@lukoweb/apitogo 0.2.36 → 0.2.37

package/src/config/v2/paths.ts

@@ -1,54 +1,63 @@
-import path from "node:path";
-import type { Layout } from "./schema.js";
-
-/** Names inside the generated-state directory (Tenant Service Model, section 4). All of it is regenerable. */
-export const STATE_FILE = "state.json";
-/** Service manifest written by `deploy` (Reference, section 4). Public values only. */
-export const MANIFEST_FILE = "services.json";
-export const GENERATED_DIR = "generated";
-export const BUILD_DIR = "build";
-
-/**
- * Directory that holds the tenant-authored content for a layout: the config's own directory for `standalone`,
- * an `apitogo/` folder next to it for `embedded`.
- */
-export function layoutRoot(configDir: string, layout: Layout): string {
-  return layout === "embedded" ? path.join(configDir, "apitogo") : configDir;
-}
-
-/**
- * Directory for generated and observed state. It carries its own `.gitignore` containing `*`, so the tenant's root
- * `.gitignore` never needs to change.
- */
-export function stateDirFor(configDir: string, layout: Layout): string {
-  return layout === "embedded"
-    ? path.join(configDir, "apitogo", ".state")
-    : path.join(configDir, ".apitogo");
-}
-
-/** Path of the service manifest inside a state directory. */
-export const manifestPathFor = (state: { dir: string }): string =>
-  path.join(state.dir, MANIFEST_FILE);
-
-export type StatePaths = {
-  dir: string;
-  /** Per-service ledger and artifact hashes. */
-  file: string;
-  /** Generated portal wrapper, resolved config snapshot, processed OpenAPI schemas. */
-  generatedDir: string;
-  /** Build output; replaces the old root `dist/`. */
-  buildDir: string;
-  /** The state directory's own ignore file. */
-  gitignore: string;
-};
-
-export function statePathsFor(configDir: string, layout: Layout): StatePaths {
-  const dir = stateDirFor(configDir, layout);
-  return {
-    dir,
-    file: path.join(dir, STATE_FILE),
-    generatedDir: path.join(dir, GENERATED_DIR),
-    buildDir: path.join(dir, BUILD_DIR),
-    gitignore: path.join(dir, ".gitignore"),
-  };
-}
+import path from "node:path";
+import type { Layout } from "./schema.js";
+
+/** Names inside the generated-state directory (Tenant Service Model, section 4). All of it is regenerable. */
+export const STATE_FILE = "state.json";
+/** Service manifest written by `deploy` (Reference, section 4). Public values only. */
+export const MANIFEST_FILE = "services.json";
+export const GENERATED_DIR = "generated";
+export const BUILD_DIR = "build";
+
+/**
+ * Directory that holds the tenant-authored content for a layout: the config's own directory for `standalone`,
+ * an `apitogo/` folder next to it for `embedded`.
+ */
+export function layoutRoot(
+  configDir: string,
+  layout: Layout = "embedded",
+): string {
+  return layout === "embedded" ? path.join(configDir, "apitogo") : configDir;
+}
+
+/**
+ * Directory for generated and observed state. It carries its own `.gitignore` containing `*`, so the tenant's root
+ * `.gitignore` never needs to change.
+ */
+export function stateDirFor(
+  configDir: string,
+  layout: Layout = "embedded",
+): string {
+  return layout === "embedded"
+    ? path.join(configDir, "apitogo", ".state")
+    : path.join(configDir, ".apitogo");
+}
+
+/** Path of the service manifest inside a state directory. */
+export const manifestPathFor = (state: { dir: string }): string =>
+  path.join(state.dir, MANIFEST_FILE);
+
+export type StatePaths = {
+  dir: string;
+  /** Per-service ledger and artifact hashes. */
+  file: string;
+  /** Generated portal wrapper, resolved config snapshot, processed OpenAPI schemas. */
+  generatedDir: string;
+  /** Build output; replaces the old root `dist/`. */
+  buildDir: string;
+  /** The state directory's own ignore file. */
+  gitignore: string;
+};
+
+export function statePathsFor(
+  configDir: string,
+  layout: Layout = "embedded",
+): StatePaths {
+  const dir = stateDirFor(configDir, layout);
+  return {
+    dir,
+    file: path.join(dir, STATE_FILE),
+    generatedDir: path.join(dir, GENERATED_DIR),
+    buildDir: path.join(dir, BUILD_DIR),
+    gitignore: path.join(dir, ".gitignore"),
+  };
+}

