@getxflow/cli 0.31.0 → 0.32.0

package/dist/commands/functions.js

@@ -9,11 +9,12 @@ const errors_1 = require("../errors");
 const json_arg_1 = require("../json-arg");
 const session_1 = require("../session");
 const ui_1 = require("../ui");
-/** Who can call the function: inside the app only, or an outside service holding a key. */
+/** Who can call the function: anyone, an outside service holding a key, or the app alone. */
 function accessLabel(fn) {
-    if (!fn.external_keys)
-        return 'in-app only';
-    return `external (${fn.external_keys} key${fn.external_keys > 1 ? 's' : ''})`;
+    const keys = fn.external_keys ? `external (${fn.external_keys} key${fn.external_keys > 1 ? 's' : ''})` : '';
+    if (fn.is_public)
+        return keys ? `public, ${keys}` : 'public';
+    return keys || 'in-app only';
 }
 const FUNCTIONS_DIR = 'functions';
 async function functionsList(args) {
@@ -28,6 +29,9 @@ async function functionsList(args) {
         fn.status === 'deployed' ? 'deployed' : fn.status === 'failed' ? 'failed' : fn.status,
         accessLabel(fn),
         fn.last_deployed_at ? (0, ui_1.formatAge)(fn.last_deployed_at) : '-',
+        // The address is not a secret (the app bundle carries it): a page or a
+        // webhook needs it, and asking the user to copy it out of the UI was a detour.
+        fn.invoke_url ?? '',
         fn.error_message ?? '',
     ]));
 }
@@ -50,7 +54,7 @@ function prettyBody(text) {
  * this package ships without dependencies and cannot reach into the platform. One test
  * holds the two halves together.
  */
-const WRAPPER_REASONS = ['no_pass', 'invalid', 'expired', 'no_access', 'unavailable', 'role'];
+const WRAPPER_REASONS = ['no_pass', 'invalid', 'expired', 'no_access', 'unavailable', 'role', 'access'];
 /** What to look at next, when the function did not answer with a success. */
 function failureHint(name, status, body) {
     let reason;

package/dist/help.js

@@ -64,7 +64,7 @@ ${(0, ui_1.bold)('Releasing')}
   xflow deployments               version history
 
 ${(0, ui_1.bold)('Functions')}
-  xflow functions list            what is deployed (they ship with xflow deploy)
+  xflow functions list            what is deployed, who may call it, the address
   xflow functions invoke <name> [--data '{"a":1}']
                                   call a function and print the answer
   xflow functions logs [name]     function crashes: stack and console output
@@ -261,13 +261,14 @@ build it and upload what the build writes. Dot entries are skipped. At most 5 MB
 unpacked and 1000 files.
 
 The page is public, so a file holding a secret key is refused whole: every visitor would read
-it. A function key is the exception: it opens that one function to every visitor, which is
-what a form on a landing page needs. Search engines are asked not to index pages, so do not
-promise SEO.
-
-A page takes the key of the whole organization, the one ${(0, ui_1.bold)('xflow login')} issues. The
-section is in beta: XFlow support switches it on for an organization. Switching a page off
-and deleting it are for a person, in the platform interface.`,
+it. A page that needs a backend (a form, a lookup) calls a cloud function that declares
+${(0, ui_1.bold)("exports.access = 'public'")}: such a function answers without a pass and without a
+key, and the page calls its address directly (${(0, ui_1.bold)('xflow functions list')} prints it). No
+key is baked into the page. Search engines are asked not to index pages, so do not promise SEO.
+
+A page takes the key of the whole organization, the one ${(0, ui_1.bold)('xflow login')} issues: a key
+scoped to projects is refused. Switching a page off and deleting it are for a person, in the
+platform interface.`,
     update: `${(0, ui_1.bold)('xflow update')}: bring the CLI up to date
 
 Installs the published version and, if anything changed, rewrites the platform

package/dist/version.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_API_URL = exports.CLI_VERSION = void 0;
 /** Keep in sync with cli/package.json. */
-exports.CLI_VERSION = '0.31.0';
+exports.CLI_VERSION = '0.32.0';
 /** Overridden by XFLOW_API_URL or the `api` field in xflow.json. */
 exports.DEFAULT_API_URL = 'https://app.getxflow.com';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getxflow/cli",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "CLI for the XFlow platform: source sync, deployment and publishing of applications",
   "license": "UNLICENSED",
   "engines": {

package/skills/xflow/SKILL.md

@@ -22,7 +22,7 @@ contains the fix.
 
