@tinacms/cli 2.5.1 → 2.5.2

package/dist/cmds/forestry-migrate/index.d.ts

@@ -14,5 +14,5 @@ export declare const generateCollections: ({ pathToForestryConfig, usingTypescri
 }) => Promise<{
     collections: Collection[];
     importStatements: string;
-    templateCode: string;
+    templateCode: any;
 }>;

package/dist/cmds/forestry-migrate/util/codeTransformer.d.ts

@@ -34,5 +34,5 @@ export declare const makeTemplateFile: ({ templateMap, usingTypescript, }: {
     usingTypescript: boolean;
 }) => Promise<{
     importStatements: string[];
-    templateCodeText: string;
+    templateCodeText: any;
 }>;

package/dist/index.js

@@ -2,7 +2,7 @@
 import { Cli, Builtins } from "clipanion";
 
 // package.json
-var version = "2.5.1";
+var version = "2.5.2";
 
 // src/next/commands/dev-command/index.ts
 import path10 from "path";
@@ -1699,32 +1699,30 @@ function expandOrigins(raw) {
   const filtered = raw.filter((o) => o !== "private");
   return hasPrivate ? [...filtered, PRIVATE_NETWORK_RE] : filtered;
 }
-function buildCorsOriginCheck(allowedOrigins = []) {
-  const extra = expandOrigins(allowedOrigins);
-  return (origin, callback) => {
-    if (!origin) {
-      callback(null, true);
-      return;
-    }
-    if (LOCALHOST_RE.test(origin)) {
-      callback(null, true);
-      return;
-    }
-    for (const allowed of extra) {
-      if (typeof allowed === "string") {
-        if (allowed === origin) {
-          callback(null, true);
-          return;
-        }
-      } else {
-        allowed.lastIndex = 0;
-        if (allowed.test(origin)) {
-          callback(null, true);
-          return;
-        }
+function isOriginAllowed(origin, allowedOrigins = []) {
+  if (!origin) {
+    return true;
+  }
+  if (LOCALHOST_RE.test(origin)) {
+    return true;
+  }
+  for (const allowed of expandOrigins(allowedOrigins)) {
+    if (typeof allowed === "string") {
+      if (allowed === origin) {
+        return true;
+      }
+    } else {
+      allowed.lastIndex = 0;
+      if (allowed.test(origin)) {
+        return true;
       }
     }
-    callback(null, false);
+  }
+  return false;
+}
+function buildCorsOriginCheck(allowedOrigins = []) {
+  return (origin, callback) => {
+    callback(null, isOriginAllowed(origin, allowedOrigins));
   };
 }
 
@@ -2582,9 +2580,17 @@ var devServerEndPointsPlugin = ({
   searchIndex,
   databaseLock
 }) => {
-  const corsOriginCheck = buildCorsOriginCheck(
-    configManager.config?.server?.allowedOrigins
-  );
+  const allowedOrigins = configManager.config?.server?.allowedOrigins;
+  const corsOriginCheck = buildCorsOriginCheck(allowedOrigins);
+  const isStateChangingRequest = (req) => {
+    const url = req.url || "";
+    if (url.startsWith("/media/upload")) return true;
+    if (url.startsWith("/media") && req.method === "DELETE") return true;
+    if (url.startsWith("/graphql") && req.method === "POST") return true;
+    if ((url.startsWith("/searchIndex") || url.startsWith("/v2/searchIndex")) && (req.method === "POST" || req.method === "DELETE"))
+      return true;
+    return false;
+  };
   const plug = {
     name: "graphql-endpoints",
     configureServer(server) {
@@ -2607,6 +2613,11 @@ var devServerEndPointsPlugin = ({
           config: { apiURL, searchPath: "searchIndex" },
           searchIndex
         });
+        if (isStateChangingRequest(req) && !isOriginAllowed(req.headers.origin, allowedOrigins)) {
+          res.statusCode = 403;
+          res.end(JSON.stringify({ error: "Origin not allowed" }));
+          return;
+        }
         if (req.url.startsWith("/media/upload")) {
           await mediaRouter.handlePost(req, res);
           return;

package/dist/next/vite/cors.d.ts

@@ -8,6 +8,18 @@
  * bridge networks, etc.
  */
 /**
- * Build a CORS `origin` callback compatible with the `cors` npm package.
+ * Decide whether a request `Origin` is allowed to reach the dev server.
+ *
+ * No `Origin` (curl, same-origin, CLI tooling) and localhost are always
+ * allowed; extra `allowedOrigins` (with `'private'` expanded) match by exact
+ * string or RegExp.
+ */
+export declare function isOriginAllowed(origin: string | undefined, allowedOrigins?: (string | RegExp)[]): boolean;
+/**
+ * Build a CORS `origin` callback for the `cors` npm package.
+ *
+ * NOTE: `cors` only uses this to set the `Access-Control-Allow-Origin` header;
+ * it does NOT reject disallowed requests server-side. State-changing routes
+ * must also gate on {@link isOriginAllowed} (see plugins.ts).
  */
 export declare function buildCorsOriginCheck(allowedOrigins?: (string | RegExp)[]): (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => void;