package/src/config/v2/protected-routes.ts

@@ -0,0 +1,43 @@
+export type RequireAuthSetting = boolean | { exclude: string[] } | undefined;
+
+export type ProtectedRoutesInput = {
+  requireAuth: RequireAuthSetting;
+  /** The portal can sign people in (the identity or an OpenID provider is wired). Without it nothing can be protected. */
+  hasAuth: boolean;
+  /** Routes of the hosted docs pages (see `docRoutes`). */
+  docRoutes: string[];
+  /** The API reference page, at this path. */
+  apiReferencePath?: string;
+};
+
+/**
+ * The pages a visitor must sign in to see when `portal.requireAuth` is on: the home page, the hosted docs pages and the
+ * API reference. The generated site config can only list paths to protect, not "everything except", and the sign-in
+ * pages and the return address (`/oauth/callback`) must stay open or signing in would send the visitor in a circle, so
+ * the list names the content pages. The console pages that need a session (account, keys, usage) are protected by
+ * their own plugins; pricing stays public. `exclude` takes pages out again (an entry also covers the pages below it).
+ * This is a soft gate: the site is static, the HTML of the pages is still published (API-79).
+ */
+export function protectedRoutesFor(
+  input: ProtectedRoutesInput,
+): string[] | undefined {
+  const { requireAuth } = input;
+  if (!input.hasAuth || requireAuth === undefined || requireAuth === false)
+    return undefined;
+
+  const excluded =
+    typeof requireAuth === "object"
+      ? requireAuth.exclude.map((route) => route.replace(/\/+$/, "") || "/")
+      : [];
+  const isExcluded = (route: string) =>
+    excluded.some(
+      (e) => route === e || (e !== "/" && route.startsWith(`${e}/`)),
+    );
+
+  const routes = new Set<string>(["/", ...input.docRoutes]);
+  if (input.apiReferencePath) {
+    routes.add(input.apiReferencePath);
+    routes.add(`${input.apiReferencePath}/*`);
+  }
+  return [...routes].filter((route) => !isExcluded(route));
+}

package/src/config/v2/resolve.ts

@@ -101,7 +101,7 @@ export function resolveConfigV2(
 ): ResolvedConfigV2 {
   const absoluteConfigPath = path.resolve(configPath);
   const configDir = path.dirname(absoluteConfigPath);
-  const layout = config.layout ?? "standalone";
+  const layout = config.layout ?? "embedded";
   const root = layoutRoot(configDir, layout);
   const projectName = config.project?.name ?? path.basename(configDir);
 
@@ -206,5 +206,44 @@ export function resolveConfigV2(
     };
   }
 
+  // With a sign-in provider of the customer's own there is no identity of the platform for the gateway to read the
+  // tokens from, so `auth.mode: identity` means "the tokens of that provider": its issuer is the identity's issuer, its
+  // metadata is the provider's standard document, and the audience is the client id (what an OpenID sign-in token carries).
+  // A config that spells these out itself uses `auth.mode: oidc` and is never changed (API-97).
+  if (
+    resolved.gateway?.auth?.mode === "identity" &&
+    resolved.identity?.enabled &&
+    resolved.identity.provider === "oidc" &&
+    resolved.identity.issuer
+  ) {
+    const issuer = resolved.identity.issuer;
+    resolved.gateway.auth = {
+      mode: "oidc",
+      metadataUrl: `${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`,
+      issuers: [issuer],
+      ...(resolved.identity.clientId
+        ? { audiences: [resolved.identity.clientId] }
+        : {}),
+    };
+  }
+
+  // Without plans there are no keys handed out, so a valid login token is the credential. Before this default the
+  // gateway also demanded an API key and a good token alone got 401 (API-76, API-80). A config that sets
+  // `access.apiKey` itself, or that switches the token check off (a key-only gateway), is never changed.
+  if (
+    resolved.gateway &&
+    !resolved.plans?.enabled &&
+    resolved.gateway.auth !== undefined
+  ) {
+    const access = resolved.gateway.policies.access;
+    const tokenChecked = access?.jwt ?? true;
+    if (tokenChecked && access?.apiKey === undefined) {
+      resolved.gateway.policies = {
+        ...resolved.gateway.policies,
+        access: { ...access, jwt: true, apiKey: false },
+      };
+    }
+  }
+
   return resolved;
 }

package/src/config/v2/rules.ts

@@ -73,6 +73,33 @@ function dependencyRules(
   const oidcGateway = gatewayOn && resolved.gateway?.auth?.mode === "oidc";
   const hasIdentitySource = identityOn || oidcGateway;
 
+  // `apitogo project create` hosts services through the portal or the gateway, so identity alone has nowhere to run.
+  if (identityOn && resolved.portal?.enabled !== true && !gatewayOn) {
+    out.error({
+      code: "NOTHING_TO_HOST",
+      path: "identity",
+      message:
+        "identity needs the portal or the gateway: a project with only identity cannot be created yet.",
+      hint: "Enable the gateway (apitogo add gateway) or the portal (apitogo add portal) next to identity.",
+    });
+  }
+
+  // The plans backend signs customers in through the platform's own identity and gets no connection to a provider of the
+  // customer's own, so the portal's login page would have no sign-in method at all (API-96).
+  if (
+    resolved.plans?.enabled &&
+    identityOn &&
+    resolved.identity?.provider === "oidc"
+  ) {
+    out.error({
+      code: "PLANS_OWN_PROVIDER_UNSUPPORTED",
+      path: "plans",
+      message:
+        "plans cannot be used with your own sign-in provider yet (identity.provider is oidc): the plans backend signs customers in through the platform's identity, so nobody could sign in.",
+      hint: 'Use identity.provider "apitogo", or remove the plans section.',
+    });
+  }
+
   if (resolved.plans?.enabled) {
     if (!gatewayOn) {
       out.error({