@quadient/skillshare 1.6.0 → 1.6.2

package/README.md

@@ -21,6 +21,9 @@ bun run index.ts install --skill-version-id 42 --target ./installed
 
 ## Behavior
 
+- Starting with 1.6.2, `login`, `git configure` and API commands without a stored session default to `https://skillshare.quadientcloudpreprod.eu`. `login local` and `git configure local` still select `http://localhost:5050`.
+- Existing sessions keep their saved server. After preprod cutover, run `skillshare login` again to replace a UAT session with a preprod session; stored tokens are not reused across hosts.
+- Uploaded/installed records retain their registry URL. Legacy records without a URL still belong to UAT and are not silently reassigned to preprod.
 - Upload and publish commands show progress while scanning and reading local files, then keep a timed upload status visible until the registry call finishes.
 - `update` reads the centralized install registry and refreshes recorded installs to the latest published registry versions.
 - `update` can be narrowed to one skill or one target directory, and `--dry-run` prints planned changes without downloading or overwriting files.
@@ -36,7 +39,7 @@ flowchart TD
   B -- Yes --> D{Which command?}
 
   D -->|login local| E[login LOCAL_URL]
-  D -->|login| F[login PROD_URL]
+  D -->|login| F[login DEFAULT_URL]
   D -->|logout| G[logoutSession]
   D -->|whoami list show upload install update| H[createClient using active baseUrl]
 
@@ -148,7 +151,7 @@ export SKILLSHARE_TOKEN="<personal-access-token>"
 npx @quadient/skillshare whoami
 ```
 
-Register the production or local SkillShare host as a generic OAuth provider in Git Credential
+Register the default preprod or local SkillShare host as a generic OAuth provider in Git Credential
 Manager 2.0.931 or newer:
 
