veryfront 0.1.1237 → 0.1.1238

package/esm/src/server/project-env/fetcher.js

@@ -3,12 +3,12 @@
  *
  * @module server/project-env/fetcher
  */
-import { encodeBase64, getBaseLogger } from "../../utils/index.js";
+import { getBaseLogger } from "../../utils/index.js";
 import { readResponseTextPrefix } from "../../utils/response-body.js";
-import { AUTHENTICATION_REQUIRED, isVeryfrontError, NETWORK_ERROR, PERMISSION_DENIED, } from "../../errors/index.js";
-import { getHostEnv } from "../../platform/compat/process.js";
+import { AUTHENTICATION_REQUIRED, CONFIG_INVALID, isVeryfrontError, NETWORK_ERROR, PERMISSION_DENIED, } from "../../errors/index.js";
 import { isErrorAcrossRealms } from "../../platform/compat/error-introspection.js";
 import { createProjectEnvSnapshot } from "./snapshot.js";
+import { getMissingProjectEnvInternalCredentialDetail, getProjectEnvInternalAuthorization, requiresProjectEnvInternalAuthorization, } from "./internal-authorization.js";
 const baseLogger = getBaseLogger("PROJECT-ENV");
 const logger = baseLogger.component("project-env");
 /** Max env vars per request. API enforces a hard cap of 100. */
@@ -92,13 +92,6 @@ function parseEnvironmentResponse(text) {
         throw invalidEnvironmentResponse("Project environment response violated runtime limits", cause);
     }
 }
-function getInternalAuthorization() {
-    const username = getHostEnv("VERYFRONT_API_INTERNAL_USER");
-    const password = getHostEnv("VERYFRONT_API_INTERNAL_PASS");
-    if (!username || !password)
-        return undefined;
-    return `Basic ${encodeBase64(`${username}:${password}`)}`;
-}
 async function fetchEnvironmentVariables(url, authorization, projectSlug, environmentId, signal, headers = {}) {
     try {
         const requestHeaders = new Headers(headers);
@@ -171,7 +164,14 @@ export async function fetchProjectEnvVars(apiBaseUrl, projectSlug, environmentId
     }
     // Do not even materialize the host credential until the tenant credential
     // has proved access to this canonical project/environment pair.
-    const internalAuthorization = getInternalAuthorization();
+    const internalAuthorization = getProjectEnvInternalAuthorization();
+    if (!internalAuthorization && requiresProjectEnvInternalAuthorization()) {
+        discardResponseBody(response);
+        throw CONFIG_INVALID.create({
+            detail: getMissingProjectEnvInternalCredentialDetail() ??
+                "Internal project environment authorization is unavailable in hosted proxy mode",
+        });
+    }
     if (internalAuthorization) {
         discardResponseBody(response);
         response = await fetchEnvironmentVariables(internalUrl, internalAuthorization, projectSlug, environmentId, signal, { "x-project-slug": projectSlug });

package/esm/src/server/project-env/internal-authorization.d.ts

@@ -0,0 +1,7 @@
+/** Whether project env reads require the hosted runtime's internal API credential. */
+export declare function requiresProjectEnvInternalAuthorization(): boolean;
+/** Name the missing hosted runtime credentials without exposing their values. */
+export declare function getMissingProjectEnvInternalCredentialDetail(): string | undefined;
+/** Build the internal API authorization header when both credentials are present. */
+export declare function getProjectEnvInternalAuthorization(): string | undefined;
+//# sourceMappingURL=internal-authorization.d.ts.map

package/esm/src/server/project-env/internal-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-authorization.d.ts","sourceRoot":"","sources":["../../../../src/src/server/project-env/internal-authorization.ts"],"names":[],"mappings":"AAQA,sFAAsF;AACtF,wBAAgB,uCAAuC,IAAI,OAAO,CAKjE;AAED,iFAAiF;AACjF,wBAAgB,4CAA4C,IAAI,MAAM,GAAG,SAAS,CAQjF;AAED,qFAAqF;AACrF,wBAAgB,kCAAkC,IAAI,MAAM,GAAG,SAAS,CAKvE"}

package/esm/src/server/project-env/internal-authorization.js

@@ -0,0 +1,32 @@
+import { getHostEnv } from "../../platform/compat/process.js";
+import { encodeBase64 } from "../../utils/index.js";
+import { getEnvSource } from "../../utils/env-loader.js";
+const INTERNAL_USER_ENV = "VERYFRONT_API_INTERNAL_USER";
+const INTERNAL_PASS_ENV = "VERYFRONT_API_INTERNAL_PASS";
+const LOCAL_CLI_PROXY_MODE_ENV = "VERYFRONT_CLI_LOCAL_PROXY_MODE";
+/** Whether project env reads require the hosted runtime's internal API credential. */
+export function requiresProjectEnvInternalAuthorization() {
+    if (getHostEnv("PROXY_MODE") !== "1")
+        return false;
+    const isLocalCliProxyMode = getHostEnv(LOCAL_CLI_PROXY_MODE_ENV) === "1" &&
+        getEnvSource(LOCAL_CLI_PROXY_MODE_ENV).source === "process";
+    return !isLocalCliProxyMode;
+}
+/** Name the missing hosted runtime credentials without exposing their values. */
+export function getMissingProjectEnvInternalCredentialDetail() {
+    const missing = [
+        getHostEnv(INTERNAL_USER_ENV) ? undefined : INTERNAL_USER_ENV,
+        getHostEnv(INTERNAL_PASS_ENV) ? undefined : INTERNAL_PASS_ENV,
+    ].filter((name) => name !== undefined);
+    return missing.length > 0
+        ? `${missing.join(" and ")} must be set in hosted proxy mode`
+        : undefined;
+}
+/** Build the internal API authorization header when both credentials are present. */
+export function getProjectEnvInternalAuthorization() {
+    const username = getHostEnv(INTERNAL_USER_ENV);
+    const password = getHostEnv(INTERNAL_PASS_ENV);
+    if (!username || !password)
+        return undefined;
+    return `Basic ${encodeBase64(`${username}:${password}`)}`;
+}

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1237";
+export declare const VERSION = "0.1.1238";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1237";
+export const VERSION = "0.1.1238";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1237",
+  "version": "0.1.1238",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -425,13 +425,13 @@
     "@deno/shim-crypto": "0.3.1",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
-    "@veryfront/ext-bundler-esbuild": "0.1.1237",
-    "@veryfront/ext-content-mdx": "0.1.1237",
-    "@veryfront/ext-css-tailwind": "0.1.1237",
-    "@veryfront/ext-dev-ui-react": "0.1.1237",
-    "@veryfront/ext-node-websocket-ws": "0.1.1237",
-    "@veryfront/ext-parser-babel": "0.1.1237",
-    "@veryfront/ext-yaml": "0.1.1237"
+    "@veryfront/ext-bundler-esbuild": "0.1.1238",
+    "@veryfront/ext-content-mdx": "0.1.1238",
+    "@veryfront/ext-css-tailwind": "0.1.1238",
+    "@veryfront/ext-dev-ui-react": "0.1.1238",
+    "@veryfront/ext-node-websocket-ws": "0.1.1238",
+    "@veryfront/ext-parser-babel": "0.1.1238",
+    "@veryfront/ext-yaml": "0.1.1238"
   },
   "devDependencies": {
     "@types/node": "20.9.0"