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@tinacms/cli",
   "type": "module",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "main": "dist/index.js",
   "typings": "dist/index.d.ts",
   "files": [
     "dist",
-    "bin/*",
-    ".env"
+    "bin/*"
   ],
   "license": "Apache-2.0",
   "bin": {
@@ -44,11 +43,11 @@
     "mongodb-level": "^0.0.4",
     "sqlite-level": "^2.1.0",
     "ts-jest": "^29.2.5",
-    "@tinacms/scripts": "1.6.1"
+    "@tinacms/scripts": "1.6.2"
   },
   "dependencies": {
     "@graphql-codegen/core": "^2.6.8",
-    "@graphql-codegen/plugin-helpers": "latest",
+    "@graphql-codegen/plugin-helpers": "^7.0.1",
     "@graphql-codegen/typescript": "^4.1.3",
     "@graphql-codegen/typescript-operations": "^4.4.1",
     "@graphql-codegen/visitor-plugin-common": "^4.1.2",
@@ -92,12 +91,12 @@
     "vite": "^4.5.9",
     "yup": "^1.6.1",
     "zod": "^3.24.2",
-    "@tinacms/app": "2.5.6",
-    "@tinacms/graphql": "2.4.5",
-    "@tinacms/metrics": "2.1.0",
-    "tinacms": "3.9.3",
-    "@tinacms/schema-tools": "2.8.1",
-    "@tinacms/search": "1.2.19"
+    "@tinacms/app": "2.5.7",
+    "@tinacms/schema-tools": "2.8.2",
+    "@tinacms/graphql": "2.4.6",
+    "@tinacms/search": "1.2.20",
+    "tinacms": "3.9.4",
+    "@tinacms/metrics": "2.1.1"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"

package/dist/server/index.d.ts

@@ -1,4 +0,0 @@
-/**
-
-*/
-export * from './server';

package/dist/server/models/media.d.ts

@@ -1,56 +0,0 @@
-/**
-
-*/
-interface MediaArgs {
-    searchPath: string;
-    cursor?: string;
-    limit?: string;
-}
-interface File {
-    src: string;
-    filename: string;
-    size: number;
-}
-interface ListMediaRes {
-    directories: string[];
-    files: File[];
-    cursor?: string;
-    error?: string;
-}
-export interface PathConfig {
-    rootPath: string;
-    publicFolder: string;
-    mediaRoot: string;
-}
-type SuccessRecord = {
-    ok: true;
-} | {
-    ok: false;
-    message: string;
-};
-/**
- * Handles media file operations (list, delete) for the Express-based server.
- *
- * @security Every method that accepts a user-supplied `searchPath` validates
- * it against the media root using `resolveWithinBase` (list) or
- * `resolveStrictlyWithinBase` (delete) before any filesystem access.
- *
- * - **list** uses `resolveWithinBase` because listing the media root itself
- *   (empty path / exact base match) is a valid operation.
- * - **delete** uses `resolveStrictlyWithinBase` because deleting the media
- *   root directory itself must never be allowed.
- *
- * Both methods catch `PathTraversalError` and re-throw it so that the
- * route handler can return a 403 response. Other errors are caught and
- * returned as structured error responses (this avoids leaking stack traces
- * to the client).
- */
-export declare class MediaModel {
-    readonly rootPath: string;
-    readonly publicFolder: string;
-    readonly mediaRoot: string;
-    constructor({ rootPath, publicFolder, mediaRoot }: PathConfig);
-    listMedia(args: MediaArgs): Promise<ListMediaRes>;
-    deleteMedia(args: MediaArgs): Promise<SuccessRecord>;
-}
-export {};

package/dist/server/routes/index.d.ts

@@ -1,6 +0,0 @@
-/**
-
-*/
-import { Router } from 'express';
-import { PathConfig } from '../models/media';
-export declare const createMediaRouter: (config: PathConfig) => Router;

package/dist/server/server.d.ts

@@ -1,5 +0,0 @@
-/**
-
-*/
-import http from 'node:http';
-export declare const gqlServer: (database: any, verbose: boolean) => Promise<http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>>;