@raketa-cloud/admin 1.10.8 → 1.10.9

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@raketa-cloud/admin",
-  "version": "1.10.8",
+  "version": "1.10.9",
   "main": "src/index.js",
+  "engines": {
+    "node": ">=22"
+  },
   "files": [
     "src/",
     "dist/"
@@ -26,7 +29,7 @@
     "@tailwindcss/cli": "4.3.3",
     "@tailwindcss/forms": "0.5.11",
     "@tailwindcss/typography": "0.5.20",
-    "@types/node": "24.10.1",
+    "@types/node": "22.20.5",
     "babel-jest": "30.5.2",
     "jest": "30.5.2",
     "jest-environment-node": "30.5.2",
@@ -37,8 +40,9 @@
     "@hono/node-server": "2.0.12",
     "chart.js": "4.5.1",
     "ejs": "6.0.1",
+    "google-auth-library": "11.3.1",
     "graphql-request": "7.4.0",
-    "hono": "4.13.7",
+    "hono": "4.13.13",
     "lru-cache": "11.5.2"
   },
   "overrides": {

package/src/helpers/reports/googleAuth.js

@@ -5,9 +5,15 @@
 // with no human in the loop — sign a JWT with it, swap that for an access token.
 // Nothing is persisted, so a restart costs one token exchange.
 //
-// The key's client_email needs Viewer access on the GA property.
+// Without a key, config.ga.useAdc falls back to Application Default Credentials
+// via google-auth-library — on Cloud Run / GCE / GKE that is the attached
+// service account through the metadata server. A key, when set, always wins.
+//
+// The key's client_email (or the ADC principal) needs Viewer access on the GA
+// property.
 import { createSign } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { GoogleAuth } from "google-auth-library";
 
 const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
 const JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
@@ -24,12 +30,16 @@ const keyCache = new Map();
 const tokenCache = new Map();
 const pendingTokens = new Map();
 
+// Single ADC client: it owns its own token cache and refresh.
+let adcAuth = null;
+
 const credentialSource = (ga = {}) => ga.serviceAccount;
+const adcEnabled = (ga = {}) => Boolean(ga.useAdc);
 
 // True when a credential is configured — gates the Insights tab, so an
 // unconfigured admin sees no GA UI at all.
 export const serviceAccountConfigured = (ga = {}) =>
-  Boolean(credentialSource(ga));
+  Boolean(credentialSource(ga)) || adcEnabled(ga);
 
 // GOOGLE_APPLICATION_CREDENTIALS now holds the whole key JSON rather than a path
 // to it, so a source can be: an already-parsed object, the JSON itself, that
@@ -88,7 +98,7 @@ function serviceAccountKey(ga = {}) {
 
   if (!source) {
     throw new Error(
-      "Google service-account key is not set. Put the key JSON in GOOGLE_APPLICATION_CREDENTIALS (surfaced via config.ga.serviceAccount).",
+      "Google service-account key is not set. Put the key JSON in GOOGLE_APPLICATION_CREDENTIALS (surfaced via config.ga.serviceAccount), or enable Application Default Credentials via config.ga.useAdc.",
     );
   }
 
@@ -139,6 +149,8 @@ function signAssertion(key) {
 // they would each mint their own token. The in-flight exchange is shared: the
 // first caller starts it, the rest await the same promise.
 export async function accessToken(ga) {
+  if (!credentialSource(ga) && adcEnabled(ga)) return adcAccessToken();
+
   const key = serviceAccountKey(ga);
 
   const cached = tokenCache.get(key.client_email);
@@ -190,9 +202,27 @@ async function requestToken(key) {
   return json.access_token;
 }
 
+async function adcAccessToken() {
+  adcAuth ??= new GoogleAuth({ scopes: [SCOPE] });
+
+  let token;
+  try {
+    token = await adcAuth.getAccessToken();
+  } catch (err) {
+    throw new Error(`Google ADC token request failed: ${err.message}`);
+  }
+
+  if (!token) {
+    throw new Error("Google ADC token response contained no access_token.");
+  }
+
+  return token;
+}
+
 // Test / credential-rotation helper.
 export function clearAuthCache() {
   keyCache.clear();
   tokenCache.clear();
   pendingTokens.clear();
+  adcAuth = null;
 }

package/src/helpers/reports/quick-insights.js

@@ -2,7 +2,7 @@
 // Quick Insights for a single page path: summary KPIs with period-over-period
 // trend plus a daily page-views series, both over the last 30 days.
 //
-// `ga` below is the whole config.ga object — property id plus the key path the
+// `ga` below is the whole config.ga object — property id plus the credentials the
 // bearer token is minted from (see ./googleAuth).
 import localCache from "../../localCache";
 import { accessToken } from "./googleAuth";

package/src/helpers/reports/reportsUtils.js

@@ -135,7 +135,7 @@ async function fetchQuickInsights(ctx, resource, resourceType) {
   try {
     if (!gaEnabled(ctx)) {
       throw new Error(
-        "Google Analytics is not configured. Set config.ga.propertyId and config.ga.serviceAccount (GOOGLE_APPLICATION_CREDENTIALS) to enable reports.",
+        "Google Analytics is not configured. Set config.ga.propertyId plus config.ga.serviceAccount (GOOGLE_APPLICATION_CREDENTIALS) or config.ga.useAdc to enable reports.",
       );
     }
     const pagePath = gaPagePath(ctx, resource, resourceType);

package/src/tests/helpers/reports/quick-insights.test.js

@@ -3,6 +3,7 @@ import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
+import { GoogleAuth } from "google-auth-library";
 import {
   clearAuthCache,
   serviceAccountConfigured,
@@ -14,6 +15,14 @@ import {
 } from "../../../helpers/reports/quick-insights";
 import localCache from "../../../localCache";
 
