ogcio · SamSalvatico · Jun 7, 2024 · Apr 10, 2024 · Apr 10, 2024 · Apr 11, 2024
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -1,3 +1,4 @@
+[comment]: <> (This file has been added on OGCIO fork)
 ### Ticket:
 
 - [XXX](https://dev.azure.com/OGCIO-Digital-Services/Digital%20Services%20Programme/_workitems/edit/XXX)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -132,11 +132,7 @@ jobs:
 
       - name: Prepack alteration
         working-directory: ./alteration
-        run: |
-          # Remove corepack commands once a new Logto release is out
-          corepack enable pnpm
-          corepack use pnpm@8
-          pnpm i && pnpm prepack
+        run: pnpm i && pnpm prepack
       # ** End **
 
       - name: Setup Postgres
@@ -192,4 +188,4 @@ jobs:
 
       - name: Check alteration sequence
         working-directory: ./fresh
-        run: node .scripts/check-alterations-sequence.js
+        run: node .scripts/check-alterations-sequence.js
diff --git a/Dockerfile b/Dockerfile
@@ -5,7 +5,10 @@ ENV CI=true
 
 # No need for Docker build
 ENV PUPPETEER_SKIP_DOWNLOAD=true
+
+# OGCIO
 ENV PORT=3301
+# OGCIO
 ENV ADMIN_PORT=3302
 ### Install toolchain ###
 RUN npm add --location=global pnpm@^9.0.0
@@ -40,12 +43,17 @@ RUN rm -rf .scripts .parcel-cache pnpm-*.yaml packages/cloud
 
 ###### [STAGE] Seal ######
 FROM node:20-alpine as app
+# OGCIO
 ENV PORT=3301
+# OGCIO
 ENV ADMIN_PORT=3302
 WORKDIR /etc/logto
 COPY --from=builder /etc/logto .
+# OGCIO
 RUN apk add --no-cache jq
+# OGCIO
 EXPOSE 3301
+# OGCIO
 EXPOSE 3302
-
+# OGCIO
 CMD [ "sh", "-c", "export ENCODED_PASSWORD=$(jq --slurp --raw-input --raw-output @uri <(printf \"%s\" $POSTGRES_PASSWORD)) && export DB_URL=\"postgres://$POSTGRES_USER:$ENCODED_PASSWORD@$POSTGRES_HOST:$POSTGRES_PORT/$POSTGRES_DB_NAME\" && export REDIS_URL=\"redis://$REDIS_HOST:$REDIS_PORT\" && npm run cli db seed -- --swe && npm run cli db alteration deploy latest && npm run ogcio:start"]
diff --git a/README.OGCIO.md b/README.OGCIO.md
@@ -1,3 +1,5 @@
+[comment]: <> (This file has been added on OGCIO fork)
+
 # LogTo per OGCIO
 
 ## Get started

diff --git a/README.md b/README.md
@@ -62,7 +62,7 @@ docker compose -p logto -f - up
 
