@salesforce/templates 66.11.1 → 66.13.0

package/lib/templates/project/angularextapp/scripts/org-setup-utils.mjs

@@ -0,0 +1,369 @@
+/**
+ * Shared helpers for the org-setup scripts (W-23043735, spec §5.2/§5.6/Q9).
+ *
+ * Factored out of org-setup.mjs so BOTH `org-setup.mjs` and `org-setup-dev.mjs` import the
+ * same primitives instead of duplicating them:
+ *   - process runners (`run`, `runAsync`, `spawnAsync`)
+ *   - SFDX path + UI-bundle discovery (`resolveSfdxSource`, `discoverAllUIBundleDirs`,
+ *     `discoverUIBundleDir` — with the multi-bundle acknowledgment of §5.1 item 2)
+ *   - the interactive `--target-org` fallback (`resolveTargetOrg`) and its
+ *     single-select picker (`promptSelect`)
+ *   - pure, unit-testable logic for the license gate, SOQL-name validation, org-list
+ *     parsing, and the non-TTY multi-bundle warning
+ *
+ * IMPORTANT: this module is side-effect-free at import time — no top-level
+ * readFileSync / process.exit / CLI run — so it can be imported by tests and by
+ * org-setup-dev.mjs without triggering org-setup's main(). All I/O happens inside the
+ * exported functions, only when they are called. Errors are plain `Error`s (not
+ * org-setup's StepError) to avoid an import cycle; runStep handles both alike.
+ */
+
+import { spawnSync } from 'node:child_process';
+import { readdirSync, existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+// ---------------------------------------------------------------------------
+// Pure logic (no I/O) — unit-testable in isolation.
+// ---------------------------------------------------------------------------
+
+/**
+ * Validate that a profile name is safe to interpolate into a SOQL `WHERE Name =
+ * '<name>'` clause (spec §5.3, Q10 — validate-and-fail, NOT an escaper). The
+ * `selfRegProfile` is developer-authored config the app ships, and license /
+ * profile names are not expected to contain special characters, so a `'`, `\`,
+ * or control char is treated as a config mistake to surface loudly rather than a
+ * value to silently escape. Returns the name unchanged when valid; throws a
+ * clear config error otherwise. AC-8.
+ */
+export function validateProfileNameForSoql(name) {
+  const s = String(name);
+  // SOQL string delimiter (') and escape char (\) would break/inject the query;
+  // control chars (C0 + DEL) have no legitimate place in a profile name.
+  if (/['\\]/.test(s) || /[\x00-\x1f\x7f]/.test(s)) {
+    throw new Error(
+      `selfRegProfile name "${name}" contains an unsupported character ` +
+        `(quotes, backslashes, and control characters are not allowed). ` +
+        `Fix the profile name in org-setup.config.json.`,
+    );
+  }
+  return s;
+}
+
+/**
+ * Decide whether the self-reg profile's UserLicense is satisfied, from the rows
+ * a `SELECT UserLicense.LicenseDefinitionKey, UserLicense.Name, UserLicense.Status,
+ * UserLicense.TotalLicenses, UserLicense.UsedLicenses FROM Profile WHERE Name = '…'`
+ * query returns (spec §5.3). The seat math MUST be done here in JS — SOQL cannot
+ * compare two fields (Q3, verified live). Matches/report on the stable
+ * `LicenseDefinitionKey`, never the display Name (AC-2b).
+ *
+ * satisfied ⇔ Status === 'Active' && (total === -1 [unlimited sentinel] || total - used > 0).
+ * 0 rows / null UserLicense ⇒ not satisfied, with a reason naming the profile.
+ *
+ * @returns {{ satisfied: boolean, reason: string|null, license: {key,label,status,total,used}|null }}
+ */
+export function evaluateLicenseRows(rows, profileName) {
+  const lic = Array.isArray(rows) ? rows[0]?.UserLicense : null;
+  if (!lic) {
+    return {
+      satisfied: false,
+      reason: `no UserLicense found for profile "${profileName}" — the profile is missing in the org or its name is misspelled`,
+      license: null,
+    };
+  }
+  const key = lic.LicenseDefinitionKey ?? null;
+  const label = lic.Name ?? key ?? 'unknown license';
+  const total = Number(lic.TotalLicenses);
+  const used = Number(lic.UsedLicenses);
+  const license = { key, label, status: lic.Status, total, used };
+
+  if (lic.Status !== 'Active') {
+    return { satisfied: false, reason: `license ${label} (${key}) is not Active (Status=${lic.Status})`, license };
+  }
+  // Seat counts should always be integers in practice, but guard against a
+  // missing/non-numeric field so the skip reason stays legible (not "NaN/NaN").
