@lukoweb/apitogo 0.1.92 → 0.1.93

package/dist/cli/cli.js

@@ -301,23 +301,15 @@ function firstApiInput(config2) {
   }
   return void 0;
 }
-function mergeAuthenticationGateway(config2) {
+function normalizeGatewayPlacement(config2) {
   const authentication = asRecord2(config2.authentication);
   if (!authentication) {
-    return void 0;
+    return;
   }
-  const authGateway = asRecord2(authentication.gateway);
-  const rootGateway = asRecord2(config2.gateway);
-  if (!authGateway && !rootGateway) {
-    return authentication;
+  if ("gateway" in authentication) {
+    delete authentication.gateway;
+    config2.authentication = authentication;
   }
-  return {
-    ...authentication,
-    gateway: {
-      ...rootGateway,
-      ...authGateway
-    }
-  };
 }
 function ensureModules(config2) {
   const modules = asRecord2(config2.modules) ?? {};
@@ -378,11 +370,10 @@ function normalizeApitogoConfig(config2) {
     };
   }
   normalized.site = site;
-  const authentication = mergeAuthenticationGateway(normalized);
+  const authentication = asRecord2(normalized.authentication);
   if (authentication) {
-    normalized.authentication = authentication;
+    normalizeGatewayPlacement(normalized);
   }
-  delete normalized.gateway;
   const modules = ensureModules(normalized);
   const legacyDocs = asRecord2(normalized.docs);
   const moduleDocs = asRecord2(modules.docs) ?? {};
@@ -533,13 +524,16 @@ function deriveManifestFields(config2) {
       continue;
     }
     if (key === "authentication") {
-      const authentication2 = asRecord2(normalized.authentication);
-      if (authentication2) {
-        manifest.authentication = stripAuthenticationSecrets2(authentication2);
+      const authentication = asRecord2(normalized.authentication);
+      if (authentication) {
+        manifest.authentication = stripAuthenticationSecrets2(authentication);
       }
       continue;
     }
     if (key === "gateway") {
+      if (normalized.gateway !== void 0) {
+        manifest.gateway = normalized.gateway;
+      }
       continue;
     }
     if (key === "pricing") {
@@ -570,10 +564,6 @@ function deriveManifestFields(config2) {
       manifest[key] = normalized[key];
     }
   }
-  const authentication = asRecord2(normalized.authentication);
-  if (authentication?.gateway) {
-    manifest.gateway = authentication.gateway;
-  }
   return manifest;
 }
 function extractManifest(config2) {
@@ -1158,7 +1148,11 @@ var init_local_manifest = __esm({
         oidcAllowedIssuers: z4.array(z4.string()).optional(),
         oidcAudiences: z4.array(z4.string()).optional(),
         limitsJson: z4.string().optional(),
-        publicHealthActionKey: z4.string().optional()
+        publicHealthActionKey: z4.string().optional(),
+        publicRoutes: z4.array(z4.string()).optional(),
+        cors: z4.object({
+          allowedOrigins: z4.array(z4.string()).optional()
+        }).optional()
       }).optional(),
       projectId: z4.string().optional(),
       landing: z4.object({
@@ -6034,6 +6028,7 @@ function manifestFilePath(siteDirectory) {
 var STORED_MANIFEST_KEYS = [
   "authentication",
   "backend",
+  "gateway",
   "projectId"
 ];
 function readPlanItemsFromConfig(config2) {
@@ -6189,12 +6184,6 @@ function extractManifestFromConfig(config2) {
   if (readPricingEnabledFromConfig(config2)) {
     manifest.pricing = { enabled: true };
   }
-  const authConfig = config2.authentication;
-  if (authConfig?.gateway) {
-    manifest.gateway = authConfig.gateway;
-  } else if (config2.gateway) {
-    manifest.gateway = config2.gateway;
-  }
   const landing = readLandingFromConfig(config2);
   if (landing) {
     manifest.landing = landing;
@@ -6234,15 +6223,14 @@ function applyManifestToConfig(config2, manifest) {
   }
   delete next.plans;
   delete next.pricing;
-  if (manifest.gateway) {
-    const authentication = next.authentication ?? {};
-    authentication.gateway = manifest.gateway;
+  if (next.authentication && typeof next.authentication === "object") {
+    const authentication = { ...next.authentication };
+    delete authentication.gateway;
     next.authentication = authentication;
   }
   delete next.siteName;
   delete next.branding;
   delete next.projectName;
-  delete next.gateway;
   return next;
 }
 async function readLegacyManifest(_siteDirectory) {
@@ -12545,7 +12533,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.1.92",
+  version: "0.1.93",
   type: "module",
   sideEffects: [
     "**/*.css",

package/dist/declarations/cli/platform/helpers/dev-portal-manifest.d.ts

@@ -58,6 +58,9 @@ export interface DevPortalLocalManifest {
         limitsJson?: string;
         publicHealthActionKey?: string;
         publicRoutes?: string[];
+        cors?: {
+            allowedOrigins?: string[];
+        };
     };
     projectId?: string;
     landing?: LandingManifestInput;

package/dist/declarations/config/local-manifest.d.ts

@@ -89,6 +89,10 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
         oidcAudiences: z.ZodOptional<z.ZodArray<z.ZodString>>;
         limitsJson: z.ZodOptional<z.ZodString>;
         publicHealthActionKey: z.ZodOptional<z.ZodString>;
+        publicRoutes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        cors: z.ZodOptional<z.ZodObject<{
+            allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     projectId: z.ZodOptional<z.ZodString>;
     landing: z.ZodOptional<z.ZodObject<{