 #### npm-init
 
-Requires [Node.js](https://nodejs.org/) `^18.12.0` + [PostgreSQL](https://postgresql.org/) `^14.0`.
+Requires [Node.js](https://nodejs.org/) `^20.9.0` + [PostgreSQL](https://postgresql.org/) `^14.0`.
 
 ```bash
 npm init @logto
@@ -87,11 +87,11 @@ Logto uses the [default browserslist config](https://github.com/browserslist/bro
 - Our team takes security seriously, especially when it relates to identity. If you find any existing or potential security issues, please do not hesitate to email 🔒 [[email protected]](mailto:[email protected]).
 - About other bug reports, feature requests, and feedback, you can:
   - Directly 🙋 [open an issue](https://github.com/logto-io/logto/issues/new) on GitHub;
-  - 💬 [join our Discord server](https://discord.gg/vRvwuwgpVX) to have a live chat;
+  - 💬 [Join our Discord server](https://discord.gg/vRvwuwgpVX) to have a live chat.
 
 ## Licensing
 
-See the [LICENSE](LICENSE) file for licensing information as it pertains to files in this repository.
+[MPL-2.0](LICENSE).
 
 ## Contributing
 

diff --git a/docker-compose-local.yml b/docker-compose-local.yml
@@ -1,3 +1,4 @@
+# This file has been added on OGCIO fork
 services:
   app:
     depends_on:

diff --git a/docker-compose.yml b/docker-compose.yml
@@ -13,28 +13,35 @@ services:
         "npm run cli db seed -- --swe && npm start"
       ]
     ports:
+      # OGCIO
       - 3301:3301
+      # OGCIO
       - 3302:3302
     environment:
       - TRUST_PROXY_HEADER=1
+      # OGCIO
       - DB_URL=postgres://postgres:p0stgr3s@postgres:5433/logto
       # Mandatory for GitPod to map host env to the container, thus GitPod can dynamically configure the public URL of Logto;
       # Or, you can leverage it for local testing.
       - ENDPOINT
       - ADMIN_ENDPOINT
+      # OGCIO
       - PORT=3301
+      # OGCIO
       - ADMIN_PORT=3302
   postgres:
     image: postgres:14-alpine
     user: postgres
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: p0stgr3s
+      # OGCIO
       PGPORT: 5433
     healthcheck:
       test: [ "CMD-SHELL", "pg_isready" ]
       interval: 10s
       timeout: 5s
       retries: 5
+    # OGCIO
     ports:
       - 5433:5433
diff --git a/makefile b/makefile
@@ -1,3 +1,4 @@
+# This file has been added on OGCIO fork
 TAG = local-logto:latest
 
 build:

diff --git a/packages/app-insights/package.json b/packages/app-insights/package.json
@@ -47,7 +47,7 @@
   },
   "prettier": "@silverhand/eslint-config/.prettierrc",
   "dependencies": {
-    "@silverhand/essentials": "^2.9.0",
+    "@silverhand/essentials": "^2.9.1",
     "applicationinsights": "^2.9.5"
   },
   "peerDependencies": {

diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Change Log
 
+## 1.17.0
+
+### Minor Changes
+
+- 25d67f33f: create a pre-configured role with Management API access when seeding the database
+
+### Patch Changes
+
+- 07ac3e87c: fix the translate CLI command by adding the missing import
+- Updated dependencies [25d67f33f]
+- Updated dependencies [e04d9523a]
+- Updated dependencies [b5104d8c1]
+- Updated dependencies [0c70d65c7]
+- Updated dependencies [76fd33b7e]
+  - @logto/[email protected]
+  - @logto/[email protected]
+  - @logto/[email protected]
+
 ## 1.16.0
 
 ### Patch Changes

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/cli",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "Logto CLI.",
   "author": "Silverhand Inc. <[email protected]>",
   "homepage": "https://github.com/logto-io/logto#readme",
@@ -43,13 +43,13 @@
   },
   "dependencies": {
     "@logto/connector-kit": "workspace:^3.0.0",
-    "@logto/core-kit": "workspace:^2.4.0",
+    "@logto/core-kit": "workspace:^2.5.0",
     "@logto/language-kit": "workspace:^1.1.0",
-    "@logto/phrases": "workspace:^1.10.1",
+    "@logto/phrases": "workspace:^1.11.0",
     "@logto/phrases-experience": "workspace:^1.6.1",
-    "@logto/schemas": "workspace:1.16.0",
+    "@logto/schemas": "workspace:1.17.0",
     "@logto/shared": "workspace:^3.1.1",
-    "@silverhand/essentials": "^2.9.0",
+    "@silverhand/essentials": "^2.9.1",
     "@silverhand/slonik": "31.0.0-beta.2",
     "chalk": "^5.0.0",
     "decamelize": "^6.0.0",
@@ -84,7 +84,7 @@
     "eslint": "^8.56.0",
     "lint-staged": "^15.0.0",
     "prettier": "^3.0.0",
-    "sinon": "^17.0.0",
+    "sinon": "^18.0.0",
     "vitest": "^1.4.0"
   },
   "eslintConfig": {

