@mesh-tech/mesh-cli 0.21.0 → 0.22.1

package/dist/bin/mesh.js

@@ -6300,7 +6300,12 @@ var init_src = __esm({
       description: z.string().optional(),
       surfaces: apiSurfaceSchema,
       credentials: z.object({ keyedBy: z.string().nullish() }).optional(),
-      docs: z.object({ url: z.string().min(1), contentHash: z.string().min(1) }),
+      docs: z.object({
+        url: z.string().min(1),
+        contentHash: z.string().min(1),
+        siteUrl: z.string().min(1).optional(),
+        siteInternalUrl: z.string().min(1).optional()
+      }),
       enabledOps: z.array(z.string()),
       // The consumer schema strips unknown keys, so a producer-side field that is
       // not mirrored here never reaches a consumer — mirror every addition.
@@ -10793,6 +10798,209 @@ function authzSurface(app) {
   walk2(app);
   return hits;
 }
+function balancedSpan(text, open) {
+  const closers = { "(": ")", "{": "}", "[": "]" };
+  const stack = [];
+  let quote;
+  for (let i = open; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === "\\") i++;
+      else if (ch === quote) quote = void 0;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      const eol = text.indexOf("\n", i);
+      if (eol === -1) return "";
+      i = eol;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      const end = text.indexOf("*/", i + 2);
+      if (end === -1) return "";
+      i = end + 1;
+      continue;
+    }
+    if (closers[ch]) stack.push(closers[ch]);
+    else if (ch === ")" || ch === "}" || ch === "]") {
+      if (stack.pop() !== ch) return "";
+      if (stack.length === 0) return text.slice(open, i + 1);
+    }
+  }
+  return "";
+}
+function splitTopLevel(inner) {
+  const parts = [];
+  let depth = 0;
+  let quote;
+  let start = 0;
+  for (let i = 0; i < inner.length; i++) {
+    const ch = inner[i];
+    if (quote) {
+      if (ch === "\\") i++;
+      else if (ch === quote) quote = void 0;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "/" && inner[i + 1] === "/") {
+      const eol = inner.indexOf("\n", i);
+      if (eol === -1) break;
+      i = eol;
+      continue;
+    }
+    if (ch === "/" && inner[i + 1] === "*") {
+      const end = inner.indexOf("*/", i + 2);
+      if (end === -1) break;
+      i = end + 1;
+      continue;
+    }
+    if (ch === "(" || ch === "{" || ch === "[") depth++;
+    else if (ch === ")" || ch === "}" || ch === "]") depth--;
+    else if (ch === "," && depth === 0) {
+      parts.push(inner.slice(start, i));
+      start = i + 1;
+    }
+  }
+  const last = inner.slice(start);
+  if (last.trim()) parts.push(last);
+  return parts;
+}
+function stripLeadingComments(entry) {
+  let text = entry;
+  for (; ; ) {
+    const next = text.replace(/^\s*(?:\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)/, "");
+    if (next === text) return text;
+    text = next;
+  }
+}
+function stripTrailingComments(value) {
+  let out = "";
+  let depth = 0;
+  let quote;
+  for (let i = 0; i < value.length; i++) {
+    const ch = value[i];
+    if (quote) {
+      out += ch;
+      if (ch === "\\") {
+        out += value[i + 1] ?? "";
+        i++;
+      } else if (ch === quote) quote = void 0;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      out += ch;
+      continue;
+    }
+    if (depth === 0 && ch === "/" && value[i + 1] === "/") {
+      const eol = value.indexOf("\n", i);
+      if (eol === -1) break;
+      i = eol;
+      out += "\n";
+      continue;
+    }
