@wix/himalaya-cli 0.1012.0 → 0.1014.0

package/dist/cli.mjs

@@ -45887,6 +45887,29 @@ var init_assets = __esm({
   }
 });
 
+// ../../core/serve-runtime/src/pinned-read.ts
+async function checkPinnedRead(input) {
+  const { secret, token, app, releaseId, screenId, authorizePreview } = input;
+  if (!secret) return authorizePreview ? { status: 503, body: { error: "preview_token_unavailable" } } : null;
+  if (!token) return await input.isLive() ? null : { status: 401, body: { error: "preview_token_required", app, releaseId } };
+  const verified = await verifyPreviewToken({ token, secret, app, releaseId, screenId });
+  if (verified.ok) {
+    if (authorizePreview ? !await authorizePreview(verified.claims) : !!verified.claims.siteLease) {
+      return { status: 403, body: { error: "site_preview_forbidden" } };
+    }
+    return null;
+  }
+  return {
+    status: verified.error === "scope_mismatch" ? 403 : 401,
+    body: { error: `preview_token_${verified.error}`, app, releaseId, ...screenId ? { screenId } : {} }
+  };
+}
+var init_pinned_read = __esm({
+  "../../core/serve-runtime/src/pinned-read.ts"() {
+    init_preview_token();
+  }
+});
+
 // ../../core/serve-runtime/package-share.ts
 function parseStored(bytes2, id) {
   if (!bytes2) return null;
@@ -46193,10 +46216,13 @@ ${releaseId}`;
       }
     );
   }
-  async function appConfigFor(app, pin) {
+  async function appConfigFor(request, url, app) {
     const store = await getStore();
+    const pin = resolvePin(request, url);
     let bytes2 = null;
     if (pin) {
+      const denied = await authorizePinnedRead(request, url, app, pin);
+      if (denied) return { ok: false, response: denied };
       const m = await pinnedManifest(app, pin);
       if (!m) return { ok: false, response: json3(404, { error: "release_not_found", app, releaseId: pin }) };
       bytes2 = m.appConfigHash ? await pinnedBody(app, m.appConfigHash, () => store.getAppConfig(app)) : null;
@@ -46219,23 +46245,16 @@ ${releaseId}`;
     return new Response(body, { status: 200, headers: { "content-type": JSON_CT, etag, "cache-control": cache, ...vary } });
   }
   async function authorizePinnedRead(request, url, app, releaseId, screenId) {
-    const secret = opts.previewTokenSecret;
-    if (!secret) return opts.authorizePreview ? json3(503, { error: "preview_token_unavailable" }) : null;
-    const token = resolvePreviewToken(request, url);
-    const live2 = await manifest(app);
-    const isLive = live2?.releaseId === releaseId;
-    if (!token) return isLive ? null : json3(401, { error: "preview_token_required", app, releaseId });
-    const verified = await verifyPreviewToken({ token, secret, app, releaseId, screenId });
-    if (verified.ok) {
-      if (opts.authorizePreview ? !await opts.authorizePreview(verified.claims) : !!verified.claims.siteLease) return json3(403, { error: "site_preview_forbidden" });
-      return null;
-    }
-    return json3(verified.error === "scope_mismatch" ? 403 : 401, {
-      error: `preview_token_${verified.error}`,
+    const denied = await checkPinnedRead({
+      secret: opts.previewTokenSecret,
+      token: resolvePreviewToken(request, url),
       app,
       releaseId,
-      ...screenId ? { screenId } : {}
+      screenId,
+      isLive: async () => (await manifest(app))?.releaseId === releaseId,
+      authorizePreview: opts.authorizePreview
     });
+    return denied && json3(denied.status, denied.body);
   }
   const corsHeaders = (request) => {
     const origin = request.headers.get("origin");
@@ -46350,7 +46369,7 @@ ${releaseId}`;
           });
         }
         if (request.method !== "GET") return json3(405, { error: "method_not_allowed" });
-        const cfg = await appConfigFor(app2, resolvePin(request, url));
+        const cfg = await appConfigFor(request, url, app2);
         if (!cfg.ok) return cfg.response;
         const resolved2 = wixMemberAuthOf(utf8Decode(cfg.bytes), callbackUrlFor(url));
         if (!resolved2.ok) return json3(501, { error: `member_auth_${resolved2.error}`, app: app2 });
@@ -46408,7 +46427,7 @@ ${releaseId}`;
         }
         const app2 = resolveApp(request, url);
         if (!app2) return json3(400, { error: "app_required" });
-        const resolvedCfg = await appConfigFor(app2, resolvePin(request, url));
+        const resolvedCfg = await appConfigFor(request, url, app2);
         if (!resolvedCfg.ok) return resolvedCfg.response;
         const cfgBytes = resolvedCfg.bytes;
         let call;
@@ -46666,6 +46685,10 @@ ${releaseId}`;
       const cfgMatch = /^\/v1\/app-config\/([^/]+)$/.exec(path2);
       const app = cfgMatch?.[1] ?? resolveApp(request, url);
       const pin = resolvePin(request, url);
+      if (app && pin) {
+        const denied = await authorizePinnedRead(request, url, app, pin);
+        if (denied) return denied;
+      }
       if (path2 === "/v1/template-source") {
         if (!app) return json3(400, { error: "missing_app" });
         if (!store.getSource) return json3(501, { error: "templates_unsupported" });
@@ -46682,10 +46705,6 @@ ${releaseId}`;
           headers: { "content-type": JSON_CT, etag, "cache-control": DOC_CACHE_CONTROL, "x-himalaya-app": app }
         });
       }
-      if (app && pin) {
-        const denied = await authorizePinnedRead(request, url, app, pin);
-        if (denied) return denied;
-      }
       if (path2 === "/v1/authoring-docs" || /^\/v1\/authoring-docs\/(spec|mobile-ux)$/.test(path2)) {
         if (!app) return json3(400, { error: "missing_app" });
         const m = pin ? await pinnedManifest(app, pin) : await manifest(app);
@@ -47005,7 +47024,7 @@ var init_server = __esm({
     init_store();
     init_base64();
     init_contract();
-    init_preview_token();
+    init_pinned_read();
     init_package_share();
     init_wix_bridge();
     init_wix_member_auth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1012.0",
+  "version": "0.1014.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "e35f79cf127f1c7cbedf8abdcd5b92c12f3d7456c71abc3b741b08fb"
+  "falconPackageHash": "18405dc60f540308524da075bbb12c054da8e06b44e0fcdabaf2e2b0"
 }