diff --git a/packages/cli/src/commands/database/alteration/index.ts b/packages/cli/src/commands/database/alteration/index.ts
@@ -1,6 +1,6 @@
 import type { AlterationScript } from '@logto/schemas/lib/types/alteration.js';
 import { conditionalString } from '@silverhand/essentials';
-import type { DatabasePool } from '@silverhand/slonik';
+import type { CommonQueryMethods, DatabasePool } from '@silverhand/slonik';
 import chalk from 'chalk';
 import type { CommandModule } from 'yargs';
 
@@ -39,7 +39,7 @@ export const getLatestAlterationTimestamp = async () => {
 };
 
 export const getAvailableAlterations = async (
-  pool: DatabasePool,
+  pool: CommonQueryMethods,
   compareMode: 'gt' | 'lte' = 'gt'
 ) => {
   const databaseTimestamp = await getCurrentDatabaseAlterationTimestamp(pool);

diff --git a/packages/cli/src/commands/database/index.ts b/packages/cli/src/commands/database/index.ts
@@ -16,6 +16,7 @@ const database: CommandModule = {
       .command(seed)
       .command(alteration)
       .command(system)
+      // OGCIO
       .command(ogcio)
       .demandCommand(1),
   handler: noop,

diff --git a/packages/cli/src/commands/database/seed/roles.ts b/packages/cli/src/commands/database/seed/roles.ts
@@ -0,0 +1,44 @@
+import {
+  PredefinedScope,
+  getManagementApiResourceIndicator,
+  createPreConfiguredManagementApiAccessRole,
+} from '@logto/schemas';
+import { generateStandardId } from '@logto/shared';
+import { sql, type CommonQueryMethods } from '@silverhand/slonik';
+
+import { insertInto } from '../../../database.js';
+
+/**
+ * Create a pre-configured role with Management API access
+ *
+ * Caution:
+ * This function should only be called after the tenant's Management API resource and the related all scope have been created.
+ */
+export const seedPreConfiguredManagementApiAccessRole = async (
+  pool: CommonQueryMethods,
+  tenantId: string
+) => {
+  const role = createPreConfiguredManagementApiAccessRole(tenantId);
+
+  await pool.query(insertInto(role, 'roles'));
+
+  // Assign Logto Management API permission `all` to the Logto Management API M2M role
+  await pool.query(sql`
+    insert into roles_scopes (id, role_id, scope_id, tenant_id)
+    values (
+      ${generateStandardId()},
+      ${role.id},
+      (
+        select scopes.id
+        from scopes
+        join resources on
+          scopes.tenant_id = resources.tenant_id and
+          scopes.resource_id = resources.id
+        where resources.indicator = ${getManagementApiResourceIndicator(tenantId)}
+        and scopes.name = ${PredefinedScope.All}
+        and scopes.tenant_id = ${tenantId}
+      ),
+      ${tenantId}
+    )
+  `);
+};
diff --git a/packages/cli/src/commands/database/seed/tables.ts b/packages/cli/src/commands/database/seed/tables.ts
@@ -40,6 +40,7 @@ import { consoleLog, getPathInModule } from '../../../utils.js';
 
 import { appendAdminConsoleRedirectUris, seedTenantCloudServiceApplication } from './cloud.js';
 import { seedOidcConfigs } from './oidc-config.js';
+import { seedPreConfiguredManagementApiAccessRole } from './roles.js';
 import { seedTenantOrganizations } from './tenant-organizations.js';
 import {
   assignScopesToRole,
@@ -150,6 +151,14 @@ export const seedTables = async (
   await seedOidcConfigs(connection, defaultTenantId);
   await seedAdminData(connection, defaultManagementApi);
 
+  /**
+   * Create a pre-configured role for the Logto Management API access
+   * in the default tenant (the default tenant is the only tenant for the OSS version, and the initial tenant for cloud).
+   *
+   * Called after the default tenant's Management API resource and the related all scope have been created.
+   */
+  await seedPreConfiguredManagementApiAccessRole(connection, defaultTenantId);
+
   await createTenant(connection, adminTenantId);
   await seedOidcConfigs(connection, adminTenantId);
   await seedAdminData(connection, createAdminDataInAdminTenant(defaultTenantId));

diff --git a/packages/cli/src/commands/database/seed/tenant.ts b/packages/cli/src/commands/database/seed/tenant.ts
@@ -1,4 +1,4 @@
-import { createTenantMetadata } from '@logto/core-kit';
+import { createTenantDatabaseMetadata } from '@logto/core-kit';
 import {
   type AdminData,
   type UpdateAdminData,
@@ -26,7 +26,7 @@ import { consoleLog } from '../../../utils.js';
 
 export const createTenant = async (pool: CommonQueryMethods, tenantId: string) => {
   const database = await getDatabaseName(pool, true);