 ```bash
@@ -179,7 +182,7 @@ npx @quadient/skillshare pages show release-notes
 ```
 
 The page is then available at
-`https://skillshare.inspireclouduat.net/p/release-notes/` after SSO sign-in.
+`https://skillshare.quadientcloudpreprod.eu/p/release-notes/` after SSO sign-in.
 
 ## Package Distribution
 
@@ -276,3 +279,13 @@ This is full-page reload, not React HMR. A CSP that disallows same-origin script
 or connections must be adjusted for local development or the page reloaded manually.
 The `/__skillshare_dev/` path is reserved for local development controls. This command
 does not implement the SkillShare catalog, actual SSO or cloud deployment.
+
+### Worker user directory (1.6.1)
+
+Authenticated requests in `pages dev` include `X-Skillshare-Users-Url` and
+`X-Skillshare-Users-Token`. A Worker can fetch the URL with the token in the
+`X-Skillshare-Users-Token` request header to read the four local users. Each entry
+contains `id`, `displayName`, `email`, `isAdmin` and `isOwner`. The hosted backend
+uses the same contract for active SkillShare users. These capabilities stay in
+the Worker and are not injected on `api/bypass-sso/*` requests. See the
+[Worker example](../docs/pages-backends.md#skillshare-user-directory-from-a-worker).

package/dist/index.js

@@ -8,7 +8,9 @@ import { mkdir, open, readFile, readdir, rm, stat, writeFile } from 'node:fs/pro
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { cancel, confirm, intro, isCancel, multiselect, outro, progress, select, spinner, text } from '@clack/prompts';
-const PROD_URL = 'https://skillshare.inspireclouduat.net';
+const DEFAULT_URL = 'https://skillshare.quadientcloudpreprod.eu';
+// Records without a registry URL were created against UAT before the preprod migration.
+const LEGACY_UAT_URL = 'https://skillshare.inspireclouduat.net';
 const LOCAL_URL = 'http://localhost:5050';
 const APP_DIR = getAppDir();
 const SESSION_PATH = join(APP_DIR, 'session.json');
@@ -91,6 +93,9 @@ Commands:
 
 Options:
   --token <token>    Bearer token for API requests (overrides SKILLSHARE_TOKEN)
+
+Default server: ${DEFAULT_URL}
+A stored session keeps its server; run "skillshare login" to switch to the default.
 `;
 async function main() {
     const args = process.argv.slice(2);
@@ -110,7 +115,7 @@ async function main() {
     }
     switch (command) {
         case 'login': {
-            await login(options.positionals[0] === 'local' ? LOCAL_URL : PROD_URL);
+            await login(options.positionals[0] === 'local' ? LOCAL_URL : DEFAULT_URL);
             return;
         }
         case 'logout': {
@@ -119,7 +124,7 @@ async function main() {
         }
         case 'git': {
             const action = options.positionals[0];
-            const baseUrl = options.positionals[1] === 'local' ? LOCAL_URL : PROD_URL;
+            const baseUrl = options.positionals[1] === 'local' ? LOCAL_URL : DEFAULT_URL;
             if (action === 'configure') {
                 await configureGitCredentialManager(baseUrl);
                 return;
@@ -1455,7 +1460,7 @@ async function resolveActiveBaseUrl() {
     if (session?.baseUrl) {
         return normalizeBaseUrl(session.baseUrl);
     }
-    return PROD_URL;
+    return DEFAULT_URL;
 }
 async function createClient(baseUrl, explicitToken) {
     const resolvedBaseUrl = normalizeBaseUrl(baseUrl);
@@ -1823,7 +1828,7 @@ async function readUploadedSkillRecords() {
         const normalizedSkillId = Number.isInteger(skillId) && skillId > 0 ? skillId : undefined;
         return [{
                 directory: typeof entry.directory === 'string' ? resolve(entry.directory) : '',
-                baseUrl: typeof entry.baseUrl === 'string' ? normalizeBaseUrl(entry.baseUrl) : PROD_URL,
+                baseUrl: typeof entry.baseUrl === 'string' ? normalizeBaseUrl(entry.baseUrl) : LEGACY_UAT_URL,
                 updatedAt: typeof entry.updatedAt === 'string' ? entry.updatedAt : '',
                 skillId: normalizedSkillId,
                 skillName: typeof entry.skillName === 'string' ? entry.skillName : '',
@@ -1844,7 +1849,7 @@ async function readInstalledSkillRecords() {
         }
         return [{
                 targetRoot: typeof entry.targetRoot === 'string' ? resolve(entry.targetRoot) : '',
-                baseUrl: typeof entry.baseUrl === 'string' ? normalizeBaseUrl(entry.baseUrl) : PROD_URL,
+                baseUrl: typeof entry.baseUrl === 'string' ? normalizeBaseUrl(entry.baseUrl) : LEGACY_UAT_URL,
                 updatedAt: typeof entry.updatedAt === 'string' ? entry.updatedAt : '',
                 skillId,
                 skillName: typeof entry.skillName === 'string' ? entry.skillName : '',

package/dist/pages-dev-proxy.js

@@ -1,4 +1,5 @@
 import { createServer, request as httpRequest, } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 const sessionCookie = 'skillshare.dev-user';
 const internal = '/__skillshare_dev';
 const hostCookie = (name) => name.startsWith('skillshare.auth') ||
@@ -25,7 +26,7 @@ function cleanHeaders(headers) {
         delete result[name];
     return result;
 }
-export function requestHeaders(request, user, baseUrl, slug) {
+export function requestHeaders(request, user, baseUrl, slug, usersToken) {
     const headers = cleanHeaders(request.headers);
     for (const name of Object.keys(headers))
         if (name.startsWith('x-skillshare-') ||
@@ -37,6 +38,10 @@ export function requestHeaders(request, user, baseUrl, slug) {
     headers['accept-encoding'] = 'identity';
     if (user) {
         delete headers.authorization;
+        if (usersToken) {
+            headers['x-skillshare-users-url'] = new URL(`/api/pages/${encodeURIComponent(slug)}/users-directory`, baseUrl).href;
+            headers['x-skillshare-users-token'] = usersToken;
+        }
         headers['x-skillshare-user'] = Buffer.from(JSON.stringify(user)).toString('base64');
         const cookies = (request.headers.cookie ?? '')
             .split(';')
@@ -74,6 +79,7 @@ export function responseCookies(cookies, prefix) {
 }
 export function createDevProxy(options) {
     const prefix = `/p/${options.slug}`;
+    const usersToken = randomBytes(32).toString('hex');
     const streams = new Set();
     const upgrades = new Set();
     const userFor = (request) => {
@@ -98,6 +104,22 @@ export function createDevProxy(options) {
             return;
         }
         const url = new URL(request.url, `http://${request.headers.host}`);
+        if (url.pathname === `/api/pages/${encodeURIComponent(options.slug)}/users-directory`) {
+            response.setHeader('Cache-Control', 'no-store');
+            const token = request.headers['x-skillshare-users-token'];
+            if (typeof token !== 'string' || !/^[a-f0-9]{64}$/.test(token) ||
+                !timingSafeEqual(Buffer.from(token), Buffer.from(usersToken))) {
+                response.writeHead(401).end();
+                return;
+            }
+            if (request.method !== 'GET') {
+                response.writeHead(405).end();
+                return;
+            }
+            response.writeHead(200, { 'Content-Type': 'application/json' });
+            response.end(JSON.stringify(options.users.map(({ id, displayName, email, isAdmin, isOwner }) => ({ id, displayName, email, isAdmin, isOwner }))));
+            return;
+        }
         if (url.pathname === '/' || url.pathname === prefix) {
             response.writeHead(307, { Location: prefix + '/' + url.search }).end();
             return;
@@ -188,7 +210,7 @@ label.append(select); bar.append(label); document.body.append(bar);
         const user = bypass ? undefined : userFor(request);
         const upstream = httpRequest(new URL(path + url.search, target), {
             method: request.method,
-            headers: requestHeaders(request, user, url.origin + prefix + '/', options.slug),
+            headers: requestHeaders(request, user, url.origin + prefix + '/', options.slug, usersToken),
         }, (incoming) => {
             const headers = cleanHeaders(incoming.headers);
             headers['cache-control'] = 'private, no-cache';
@@ -251,7 +273,7 @@ label.append(select); bar.append(label); document.body.append(bar);
             return;
         }
         const bypass = path === '/api/bypass-sso' || path.startsWith('/api/bypass-sso/');
-        const headers = requestHeaders(request, bypass ? undefined : userFor(request), url.origin + prefix + '/', options.slug);
+        const headers = requestHeaders(request, bypass ? undefined : userFor(request), url.origin + prefix + '/', options.slug, usersToken);
         headers.connection = 'Upgrade';
         headers.upgrade = request.headers.upgrade;
         const upstream = httpRequest(new URL(path + url.search, target), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quadient/skillshare",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "Skillshare CLI for installing and publishing Quadient skills",
   "type": "module",
   "bin": {