@raketa-cloud/admin 1.10.7 → 1.10.9

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@raketa-cloud/admin",
-  "version": "1.10.7",
+  "version": "1.10.9",
   "main": "src/index.js",
+  "engines": {
+    "node": ">=22"
+  },
   "files": [
     "src/",
     "dist/"
@@ -26,7 +29,7 @@
     "@tailwindcss/cli": "4.3.3",
     "@tailwindcss/forms": "0.5.11",
     "@tailwindcss/typography": "0.5.20",
-    "@types/node": "24.10.1",
+    "@types/node": "22.20.5",
     "babel-jest": "30.5.2",
     "jest": "30.5.2",
     "jest-environment-node": "30.5.2",
@@ -37,8 +40,9 @@
     "@hono/node-server": "2.0.12",
     "chart.js": "4.5.1",
     "ejs": "6.0.1",
+    "google-auth-library": "11.3.1",
     "graphql-request": "7.4.0",
-    "hono": "4.13.7",
+    "hono": "4.13.13",
     "lru-cache": "11.5.2"
   },
   "overrides": {

package/src/handlers/resources/PartialTranslationsHandler.js

@@ -22,6 +22,39 @@ const targetTranslationLocales = (resource, sourceLocale) =>
     )
     .map(([locale]) => locale);
 
+const localesAtOpenRevisionLimit = (resource, sourceLocale, maxOpenRevisions) =>
+  Object.entries(resource.translations || {})
+    .filter(
+      ([locale, translation]) =>
+        locale !== sourceLocale &&
+        translation?.id &&
+        translation.revisionsCount >= maxOpenRevisions,
+    )
+    .map(([locale]) => locale);
+
+const withTranslationRevisionCounts = async (ctx, resource, resourceType) => {
+  const revisionCounts = await Promise.all(
+    Object.entries(resource.translations || {}).map(
+      async ([locale, translation]) => {
+        if (locale === ctx.locale || !translation?.id) {
+          return [locale, translation];
+        }
+
+        const target = await ctx.client.resources.find(
+          translation.id,
+          locale,
+          resourceType,
+        );
+        return [
+          locale,
+          { ...translation, revisionsCount: target.revisionsCount },
+        ];
+      },
+    ),
+  );
+
+  return { ...resource, translations: Object.fromEntries(revisionCounts) };
+};
 const selectedWidgetIds = (resource, query = {}) => {
   const requested = Array.isArray(query.widget_ids)
     ? query.widget_ids
@@ -73,6 +106,7 @@ const validatePartialTranslation = ({
   workflow,
   unknownWidgetIds,
   unknownLocales,
+  localesAtRevisionLimit,
 }) => {
   const errors = [];
 
@@ -91,6 +125,12 @@ const validatePartialTranslation = ({
       message: `not found in the resource translations: ${unknownLocales.join(", ")}`,
     });
   }
+  if (localesAtRevisionLimit.length > 0) {
+    errors.push({
+      key: "locales",
+      message: `open revision limit reached for: ${localesAtRevisionLimit.join(", ")}`,
+    });
+  }
   if (!workflow.type) {
     errors.push({ key: "workflow", message: "can't be blank" });
   }
@@ -131,14 +171,19 @@ const create_form = async (ctx) => {
     throw new Error(`Cannot find ${resourceType} with id ${parent_id}`);
   }
 
-  const widgetIds = selectedWidgetIds(resource, ctx.query);
+  const resourceWithTranslationRevisionCounts =
+    await withTranslationRevisionCounts(ctx, resource, resourceType);
+  const widgetIds = selectedWidgetIds(
+    resourceWithTranslationRevisionCounts,
+    ctx.query,
+  );
   const { validWidgetIds, unknownWidgetIds } = partitionWidgetIds(
-    resource,
+    resourceWithTranslationRevisionCounts,
     widgetIds,
   );
 
   const previewUrl = ctx.client.resources.previewUrl(
-    { ...resource, resourceType },
+    { ...resourceWithTranslationRevisionCounts, resourceType },
     ctx.locale,
   );
   const validationErrors = [];
@@ -170,7 +215,7 @@ const create_form = async (ctx) => {
   if (validationErrors.length > 0) {
     return {
       assigns: formAssigns(
-        resource,
+        resourceWithTranslationRevisionCounts,
         ctx.query,
         previewUrl,
         { widgetIds: validWidgetIds },
@@ -182,7 +227,13 @@ const create_form = async (ctx) => {
     };
   }
 
