@lightdash/cli 1.104.0 → 1.106.0

package/dist/handlers/apps/preview.d.ts

@@ -1,3 +1,4 @@
+import { type DataAppManifest } from '@lightdash/common';
 /**
  * Environment passed to the `npm run dev` child process. Only the small set of
  * host variables needed to launch a portable child process is inherited. In
@@ -10,8 +11,17 @@ export declare const buildPreviewChildEnv: (args: {
     projectUuid: string;
     proxyPort: number;
     proxyNonce: string;
+    browserImageOrigins?: string[];
     parentEnv?: NodeJS.ProcessEnv;
 }) => Record<string, string>;
+export declare const fetchBrowserImageOrigins: (args: {
+    manifest: DataAppManifest;
+    projectUuid: string;
+    serverUrl: string;
+    authorization: string;
+    proxyAuthorization?: string;
+    fetchFn?: typeof fetch;
+}) => Promise<string[]>;
 /**
  * Older downloads have a vite.config.js that proxies /api straight to the
  * instance and expects the credential in .env.local — incompatible with the

package/dist/handlers/apps/preview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/preview.ts"],"names":[],"mappings":"AAcA;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,SAAU;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACjC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CA2CxB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,WACtC,MAAM,KACf,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF,eAAO,MAAM,oBAAoB,SAAgB;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CA2BlD,CAAC;AAQF,eAAO,MAAM,wBAAwB,WACzB,MAAM,KACf,OAAO,CAAC,IAAI,CAMd,CAAC;AAyBF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,SAAgB;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACtB,KAAG,OAAO,CAAC,IAAI,CAuEf,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,SAAU;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACrB,KAAG,MACgT,CAAC;AAErT,eAAO,MAAM,uBAAuB,SAAgB;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,KAAG,OAAO,CAAC,OAAO,CAmBlB,CAAC;AAKF,eAAO,MAAM,6BAA6B,WAC9B,MAAM,KACf,OAAO,CAAC,OAAO,CAmBjB,CAAC;AAkBF,KAAK,kBAAkB,GAAG;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,kBAAkB,QACtB,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SASX,CAAC;AAEF,eAAO,MAAM,kBAAkB,YAClB,MAAM,GAAG,SAAS,WAClB,kBAAkB,KAC5B,OAAO,CAAC,IAAI,CAkId,CAAC"}
+{"version":3,"file":"preview.d.ts","sourceRoot":"","sources":["../../../src/handlers/apps/preview.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,eAAe,EACvB,MAAM,mBAAmB,CAAC;AAc3B;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,SAAU;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACjC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CA8CxB,CAAC;AAEF,eAAO,MAAM,wBAAwB,SAAgB;IACjD,QAAQ,EAAE,eAAe,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,KAAG,OAAO,CAAC,MAAM,EAAE,CA6EnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,WACtC,MAAM,KACf,OAAO,CAAC,IAAI,CAWd,CAAC;AAEF,eAAO,MAAM,oBAAoB,SAAgB;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;CACf,KAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CA2BlD,CAAC;AAQF,eAAO,MAAM,wBAAwB,WACzB,MAAM,KACf,OAAO,CAAC,IAAI,CAMd,CAAC;AAyBF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,SAAgB;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACtB,KAAG,OAAO,CAAC,IAAI,CAuEf,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,SAAU;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACrB,KAAG,MACgT,CAAC;AAErT,eAAO,MAAM,uBAAuB,SAAgB;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,KAAG,OAAO,CAAC,OAAO,CAmBlB,CAAC;AAKF,eAAO,MAAM,6BAA6B,WAC9B,MAAM,KACf,OAAO,CAAC,OAAO,CAmBjB,CAAC;AAkBF,KAAK,kBAAkB,GAAG;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,kBAAkB,QACtB,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SASX,CAAC;AAEF,eAAO,MAAM,kBAAkB,YAClB,MAAM,GAAG,SAAS,WAClB,kBAAkB,KAC5B,OAAO,CAAC,IAAI,CA2Id,CAAC"}