+  if (!Number.isFinite(total) || !Number.isFinite(used)) {
+    return { satisfied: false, reason: `could not read seat counts for license ${label} (${key})`, license };
+  }
+  // -1 is the documented "unlimited" sentinel (defensive — unverified live, §5.3).
+  if (total === -1 || total - used > 0) {
+    return { satisfied: true, reason: null, license };
+  }
+  return {
+    satisfied: false,
+    reason: `license ${label} (${key}) has no available seats (${used}/${total} used)`,
+    license,
+  };
+}
+
+/**
+ * Parse `sf org list --json` defensively into a flat org list + the default org
+ * (spec §5.1 item 3; mirrors isOrgConnected's try/catch tolerance). Collects
+ * every array under `result` (nonScratchOrgs, scratchOrgs, sandboxes, devHubs, …)
+ * so the picker sees all authenticated orgs; the default is the entry marked
+ * `isDefaultUsername`. Malformed / unexpected JSON ⇒ empty result (caller then
+ * falls back to the clear error).
+ *
+ * @returns {{ orgs: Array<{alias:string|null, username:string, isDefault:boolean}>, defaultOrg: string|null }}
+ */
+export function parseOrgList(jsonText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonText);
+  } catch {
+    return { orgs: [], defaultOrg: null };
+  }
+  const result = parsed?.result;
+  if (!result || typeof result !== 'object') return { orgs: [], defaultOrg: null };
+
+  const orgs = [];
+  const seen = new Set();
+  for (const val of Object.values(result)) {
+    if (!Array.isArray(val)) continue;
+    for (const entry of val) {
+      if (!entry || typeof entry !== 'object' || !entry.username) continue;
+      if (seen.has(entry.username)) continue;
+      seen.add(entry.username);
+      orgs.push({
+        alias: entry.alias ?? null,
+        username: entry.username,
+        isDefault: entry.isDefaultUsername === true,
+      });
+    }
+  }
+  const def = orgs.find((o) => o.isDefault);
+  return { orgs, defaultOrg: def ? (def.alias ?? def.username) : null };
+}
+
+/**
+ * Multi-line warning for the non-TTY multi-bundle case (spec §5.1 item 2, AC-4b):
+ * there is nothing to interactively acknowledge, so keep the deterministic
+ * `all[0]` pick but never do it silently — name every bundle, the chosen one, and
+ * the `--ui-bundle-name` remedy.
+ */
+export function buildMultiBundleWarning(allBundleNames, chosen) {
+  return [
+    `⚠ Multiple UI bundles found under uiBundles/ (${allBundleNames.length}):`,
+    ...allBundleNames.map((n) => `    - ${n}${n === chosen ? '   ← using this one' : ''}`),
+    `  Using "${chosen}" (first alphabetically). To deploy a different bundle, re-run with:`,
+    `    --ui-bundle-name <name>`,
+  ].join('\n');
+}
+
+// ---------------------------------------------------------------------------
+// Process runner (moved from org-setup.mjs; plain Error to avoid an import cycle).
+// Only the synchronous `run` is shared — org-setup-dev.mjs runs its steps serially. The
+// async spawn variants stay local to org-setup.mjs where the parallel permset
+// path uses them, so this module exposes no caller-less surface.
+// ---------------------------------------------------------------------------
+
+export function run(name, cmd, args, opts = {}) {
+  const { cwd = process.cwd(), optional = false } = opts;
+  console.log('\n---', name, '---');
+  const result = spawnSync(cmd, args, {
+    cwd,
+    stdio: 'inherit',
+    shell: true,
+    ...(opts.env && { env: opts.env }),
+    ...(opts.timeout && { timeout: opts.timeout }),
+  });
+  if (result.status !== 0 && !optional) {
+    throw new Error(`${name} (exit ${result.status ?? 1})`);
+  }
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// SFDX paths + UI-bundle discovery.