 ## Keeping these instructions current
 
-These instructions ship with xflow CLI 0.31.0, so the copy you are reading can be older than
+These instructions ship with xflow CLI 0.32.0, so the copy you are reading can be older than
 the CLI answering your commands.
 
 When the CLI says this file does not match it, run `xflow skills --refresh` and then **read
@@ -288,7 +288,8 @@ with the platform on every call, and the handler receives the answer in `event.x
 exports.handler = async (event) => {
   const { caller, user } = event.xflow
   // caller: 'visitor' (a person), 'service' (another function of this project),
-  //         'external' (an outside service with a key), 'schedule' (a timer run)
+  //         'external' (an outside service with a key), 'schedule' (a timer run),
+  //         'public' (anyone, see below)
   // user:   { id, role } for a visitor, null for everything else
 }
 ```
@@ -321,13 +322,30 @@ An outside service (a payment webhook, a bot, a CRM) has no person behind it and
 that one function. Keys are not issued by default and the CLI cannot create one: a human issues
 it in the project settings, «Облачные функции» → the function → «Настройки»; a standalone
 function has a screen of its own, «Функции» → the function → «Настройки». Ask the user to do
-that and to paste the address back — never invent another way in. Send it in the
-`X-Function-Key` header. A function holds at most two keys, the second one to replace the first
-without downtime, not to serve a second consumer.
+that — never invent another way in. The service sends the key in the `X-Function-Key` header
+to the address `xflow functions list` prints. A function holds at most two keys, the second
+one to replace the first without downtime, not to serve a second consumer.
 
-`xflow functions list` shows who can reach each function: `in-app only` (no keys, answers
-only inside the application) or `external (N keys)` (a human issued external access). Key
-values are never shown there.
+A function behind a public page (a form on a landing, a lookup, a calculator on
+`xflowpage.ru`) has neither a person nor a key: every visitor calls it. Declare that in the
+code and nothing else is needed, no key, no setting, nobody to ask:
+
+```js
+exports.access = 'public'
+```
+
+The wrapper then lets a call without any credential through, with `caller: 'public'` and
+`user: null`, and never asks the platform. The page calls the address from `xflow functions
+list` directly (CORS is open) and bakes no key into its files. Everything else stays as it
+is: a call that does carry a pass or a key is still checked. Use it only for a function whose
+work is fine for anyone on the internet to trigger: it cannot hold `minRole`, and it must not
+write or delete data on the caller's word, there is no caller to trust. The platform marks
+such a function «Открыта всем»
+in the interface, and removing the line and deploying closes it again.
+
+`xflow functions list` shows who can reach each function: `in-app only` (answers only inside
+the application), `external (N keys)` (a human issued external access), `public` (the code
+opened it), and the address of every deployed function. Key values are never shown there.
 
 ## Secrets and connected accounts
 
@@ -605,15 +623,17 @@ platform: pick a page when the audience is outside the organization.
 - Static files only: HTML, CSS, JS, images, fonts, PDF, audio, video. No server code, database
   or functions on a page. Upload what the build writes (`dist`), never a folder with
   `package.json`. At most 5 MB zipped, 25 MB unpacked, 1000 files.
+- A page that needs a backend (a form, a lookup) calls a cloud function of a project that
+  declares `exports.access = 'public'` (see «Who is calling»): the page fetches the address
+  from `xflow functions list` directly, with no key and no header. The function lives in a
+  project, the page does not: deploy the function first, then upload the page.
 - Everything in a page is readable by every visitor. Never put a key, token or password into
-  it: a known key format gets the upload refused, anything else simply leaks. A function key is
-  the exception: a person issues it in the settings of the function, and a form on a page may
-  call that function with it. So can every visitor.
+  it: a known key format gets the upload refused, anything else simply leaks.
 - Search engines are asked not to index pages: do not promise SEO.
 - The MCP `pages` tool uploads one self-contained HTML document up to 150 KB.
-- Pages take the key of the whole organization, the one `xflow login` issues. The section is in
-  beta, switched on per organization by XFlow support: that refusal is not yours to fix. Switching
-  a page off and deleting it are for a person, in the platform interface.
+- Pages take the key of the whole organization, the one `xflow login` issues; a key scoped to
+  projects is refused, and that refusal is not yours to fix. Switching a page off and deleting it
+  are for a person, in the platform interface.
 
 ## Organizations and keys