-  return { assigns: formAssigns(resource, ctx.query, previewUrl) };
+  return {
+    assigns: formAssigns(
+      resourceWithTranslationRevisionCounts,
+      ctx.query,
+      previewUrl,
+    ),
+  };
 };
 
 const create = async (ctx) => {
@@ -198,8 +249,10 @@ const create = async (ctx) => {
     throw new Error(`Cannot find ${resourceType} with id ${parent_id}`);
   }
 
+  const resourceWithTranslationRevisionCounts =
+    await withTranslationRevisionCounts(ctx, resource, resourceType);
   const previewUrl = ctx.client.resources.previewUrl(
-    { ...resource, resourceType },
+    { ...resourceWithTranslationRevisionCounts, resourceType },
     ctx.locale,
   );
   const values = ctx.resourceParams?.partial_translation || {};
@@ -210,30 +263,42 @@ const create = async (ctx) => {
       : toArray(values.widget_ids);
   const workflow = values.workflow || {};
   const { validWidgetIds, unknownWidgetIds } = partitionWidgetIds(
-    resource,
+    resourceWithTranslationRevisionCounts,
     widgetIds,
   );
-  const validLocales = targetTranslationLocales(resource, ctx.locale);
+  const validLocales = targetTranslationLocales(
+    resourceWithTranslationRevisionCounts,
+    ctx.locale,
+  );
   const unknownLocales = locales.filter(
     (locale) => !validLocales.includes(locale),
   );
-  const selectedValidLocales = locales.filter((locale) =>
-    validLocales.includes(locale),
+  const localesAtRevisionLimit = localesAtOpenRevisionLimit(
+    resourceWithTranslationRevisionCounts,
+    ctx.locale,
+    ctx.maxOpenRevisions,
+  );
+  const selectedValidLocales = locales.filter(
+    (locale) =>
+      validLocales.includes(locale) && !localesAtRevisionLimit.includes(locale),
   );
 
   const validationErrors = validatePartialTranslation({
-    resource,
+    resource: resourceWithTranslationRevisionCounts,
     locales,
     widgetIds,
     workflow,
     unknownWidgetIds,
     unknownLocales,
+    localesAtRevisionLimit: locales.filter((locale) =>
+      localesAtRevisionLimit.includes(locale),
+    ),
   });
 
   if (validationErrors.length > 0) {
     return {
       assigns: formAssigns(
-        resource,
+        resourceWithTranslationRevisionCounts,
         ctx.query,
         previewUrl,
         {
@@ -250,21 +315,25 @@ const create = async (ctx) => {
     };
   }
 
-  const widgets = (resource.widgets || []).filter((widget) =>
-    validWidgetIds.includes(widget.widgetId),
+  const widgets = (resourceWithTranslationRevisionCounts.widgets || []).filter(
+    (widget) => validWidgetIds.includes(widget.widgetId),
   );
   const { errors } = await ctx.client.resources.multiPartialTranslate(
     parent_id,
     locales,
     widgets,
     workflow,
-    { ...resource, locale: ctx.locale, resourceType },
+    {
+      ...resourceWithTranslationRevisionCounts,
+      locale: ctx.locale,
+      resourceType,
+    },
   );
 
   if (errors) {
     return {
       assigns: formAssigns(
-        resource,
+        resourceWithTranslationRevisionCounts,
         ctx.query,
         previewUrl,
         { ...values, locales, widgetIds: validWidgetIds, workflow },

package/src/helpers/reports/googleAuth.js

@@ -5,9 +5,15 @@
 // with no human in the loop — sign a JWT with it, swap that for an access token.
 // Nothing is persisted, so a restart costs one token exchange.
 //
-// The key's client_email needs Viewer access on the GA property.
+// Without a key, config.ga.useAdc falls back to Application Default Credentials
+// via google-auth-library — on Cloud Run / GCE / GKE that is the attached
+// service account through the metadata server. A key, when set, always wins.
+//
+// The key's client_email (or the ADC principal) needs Viewer access on the GA
+// property.
 import { createSign } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { GoogleAuth } from "google-auth-library";
 
 const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
 const JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
@@ -24,12 +30,16 @@ const keyCache = new Map();
 const tokenCache = new Map();
 const pendingTokens = new Map();
 
+// Single ADC client: it owns its own token cache and refresh.
+let adcAuth = null;
+
 const credentialSource = (ga = {}) => ga.serviceAccount;
+const adcEnabled = (ga = {}) => Boolean(ga.useAdc);
 
