@mesh-tech/mesh-cli 0.24.0 → 0.25.0

package/dist/bin/mesh.js

@@ -6253,19 +6253,26 @@ function hubOperatorRoleKeys(tenants) {
     )
   ];
 }
-var HUB_STAFF_ROLES, HUB_RESTRICTED_ROLES, HUB_BASE_ROLES, HUB_ROLE_KEY_SEPARATOR, HUB_ROLE_APP_SEPARATOR, RESTRICTED;
+var HUB_STAFF_ROLES, HUB_RESTRICTED_ROLES, HUB_VENDOR_DOCS_ROLE, HUB_ADDON_ROLES, HUB_TIER_ROLES, HUB_BASE_ROLES, HUB_ROLE_KEY_SEPARATOR, HUB_ROLE_APP_SEPARATOR, RESTRICTED, ADDONS;
 var init_hub_roles = __esm({
   "libs/api-registry/src/hub-roles.ts"() {
     "use strict";
     HUB_STAFF_ROLES = ["ops", "admin"];
     HUB_RESTRICTED_ROLES = ["developer", "auditor", "vendor", "docs"];
-    HUB_BASE_ROLES = [
+    HUB_VENDOR_DOCS_ROLE = "vendor-docs";
+    HUB_ADDON_ROLES = [HUB_VENDOR_DOCS_ROLE];
+    HUB_TIER_ROLES = [
       ...HUB_STAFF_ROLES,
       ...HUB_RESTRICTED_ROLES
     ];
+    HUB_BASE_ROLES = [
+      ...HUB_TIER_ROLES,
+      ...HUB_ADDON_ROLES
+    ];
     HUB_ROLE_KEY_SEPARATOR = ":";
     HUB_ROLE_APP_SEPARATOR = "/";
     RESTRICTED = new Set(HUB_RESTRICTED_ROLES);
+    ADDONS = new Set(HUB_ADDON_ROLES);
   }
 });
 
@@ -11011,6 +11018,17 @@ function docsSiteFindings(text) {
         why: `mesh.apps.${decl.ctor} declares a docs site but neither its kind nor its audience \u2014 who the Hub admits through the door would fall out of the name heuristic, and a vendor surface must never default to partner-readable that way`
       });
     }
+    if (statedKind(decl, args) === "vendor" && docs.has("audience")) {
+      const audience = objectLiteralOf(docs.get("audience"), text);
+      const roles = audience ? stringList(topLevelProperties(audience).get("roles")) : void 0;
+      if (roles !== void 0 && roles.length === 0) {
+        findings.push({
+          code: "DOCS_VENDOR_AUDIENCE_PARTNER",
+          line: decl.line,
+          why: `mesh.apps.${decl.ctor} declares a vendor surface's docs site with audience: { roles: [] } \u2014 partner-readable by every docs-role user of the tenant; a vendor's spec is the raw core API, its site is read by holders of the Hub's vendor-docs add-on only, and the deploy refuses this declaration`
+        });
+      }
+    }
     const httpText = objectLiteralOf(topLevelProperties(objectLiteralOf(args.get("surfaces"), text) ?? "{}").get("http"), text);
     for (const f of docsAudienceUngrantable(text, decl, args, docs, httpText)) findings.push(f);
   }
@@ -11027,15 +11045,19 @@ function docsSiteFindings(text) {
   }
   return findings;
 }
+function statedKind(decl, args) {
+  if (decl.ctor === "AppApiSurface") return "app";
+  if (decl.ctor === "VendorApiSurface") return "vendor";
+  return /^["']([a-z]+)["']$/.exec(args.get("kind") ?? "")?.[1];
+}
 function docsAudienceUngrantable(text, decl, args, docs, httpText) {
   const findings = [];
   let roles;
   if (docs.has("audience")) {
     const audience = objectLiteralOf(docs.get("audience"), text);
     roles = audience ? stringList(topLevelProperties(audience).get("roles")) : void 0;
-  } else {
-    const kind = decl.ctor === "AppApiSurface" ? "app" : decl.ctor === "VendorApiSurface" ? "vendor" : /^["']([a-z]+)["']$/.exec(args.get("kind") ?? "")?.[1];
-    if (kind === "app") roles = DEFAULT_PARTNER_DOCS_ROLES;
+  } else if (statedKind(decl, args) === "app") {
+    roles = DEFAULT_PARTNER_DOCS_ROLES;
   }
   if (!roles || roles.length === 0) return findings;
   const identities = [];
@@ -11048,7 +11070,7 @@ function docsAudienceUngrantable(text, decl, args, docs, httpText) {
   if (identities.length === 0) return findings;
   const docsAuth = objectLiteralOf(docs.get("auth"), text);
   const clientExpr = (docsAuth ? topLevelProperties(docsAuth).get("clientId") : void 0) ?? (httpText ? topLevelProperties(objectLiteralOf(topLevelProperties(httpText).get("auth"), text) ?? "{}").get("clientId") : void 0);
-  const clientRoot = clientExpr ? /^([A-Za-z_$][\w$]*)\.applications\./.exec(clientExpr.trim())?.[1] : void 0;
+  const clientRoot = clientExpr ? /^([A-Za-z_$][\w$]*)\.(?:clientIds|applications)\./.exec(clientExpr.trim())?.[1] : void 0;
   const identity = (clientRoot ? identities.find((id) => id.binding === clientRoot) : void 0) ?? (identities.length === 1 ? identities[0] : void 0);
   if (!identity) return findings;
   const rolesText = identity.options.get("roles");
@@ -11394,6 +11416,15 @@ var init_app_check = __esm({
         severity: "block",
         remediation: `declare every audience role on the ZitadelAppIdentity (roles: ["docs"]) so the Hub can grant it from the app's Access tab \u2014 the audience is published on the surface's registry entry as the reader set for the Hub to admit by, and a role nobody can be granted admits nobody`,
         scope: "app"
+      },
+      DOCS_VENDOR_AUDIENCE_PARTNER: {
+        gate: "H",
+        title: "Vendor reference never partner-readable",
+        // The same declaration fails `pulumi up` (the primitive refuses it); the
+        // check says so where the program is written, not at the deploy.
+        severity: "block",
+        remediation: "drop docs.audience from the vendor surface \u2014 a vendor surface's site is the raw core API reference, read inside the Hub by holders of the vendor-docs add-on only; audience: { roles: [] } would declare it readable by every docs-role user of the tenant, which the Hub never honours and the deploy refuses",
+        scope: "app"
       }
     };
     APP_CHECK_CODES = Object.keys(APP_CHECK_RULES);