+// Only the ADC path goes through google-auth-library; the key path signs its
+// own JWT against the mocked fetch below, so it never touches this.
+const mockGetAccessToken = jest.fn();
+
+jest.mock("google-auth-library", () => ({
+  GoogleAuth: jest.fn(() => ({ getAccessToken: mockGetAccessToken })),
+}));
+
 // One throwaway RSA key. The app passes the whole key JSON through
 // ga.serviceAccount, so that is the form used here; the same key is also written
 // to a temp file, since that config value also accepts a path.
@@ -280,6 +289,98 @@ describe("quick-insights auth", () => {
   });
 });
 
+describe("quick-insights ADC auth", () => {
+  const ADC_GA = { propertyId: "1234", useAdc: true };
+
+  const ARGS = {
+    pagePath: "/pricing",
+    startDate: "2026-07-01",
+    endDate: "2026-07-01",
+    ga: ADC_GA,
+  };
+
+  beforeEach(() => {
+    clearAuthCache();
+    jest.clearAllMocks();
+    mockGetAccessToken.mockResolvedValue("adc-token");
+  });
+
+  afterEach(() => {
+    delete global.fetch;
+  });
+
+  test("serviceAccountConfigured accepts ADC in place of a key", () => {
+    expect(serviceAccountConfigured({ useAdc: true })).toBe(true);
+    expect(serviceAccountConfigured({ useAdc: false })).toBe(false);
+  });
+
+  test("calls the Data API with the ADC token, no JWT exchange", async () => {
+    mockGoogle();
+
+    const result = await runPageReport(ARGS);
+
+    expect(GoogleAuth).toHaveBeenCalledWith({
+      scopes: ["https://www.googleapis.com/auth/analytics.readonly"],
+    });
+    expect(global.fetch).toHaveBeenCalledTimes(1);
+
+    const [reportUrl, reportOptions] = global.fetch.mock.calls[0];
+    expect(reportUrl).toBe(
+      "https://analyticsdata.googleapis.com/v1beta/properties/1234:runReport",
+    );
+    expect(reportOptions.headers.authorization).toBe("Bearer adc-token");
+    expect(result.rows).toEqual([{ date: "2026-07-01", views: 4 }]);
+  });
+
+  test("a configured key wins over ADC", async () => {
+    mockGoogle();
+
+    await runPageReport({
+      ...ARGS,
+      ga: { ...ADC_GA, serviceAccount: keyJson },
+    });
+
+    expect(GoogleAuth).not.toHaveBeenCalled();
+    expect(global.fetch.mock.calls[0][0]).toBe(
+      "https://oauth2.googleapis.com/token",
+    );
+    expect(global.fetch.mock.calls[1][1].headers.authorization).toBe(
+      "Bearer at-1",
+    );
+  });
+
+  test("reuses one ADC client until the cache is cleared", async () => {
+    mockGoogle();
+
+    await runPageReport(ARGS);
+    await runPageReport(ARGS);
+    expect(GoogleAuth).toHaveBeenCalledTimes(1);
+    expect(mockGetAccessToken).toHaveBeenCalledTimes(2);
+
+    clearAuthCache();
+    await runPageReport(ARGS);
+    expect(GoogleAuth).toHaveBeenCalledTimes(2);
+  });
+
+  test("surfaces ADC token failures", async () => {
+    mockGoogle();
+
+    mockGetAccessToken.mockRejectedValueOnce(
+      new Error("Could not load the default credentials"),
+    );
+    await expect(runPageReport(ARGS)).rejects.toThrow(
+      /Google ADC token request failed: Could not load the default credentials/,
+    );
+
+    mockGetAccessToken.mockResolvedValueOnce(null);
+    await expect(runPageReport(ARGS)).rejects.toThrow(
+      /Google ADC token response contained no access_token/,
+    );
+
+    expect(global.fetch).not.toHaveBeenCalled();
+  });
+});
+
 describe("runSummary", () => {
   const metrics = (views, users, engagementSeconds, rate, sessions) => ({
     metricValues: [views, users, engagementSeconds, rate, sessions].map(

package/src/views/resources/_shared/_history_toolbar.ejs

@@ -1,4 +1,4 @@
-<div class="actions-toolbar justify-end">
+<div class="justify-end actions-toolbar">
   <form method="POST" action="<%= `/${_context.locale}/${_context.resourceConfig.resourceTypePlural}/${resource.id}/${_context.resourceConfig.resourceType}_changes/reverts` %>" class="inline-block">
     <input type="hidden" name="version" value="<%= change.version %>">
 
@@ -7,7 +7,7 @@
       Revert
     </button>
     <% } else { %>
-    <button type="submit" disabled class="btn-text opacity-50 cursor-not-allowed">
+    <button type="submit" disabled class="opacity-50 cursor-not-allowed btn-text">
       Revert
     </button>
     <% } %>