@percy/core 1.31.9-beta.2 → 1.31.9-beta.4

package/dist/config.js

@@ -526,6 +526,10 @@ export const configSchema = {
             error: 'must not include a protocol'
           }]
         }
+      },
+      autoConfigureAllowedHostnames: {
+        type: 'boolean',
+        default: true
       }
     }
   }

package/dist/discovery.js

@@ -58,6 +58,7 @@ function debugSnapshotOptions(snapshot) {
   debugProp(snapshot, 'ignoreCanvasSerializationErrors');
   debugProp(snapshot, 'ignoreStyleSheetSerializationErrors');
   debugProp(snapshot, 'pseudoClassEnabledElements', JSON.stringify);
+  debugProp(snapshot, 'discovery.autoConfigureAllowedHostnames');
   if (Array.isArray(snapshot.domSnapshot)) {
     debugProp(snapshot, 'domSnapshot.0.userAgent');
   } else {
@@ -498,6 +499,10 @@ export function createDiscoveryQueue(percy) {
             ...snapshot.meta,
             snapshotURL: snapshot.url
           },
+          // pass domain validation context for auto-allowlisting
+          domainValidation: percy.domainValidation,
+          client: percy.client,
+          autoConfigureAllowedHostnames: snapshot.discovery.autoConfigureAllowedHostnames,
           // enable network inteception
           intercept: {
             enableJavaScript: snapshot.enableJavaScript,

package/dist/network.js

@@ -1,7 +1,7 @@
 import { request as makeRequest } from '@percy/client/utils';
 import logger from '@percy/logger';
 import mime from 'mime-types';
-import { DefaultMap, createResource, hostnameMatches, normalizeURL, waitFor, decodeAndEncodeURLWithLogging, handleIncorrectFontMimeType } from './utils.js';
+import { DefaultMap, createResource, hostnameMatches, normalizeURL, waitFor, decodeAndEncodeURLWithLogging, handleIncorrectFontMimeType, executeDomainValidation } from './utils.js';
 const MAX_RESOURCE_SIZE = 25 * 1024 ** 2 * 0.63; // 25MB, 0.63 factor for accounting for base64 encoding
 const ALLOWED_STATUSES = [200, 201, 301, 302, 304, 307, 308];
 const ALLOWED_RESOURCES = ['Document', 'Stylesheet', 'Image', 'Media', 'Font', 'Other'];
@@ -41,6 +41,10 @@ export class Network {
     this.fontDomains = options.fontDomains || [];
     this.intercept = options.intercept;
     this.meta = options.meta;
+    // domain validation context for auto-allowlisting
+    this.domainValidation = options.domainValidation;
+    this.client = options.client;
+    this.autoConfigureAllowedHostnames = options.autoConfigureAllowedHostnames ?? true;
     this._initializeNetworkIdleWaitTimeout();
   }
   watch(session) {
@@ -446,6 +450,47 @@ function originURL(request) {
   return normalizeURL((request.redirectChain[0] || request).url);
 }
 
