@data-fair/dev-server 2.5.1 → 2.5.2

package/README.md

@@ -51,12 +51,23 @@ balise `<meta name="application-name">` de l'`index.html` local et de la version
 du `package.json`.
 
 Une application de base réservée à une organisation (`privateAccess`) est
-invisible à une requête anonyme : sans elle la liste est vide, quand bien même
-les applications qui l'utilisent seraient publiques. Le paramètre
-`privateAccess` la rend visible, mais data-fair répond 401 sans
-authentification — il n'est donc envoyé que si `DATAFAIR_API_KEY` est
-renseignée. Une clé d'API se crée depuis le compte ou l'organisation sur le
-data-fair distant, et se met dans le `.env` de l'application :
+invisible à une requête anonyme. Le paramètre `privateAccess` la rend visible,
+mais data-fair répond 401 sans authentification — il n'est donc envoyé que si
+`DATAFAIR_API_KEY` est renseignée.
+
+Ne pas la trouver n'arrête pas la recherche pour autant : les applications qui
+tournent dessus sont souvent publiques, et il suffit de connaître son URL pour
+les lister. Les URL des applications de base publiées suivent deux conventions
+(`<data-fair>/apps/<slug>/<mineure>/` et
+`https://cdn.jsdelivr.net/npm/@scope/<paquet>@<mineure>/dist/`), et le filtre
+de `/applications` est une égalité stricte : une URL devinée ne peut que ne
+rien renvoyer, jamais renvoyer autre chose. Les candidates sont donc essayées
+en une requête, ce qui suffit à lister les configurations publiques d'une
+application de base privée, sans aucune clé.
+
+Une clé reste nécessaire pour une application, elle, privée. Elle se crée
+depuis le compte ou l'organisation sur le data-fair distant, et se met dans le
+`.env` de l'application :
 
 ```
 DATAFAIR_API_KEY=xxx

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@data-fair/dev-server",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "description": "A development server for optimal development experience of data-fair applications.",
   "main": "src/index.js",
   "bin": {

package/src/app.js

@@ -3,6 +3,7 @@ import config from './config.js';
 import uiConfig from './ui-config.js';
 import { localizeConfig } from './localize.js';
 import { ATTACHMENTS_DIR, attachmentPath, copyAttachments, listAttachments } from './attachments.js';
+import { candidateBaseAppUrls } from './base-app-urls.js';
 import { WebSocket, WebSocketServer } from 'ws';
 import { createServer } from 'node:http';
 import express from 'express';
@@ -150,13 +151,16 @@ const localAppInfo = async () => {
         debug('failed to fetch local app index.html', err);
     }
     let version;
+    let packageName;
     try {
-        version = JSON.parse(readFileSync('package.json', 'utf8')).version;
+        const pkg = JSON.parse(readFileSync('package.json', 'utf8'));
+        version = pkg.version;
+        packageName = pkg.name;
     }
     catch (err) {
         debug('failed to read local package.json', err);
     }
-    return { name, version };
+    return { name, version, packageName };
 };
 // The owner the dev-server works on behalf of, in the "type:id[:department]" form the
 // data-fair api expects for its owner and privateAccess filters.
@@ -368,7 +372,7 @@ const minorVersion = (version) => version.split('.').slice(0, 2).join('.');
 // list configurations of the app under development that exist on the remote data-fair
 // with the same minor version, useful to test quickly for regressions
 app.get('/configurations', async (req, res) => {
-    const { name, version } = await localAppInfo();
+    const { name, version, packageName } = await localAppInfo();
     const response = { appName: name, localVersion: version, remoteUrl: config.dataFair.url };
     if (!name) {
         res.status(400).send({ ...response, error: 'The "application-name" meta tag was not found in the local app index.html' });
@@ -379,10 +383,9 @@ app.get('/configurations', async (req, res) => {
         return;
     }
     response.minorVersion = minorVersion(version);
-    // a base application restricted to an organization is invisible to an anonymous request, and
-    // without it the listing below finds nothing at all — the applications are then never reached,
-    // however public they are. privateAccess is what makes it visible, and data-fair answers 401
-    // to it without credentials, so it is only sent when an api key is configured.
+    // a base application restricted to an organization is invisible to an anonymous request.
+    // privateAccess is what makes it visible, and data-fair answers 401 to it without
+    // credentials, so it is only sent when an api key is configured.
     response.authenticated = !!config.dataFair.apiKey;
     try {
         let baseAppsQuery = '/base-applications?applicationName=' + encodeURIComponent(name) + '&size=1000&count=false';
