@mesh-tech/mesh-cli 0.22.4 → 0.23.0

package/dist/bin/mesh.js

@@ -10798,6 +10798,20 @@ function authzSurface(app) {
   walk2(app);
   return hits;
 }
+function stringList(value) {
+  if (!value) return void 0;
+  const text = value.trim();
+  if (!text.startsWith("[") || !text.endsWith("]")) return void 0;
+  const out = [];
+  for (const entry of splitTopLevel(text.slice(1, -1))) {
+    const item = stripLeadingComments(entry).trim();
+    if (!item) continue;
+    const m = /^(["'])((?:(?!\1).)*)\1$/.exec(stripTrailingComments(item));
+    if (!m) return void 0;
+    out.push(m[2]);
+  }
+  return out;
+}
 function balancedSpan(text, open) {
   const closers = { "(": ")", "{": "}", "[": "]" };
   const stack = [];
@@ -10986,6 +11000,7 @@ function docsSiteFindings(text) {
         why: `mesh.apps.${decl.ctor} declares a docs site but neither its kind nor its audience \u2014 who may read it would fall out of the name heuristic, and a vendor surface must never default to partner-readable that way`
       });
     }
+    for (const f of docsAudienceUngrantable(text, decl, args, docs, httpText)) findings.push(f);
   }
   for (const decl of surfaceDeclarations(text, RE_APIDOCS_NEW)) {
     const options = optionsObject(decl.body);
@@ -11001,6 +11016,56 @@ function docsSiteFindings(text) {
   }
   return findings;
 }
+function docsAudienceUngrantable(text, decl, args, docs, httpText) {
+  const findings = [];
+  let roles;
+  if (docs.has("audience")) {
+    const audience = objectLiteralOf(docs.get("audience"), text);
+    roles = audience ? stringList(topLevelProperties(audience).get("roles")) : void 0;
+  } else {
+    const kind = decl.ctor === "AppApiSurface" ? "app" : decl.ctor === "VendorApiSurface" ? "vendor" : /^["']([a-z]+)["']$/.exec(args.get("kind") ?? "")?.[1];
+    if (kind === "app") roles = DEFAULT_PARTNER_DOCS_ROLES;
+  }
+  if (!roles || roles.length === 0) return findings;
+  const identities = [];
+  for (const d of surfaceDeclarations(text, RE_IDENTITY_NEW)) {
+    const options = optionsObject(d.body);
+    if (!options) continue;
+    const binding = [...text.matchAll(RE_IDENTITY_BINDING)].find((m) => text.indexOf(d.body, m.index) === m.index + m[0].length - 1)?.[1];
+    identities.push({ binding, options: topLevelProperties(options) });
+  }
+  if (identities.length === 0) return findings;
+  const docsAuth = objectLiteralOf(docs.get("auth"), text);
+  const clientExpr = (docsAuth ? topLevelProperties(docsAuth).get("clientId") : void 0) ?? (httpText ? topLevelProperties(objectLiteralOf(topLevelProperties(httpText).get("auth"), text) ?? "{}").get("clientId") : void 0);
+  const appName = clientExpr ? RE_IDENTITY_APP_CLIENT.exec(clientExpr)?.[1] : void 0;
+  const clientRoot = clientExpr ? /^([A-Za-z_$][\w$]*)\.applications\./.exec(clientExpr.trim())?.[1] : void 0;
+  const identity = (clientRoot ? identities.find((id) => id.binding === clientRoot) : void 0) ?? (identities.length === 1 ? identities[0] : void 0);
+  if (!identity) return findings;
+  const rolesText = identity.options.get("roles");
+  const coarseText = identity.options.get("coarseRoles");
+  const declared = rolesText !== void 0 ? stringList(rolesText) : coarseText !== void 0 ? stringList(coarseText) : [];
+  if (declared) {
+    for (const role of roles) {
