pxt-core 12.2.13 → 12.2.14

package/built/pxt.js

@@ -108276,6 +108276,31 @@ var pxt;
                 return false;
             return hasProxy();
         }
+        /**
+         * Organizations that require SAML SSO for OAuth tokens.
+         * User tokens without SAML authorization will fail with 403 errors for these orgs.
+         * We should use the proxy instead when a token is present.
+         */
+        const samlProtectedOrgs = ["microsoft"];
+        /**
+         * Determines if we should use the proxy for a specific repo to avoid SAML SSO issues.
+         * Returns true if the repo is owned by an organization that requires SAML and we have a token.
+         */
+        function shouldUseProxyForRepo(repoPath) {
+            // If no token, let normal proxy logic apply
+            if (!github.token)
+                return shouldUseProxy();
+            const parsed = parseRepoId(repoPath);
+            if (!parsed)
+                return shouldUseProxy();
+            // Check if the repo owner requires SAML SSO
+            const ownerLower = parsed.owner.toLowerCase();
+            const requiresSaml = samlProtectedOrgs.some(org => org === ownerLower);
+            // If SAML is required and we have a token, force proxy to avoid auth issues
+            // Otherwise use normal logic (which will skip proxy if we have a token)
+            return requiresSaml ? true : shouldUseProxy();
+        }
+        github.shouldUseProxyForRepo = shouldUseProxyForRepo;
         const isPrivateRepoCache = {};
         function ghRequestAsync(options) {
             var _a;
@@ -131073,14 +131098,15 @@ ${output}</xml>`;
                     if (checkIfWithinFunction(n)) {
                         return undefined;
                     }
-                    return pxtc.Util.lf("Return statements can only be used within top-level function declarations");
-                    function checkIfWithinFunction(n) {
-                        const enclosing = ts.getEnclosingBlockScopeContainer(n);
+                    return pxtc.Util.lf("Return statements can only return values inside user-defined functions");
+                    function checkIfWithinFunction(toCheck) {
+                        const enclosing = ts.getEnclosingBlockScopeContainer(toCheck);
                         if (enclosing) {
                             switch (enclosing.kind) {
-                                case SK.SourceFile:
                                 case SK.ArrowFunction:
                                 case SK.FunctionExpression:
+                                    return !n.expression;
+                                case SK.SourceFile:
                                     return false;
                                 case SK.FunctionDeclaration:
                                     return enclosing.parent && enclosing.parent.kind === SK.SourceFile && !checkStatement(enclosing, env, false, true);

package/built/pxtblocks/plugins/duplicateOnDrag/connectionChecker.d.ts

@@ -7,3 +7,4 @@ export declare class DuplicateOnDragConnectionChecker extends Blockly.Connection
      */
     doSafetyChecks(a: Blockly.Connection | null, b: Blockly.Connection | null): number;
 }
+export declare function getContainingFunction(block: Blockly.Block): Blockly.Block;

package/built/pxtcompiler.js

@@ -6632,14 +6632,15 @@ ${output}</xml>`;
                     if (checkIfWithinFunction(n)) {
                         return undefined;
                     }
-                    return pxtc.Util.lf("Return statements can only be used within top-level function declarations");
-                    function checkIfWithinFunction(n) {
-                        const enclosing = ts.getEnclosingBlockScopeContainer(n);
+                    return pxtc.Util.lf("Return statements can only return values inside user-defined functions");
+                    function checkIfWithinFunction(toCheck) {
+                        const enclosing = ts.getEnclosingBlockScopeContainer(toCheck);
                         if (enclosing) {
                             switch (enclosing.kind) {
-                                case SK.SourceFile:
                                 case SK.ArrowFunction:
                                 case SK.FunctionExpression:
+                                    return !n.expression;
+                                case SK.SourceFile:
                                     return false;
                                 case SK.FunctionDeclaration:
                                     return enclosing.parent && enclosing.parent.kind === SK.SourceFile && !checkStatement(enclosing, env, false, true);

package/built/pxtlib.d.ts

@@ -1441,6 +1441,11 @@ declare namespace pxt.github {
         latestVersion?: string;
     }
     let forceProxy: boolean;
+    /**
+     * Determines if we should use the proxy for a specific repo to avoid SAML SSO issues.
+     * Returns true if the repo is owned by an organization that requires SAML and we have a token.
+     */
+    function shouldUseProxyForRepo(repoPath: string): boolean;
     let handleGithubNetworkError: (opts: U.HttpRequestOptions, e: any) => boolean;
     interface CachedPackage {
         files: Map<string>;

package/built/pxtlib.js

@@ -10555,6 +10555,31 @@ var pxt;
                 return false;
             return hasProxy();
         }
+        /**
+         * Organizations that require SAML SSO for OAuth tokens.
+         * User tokens without SAML authorization will fail with 403 errors for these orgs.
+         * We should use the proxy instead when a token is present.
+         */
+        const samlProtectedOrgs = ["microsoft"];
+        /**
+         * Determines if we should use the proxy for a specific repo to avoid SAML SSO issues.
+         * Returns true if the repo is owned by an organization that requires SAML and we have a token.
+         */
+        function shouldUseProxyForRepo(repoPath) {
+            // If no token, let normal proxy logic apply
+            if (!github.token)
+                return shouldUseProxy();
+            const parsed = parseRepoId(repoPath);
+            if (!parsed)
+                return shouldUseProxy();
+            // Check if the repo owner requires SAML SSO
+            const ownerLower = parsed.owner.toLowerCase();
+            const requiresSaml = samlProtectedOrgs.some(org => org === ownerLower);
+            // If SAML is required and we have a token, force proxy to avoid auth issues
+            // Otherwise use normal logic (which will skip proxy if we have a token)
+            return requiresSaml ? true : shouldUseProxy();
+        }
+        github.shouldUseProxyForRepo = shouldUseProxyForRepo;
         const isPrivateRepoCache = {};
         function ghRequestAsync(options) {
             var _a;