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve the first package directory's source root (main/default) from
+ * sfdx-project.json under `root`. Exits non-zero with a clear message when the
+ * project file or packageDirectories path is missing. Called explicitly by each
+ * entry script (not at import) so this module stays side-effect-free.
+ */
+export function resolveSfdxSource(root) {
+  const sfdxPath = resolve(root, 'sfdx-project.json');
+  if (!existsSync(sfdxPath)) {
+    console.error('Error: sfdx-project.json not found at project root.');
+    process.exit(1);
+  }
+  const sfdxProject = JSON.parse(readFileSync(sfdxPath, 'utf8'));
+  const pkgDir = sfdxProject?.packageDirectories?.[0]?.path;
+  if (!pkgDir) {
+    console.error('Error: No packageDirectories[].path found in sfdx-project.json.');
+    process.exit(1);
+  }
+  return resolve(root, pkgDir, 'main', 'default');
+}
+
+/** Basename of a bundle dir path, cross-platform. */
+function bundleName(dir) {
+  return dir.split(/[/\\]/).pop();
+}
+
+/**
+ * All UI bundle directories under `uiBundlesDir` (alphabetical, hidden dirs
+ * excluded). When `uiBundleName` is given, returns just that one (erroring if it
+ * doesn't exist). Exits non-zero when the uiBundles dir or a named bundle is
+ * missing.
+ */
+export function discoverAllUIBundleDirs(uiBundlesDir, uiBundleName) {
+  if (!existsSync(uiBundlesDir)) {
+    console.error(`Error: uiBundles directory not found: ${uiBundlesDir}`);
+    process.exit(1);
+  }
+  const entries = readdirSync(uiBundlesDir, { withFileTypes: true });
+  const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith('.'));
+  if (dirs.length === 0) {
+    console.error(`Error: No UI bundle folder found under ${uiBundlesDir}`);
+    process.exit(1);
+  }
+  if (uiBundleName) {
+    const requested = dirs.find((d) => d.name === uiBundleName);
+    if (!requested) {
+      console.error(`Error: UI bundle directory not found: ${uiBundleName}`);
+      process.exit(1);
+    }
+    return [resolve(uiBundlesDir, requested.name)];
+  }
+  return dirs.map((d) => resolve(uiBundlesDir, d.name));
+}
+
+/**
+ * Resolve the single UI bundle to operate on, with the multi-bundle
+ * acknowledgment of spec §5.1 item 2 (Q5). When >1 bundle exists and no
+ * `--ui-bundle-name` was given:
+ *   - TTY: present a single-select picker (all bundles, alphabetical all[0]
+ *     preselected) — enter accepts all[0], arrows choose another (AC-4).
+ *   - non-TTY: keep the deterministic all[0] pick but emit the multi-line warning
+ *     (AC-4b) — never a silent pick.
+ * Explicit `--ui-bundle-name` short-circuits both (no prompt, no warning; AC-4c).
+ */
+export async function discoverUIBundleDir(uiBundlesDir, uiBundleName) {
+  const all = discoverAllUIBundleDirs(uiBundlesDir, uiBundleName);
+  if (all.length > 1 && !uiBundleName) {
+    const names = all.map(bundleName);
+    if (process.stdin.isTTY) {
+      const idx = await promptSelect(names, {
+        prompt: 'Multiple UI bundles found — select which one to deploy:',
+        preselectedIndex: 0,
+      });
+      return all[idx];
+    }
+    console.warn(buildMultiBundleWarning(names, names[0]));
+  }
+  return all[0];
+}
+
+// ---------------------------------------------------------------------------
+// Interactive single-select picker + --target-org fallback.
+// ---------------------------------------------------------------------------
+
+/**
+ * Interactive single-select: arrow keys navigate, enter confirms. Returns the
+ * chosen index. Falls through to `preselectedIndex` immediately when stdin is not
+ * a TTY. Built on the same raw-mode scaffolding as promptSteps (org-setup.mjs)
+ * but selects exactly one item (spec §5.1 items 2 & 3).