+// Validate domain for auto-allowlisting feature
+// Only validates domains that returned 200 status
+async function validateDomainForAllowlist(network, hostname, url, statusCode) {
+  const {
+    domainValidation,
+    client,
+    autoConfigureAllowedHostnames
+  } = network;
+  const {
+    autoConfiguredHosts,
+    processedHosts,
+    pending,
+    workerUrl,
+    processedDomains
+  } = domainValidation;
+
+  // Skip validation if autoConfigureAllowedHostnames is disabled
+  if (!autoConfigureAllowedHostnames || statusCode !== 200 || !workerUrl) {
+    return false;
+  }
+  if (autoConfiguredHosts.has(hostname)) {
+    // Adding autoConfigured hosts to processedHosts so that we can track the latest
+    // usage of autoConfigured hosts for cleanup later.
+    processedHosts.add(hostname);
+    return true;
+  }
+
+  // If validation is already pending for this hostname, await the same promise (mutex)
+  if (pending.has(hostname)) {
+    return pending.get(hostname);
+  }
+  if (processedDomains.has(hostname)) {
+    return processedDomains.get(hostname);
+  }
+
+  // Perform external validation using worker URL from API
+  const validationPromise = executeDomainValidation(network, hostname, url, domainValidation, client, workerUrl);
+  pending.set(hostname, validationPromise);
+  return validationPromise;
+}
+
 // Send a response for a given request, responding with cached resources when able
 async function sendResponseResource(network, request, session) {
   let {
@@ -594,7 +639,21 @@ async function saveResponseResource(network, request, session) {
       var _mimeType;
       // Don't rename the below log line as it is used in getting network logs in api
       log.debug(`Processing resource: ${url}`, meta);
+
+      // Check if domain should be captured via auto-validation
+      let hostname = new URL(url).host;
+
+      // Check if domain is allowed via manual config or auto-validation
       let shouldCapture = response && hostnameMatches(allowedHostnames, url);
+
+      // Also capture if domain is auto-validated as allowed (autoConfiguredHosts or processedHosts)
+      if (!shouldCapture && hostname) {
+        const domainResult = await validateDomainForAllowlist(network, hostname, url, response.status);
+        if (domainResult) {
+          shouldCapture = true;
+          log.debug(`- Capturing auto-validated domain: ${hostname}`, meta);
+        }
+      }
       let body = shouldCapture && (await response.buffer());
 
       // Don't rename the below log line as it is used in getting network logs in api

package/dist/percy.js

@@ -115,6 +115,21 @@ export class Percy {
     this.monitoringCheckLastExecutedAt = null;
     this.sdkInfoDisplayed = false;
 
+    // Domain validation state for auto domain allow-listing
+    this.domainValidation = {
+      autoConfiguredHosts: new Set(),
+      // Domains from project config
+      processedHosts: new Set(),
+      // Newly discovered allowed domains this session
+      newErrorHosts: new Set(),
+      // Newly discovered blocked domains this session
+      pending: new Map(),
+      // Domain -> Promise (deduplication)
+      workerUrl: null,
+      // Domain validator worker URL from API
+      processedDomains: new Map()
+    };
+
     // generator methods are wrapped to autorun and return promises
     for (let m of ['start', 'stop', 'flush', 'idle', 'snapshot', 'upload']) {
       // the original generator can be referenced with percy.yield.<method>
@@ -216,6 +231,13 @@ export class Percy {
       // Not awaiting proxy check as this can be asynchronous when not enabled
       const detectProxy = detectSystemProxyAndLog(this.config.percy.useSystemProxy);
       if (this.config.percy.useSystemProxy) await detectProxy;
+
+      // Load domain config early if domain validation is enabled
+      // This ensures pre-approved domains are loaded before discovery starts
+      if (!this.skipUploads && !this.skipDiscovery) {
+        await this.loadAutoConfiguredHostnames();
+      }
+
       // start the snapshots queue immediately when not delayed or deferred
       if (!this.delayUploads && !this.deferUploads) yield _classPrivateFieldGet(_snapshots, this).start();
       // do not start the discovery queue when not needed
@@ -326,6 +348,11 @@ export class Percy {
         this.log.info(info('Found', _classPrivateFieldGet(_snapshots, this).size));
       }
 