package/docs/configuration/manifest.md

@@ -25,10 +25,17 @@ metadata, with optional `.env` overrides for secrets and local tweaks.
   "authentication": {
     "enabled": true,
     "type": "dev-portal",
-    "apiBaseUrl": "https://your-dev-portal-api.example.com",
-    "gateway": {
-      "authMode": "bringYourOwnOidc",
-      "oidcMetadataUrl": "https://login.example.com/.well-known/openid-configuration"
+    "apiBaseUrl": "https://your-dev-portal-api.example.com"
+  },
+  "gateway": {
+    "authMode": "bringYourOwnOidc",
+    "oidcMetadataUrl": "https://login.example.com/.well-known/openid-configuration",
+    "publicRoutes": ["/health"],
+    "cors": {
+      "allowedOrigins": [
+        "https://myapp.example.com",
+        "http://localhost:5173"
+      ]
     }
   },
   "modules": {
@@ -60,6 +67,36 @@ metadata, with optional `.env` overrides for secrets and local tweaks.
   `modules.userPanel.plans.items`. Add plans with `apitogo config` or edit the manifest by hand.
   See [Gateway plans](./plans.md). Legacy root `plans` is migrated on load.
 - **Docs / API keys:** configure under `modules.docs` and `modules.userPanel.apiKeys` only.
+- **Gateway:** top-level `gateway` (not under `authentication`). See [Gateway CORS](#gateway-cors)
+  and [Gateway plans](./plans.md).
+
+## Gateway CORS
+
+Browser calls from your developer portal (and any other SPA) to the API gateway are cross-origin.
+APItoGo always allows the portal site origin. Add extra origins under `gateway.cors.allowedOrigins`
+when tenant apps or local frontends call the gateway:
+
+```json
+{
+  "gateway": {
+    "cors": {
+      "allowedOrigins": [
+        "https://myapp.example.com",
+        "http://localhost:5173"
+      ]
+    }
+  }
+}
+```
+
+| Rule | Detail |
+| ---- | ------ |
+| Portal origin | Always allowed by the platform (`https://{your-portal-host}`). Do not list it here. |
+| Extra origins | Absolute `http://` or `https://` origins only — no path, query, or fragment. |
+| Wildcard | `"*"` is allowed (replaces the list; credentials stay off). |
+| Empty / omitted | Portal playground still works; only extras are missing. |
+
+Apply with `apitogo apply` / `publish_dev_portal` so APIM policies pick up the change.
 
 ## Environment variables
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.92",
+  "version": "0.1.93",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/config/apitogo-config-core.ts

@@ -297,28 +297,17 @@ function firstApiInput(config: ApitogoJsonConfig): string | undefined {
   return undefined;
 }
 
-function mergeAuthenticationGateway(
-  config: ApitogoJsonConfig,
-): Record<string, unknown> | undefined {
+/** Keep gateway at config root; strip any nested authentication.gateway. */
+function normalizeGatewayPlacement(config: ApitogoJsonConfig): void {
   const authentication = asRecord(config.authentication);
   if (!authentication) {
-    return undefined;
+    return;
   }
 
-  const authGateway = asRecord(authentication.gateway);
-  const rootGateway = asRecord(config.gateway);
-
-  if (!authGateway && !rootGateway) {
-    return authentication;
+  if ("gateway" in authentication) {
+    delete authentication.gateway;
+    config.authentication = authentication;
   }
-
-  return {
-    ...authentication,
-    gateway: {
-      ...rootGateway,
-      ...authGateway,
-    },
-  };
 }
 
 function ensureModules(config: ApitogoJsonConfig): Record<string, unknown> {
@@ -403,11 +392,10 @@ export function normalizeApitogoConfig(
   }
   normalized.site = site;
 
-  const authentication = mergeAuthenticationGateway(normalized);
+  const authentication = asRecord(normalized.authentication);
   if (authentication) {
-    normalized.authentication = authentication;
+    normalizeGatewayPlacement(normalized);
   }
-  delete normalized.gateway;
 
   const modules = ensureModules(normalized);
   const legacyDocs = asRecord(normalized.docs);
@@ -654,6 +642,9 @@ export function deriveManifestFields(
       continue;
     }
     if (key === "gateway") {
+      if (normalized.gateway !== undefined) {
+        manifest.gateway = normalized.gateway;
+      }
       continue;
     }
     if (key === "pricing") {
@@ -686,11 +677,6 @@ export function deriveManifestFields(
     }
   }
 
-  const authentication = asRecord(normalized.authentication);
-  if (authentication?.gateway) {
-    manifest.gateway = authentication.gateway;
-  }
-
   return manifest;
 }
 

package/src/config/local-manifest.ts

@@ -140,6 +140,12 @@ export const DevPortalLocalManifestSchema = z.object({
       oidcAudiences: z.array(z.string()).optional(),
       limitsJson: z.string().optional(),
       publicHealthActionKey: z.string().optional(),
+      publicRoutes: z.array(z.string()).optional(),
+      cors: z
+        .object({
+          allowedOrigins: z.array(z.string()).optional(),
+        })
+        .optional(),
     })
     .optional(),
   projectId: z.string().optional(),