+ */
+export function promptSelect(options, { prompt = 'Select an option:', preselectedIndex = 0 } = {}) {
+  if (!process.stdin.isTTY || options.length === 0) return Promise.resolve(preselectedIndex);
+
+  let cursor = Math.min(Math.max(0, preselectedIndex), options.length - 1);
+  const RST = '\x1B[0m';
+  const CYAN = '\x1B[36m';
+  const GREEN = '\x1B[32m';
+
+  function render() {
+    return options.map((label, row) => {
+      const ptr = row === cursor ? `${CYAN}❯${RST}` : ' ';
+      const chk = row === cursor ? `${GREEN}●${RST}` : '○';
+      return `${ptr} ${chk} ${label}`;
+    });
+  }
+
+  return new Promise((resolvePromise) => {
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding('utf8');
+    process.stdout.write('\x1B[?25l');
+    console.log(`\n${prompt} (↑↓ move, enter confirm):\n`);
+    let prevRows = options.length;
+    process.stdout.write(render().join('\n') + '\n');
+
+    function redraw() {
+      process.stdout.write(`\x1B[${prevRows}A`);
+      const lines = render();
+      for (const line of lines) process.stdout.write(`\x1B[2K${line}\n`);
+      prevRows = lines.length;
+    }
+
+    process.stdin.on('data', (key) => {
+      if (key === '\x03') {
+        process.stdout.write('\x1B[?25h\n');
+        process.exit(0);
+      }
+      if (key === '\r' || key === '\n') {
+        process.stdout.write('\x1B[?25h');
+        process.stdin.setRawMode(false);
+        process.stdin.pause();
+        process.stdin.removeAllListeners('data');
+        console.log();
+        resolvePromise(cursor);
+        return;
+      }
+      if (key === '\x1B[A' || key === 'k') {
+        cursor = Math.max(0, cursor - 1);
+        redraw();
+      } else if (key === '\x1B[B' || key === 'j') {
+        cursor = Math.min(options.length - 1, cursor + 1);
+        redraw();
+      }
+    });
+  });
+}
+
+/**
+ * Resolve the target org (spec §5.1 item 3, §15). When `--target-org` is supplied
+ * it is returned verbatim with NO `sf org list` call (AC-7, byte-for-byte the
+ * scripted path). Otherwise discover authenticated orgs via `sf org list --json`
+ * and:
+ *   - TTY: present a picker with the default org at the top and preselected
+ *     (AC-5); enter selects the default.
+ *   - non-TTY: use the default org if resolvable, else exit 1 with a clear
+ *     message (AC-6).
+ */
+export async function resolveTargetOrg(parsed) {
+  if (parsed.targetOrg) return parsed.targetOrg;
+
+  const listResult = spawnSync('sf', ['org', 'list', '--json'], {
+    encoding: 'utf8',
+    shell: true,
+  });
+  const { orgs, defaultOrg } = parseOrgList(listResult.status === 0 ? listResult.stdout : '');
+
+  if (process.stdin.isTTY && orgs.length > 0) {
+    // Default org first + preselected; the rest keep sf's order.
+    const ordered = [...orgs].sort((a, b) => (b.isDefault ? 1 : 0) - (a.isDefault ? 1 : 0));
+    const labels = ordered.map((o) => {
+      const name = o.alias ?? o.username;
+      const suffix = o.alias && o.alias !== o.username ? ` (${o.username})` : '';
+      return `${name}${suffix}${o.isDefault ? '  [default]' : ''}`;
+    });
+    const idx = await promptSelect(labels, { prompt: 'Select the target org:', preselectedIndex: 0 });
+    const chosen = ordered[idx];
+    return chosen.alias ?? chosen.username;
+  }
+
+  if (defaultOrg) {
+    console.log(`No --target-org given; using the default org: ${defaultOrg}`);
+    return defaultOrg;
+  }
+
+  console.error(
+    'Error: --target-org <alias> is required. No default org is set and this is not an ' +
+      'interactive terminal. Set a default org (sf config set target-org=<alias>) or pass --target-org.',
+  );
+  process.exit(1);
+}

package/lib/templates/project/angularextapp/scripts/org-setup-xml.mjs

@@ -0,0 +1,182 @@
+/**
+ * Pure, importable XML helpers for org-setup.mjs network-metadata mutation
+ * (W-23043734 — Infrastructure Hygiene).
