web-manager 4.3.3 → 4.3.5

package/dist/index.js

@@ -99,7 +99,10 @@ class Manager {
       // convention). Reads flat `firebaseConfig` (BEM/BXM/EM canonical shape) and falls
       // back to nested `firebase.app.config` (UJM's current `_config.yml` shape).
       // Once UJM migrates to the flat shape this fallback can be dropped.
-      if (this._resolveFirebaseConfig()) {
+      // Initialize Firebase only when the resolved config can actually boot the
+      // SDK — apiKey is mandatory (init without one crashes with auth/invalid-api-key).
+      // Configs carrying only projectId/authDomain still resolve for URL derivation.
+      if (this._resolveFirebaseConfig()?.apiKey) {
         await this._initializeFirebase();
       }
 
@@ -394,14 +397,20 @@ class Manager {
 
   // Resolve the Firebase web SDK config blob. Flat `firebaseConfig` first (canonical
   // shape — BEM/BXM/EM), then nested `firebase.app.config` (UJM legacy yaml shape).
-  // Returns the blob when it has at least one own key, otherwise null.
+  // A blob only counts when at least one value is non-empty — framework config merges
+  // (e.g. UJM's Jekyll chain) inject all-empty-string blobs into Firebase-less sites,
+  // and those must resolve to null (no init, no URL derivation).
   _resolveFirebaseConfig() {
+    const hasValues = (blob) => !!blob
+      && typeof blob === 'object'
+      && Object.values(blob).some((value) => value);
+
     const flat = this.config.firebaseConfig;
-    if (flat && typeof flat === 'object' && Object.keys(flat).length > 0) {
+    if (hasValues(flat)) {
       return flat;
     }
     const nested = this.config.firebase?.app?.config;
-    if (nested && typeof nested === 'object' && Object.keys(nested).length > 0) {
+    if (hasValues(nested)) {
       return nested;
     }
     return null;
@@ -506,7 +515,9 @@ class Manager {
       || this.config.environment;
 
     if (env === 'development') {
-      return 'http://localhost:5002';
+      // BEM's `mgr serve` exposes the local API over HTTPS (mkcert proxy on 5002,
+      // since backend-manager 5.7.0) — plain http:// cannot connect to it.
+      return 'https://localhost:5002';
     }
 
     const apiDomain = this._resolveFirebaseConfig()?.authDomain; // Has to be this since some projects like Clockii use ITW Universal Auth
@@ -526,6 +537,14 @@ class Manager {
       const returnUrlObject = new URL(decodeURIComponent(url));
       const currentUrlObject = new URL(window.location.href);
 
+      // Loopback returns (RFC 8252 §7.3) are valid while the SITE runs in development:
+      // native apps (Electron Manager) can't OS-register their custom scheme in dev, so
+      // their sign-in flow returns to an ephemeral 127.0.0.1 listener instead. Any port —
+      // the app binds it at flow start. Production sites never match this branch.
+      if (this.isDevelopment() && ['127.0.0.1', '[::1]', 'localhost'].includes(returnUrlObject.hostname)) {
+        return true;
+      }
+
       return returnUrlObject.host === currentUrlObject.host
         || returnUrlObject.protocol === this.config.brand?.id + ':'
         || (this.config.validRedirectHosts || []).includes(returnUrlObject.host);