+      if (declared.includes(role)) continue;
+      findings.push({
+        code: "DOCS_AUDIENCE_UNGRANTABLE",
+        line: decl.line,
+        why: `the docs audience gates on role "${role}", which the app's ZitadelAppIdentity does not declare in roles \u2014 the Hub cannot grant it, so no one can read the site`
+      });
+    }
+  }
+  if (!appName) return findings;
+  const apps = objectLiteralOf(identity.options.get("applications"), text);
+  const app = apps ? objectLiteralOf(topLevelProperties(apps).get(appName), text) : void 0;
+  if (app && topLevelProperties(app).get("idTokenRoleAssertion") === "false") {
+    findings.push({
+      code: "DOCS_AUDIENCE_UNGRANTABLE",
+      line: decl.line,
+      why: `the docs sign-in client is applications.${appName} on the ZitadelAppIdentity, which sets idTokenRoleAssertion: false \u2014 the proxy's ID token then carries no roles and the site's gate admits nobody`
+    });
+  }
+  return findings;
+}
 function listApps(root) {
   const apps = [];
   const appsDir = path22.join(root, "apps");
@@ -11206,7 +11271,7 @@ function registerAppCommands(program2) {
     }
   });
 }
-var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE, RE_SURFACE_NEW, RE_APIDOCS_NEW, DOCS_SITE_FIELDS, RE_DEV_BYPASS, RE_PROPERTY;
+var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE, RE_SURFACE_NEW, RE_APIDOCS_NEW, RE_IDENTITY_NEW, RE_IDENTITY_BINDING, DEFAULT_PARTNER_DOCS_ROLES, RE_IDENTITY_APP_CLIENT, DOCS_SITE_FIELDS, RE_DEV_BYPASS, RE_PROPERTY;
 var init_app_check = __esm({
   "libs/mesh-cli/src/commands/app-check.ts"() {
     "use strict";
@@ -11319,6 +11384,13 @@ var init_app_check = __esm({
         severity: "block",
         remediation: 'declare the surface as mesh.apps.AppApiSurface or VendorApiSurface (or pass kind: "app" | "vendor"), or state docs: { audience: { roles: [\u2026] } }',
         scope: "app"
+      },
+      DOCS_AUDIENCE_UNGRANTABLE: {
+        gate: "H",
+        title: "Docs audience grantable from the Hub",
+        severity: "block",
+        remediation: `declare every audience role on the ZitadelAppIdentity (roles: ["docs"]) so the Hub can grant it, and do not set idTokenRoleAssertion: false on the application the docs sign-in proxy uses (applications.<name>) \u2014 the identity asserts roles into the ID token by default, and the site's gate reads that token`,
+        scope: "app"
       }
     };
     APP_CHECK_CODES = Object.keys(APP_CHECK_RULES);
@@ -11352,6 +11424,10 @@ var init_app_check = __esm({
     RE_USERS_TABLE = /create table (if not exists )?"?(users|roles|user_roles|permissions)"?/i;
     RE_SURFACE_NEW = /new\s+mesh\.apps\.(ApiSurface|AppApiSurface|VendorApiSurface|Integration)\s*\(/g;
     RE_APIDOCS_NEW = /new\s+mesh\.apps\.ApiDocs\s*\(/g;
+    RE_IDENTITY_NEW = /new\s+mesh\.auth\.(ZitadelAppIdentity)\s*\(/g;
+    RE_IDENTITY_BINDING = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*new\s+mesh\.auth\.ZitadelAppIdentity\s*\(/g;
+    DEFAULT_PARTNER_DOCS_ROLES = ["docs"];
+    RE_IDENTITY_APP_CLIENT = /\bapplications\.([A-Za-z_$][\w$]*)\.clientId\b/;
     DOCS_SITE_FIELDS = ["pages", "playground", "audience", "basePath", "ingress", "auth"];
     RE_DEV_BYPASS = /^["']dev-bypass["']$/;
     RE_PROPERTY = /^(?:"([^"]+)"|'([^']+)'|([A-Za-z_$][\w$]*))\s*(?::\s*([\s\S]*))?$/;