-  const { parentRole, role, password } = createTenantMetadata(database, tenantId);
+  const { parentRole, role, password } = createTenantDatabaseMetadata(database, tenantId);
   const createTenant = {
     id: tenantId,
     dbUser: role,

diff --git a/packages/cli/src/commands/translate/sync-keys/utils.ts b/packages/cli/src/commands/translate/sync-keys/utils.ts
@@ -259,7 +259,10 @@ const traverseNode = async (
   await fs.writeFile(targetFilePath, '', { flag: 'w+' });
 
   if (isRoot) {
-    await fs.appendFile(targetFilePath, "import type { LocalePhrase } from '../../types.js';\n\n");
+    await fs.appendFile(
+      targetFilePath,
+      "import { type DeepPartial } from '@silverhand/essentials';\n\nimport type { LocalePhrase } from '../../types.js';\n\n"
+    );
   }
 
   // Write imports first
@@ -355,7 +358,7 @@ const traverseNode = async (
   await traverseObject(baseline, targetObject, 2);
 
   await (isRoot
-    ? fs.appendFile(targetFilePath, '} satisfies LocalePhrase;\n\n')
+    ? fs.appendFile(targetFilePath, '} satisfies DeepPartial<LocalePhrase>;\n\n')
     : fs.appendFile(targetFilePath, '};\n\n'));
   await fs.appendFile(targetFilePath, `export default Object.freeze(${identifier});\n`);
 };

diff --git a/packages/connectors/connector-alipay-native/package.json b/packages/connectors/connector-alipay-native/package.json
@@ -5,7 +5,7 @@
   "author": "Silverhand Inc. <[email protected]>",
   "dependencies": {
     "@logto/connector-kit": "workspace:^3.0.0",
-    "@silverhand/essentials": "^2.9.0",
+    "@silverhand/essentials": "^2.9.1",
     "dayjs": "^1.10.5",
     "got": "^14.0.0",
     "iconv-lite": "^0.6.3",

diff --git a/packages/connectors/connector-alipay-web/package.json b/packages/connectors/connector-alipay-web/package.json
@@ -4,7 +4,7 @@
   "description": "Alipay implementation.",
   "dependencies": {
     "@logto/connector-kit": "workspace:^3.0.0",
-    "@silverhand/essentials": "^2.9.0",
+    "@silverhand/essentials": "^2.9.1",
     "dayjs": "^1.10.5",
     "got": "^14.0.0",
     "iconv-lite": "^0.6.3",

diff --git a/packages/connectors/connector-aliyun-dm/package.json b/packages/connectors/connector-aliyun-dm/package.json
@@ -4,7 +4,7 @@
   "description": "Aliyun DM connector implementation.",
   "dependencies": {
     "@logto/connector-kit": "workspace:^3.0.0",
-    "@silverhand/essentials": "^2.9.0",
+    "@silverhand/essentials": "^2.9.1",
     "got": "^14.0.0",
     "snakecase-keys": "^8.0.0",
     "zod": "^3.22.4"

diff --git a/packages/connectors/connector-aliyun-sms/package.json b/packages/connectors/connector-aliyun-sms/package.json
@@ -4,7 +4,7 @@
   "description": "Aliyun SMS connector implementation.",
   "dependencies": {
     "@logto/connector-kit": "workspace:^3.0.0",
-    "@silverhand/essentials": "^2.9.0",
+    "@silverhand/essentials": "^2.9.1",
     "got": "^14.0.0",
     "snakecase-keys": "^8.0.0",
     "zod": "^3.22.4"

diff --git a/packages/connectors/connector-apple/package.json b/packages/connectors/connector-apple/package.json
@@ -5,7 +5,7 @@
   "dependencies": {
     "@logto/connector-kit": "workspace:^3.0.0",
     "@logto/shared": "workspace:^3.1.0",
-    "@silverhand/essentials": "^2.9.0",
+    "@silverhand/essentials": "^2.9.1",
     "got": "^14.0.0",
     "jose": "^5.0.0",
     "snakecase-keys": "^8.0.0",

diff --git a/packages/connectors/connector-aws-ses/package.json b/packages/connectors/connector-aws-ses/package.json
@@ -7,7 +7,7 @@
     "@aws-sdk/client-sesv2": "^3.556.0",
     "@aws-sdk/types": "^3.535.0",
     "@logto/connector-kit": "workspace:^3.0.0",
-    "@silverhand/essentials": "^2.9.0",
+    "@silverhand/essentials": "^2.9.1",
     "got": "^14.0.0",
     "snakecase-keys": "^8.0.0",
     "zod": "^3.22.4"

diff --git a/packages/connectors/connector-azuread/package.json b/packages/connectors/connector-azuread/package.json
@@ -6,7 +6,7 @@
   "dependencies": {
     "@azure/msal-node": "^2.0.0",
     "@logto/connector-kit": "workspace:^3.0.0",
-    "@silverhand/essentials": "^2.9.0",
+    "@silverhand/essentials": "^2.9.1",
     "got": "^14.0.0",
     "snakecase-keys": "^8.0.0",
     "zod": "^3.22.4"

diff --git a/packages/connectors/connector-dingtalk-web/CHANGELOG.md b/packages/connectors/connector-dingtalk-web/CHANGELOG.md
@@ -0,0 +1,7 @@
+# @logto/connector-dingtalk-web
+
+## 0.1.0
+
+### Minor Changes
+
+- 0b5b15b96: add DingTalk web connector