 // True when a credential is configured — gates the Insights tab, so an
 // unconfigured admin sees no GA UI at all.
 export const serviceAccountConfigured = (ga = {}) =>
-  Boolean(credentialSource(ga));
+  Boolean(credentialSource(ga)) || adcEnabled(ga);
 
 // GOOGLE_APPLICATION_CREDENTIALS now holds the whole key JSON rather than a path
 // to it, so a source can be: an already-parsed object, the JSON itself, that
@@ -88,7 +98,7 @@ function serviceAccountKey(ga = {}) {
 
   if (!source) {
     throw new Error(
-      "Google service-account key is not set. Put the key JSON in GOOGLE_APPLICATION_CREDENTIALS (surfaced via config.ga.serviceAccount).",
+      "Google service-account key is not set. Put the key JSON in GOOGLE_APPLICATION_CREDENTIALS (surfaced via config.ga.serviceAccount), or enable Application Default Credentials via config.ga.useAdc.",
     );
   }
 
@@ -139,6 +149,8 @@ function signAssertion(key) {
 // they would each mint their own token. The in-flight exchange is shared: the
 // first caller starts it, the rest await the same promise.
 export async function accessToken(ga) {
+  if (!credentialSource(ga) && adcEnabled(ga)) return adcAccessToken();
+
   const key = serviceAccountKey(ga);
 
   const cached = tokenCache.get(key.client_email);
@@ -190,9 +202,27 @@ async function requestToken(key) {
   return json.access_token;
 }
 
+async function adcAccessToken() {
+  adcAuth ??= new GoogleAuth({ scopes: [SCOPE] });
+
+  let token;
+  try {
+    token = await adcAuth.getAccessToken();
+  } catch (err) {
+    throw new Error(`Google ADC token request failed: ${err.message}`);
+  }
+
+  if (!token) {
+    throw new Error("Google ADC token response contained no access_token.");
+  }
+
+  return token;
+}
+
 // Test / credential-rotation helper.
 export function clearAuthCache() {
   keyCache.clear();
   tokenCache.clear();
   pendingTokens.clear();
+  adcAuth = null;
 }

package/src/helpers/reports/quick-insights.js

@@ -2,7 +2,7 @@
 // Quick Insights for a single page path: summary KPIs with period-over-period
 // trend plus a daily page-views series, both over the last 30 days.
 //
-// `ga` below is the whole config.ga object — property id plus the key path the
+// `ga` below is the whole config.ga object — property id plus the credentials the
 // bearer token is minted from (see ./googleAuth).
 import localCache from "../../localCache";
 import { accessToken } from "./googleAuth";

package/src/helpers/reports/reportsUtils.js

@@ -135,7 +135,7 @@ async function fetchQuickInsights(ctx, resource, resourceType) {
   try {
     if (!gaEnabled(ctx)) {
       throw new Error(
-        "Google Analytics is not configured. Set config.ga.propertyId and config.ga.serviceAccount (GOOGLE_APPLICATION_CREDENTIALS) to enable reports.",
+        "Google Analytics is not configured. Set config.ga.propertyId plus config.ga.serviceAccount (GOOGLE_APPLICATION_CREDENTIALS) or config.ga.useAdc to enable reports.",
       );
     }
     const pagePath = gaPagePath(ctx, resource, resourceType);

package/src/tests/handlers/resources/PartialTranslationsHandler.test.js

@@ -24,6 +24,7 @@ const buildCtx = (params = {}) => ({
   params: { parent_id: "42" },
   query: {},
   locale: "en",
+  maxOpenRevisions: 1,
   resourceConfig: { resourceType: "page", resourceTypePlural: "pages" },
   resourceParams: params,
 });
@@ -194,6 +195,30 @@ describe("PartialTranslationsHandler", () => {
     });
   });
 