+ *
+ * These functions replace the script's former blind-regex editing of
+ * `*.network-meta.xml`. The contract is:
+ *
+ *   1. Parse the XML with `fast-xml-parser` ONLY to assert the expected nodes
+ *      exist — this kills the old silent no-op (the regex matched nothing on a
+ *      reformatted file yet the file was still rewritten + success logged).
+ *   2. Decide idempotency on the parsed model (profile already a member, self-reg
+ *      already enabled) so callers keep their existing skip semantics + messages.
+ *   3. Mutate via a TARGETED string edit on the original text — NOT a full
+ *      re-serialize. The XML declaration, the `xmlns` on <Network>,
+ *      self-closing tags, and the file's existing indentation are preserved
+ *      byte-for-byte, so a configured file re-run is a true no-op and there is
+ *      zero deploy-diff hazard on this org-deployed file. (XMLBuilder/prettier
+ *      are intentionally NOT used — a full re-serialize would churn formatting.)
+ *      Profile names are asserted free of XML-special characters and interpolated
+ *      raw — we reject such names rather than entity-escape them (a special
+ *      character in a config-authored profile name signals a mistake).
+ *
+ * Pure (no fs / no process): org-setup.mjs reads/writes the file and owns the
+ * per-call-site fail mode (throw StepError vs. loud console.error); these
+ * helpers only parse, assert, and return the edited text. Kept in a dedicated
+ * module so they carry automated coverage: the shipped SFDX package has no test
+ * runner, so the specs live in the consuming ui-bundle-template-cli package
+ * (patches-cli/test/unit/org-setup-xml.spec.ts) rather than bundling into every
+ * generated app's dist/scripts.
+ */
+
+import { XMLParser } from 'fast-xml-parser';
+
+const NETWORK_ROOT = 'Network';
+
+/** Parser tuned to read the document faithfully: keep attributes, never coerce
+ *  values (so `<selfRegistration>false</...>` stays the string "false"). */
+const parser = new XMLParser({
+  ignoreAttributes: false,
+  parseTagValue: false,
+  parseAttributeValue: false,
+});
+
+/**
+ * Thrown when a required node is absent from the network metadata. Callers map
+ * this to the fail mode appropriate to their orchestration position: the
+ * post-deploy selfReg step rethrows it as a recorded StepError; the best-effort
+ * pre-deploy prep logs it loudly without aborting.
+ */
+export class NetworkXmlError extends Error {}
+
+/** Characters that would need XML entity-escaping if interpolated into markup. */
+const XML_SPECIAL_CHARS = /[&<>"']/;
+
+/**
+ * Assert a profile name is safe to interpolate into the network metadata as-is.
+ *
+ * We deliberately do NOT entity-escape: a self-reg profile name is authored in
+ * `org-setup.config.json`, and one containing `&`, `<`, `>`, or quotes almost
+ * certainly signals a config mistake rather than a genuine name. Rather than
+ * silently rewrite it into `&amp;`-style entities, fail loudly so the author
+ * fixes the config. Throws NetworkXmlError (mapped by callers to their fail
+ * mode) when the name contains an XML-special character.
+ */
+export function assertSafeProfileName(name) {
+  if (XML_SPECIAL_CHARS.test(String(name))) {
+    throw new NetworkXmlError(
+      `profile name "${name}" contains an XML-special character (& < > " '); ` +
+        `use a name without these characters in org-setup.config.json`,
+    );
+  }
+  return String(name);
+}
+
+/**
+ * Parse + assert this is a Network metadata document. Returns the parsed
+ * `Network` object. Throws NetworkXmlError if the root is missing (e.g. a file
+ * that is not actually network metadata).
+ */
+export function parseNetwork(xml) {
+  let parsed;
+  try {
+    parsed = parser.parse(xml);
+  } catch (e) {
+    throw new NetworkXmlError(`network metadata is not well-formed XML: ${e.message}`);
+  }
+  const network = parsed?.[NETWORK_ROOT];
+  if (network == null || typeof network !== 'object') {
+    throw new NetworkXmlError(`expected a <${NETWORK_ROOT}> root node, but none was found`);
+  }
+  return network;
+}
+
+/** Normalize a fast-xml-parser child (absent | scalar | array) to an array. */
+function asArray(node) {
+  if (node == null) return [];
+  return Array.isArray(node) ? node : [node];
+}
+
+/**
+ * Indentation for a new <networkMemberGroups> child, derived from the file's
+ * own formatting rather than a fixed width — so the targeted edit stays
+ * byte-faithful on reformatted (e.g. 2-space) files, not just the shipped
+ * 4-space template. Prefer an existing
+ * sibling <profile>'s exact indent; otherwise fall back to the
+ * <networkMemberGroups> indent doubled (it is always a direct child of the
+ * <Network> root, i.e. one level deep).
