            /** @deprecated since entity-types v1.5.1, use display instead */
-            modalDimensions: extension.modalDimensions,
-            display: extension.display,
-            iframeUrl: extension.iframeUrl,
-        };
+    async updateActionDefinition(existingActionDefinition, extension, app, appName) {
+        const updates = buildExtensionDefinition(extension, app, appName);
         const extensionDefinition = await new sdk_1.Entities().update({
             entityName: 'app-extension-definition',
             id: existingActionDefinition.id,

package/dist/helpers/app/extensions-deployer.spec.d.ts

@@ -0,0 +1 @@
+export {};