package/dist/handlers/apps/preview.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.appsPreviewHandler = exports.resolvePreviewPort = exports.removeLegacyPreviewCredential = exports.preflightPreviewRequest = exports.projectNotFoundMessage = exports.ensureNodeModules = exports.assertNodeModulesPresent = exports.resolvePreviewTarget = exports.assertScaffoldingSupportsPreviewProxy = exports.buildPreviewChildEnv = void 0;
+exports.appsPreviewHandler = exports.resolvePreviewPort = exports.removeLegacyPreviewCredential = exports.preflightPreviewRequest = exports.projectNotFoundMessage = exports.ensureNodeModules = exports.assertNodeModulesPresent = exports.resolvePreviewTarget = exports.assertScaffoldingSupportsPreviewProxy = exports.fetchBrowserImageOrigins = exports.buildPreviewChildEnv = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@lightdash/common");
 const crypto_1 = require("crypto");
@@ -64,9 +64,68 @@ const buildPreviewChildEnv = (args) => {
         VITE_LIGHTDASH_PROJECT_UUID: args.projectUuid,
         LIGHTDASH_PREVIEW_PROXY_TARGET: `http://127.0.0.1:${args.proxyPort}`,
         LIGHTDASH_PREVIEW_PROXY_NONCE: args.proxyNonce,
+        LIGHTDASH_PREVIEW_BROWSER_IMAGE_ORIGINS: JSON.stringify(args.browserImageOrigins ?? []),
     };
 };
 exports.buildPreviewChildEnv = buildPreviewChildEnv;
+const fetchBrowserImageOrigins = async (args) => {
+    const linkedSlugs = new Set((args.manifest.externalConnections ?? []).map(({ connectionSlug }) => connectionSlug));
+    if (linkedSlugs.size === 0)
+        return [];
+    const response = await (args.fetchFn ?? fetch)(new URL(`/api/v1/ee/projects/${args.projectUuid}/external-connections`, args.serverUrl), {
+        headers: {
+            Authorization: args.authorization,
+            ...(args.proxyAuthorization
+                ? { 'Proxy-Authorization': args.proxyAuthorization }
+                : {}),
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`Could not resolve browser image origins for local preview (${response.status}).`);
+    }
+    const payload = await response.json();
+    if (typeof payload !== 'object' ||
+        payload === null ||
+        !('results' in payload) ||
+        !Array.isArray(payload.results)) {
+        return [];
+    }
+    return [
+        ...new Set(payload.results.flatMap((connection) => {
+            if (typeof connection !== 'object' ||
+                connection === null ||
+                !('slug' in connection) ||
+                typeof connection.slug !== 'string' ||
+                !linkedSlugs.has(connection.slug) ||
+                !('allowBrowserImages' in connection) ||
+                connection.allowBrowserImages !== true ||
+                !('type' in connection) ||
+                connection.type !== 'none' ||
+                !('origin' in connection) ||
+                typeof connection.origin !== 'string') {
+                return [];
+            }
+            let originUrl;
+            try {
+                originUrl = new URL(connection.origin);
+            }
+            catch {
+                return [];
+            }
+            if (originUrl.protocol !== 'https:' ||
+                originUrl.username ||
+                originUrl.password ||
+                (originUrl.pathname && originUrl.pathname !== '/') ||
+                originUrl.search ||
+                originUrl.hash ||
+                !originUrl.hostname) {
+                return [];
+            }
+            return [originUrl.origin];
+        })),
+    ].sort();
+};
+exports.fetchBrowserImageOrigins = fetchBrowserImageOrigins;
 /**
  * Older downloads have a vite.config.js that proxies /api straight to the
  * instance and expects the credential in .env.local — incompatible with the
@@ -297,6 +356,7 @@ const appsPreviewHandler = async (pathArg, options) => {
         currentProjectUuid: config.context?.project,
         cwd: process.cwd(),
     });
+    const manifest = await (0, appCodeFiles_1.readManifestFromDir)(target.appDir);
     await (0, exports.ensureNodeModules)({
         appDir: target.appDir,
         assumeYes: options.assumeYes,
@@ -324,6 +384,13 @@ const appsPreviewHandler = async (pathArg, options) => {
             serverUrl,
         }));
     }
+    const browserImageOrigins = await (0, exports.fetchBrowserImageOrigins)({
+        manifest,
+        projectUuid: target.projectUuid,
+        serverUrl,
+        authorization,
+        proxyAuthorization,
+    });
     // Previous versions persisted this credential in .env.local. Remove only
     // that obsolete entry, preserving any unrelated user-managed settings.
     if (await (0, exports.removeLegacyPreviewCredential)(target.appDir)) {
@@ -358,6 +425,7 @@ const appsPreviewHandler = async (pathArg, options) => {
                 projectUuid: target.projectUuid,
                 proxyPort: proxy.port,
                 proxyNonce,
+                browserImageOrigins,
             }),
         });
     }