+ */
+function memberGroupChildIndent(xml) {
+  const sibling = xml.match(/\n([ \t]+)<profile>/);
+  if (sibling) return sibling[1];
+  const parent = xml.match(/\n([ \t]*)<networkMemberGroups>/);
+  const parentIndent = parent ? parent[1] : '    ';
+  return parentIndent + (parentIndent || '    ');
+}
+
+/**
+ * Ensure `selfRegProfile` is listed under <networkMemberGroups>.
+ *
+ * Asserts <networkMemberGroups> exists (throws NetworkXmlError if not). Returns
+ * `{ xml, changed }`: `changed: false` (input returned unchanged) when the
+ * profile is already a member; otherwise the profile is inserted via a targeted
+ * edit right after the opening <networkMemberGroups> tag and `changed: true`.
+ */
+export function addProfileToMemberGroups(xml, selfRegProfile) {
+  const network = parseNetwork(xml);
+  if (!('networkMemberGroups' in network) || network.networkMemberGroups == null) {
+    throw new NetworkXmlError(
+      'network metadata has no <networkMemberGroups> node to add the self-reg profile to',
+    );
+  }
+  const existing = asArray(network.networkMemberGroups.profile).map((p) => String(p));
+  if (existing.includes(String(selfRegProfile))) {
+    return { xml, changed: false };
+  }
+  // Reject names with XML-special characters rather than escaping them (see
+  // assertSafeProfileName) before interpolating raw.
+  const safeName = assertSafeProfileName(selfRegProfile);
+  // Targeted edit: insert after the open tag, matching the file's own member
+  // indent (preserves formatting on reformatted files).
+  const indent = memberGroupChildIndent(xml);
+  const updated = xml.replace(
+    /(<networkMemberGroups>)/,
+    `$1\n${indent}<profile>${safeName}</profile>`,
+  );
+  return { xml: updated, changed: true };
+}
+
+/**
+ * Enable self-registration: set <selfRegistration>true</selfRegistration> and
+ * add <selfRegProfile>.
+ *
+ * Asserts <selfRegistration> exists (throws NetworkXmlError if not). Returns
+ * `{ xml, changed }`: `changed: false` (input returned unchanged) when self-reg
+ * is already enabled or a selfRegProfile is already present — same skip
+ * semantics as before; otherwise applies a targeted edit and `changed: true`.
+ */
+export function enableSelfRegInXml(xml, selfRegProfile) {
+  const network = parseNetwork(xml);
+  if (!('selfRegistration' in network)) {
+    throw new NetworkXmlError(
+      'network metadata has no <selfRegistration> node to enable self-registration on',
+    );
+  }
+  const alreadyEnabled = String(network.selfRegistration) === 'true';
+  const alreadyHasProfile = 'selfRegProfile' in network;
+  if (alreadyEnabled || alreadyHasProfile) {
+    return { xml, changed: false };
+  }
+  // Reject names with XML-special characters rather than escaping them (see
+  // assertSafeProfileName) before interpolating raw.
+  const safeName = assertSafeProfileName(selfRegProfile);
+  let updated = xml.replace(
+    /<selfRegistration>false<\/selfRegistration>/,
+    '<selfRegistration>true</selfRegistration>',
+  );
+  updated = updated.replace(
+    /(\s*)(<selfRegistration>)/,
+    `$1<selfRegProfile>${safeName}</selfRegProfile>\n$1$2`,
+  );
+  return { xml: updated, changed: true };
+}

package/lib/templates/project/angularextapp/scripts/org-setup.config.json

@@ -0,0 +1,9 @@
+{
+  "permsetAssignments": {
+    "assignments": {
+      "angularextapp_Guest_User_Api_Access": {
+        "assignee": "guestUser"
+      }
+    }
+  }
+}