+    if (depth === 0 && ch === "/" && value[i + 1] === "*") {
+      const end = value.indexOf("*/", i + 2);
+      if (end === -1) break;
+      i = end + 1;
+      continue;
+    }
+    if (ch === "(" || ch === "{" || ch === "[") depth++;
+    else if (ch === ")" || ch === "}" || ch === "]") depth--;
+    out += ch;
+  }
+  return out.trim();
+}
+function topLevelProperties(objectText) {
+  const props = /* @__PURE__ */ new Map();
+  if (!objectText.startsWith("{") || !objectText.endsWith("}")) return props;
+  for (const entry of splitTopLevel(objectText.slice(1, -1))) {
+    const text = stripLeadingComments(entry).trim();
+    if (!text || text.startsWith("...")) continue;
+    const m = RE_PROPERTY.exec(text);
+    if (!m) continue;
+    const key = m[1] ?? m[2] ?? m[3];
+    props.set(key, stripTrailingComments(m[4] ?? key));
+  }
+  return props;
+}
+function objectLiteralOf(value, program2) {
+  if (!value) return void 0;
+  if (value.startsWith("{")) return balancedSpan(value, 0) || void 0;
+  const id = /^[A-Za-z_$][\w$]*$/.exec(value)?.[0];
+  if (!id) return void 0;
+  const decl = new RegExp(`\\bconst\\s+${id}\\s*(?::[^=]+)?=\\s*\\{`).exec(program2);
+  return decl ? balancedSpan(program2, decl.index + decl[0].length - 1) || void 0 : void 0;
+}
+function optionsObject(body) {
+  for (const arg of splitTopLevel(body.slice(1, -1))) {
+    const trimmed = arg.trim();
+    if (trimmed.startsWith("{")) return balancedSpan(trimmed, 0) || void 0;
+  }
+  return void 0;
+}
+function surfaceDeclarations(text, pattern = RE_SURFACE_NEW) {
+  const out = [];
+  for (const m of text.matchAll(pattern)) {
+    const body = balancedSpan(text, m.index + m[0].length - 1);
+    if (!body) continue;
+    out.push({ ctor: m[1] ?? "ApiDocs", body, line: text.slice(0, m.index).split("\n").length });
+  }
+  return out;
+}
+function isClientAuth(value) {
+  return value !== void 0 && value !== "undefined" && !RE_DEV_BYPASS.test(value);
+}
+function docsSiteFindings(text) {
+  const findings = [];
+  for (const decl of surfaceDeclarations(text)) {
+    const options = optionsObject(decl.body);
+    if (!options) continue;
+    const args = topLevelProperties(options);
+    const docsText = objectLiteralOf(args.get("docs"), text);
+    if (!docsText) continue;
+    const docs = topLevelProperties(docsText);
+    if (docs.get("site") === "false") continue;
+    if (docs.get("site") !== "true" && !DOCS_SITE_FIELDS.some((f) => docs.has(f))) continue;
+    const httpText = objectLiteralOf(topLevelProperties(objectLiteralOf(args.get("surfaces"), text) ?? "{}").get("http"), text);
+    const hasClient = isClientAuth(docs.get("auth")) || isClientAuth(topLevelProperties(httpText ?? "{}").get("auth"));
+    if (!hasClient) {
+      findings.push({
+        code: "DOCS_SITE_UNAUTHED",
+        line: decl.line,
+        why: `mesh.apps.${decl.ctor} declares a docs site with no OIDC client \u2014 the site is served behind the platform sign-in proxy, which needs one (docs.auth, or a client on surfaces.http.auth)`
+      });
+    }
+    const kindStated = decl.ctor === "AppApiSurface" || decl.ctor === "VendorApiSurface" || args.has("kind");
+    if (!kindStated && !docs.has("audience")) {
+      findings.push({
+        code: "DOCS_AUDIENCE_IMPLICIT",
+        line: decl.line,
+        why: `mesh.apps.${decl.ctor} declares a docs site but neither its kind nor its audience \u2014 who may read it would fall out of the name heuristic, and a vendor surface must never default to partner-readable that way`
