@wix/himalaya-cli 0.1472.0 → 0.1473.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/app-config.d.ts

@@ -2,7 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { DerivedAppMeta } from "./app-module.js";
 import { type WixCachePolicy } from "./wix-cache-policy.js";
 import type { NetMocksFile, WixMockRule } from "./wix-gateway.js";
-import { gateScreenIdProblem } from "../../ts/src/auth-gate-screen.js";
+import { gateScreenIdProblem, liftAuthBlock } from "../../ts/src/auth-gate-screen.js";
 import { type UnmappedPushDestination } from "../../ts/src/wix-push-links.js";
 import type { PushConfig, FlagConfig, AppControl, TabBarConfig, DrawerConfig, SidebarConfig, SplashConfig, LocaleConfig, NavKind, OrientationConfig, StreamPolicy } from "@wix/himalaya/core";
 export type { PushConfig, FlagConfig, AppControl, TabBarConfig, DrawerConfig, SidebarConfig, SplashConfig, LocaleConfig, NavKind, OrientationConfig, StreamPolicy };
@@ -202,14 +202,11 @@ export { gateScreenIdProblem };
 /** Derive the OTA authConfig block from a defineApp auth block
  *  ({ providerId, config }). `required` is read from `config.required === true`
  *  and lifted to the top level, as is `config.gateScreenId` (#4651); secret-ish
- *  keys are scrubbed. When the app's screens are given, a `gateScreenId` naming none
- *  of them is DROPPED (the shell falls back to the stock login) and warned about —
- *  never thrown: this runs on every app-config serve and hot reload, and
- *  `himalaya-dev app validate` is where a bad id fails ([gateScreenIdProblem]). */
-export declare function deriveAuthConfig(auth: {
-    providerId: string;
-    config: Record<string, unknown>;
-} | undefined, screenIds?: readonly string[]): AuthConfigBlock | undefined;
+ *  keys are scrubbed — the same `liftAuthBlock` the auth bake runs (#4818). When
+ *  the app's screens are given, a `gateScreenId` naming none of them is DROPPED
+ *  (the shell falls back to the stock login) and warned about — never thrown: this
+ *  runs on every app-config serve and hot reload, and `himalaya-dev app validate` is where a bad id fails ([gateScreenIdProblem]). */
+export declare function deriveAuthConfig(auth: Parameters<typeof liftAuthBlock>[0], screenIds?: readonly string[]): AuthConfigBlock | undefined;
 /** Derive a baseline NavigationConfig from the loaded app's derived meta. */
 /** What `deriveNavigationConfig` needs to finish an app-level nav bundle ref.
  *

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/auth-gate-screen.d.ts

@@ -8,3 +8,32 @@ export declare function gateScreenIdProblem(auth: {
     providerId: string;
     config: Record<string, unknown>;
 } | undefined, screenIds: readonly string[]): string | null;
+/** Keys never lifted into a client auth block — the baked auth.json or the OTA authConfig (defense in
+ *  depth: public OAuth client ids are safe; anything secret-shaped is not). */
+export declare const AUTH_SECRET_KEY_RE: RegExp;
+/** The client auth block: what auth.json bakes and what the OTA `authConfig` serves. */
+export interface LiftedAuthBlock {
+    providerId: string;
+    required: boolean;
+    /** #4651 — the app's own auth gate screen; absent ⇒ the stock login. */
+    gateScreenId?: string;
+    config: Record<string, unknown>;
+}
+/** #4818 — the one lift from an auth block to the client shape, shared by the auth bake and the OTA
+ *  authConfig so the two cannot drift. Accepts the defineApp shape (`config.required`,
+ *  `config.gateScreenId`) AND an already-lifted block (top-level `required` / `gateScreenId`, as an
+ *  existing auth.json or a seed's `authConfig` carries them): re-lifting a lifted block is the
+ *  identity, so a re-bake never fails open. `required` is true when either place says so; a
+ *  `config.gateScreenId` wins over a top-level one. Secret-ish config keys are scrubbed. Returns null
+ *  when there is no usable providerId. */
+export declare function liftAuthBlock(auth: {
+    providerId?: unknown;
+    required?: unknown;
+    gateScreenId?: unknown;
+    config?: Record<string, unknown>;
+} | undefined | null): LiftedAuthBlock | null;
+/** The raw gate id of either auth shape (`config.gateScreenId` first), unvalidated — for the checks. */
+export declare function liftedGateScreenId(auth: {
+    gateScreenId?: unknown;
+    config?: Record<string, unknown>;
+}): unknown;

package/dist/cli.mjs

@@ -10034,7 +10034,6 @@ function webViewOriginAllowed(url, origins) {
 }
 var init_webview_origin = __esm({
   "../../core/ts/src/webview-origin.ts"() {
-    "use strict";
   }
 });
 