+  test("does not submit to locales at the open revision limit", async () => {
+    const ctx = buildCtx({
+      partial_translation: {
+        locales: ["fr"],
+        widget_ids: ["hero-1"],
+        workflow: { type: "LOKALISE_TT_AI" },
+      },
+    });
+    ctx.client.resources.find
+      .mockResolvedValueOnce({
+        ...resource,
+        translations: { fr: { id: "43" } },
+      })
+      .mockResolvedValueOnce({ id: "43", revisionsCount: 1 });
+
+    const result = await PartialTranslationsHandler.create(ctx);
+
+    expect(ctx.client.resources.multiPartialTranslate).not.toHaveBeenCalled();
+    expect(result.assigns.partialTranslation.locales).toEqual([]);
+    expect(result.assigns.errors.partialTranslation).toEqual({
+      locales: "open revision limit reached for: fr",
+    });
+  });
+
   test("does not submit when a translation has an active content task", async () => {
     const ctx = buildCtx({
       partial_translation: {

package/src/tests/helpers/reports/quick-insights.test.js

@@ -3,6 +3,7 @@ import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
+import { GoogleAuth } from "google-auth-library";
 import {
   clearAuthCache,
   serviceAccountConfigured,
@@ -14,6 +15,14 @@ import {
 } from "../../../helpers/reports/quick-insights";
 import localCache from "../../../localCache";
 
+// Only the ADC path goes through google-auth-library; the key path signs its
+// own JWT against the mocked fetch below, so it never touches this.
+const mockGetAccessToken = jest.fn();
+
+jest.mock("google-auth-library", () => ({
+  GoogleAuth: jest.fn(() => ({ getAccessToken: mockGetAccessToken })),
+}));
+
 // One throwaway RSA key. The app passes the whole key JSON through
 // ga.serviceAccount, so that is the form used here; the same key is also written
 // to a temp file, since that config value also accepts a path.
@@ -280,6 +289,98 @@ describe("quick-insights auth", () => {
   });
 });
 
+describe("quick-insights ADC auth", () => {
+  const ADC_GA = { propertyId: "1234", useAdc: true };
+
+  const ARGS = {
+    pagePath: "/pricing",
+    startDate: "2026-07-01",
+    endDate: "2026-07-01",
+    ga: ADC_GA,
+  };
+
+  beforeEach(() => {
+    clearAuthCache();
+    jest.clearAllMocks();
+    mockGetAccessToken.mockResolvedValue("adc-token");
+  });
+
+  afterEach(() => {
+    delete global.fetch;
+  });
+
+  test("serviceAccountConfigured accepts ADC in place of a key", () => {
+    expect(serviceAccountConfigured({ useAdc: true })).toBe(true);
+    expect(serviceAccountConfigured({ useAdc: false })).toBe(false);
+  });
+
+  test("calls the Data API with the ADC token, no JWT exchange", async () => {
+    mockGoogle();
+
+    const result = await runPageReport(ARGS);
+
+    expect(GoogleAuth).toHaveBeenCalledWith({
+      scopes: ["https://www.googleapis.com/auth/analytics.readonly"],
+    });
+    expect(global.fetch).toHaveBeenCalledTimes(1);
+
+    const [reportUrl, reportOptions] = global.fetch.mock.calls[0];
+    expect(reportUrl).toBe(
+      "https://analyticsdata.googleapis.com/v1beta/properties/1234:runReport",
+    );
+    expect(reportOptions.headers.authorization).toBe("Bearer adc-token");
+    expect(result.rows).toEqual([{ date: "2026-07-01", views: 4 }]);
+  });
+
+  test("a configured key wins over ADC", async () => {
+    mockGoogle();
+
+    await runPageReport({
+      ...ARGS,
+      ga: { ...ADC_GA, serviceAccount: keyJson },
+    });
+
+    expect(GoogleAuth).not.toHaveBeenCalled();
+    expect(global.fetch.mock.calls[0][0]).toBe(
+      "https://oauth2.googleapis.com/token",
+    );
+    expect(global.fetch.mock.calls[1][1].headers.authorization).toBe(
+      "Bearer at-1",
+    );
+  });
+
+  test("reuses one ADC client until the cache is cleared", async () => {
+    mockGoogle();
+
+    await runPageReport(ARGS);
+    await runPageReport(ARGS);
+    expect(GoogleAuth).toHaveBeenCalledTimes(1);
+    expect(mockGetAccessToken).toHaveBeenCalledTimes(2);
+
+    clearAuthCache();
+    await runPageReport(ARGS);
+    expect(GoogleAuth).toHaveBeenCalledTimes(2);
+  });
+
+  test("surfaces ADC token failures", async () => {
+    mockGoogle();
+
+    mockGetAccessToken.mockRejectedValueOnce(
+      new Error("Could not load the default credentials"),
+    );
+    await expect(runPageReport(ARGS)).rejects.toThrow(
+      /Google ADC token request failed: Could not load the default credentials/,
+    );
+
+    mockGetAccessToken.mockResolvedValueOnce(null);
+    await expect(runPageReport(ARGS)).rejects.toThrow(
+      /Google ADC token response contained no access_token/,
+    );
+
+    expect(global.fetch).not.toHaveBeenCalled();
+  });
+});
+
 describe("runSummary", () => {
   const metrics = (views, users, engagementSeconds, rate, sessions) => ({
     metricValues: [views, users, engagementSeconds, rate, sessions].map(