+      });
+    }
+  }
+  for (const decl of surfaceDeclarations(text, RE_APIDOCS_NEW)) {
+    const options = optionsObject(decl.body);
+    if (!options) continue;
+    const args = topLevelProperties(options);
+    if (!args.has("ingress") || args.get("ingress") === "undefined") continue;
+    if (isClientAuth(args.get("auth"))) continue;
+    findings.push({
+      code: "DOCS_SITE_UNAUTHED",
+      line: decl.line,
+      why: `mesh.apps.ApiDocs is published on an ingress with no auth \u2014 the site (reference and playground) is reachable by anyone; put the platform sign-in proxy in front of it, or drop the ingress`
+    });
+  }
+  return findings;
+}
 function listApps(root) {
   const apps = [];
   const appsDir = path22.join(root, "apps");
@@ -10841,6 +11049,7 @@ function scanApp(root, appRel) {
     if (!/env\.register\(|\.annotate\(/.test(readText(index))) {
       hit("NO_REGISTER", indexRel, "never calls env.register({\u2026}) \u2014 the Hub cannot list this app");
     }
+    for (const f of docsSiteFindings(readText(index))) hit(f.code, `${indexRel}:${f.line}`, f.why);
     for (const svc of serviceDirs(app)) {
       for (const f of srcFiles(svc)) {
         const text = readText(f);
@@ -10997,7 +11206,7 @@ function registerAppCommands(program2) {
     }
   });
 }
-var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE;
+var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE, RE_SURFACE_NEW, RE_APIDOCS_NEW, DOCS_SITE_FIELDS, RE_DEV_BYPASS, RE_PROPERTY;
 var init_app_check = __esm({
   "libs/mesh-cli/src/commands/app-check.ts"() {
     "use strict";
@@ -11096,6 +11305,20 @@ var init_app_check = __esm({
         severity: "block",
         remediation: "drop the table; people and roles live in Zitadel and are administered from the Hub",
         scope: "app"
+      },
+      DOCS_SITE_UNAUTHED: {
+        gate: "0.3",
+        title: "Docs site behind the platform sign-in",
+        severity: "block",
+        remediation: 'on an API surface: docs: { auth: { clientId, clientSecret } } (or a client on surfaces.http.auth), or opt out with docs: { site: false }; on a mesh.apps.ApiDocs: auth: { provider: "mesh", clientId, clientSecret }, or drop the ingress (an in-cluster site is reachable through mesh dev)',
+        scope: "app"
+      },
+      DOCS_AUDIENCE_IMPLICIT: {
+        gate: "H",
+        title: "Docs audience stated, not derived",
+        severity: "block",
+        remediation: 'declare the surface as mesh.apps.AppApiSurface or VendorApiSurface (or pass kind: "app" | "vendor"), or state docs: { audience: { roles: [\u2026] } }',
+        scope: "app"
       }
     };
     APP_CHECK_CODES = Object.keys(APP_CHECK_RULES);
@@ -11127,6 +11350,11 @@ var init_app_check = __esm({
     RE_PASSWORD = /(^|[^a-z])(bcrypt|argon2)|password_hash|passwordHash|hashPassword|temporaryPassword.*(send|mail)|(send|mail).*temporaryPassword/;
     RE_ALLOWLIST = /ADMIN_EMAILS|ALLOWED_EMAILS|allowedEmails|adminEmails/;
     RE_USERS_TABLE = /create table (if not exists )?"?(users|roles|user_roles|permissions)"?/i;
+    RE_SURFACE_NEW = /new\s+mesh\.apps\.(ApiSurface|AppApiSurface|VendorApiSurface|Integration)\s*\(/g;
+    RE_APIDOCS_NEW = /new\s+mesh\.apps\.ApiDocs\s*\(/g;
+    DOCS_SITE_FIELDS = ["pages", "playground", "audience", "basePath", "ingress", "auth"];
+    RE_DEV_BYPASS = /^["']dev-bypass["']$/;
+    RE_PROPERTY = /^(?:"([^"]+)"|'([^']+)'|([A-Za-z_$][\w$]*))\s*(?::\s*([\s\S]*))?$/;
   }
 });