package/docs/architecture.md

@@ -50,3 +50,10 @@ Manager (index.js)
 ├── DOM utilities (standalone)
 └── Utilities (standalone)
 ```
+
+## Firebase Initialization
+
+`initialize(config)` boots Firebase only when a usable web SDK config resolves:
+
+- `_resolveFirebaseConfig()` checks the flat `firebaseConfig` blob first (canonical shape — BEM/BXM/EM), then the nested `firebase.app.config` (UJM yaml shape). A blob only counts when **at least one value is non-empty** — framework config merges (e.g. UJM's Jekyll chain) inject all-empty-string blobs into Firebase-less sites, and those resolve to `null` (no init, no URL derivation).
+- Initialization additionally requires a **non-empty `apiKey`** — the SDK cannot boot without one (it crashes the page with `auth/invalid-api-key`). Configs carrying only `projectId`/`authDomain` still resolve so `getFunctionsUrl()`/`getApiUrl()` can derive URLs, but Firebase itself stays uninitialized.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web-manager",
-  "version": "4.3.3",
+  "version": "4.3.5",
   "description": "Easily access important variables such as the query string, current domain, and current page in a single object.",
   "main": "dist/index.js",
   "files": [

package/src/index.js

@@ -99,7 +99,10 @@ class Manager {
       // convention). Reads flat `firebaseConfig` (BEM/BXM/EM canonical shape) and falls
       // back to nested `firebase.app.config` (UJM's current `_config.yml` shape).
       // Once UJM migrates to the flat shape this fallback can be dropped.
-      if (this._resolveFirebaseConfig()) {
+      // Initialize Firebase only when the resolved config can actually boot the
+      // SDK — apiKey is mandatory (init without one crashes with auth/invalid-api-key).
+      // Configs carrying only projectId/authDomain still resolve for URL derivation.
+      if (this._resolveFirebaseConfig()?.apiKey) {
         await this._initializeFirebase();
       }
 
@@ -394,14 +397,20 @@ class Manager {
 
   // Resolve the Firebase web SDK config blob. Flat `firebaseConfig` first (canonical
   // shape — BEM/BXM/EM), then nested `firebase.app.config` (UJM legacy yaml shape).
-  // Returns the blob when it has at least one own key, otherwise null.
+  // A blob only counts when at least one value is non-empty — framework config merges
+  // (e.g. UJM's Jekyll chain) inject all-empty-string blobs into Firebase-less sites,
+  // and those must resolve to null (no init, no URL derivation).
   _resolveFirebaseConfig() {
+    const hasValues = (blob) => !!blob
+      && typeof blob === 'object'
+      && Object.values(blob).some((value) => value);
+
     const flat = this.config.firebaseConfig;
-    if (flat && typeof flat === 'object' && Object.keys(flat).length > 0) {
+    if (hasValues(flat)) {
       return flat;
     }
     const nested = this.config.firebase?.app?.config;
-    if (nested && typeof nested === 'object' && Object.keys(nested).length > 0) {
+    if (hasValues(nested)) {
       return nested;
     }
     return null;
@@ -506,7 +515,9 @@ class Manager {
       || this.config.environment;
 
     if (env === 'development') {
-      return 'http://localhost:5002';
+      // BEM's `mgr serve` exposes the local API over HTTPS (mkcert proxy on 5002,
+      // since backend-manager 5.7.0) — plain http:// cannot connect to it.
+      return 'https://localhost:5002';
     }
 
     const apiDomain = this._resolveFirebaseConfig()?.authDomain; // Has to be this since some projects like Clockii use ITW Universal Auth
@@ -526,6 +537,14 @@ class Manager {
       const returnUrlObject = new URL(decodeURIComponent(url));
       const currentUrlObject = new URL(window.location.href);
 
+      // Loopback returns (RFC 8252 §7.3) are valid while the SITE runs in development:
+      // native apps (Electron Manager) can't OS-register their custom scheme in dev, so
+      // their sign-in flow returns to an ephemeral 127.0.0.1 listener instead. Any port —
+      // the app binds it at flow start. Production sites never match this branch.
+      if (this.isDevelopment() && ['127.0.0.1', '[::1]', 'localhost'].includes(returnUrlObject.hostname)) {
+        return true;
+      }
+
       return returnUrlObject.host === currentUrlObject.host
         || returnUrlObject.protocol === this.config.brand?.id + ':'
         || (this.config.validRedirectHosts || []).includes(returnUrlObject.host);