@@ -390,16 +393,21 @@ app.get('/configurations', async (req, res) => {
             baseAppsQuery += '&privateAccess=' + encodeURIComponent(ownerFilter());
         const baseApps = await remoteFetch(baseAppsQuery);
         const matchingBaseApps = (baseApps.results ?? []).filter((b) => typeof b.version === 'string' && minorVersion(b.version) === response.minorVersion);
-        // told apart from "the base application exists but carries no application": the UI has no
-        // other way to explain an empty list, and a missing api key is by far the likeliest cause
-        response.baseAppFound = matchingBaseApps.length > 0;
-        response.results = [];
-        for (const baseApp of matchingBaseApps) {
-            const applications = await remoteFetch('/applications?base-application=' + encodeURIComponent(baseApp.url) + '&size=1000&count=false&select=id,title,owner');
-            for (const application of applications.results ?? []) {
-                response.results.push({ id: application.id, title: application.title, owner: application.owner, baseAppVersion: baseApp.version });
-            }
-        }
+        // Not finding the base application is not the end of the search: it may simply be private
+        // while the applications running on it are public, and those are reachable as soon as its
+        // url is known. Guessing the url costs nothing — the filter below is an exact match.
+        const versionByUrl = new Map(matchingBaseApps.map((b) => [b.url, b.version]));
+        const baseAppUrls = matchingBaseApps.length
+            ? [...versionByUrl.keys()]
+            : candidateBaseAppUrls(config.dataFair.url, name, packageName, response.minorVersion);
+        // one request for the whole set: the data-fair list filters accept comma separated values
+        const applications = await remoteFetch('/applications?base-application=' + encodeURIComponent(baseAppUrls.join(',')) + '&size=1000&count=false&select=id,title,owner,url');
+        response.results = (applications.results ?? []).map((application) => ({
+            id: application.id,
+            title: application.title,
+            owner: application.owner,
+            baseAppVersion: versionByUrl.get(application.url) ?? response.minorVersion
+        }));
         response.results.sort((a, b) => (a.title || '').localeCompare(b.title || ''));
         res.send(response);
     }

package/src/base-app-urls.d.ts

@@ -0,0 +1 @@
+export declare const candidateBaseAppUrls: (dataFairUrl: string, appName: string, packageName: string | undefined, minorVersion: string) => string[];

package/src/base-app-urls.js

@@ -0,0 +1,37 @@
+// Candidate urls of the base application under development.
+//
+// Discovering it by name is the authoritative path, but it only works for a base application
+// the request is allowed to see: one restricted to an organization is invisible to an anonymous
+// request, while the applications running on it are often public — which is precisely the case
+// of an application developed for a single customer. The /applications listing filters on an
+// exact url, so a wrong candidate returns nothing and a right one returns the applications: a
+// guess can never produce a false match, and they all fit in a single request.
+//
+// The two conventions published base applications follow, as of today:
+//   https://koumoul.com/apps/<slug>/<minor>/
+//   https://cdn.jsdelivr.net/npm/@scope/<package>@<minor>/dist/
+// The slug is the repository name, which is not always the application name — "Liste et fiches"
+// is served under /apps/list-details/ — so both are tried, along with the package name stripped
+// of the prefixes repositories use.
+const slugs = (appName, packageName) => {
+    const candidates = [appName];
+    if (packageName) {
+        const unscoped = packageName.startsWith('@') ? packageName.slice(packageName.indexOf('/') + 1) : packageName;
+        candidates.push(unscoped, unscoped.replace(/^(app|data-fair)-/, ''));
+    }
+    return [...new Set(candidates.filter(Boolean))];
+};
+export const candidateBaseAppUrls = (dataFairUrl, appName, packageName, minorVersion) => {
+    const urls = [];
+    // the same origin as the data-fair the dev-server talks to: a base application is served
+    // beside it, never on some unrelated host
+    const origin = new URL(dataFairUrl).origin;
+    for (const slug of slugs(appName, packageName)) {
+        urls.push(`${origin}/apps/${slug}/${minorVersion}/`);
+    }
+    if (packageName) {
+        const scoped = packageName.startsWith('@') ? packageName : '@data-fair/' + packageName;
+        urls.push(`https://cdn.jsdelivr.net/npm/${scoped}@${minorVersion}/dist/`);
+    }
+    return urls;
+};