+      // Save domain validation config before closing
+      if (!this.skipUploads && !this.skipDiscovery) {
+        await this.saveHostnamesToAutoConfigure();
+      }
+
       // close server and end queues
       await ((_this$server3 = this.server) === null || _this$server3 === void 0 ? void 0 : _this$server3.close());
       await _classPrivateFieldGet(_discovery, this).end();
@@ -658,6 +685,84 @@ export class Percy {
       this.log.warn('Could not send the builds logs');
     }
   }
+
+  // This method fetched auto configured hostnames from project settings for asset discovery
+  async loadAutoConfiguredHostnames() {
+    // Skip if autoConfigureAllowedHostnames is disabled
+    if (this.config.discovery.autoConfigureAllowedHostnames === false) {
+      this.log.debug('Auto configure allowed hostnames is disabled, skipping load');
+      return;
+    }
+    try {
+      this.log.debug('Fetching auto configured hostnames from project settings');
+      const {
+        workerUrl,
+        domainConfig
+      } = await this.client.getProjectDomainConfig();
+
+      // Store domain validator worker URL from API
+      if (workerUrl) {
+        this.domainValidation.workerUrl = workerUrl;
+        this.log.debug(`Domain validation Worker URL set to ${this.domainValidation.workerUrl}`);
+      } else {
+        this.log.debug('No Domain validation Worker URL found for project');
+      }
+      if (domainConfig) {
+        var _domainConfig$allowed;
+        // Populate pre-approved domains
+        if ((_domainConfig$allowed = domainConfig['allowed-domains']) !== null && _domainConfig$allowed !== void 0 && _domainConfig$allowed.length) {
+          domainConfig['allowed-domains'].forEach(domain => {
+            this.domainValidation.autoConfiguredHosts.add(domain);
+          });
+          this.log.debug(`Auto configured hosts: ${JSON.stringify(Array.from(this.domainValidation.autoConfiguredHosts))}`);
+        }
+      } else {
+        this.log.debug('No existing auto configured hostnames found for project');
+      }
+    } catch (error) {
+      this.log.debug(`Could not fetch auto configured hostnames (${error.message})`);
+    }
+  }
+
+  // Save newly discovered auto configured hostnames back to project
+  async saveHostnamesToAutoConfigure() {
+    // Skip if autoConfigureAllowedHostnames is disabled
+    if (this.config.discovery.autoConfigureAllowedHostnames === false) {
+      this.log.debug('Auto configure allowed hostnames is disabled, skipping save');
+      return;
+    }
+    const {
+      processedHosts,
+      newErrorHosts,
+      autoConfiguredHosts
+    } = this.domainValidation;
+
+    // Only save if there are new domains discovered in this session
+    if (processedHosts.size === 0 && newErrorHosts.size === 0) {
+      return;
+    }
+
+    // Check if there are truly new domains not already in autoConfiguredHosts
+    const newAllowedDomains = Array.from(processedHosts).filter(domain => !autoConfiguredHosts.has(domain));
+    const hasNewDomains = newAllowedDomains.length > 0 || newErrorHosts.size > 0;
+    try {
+      var _this$build7;
+      await this.client.updateProjectDomainConfig({
+        buildId: (_this$build7 = this.build) === null || _this$build7 === void 0 ? void 0 : _this$build7.id,
+        allowedDomains: Array.from(processedHosts),
+        errorDomains: Array.from(newErrorHosts)
+      });
+      if (hasNewDomains) {
+        const errorDomainsArray = Array.from(newErrorHosts);
+        const allowedDomainsStr = newAllowedDomains.length > 0 ? `Saved new allowed domains: ${newAllowedDomains.join(', ')}` : '';
+        const errorDomainsStr = errorDomainsArray.length > 0 ? `${allowedDomainsStr ? ' and ' : 'Saved '}error domains: ${errorDomainsArray.join(', ')}` : '';
+        this.log.info(`${allowedDomainsStr}${errorDomainsStr}`);
+      }
+    } catch (error) {
+      this.log.warn(`Failed to save auto configured hostnames - ${error.message}`);
+      this.log.debug(error);
+    }
+  }
 }
 function _displaySuggestionLogs(suggestions, options = {}) {
   if (!(suggestions !== null && suggestions !== void 0 && suggestions.length)) return;

package/dist/snapshot.js

@@ -153,7 +153,8 @@ function getSnapshotOptions(options, {
       userAgent: config.discovery.userAgent,
       retry: config.discovery.retry,
       scrollToBottom: config.discovery.scrollToBottom,
-      fontDomains: config.discovery.fontDomains
+      fontDomains: config.discovery.fontDomains,
+      autoConfigureAllowedHostnames: config.discovery.autoConfigureAllowedHostnames
     }
   }, options], (path, prev, next) => {
     var _next, _next2, _next3;
@@ -382,12 +383,19 @@ export function createSnapshotsQueue(percy) {
       });
       let url = data.attributes['web-url'];
       let number = data.attributes['build-number'];
+      let usageWarning = data.attributes['usage-warning'];
       percy.client.buildType = (_data$attributes = data.attributes) === null || _data$attributes === void 0 ? void 0 : _data$attributes.type;
       Object.assign(build, {
         id: data.id,
         url,
         number
       });
+
+      // Display usage warning if present
+      if (usageWarning) {
+        percy.log.warn(usageWarning);
+      }
+
       // immediately run the queue if not delayed or deferred
       if (!percy.delayUploads && !percy.deferUploads) queue.run();
     } catch (err) {

package/dist/utils.js

@@ -81,6 +81,47 @@ export function handleIncorrectFontMimeType(urlObj, mimeType, body, userConfigur
   return mimeType;
 }
 