package/src/tests/views/partial_translations.test.js

@@ -10,6 +10,7 @@ function renderPartialTranslations(translations) {
   return ejs.render(template, {
     _context: {
       locale: "en",
+      maxOpenRevisions: 1,
       locales: { en: { name: "English" }, fr: { name: "French" } },
       resourceConfig: { resourceTypePlural: "pages" },
     },
@@ -47,4 +48,14 @@ describe("partial translations form", () => {
     expect(rendered).not.toContain('value="de"');
     expect(rendered).not.toContain("This resource has no translations.");
   });
+
+  test("disables translations at the open revision limit", () => {
+    const rendered = renderPartialTranslations({
+      fr: { id: "43", revisionsCount: 1 },
+    });
+
+    expect(rendered).toContain('value="fr"');
+    expect(rendered).toContain('value="fr"  disabled');
+    expect(rendered).toContain("open revision limit reached");
+  });
 });

package/src/views/resource_revisions/_nav.ejs

@@ -9,7 +9,7 @@
 
 <div class="flex gap-4 w-full pb-4">
   <div class="flex items-center justify-between mb-4">
-    <div class="flex items-center border-b-2">
+    <div class="flex items-center border-b-2 border-neutral-200 dark:border-neutral-700">
       <div class=" <%= active === 'general' ? activeClass : inactiveClass %>">
         <a href="<%= `/${_context.locale}/${_context.resourceConfig.resourceType}_revisions/${resource.id}/general/edit` %>" class="text-raketa-primary font-semibold">
           General

package/src/views/resources/_shared/_history_toolbar.ejs

@@ -1,4 +1,4 @@
-<div class="actions-toolbar justify-end">
+<div class="justify-end actions-toolbar">
   <form method="POST" action="<%= `/${_context.locale}/${_context.resourceConfig.resourceTypePlural}/${resource.id}/${_context.resourceConfig.resourceType}_changes/reverts` %>" class="inline-block">
     <input type="hidden" name="version" value="<%= change.version %>">
 
@@ -7,7 +7,7 @@
       Revert
     </button>
     <% } else { %>
-    <button type="submit" disabled class="btn-text opacity-50 cursor-not-allowed">
+    <button type="submit" disabled class="opacity-50 cursor-not-allowed btn-text">
       Revert
     </button>
     <% } %>

package/src/views/resources/partial-translations/create_form.ejs

@@ -11,10 +11,11 @@
       <div class="mb-4">
         <h6>Current translations</h6>
         <div class="checkbox-group !max-h-fit">
-          <% targetTranslations.forEach(([locale]) => { %>
-          <label>
-            <input type="checkbox" name="partial_translation[locales][]" value="<%= locale %>" <%= partialTranslation.locales.includes(locale) ? 'checked' : '' %>>
+          <% targetTranslations.forEach(([locale, translation]) => { const atRevisionLimit = translation.revisionsCount >= _context.maxOpenRevisions; %>
+          <label class="<%= atRevisionLimit ? 'opacity-50' : '' %>">
+            <input type="checkbox" name="partial_translation[locales][]" value="<%= locale %>" <%= partialTranslation.locales.includes(locale) ? 'checked' : '' %> <%= atRevisionLimit ? 'disabled' : '' %>>
             <%= _context.locales[locale]?.name || locale %>
+            <% if (atRevisionLimit) { %><span class="text-sm text-raketa-foreground/50">(open revision limit reached)</span><% } %>
           </label>
           <% }) %>
         </div>

package/src/views/settings/_nav.ejs

@@ -5,7 +5,7 @@
 
 <div class="flex w-full pb-4">
   <div class="flex items-center justify-between mb-4">
-    <div class="flex items-center border-b-2">
+    <div class="flex items-center border-b-2 border-neutral-200 dark:border-neutral-700">
       <div class="<%= active === 'meta' ? activeClass : inactiveClass %>">
         <a href="<%= `/${_context.locale}/settings/meta/edit` %>" class="text-raketa-primary font-semibold">
           Meta and OpenGraph