@@ -31153,8 +31152,29 @@ function gateScreenIdProblem(auth, screenIds) {
   if (screenIds.includes(gateId)) return null;
   return `defineApp: auth.config.gateScreenId is "${gateId}", which is not one of the app's exact screens \u2014 a required-auth launch would have no login to show (a release serves exact screens, so a templated route 404s). Name an exact screen, or drop gateScreenId to use the stock login.`;
 }
+function liftAuthBlock(auth) {
+  if (!auth || typeof auth.providerId !== "string" || auth.providerId.length === 0) return null;
+  const config = {};
+  for (const [key3, value] of Object.entries(auth.config ?? {})) {
+    if (key3 === "required" || key3 === "gateScreenId") continue;
+    if (AUTH_SECRET_KEY_RE.test(key3)) continue;
+    config[key3] = value;
+  }
+  const gateScreenId = liftedGateScreenId(auth);
+  return {
+    providerId: auth.providerId,
+    required: auth.config?.required === true || auth.required === true,
+    ...typeof gateScreenId === "string" && gateScreenId.length > 0 ? { gateScreenId } : {},
+    config
+  };
+}
+function liftedGateScreenId(auth) {
+  return auth.config?.gateScreenId ?? auth.gateScreenId;
+}
+var AUTH_SECRET_KEY_RE;
 var init_auth_gate_screen = __esm({
   "../../core/ts/src/auth-gate-screen.ts"() {
+    AUTH_SECRET_KEY_RE = /secret|private/i;
   }
 });
 
@@ -31350,22 +31370,15 @@ function deriveTelemetryConfig(app) {
   return cfg;
 }
 function deriveAuthConfig(auth, screenIds) {
-  if (!auth?.providerId) return void 0;
-  const config = {};
-  for (const [key3, value] of Object.entries(auth.config ?? {})) {
-    if (key3 === "required" || key3 === "gateScreenId") continue;
-    if (AUTH_SECRET_KEY_RE.test(key3)) continue;
-    config[key3] = value;
+  const lifted = liftAuthBlock(auth);
+  if (!lifted) return void 0;
+  const gateScreenId = liftedGateScreenId(auth);
+  const problem = gateScreenId !== void 0 && screenIds ? gateScreenIdProblem({ providerId: lifted.providerId, config: { gateScreenId } }, screenIds) : null;
+  if (problem) {
+    console.warn(`[app-config] ${problem} \u2014 serving the stock login instead.`);
+    delete lifted.gateScreenId;
   }
-  const gateScreenId = auth.config?.gateScreenId;
-  const problem = typeof gateScreenId === "string" && screenIds ? gateScreenIdProblem(auth, screenIds) : null;
-  if (problem) console.warn(`[app-config] ${problem} \u2014 serving the stock login instead.`);
-  return {
-    providerId: auth.providerId,
-    required: auth.config?.required === true,
-    ...typeof gateScreenId === "string" && gateScreenId.length > 0 && !problem ? { gateScreenId } : {},
-    config
-  };
+  return lifted;
 }
 function expandNavBundle(ref, ctx) {
   const url = ref.url ?? "";
@@ -31559,7 +31572,7 @@ function handleAppConfigRequest(req, res, meta, override, bundleCtx, devNetMocks
   });
   res.end(body);
 }
-var SHARED_WIX_SENTRY_DSN, AUTH_SECRET_KEY_RE, NAV_OVERRIDES;
+var SHARED_WIX_SENTRY_DSN, NAV_OVERRIDES;
 var init_app_config = __esm({
   "../../core/dev-server/src/app-config.ts"() {
     init_wix_cache_policy();
@@ -31568,7 +31581,6 @@ var init_app_config = __esm({
     init_preview_surfaces();
     init_wix_push_links();
     SHARED_WIX_SENTRY_DSN = "https://5dfa4f23057c43149b6219c07d177472@sentry.io/84240";
-    AUTH_SECRET_KEY_RE = /secret|private/i;
     NAV_OVERRIDES = {
       reference: {
         deepLinkPatterns: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1472.0",
+  "version": "0.1473.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "ee8b0fb2a0d0d40cae5b63254991c3606bf70ea053c38b3b602e5890"
+  "falconPackageHash": "f58b0d57918c163a9918dbe6f1170839ea6c6d6cf0d2b9c38b7a7004"
 }