+// Domain validation timeout constant
+const DOMAIN_VALIDATION_TIMEOUT = 5000;
+
+// Executes domain validation via external service
+export async function executeDomainValidation(network, hostname, url, domainValidation, client, workerUrl) {
+  const {
+    processedHosts,
+    newErrorHosts,
+    processedDomains,
+    pending
+  } = domainValidation;
+  try {
+    network.log.debug(`Domain validation: Validating ${hostname} via external service`, network.meta);
+    const result = await client.validateDomain(url, {
+      validationEndpoint: workerUrl,
+      timeout: DOMAIN_VALIDATION_TIMEOUT
+    });
+
+    // Worker returns 'accessible' field, not 'allowed'
+    if (result !== null && result !== void 0 && result.error) {
+      newErrorHosts.add(hostname);
+      network.log.debug(`Domain validation: ${hostname} validated as BLOCKED - ${result === null || result === void 0 ? void 0 : result.reason}`, network.meta);
+      processedDomains.set(hostname, false);
+      return false;
+    } else if (!(result !== null && result !== void 0 && result.accessible)) {
+      processedHosts.add(hostname);
+      network.log.debug(`Domain validation: ${hostname} validated as ALLOWED`, network.meta);
+      processedDomains.set(hostname, true);
+      return true;
+    }
+    return false;
+  } catch (error) {
+    // On error, default to allowing (fail-open for better UX)
+    network.log.warn(`Domain validation: Failed to validate ${hostname} - ${error.message}`, network.meta);
+    processedDomains.set(hostname, false);
+    return false;
+  } finally {
+    pending.delete(hostname);
+  }
+}
+
 /* istanbul ignore next: tested, but coverage is stripped */
 // Returns the body for automateScreenshot in structure
 export function percyAutomateRequestHandler(req, percy) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@percy/core",
-  "version": "1.31.9-beta.2",
+  "version": "1.31.9-beta.4",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -43,12 +43,12 @@
     "test:types": "tsd"
   },
   "dependencies": {
-    "@percy/client": "1.31.9-beta.2",
-    "@percy/config": "1.31.9-beta.2",
-    "@percy/dom": "1.31.9-beta.2",
-    "@percy/logger": "1.31.9-beta.2",
-    "@percy/monitoring": "1.31.9-beta.2",
-    "@percy/webdriver-utils": "1.31.9-beta.2",
+    "@percy/client": "1.31.9-beta.4",
+    "@percy/config": "1.31.9-beta.4",
+    "@percy/dom": "1.31.9-beta.4",
+    "@percy/logger": "1.31.9-beta.4",
+    "@percy/monitoring": "1.31.9-beta.4",
+    "@percy/webdriver-utils": "1.31.9-beta.4",
     "content-disposition": "^0.5.4",
     "cross-spawn": "^7.0.3",
     "extract-zip": "^2.0.1",
@@ -61,5 +61,5 @@
     "ws": "^8.17.1",
     "yaml": "^2.4.1"
   },
-  "gitHead": "34c4a2808d110f13a47a863b10b2105ab71eb4ea"
+  "gitHead": "2fc7e5cc27ba04e9d0d47fd267c00c756446e134"
 }

package/types/index.d.ts

@@ -20,7 +20,8 @@ interface DiscoveryOptions {
   disableCache?: boolean;
   captureMockedServiceWorker?: boolean;
   captureSrcset?: boolean;
-  devicePixelRatio?: number; 
+  devicePixelRatio?: number;
+  autoConfigureAllowedHostnames?: boolean;
 }
 
 interface ScopeOptions {