package/dist/handlers/apps/preview.test.js

@@ -40,6 +40,7 @@ describe('buildPreviewChildEnv', () => {
             projectUuid: 'proj-uuid-1',
             proxyPort: 45678,
             proxyNonce: 'nonce-abc',
+            browserImageOrigins: ['https://tiles.example.com'],
             parentEnv: {
                 HOME: '/home/developer',
                 PATH: '/usr/bin',
@@ -57,6 +58,7 @@ describe('buildPreviewChildEnv', () => {
             VITE_LIGHTDASH_PROJECT_UUID: 'proj-uuid-1',
             LIGHTDASH_PREVIEW_PROXY_TARGET: 'http://127.0.0.1:45678',
             LIGHTDASH_PREVIEW_PROXY_NONCE: 'nonce-abc',
+            LIGHTDASH_PREVIEW_BROWSER_IMAGE_ORIGINS: '["https://tiles.example.com"]',
         });
         expect(env).not.toHaveProperty('LIGHTDASH_API_KEY');
         expect(env).not.toHaveProperty('LIGHTDASH_PROXY_AUTHORIZATION');
@@ -75,6 +77,90 @@ describe('buildPreviewChildEnv', () => {
         expect(env.VITE_LIGHTDASH_URL).toBe('http://localhost:3000');
     });
 });
+describe('fetchBrowserImageOrigins', () => {
+    it('returns opted-in no-auth origins linked by manifest slug', async () => {
+        const connection = {
+            slug: 'public-tiles',
+            type: 'none',
+            origin: 'https://tiles.example.com',
+            allowBrowserImages: true,
+        };
+        const origins = await (0, preview_1.fetchBrowserImageOrigins)({
+            manifest: {
+                ...previewBundle.manifest,
+                externalConnections: [
+                    { alias: 'tiles', connectionSlug: 'public-tiles' },
+                ],
+            },
+            projectUuid: 'proj-uuid-1',
+            serverUrl: 'https://lightdash.example.com',
+            authorization: 'ApiKey token',
+            fetchFn: vi.fn().mockResolvedValue({
+                ok: true,
+                json: async () => ({ results: [connection] }),
+            }),
+        });
+        expect(origins).toEqual(['https://tiles.example.com']);
+    });
+    it('fails closed for malformed response shapes', async () => {
+        const origins = await (0, preview_1.fetchBrowserImageOrigins)({
+            manifest: {
+                ...previewBundle.manifest,
+                externalConnections: [
+                    { alias: 'tiles', connectionSlug: 'public-tiles' },
+                ],
+            },
+            projectUuid: 'proj-uuid-1',
+            serverUrl: 'https://lightdash.example.com',
+            authorization: 'ApiKey token',
+            fetchFn: vi.fn().mockResolvedValue({
+                ok: true,
+                json: async () => ({ results: 'not-an-array' }),
+            }),
+        });
+        expect(origins).toEqual([]);
+    });
+    it('ignores malformed connections and unsafe origins', async () => {
+        const origins = await (0, preview_1.fetchBrowserImageOrigins)({
+            manifest: {
+                ...previewBundle.manifest,
+                externalConnections: [
+                    { alias: 'tiles', connectionSlug: 'public-tiles' },
+                ],
+            },
+            projectUuid: 'proj-uuid-1',
+            serverUrl: 'https://lightdash.example.com',
+            authorization: 'ApiKey token',
+            fetchFn: vi.fn().mockResolvedValue({
+                ok: true,
+                json: async () => ({
+                    results: [
+                        null,
+                        {
+                            slug: 'public-tiles',
+                            type: 'none',
+                            origin: 'not-a-url',
+                            allowBrowserImages: true,
+                        },
+                        {
+                            slug: 'public-tiles',
+                            type: 'none',
+                            origin: 'https://tiles.example.com/path',
+                            allowBrowserImages: true,
+                        },
+                        {
+                            slug: 'public-tiles',
+                            type: 'none',
+                            origin: 'https://tiles.example.com',
+                            allowBrowserImages: true,
+                        },
+                    ],
+                }),
+            }),
+        });
+        expect(origins).toEqual(['https://tiles.example.com']);
+    });
+});
 describe('assertScaffoldingSupportsPreviewProxy', () => {
     it('passes when vite.config.js reads the proxy target', async () => {
         const dir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'ld-prev-'));

package/dist/vendor/template/references/external-apis.md

@@ -8,6 +8,7 @@ Each file documents one connection:
 - `instructions` — admin-authored notes on how to use this API (auth quirks, pagination, which endpoints matter, response caveats). Present only when the admin wrote them; when present, read and follow them.
 - `signature` / `howToCall` — the exact typed SDK call. Auth is injected by Lightdash — never include credentials or API keys.
 - `origin` / `requestUrl` — the connection's base origin (host only) and how the URL is formed: **the full request URL is `origin + path`.** Your `path` is appended to the origin verbatim — the origin and the path prefix are NOT auto-prepended.
+- `browserImageOrigin` — when non-null, the app may load public images directly from this exact origin in `<img>`, CSS image URLs, canvas-compatible image loaders, or map tile layers such as Leaflet. This is an image-rendering exception only: keep API/data calls on `externalFetch`, and never put Lightdash data or secrets in an image URL.
 - `rules` — hard requirements. The big ones: (1) **`path` is the COMPLETE path from the origin** — pass the whole path (e.g. `/repos/owner/repo/issues`, never a shortened `/issues`) and make sure it starts with one of `allowedPathPrefixes`. (2) **`query` is `Record<string, string>` — every query value MUST be a string** (`{ latitude: '52.52' }`, never `{ latitude: 52.52 }`); numbers and booleans are rejected with a 422. Read the response from `result.body`.
 - `allowedMethods` / `allowedPathPrefixes` — the methods and path prefixes the admin has permitted; only call within these bounds.
 - `samples` — example `{ request, response }` pairs. Copy the request shape — including the FULL `request.path` — when building your `externalFetch` calls. Treat response values as illustrative of shape, not exhaustive.
@@ -43,6 +44,8 @@ credentials, makes the request server-side, and returns the response.
 - **Always** use `lightdash.externalFetch()` for external data. **Never** use
   raw `fetch()`, `XMLHttpRequest`, `axios`, or any other client to call an
   external API directly — those calls are blocked by the sandbox and will fail.
+  The only exception is image rendering from a connection whose doc has a
+  non-null `browserImageOrigin`; use the exact origin shown there.
 - **Never** hardcode API keys, tokens, passwords, or any secret in the app.
   The connection holds the credentials; the app holds only the alias.
 - **Never** ask the user for an API key or secret, and never add an input field

package/dist/vendor/template/vite.config.js

@@ -88,7 +88,8 @@ function annotateJsx(code, filename, relPath) {
     for (const node of targets) {
         const line = offsetToLine(lineIdx, node.start);
         const insertion = ` data-loc="${relPath}:${line}"`;
-        out = out.slice(0, node.name.end) + insertion + out.slice(node.name.end);
+        out =
+            out.slice(0, node.name.end) + insertion + out.slice(node.name.end);
     }
     return out;
 }
@@ -132,9 +133,7 @@ function jsxSourceLocVitePlugin() {
             // an opinion-free `code`.
             if (!/<[A-Za-z]/.test(code)) return null;
 
-            const relPath = path
-                .relative(cwd, filename)
-                .replace(/\\/g, '/');
+            const relPath = path.relative(cwd, filename).replace(/\\/g, '/');
             const annotated = annotateJsx(code, filename, relPath);
             return annotated ?? code;
         },
@@ -152,6 +151,24 @@ export default defineConfig(({ mode }) => {
     const env = loadEnv(mode, process.cwd(), ['VITE_', 'LIGHTDASH_PREVIEW_']);
     const previewProxyTarget = env.LIGHTDASH_PREVIEW_PROXY_TARGET;
     const previewProxyNonce = env.LIGHTDASH_PREVIEW_PROXY_NONCE;
+    let browserImageOrigins = [];
+    try {
+        const parsed = JSON.parse(
+            env.LIGHTDASH_PREVIEW_BROWSER_IMAGE_ORIGINS || '[]',
+        );
+        browserImageOrigins = Array.isArray(parsed)
+            ? parsed.filter((origin) => {
+                  try {
+                      const url = new URL(origin);
+                      return url.protocol === 'https:' && url.origin === origin;
+                  } catch {
+                      return false;
+                  }
+              })
+            : [];
+    } catch {
+        browserImageOrigins = [];
+    }
     const lightdashUrl =
         env.VITE_LIGHTDASH_URL || 'https://app.lightdash.cloud';
 
@@ -165,7 +182,7 @@ export default defineConfig(({ mode }) => {
         `script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:`,
         `style-src 'self' 'unsafe-inline'`,
         `connect-src 'self'`,
-        `img-src 'self' data: blob:`,
+        `img-src 'self' data: blob: ${browserImageOrigins.join(' ')}`,
         `font-src 'self' data:`,
         `worker-src 'self' blob:`,
         `child-src 'self' blob:`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightdash/cli",
-  "version": "1.104.0",
+  "version": "1.106.0",
   "description": "Lightdash CLI tool",
   "license": "MIT",
   "repository": {
@@ -41,8 +41,8 @@
     "unique-names-generator": "4.7.1",
     "uuid": "11.1.1",
     "yaml": "2.8.3",
-    "@lightdash/common": "1.104.0",
-    "@lightdash/warehouses": "1.104.0"
+    "@lightdash/common": "1.106.0",
+    "@lightdash/warehouses": "1.106.0"
   },
   "devDependencies": {
     "@types/inquirer": "8.2.4",