Expose allowed_domains on the app#7240
Conversation
|
Warning This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
This stack of pull requests is managed by Graphite. Learn more about stacking. |
Differences in type declarationsWe detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:
New type declarationsWe found no new type declarations in this PR Existing type declarationspackages/cli-kit/dist/private/node/ui.d.ts import { Logger, LogLevel } from '../../public/node/output.js';
-import React from 'react';
import { Key, RenderOptions } from 'ink';
import { EventEmitter } from 'events';
-/**
- * Signal that the current Ink tree is done. Must be called within an
- * InkLifecycleRoot — throws if the provider is missing so lifecycle
- * bugs surface immediately instead of silently hanging.
- */
-export declare function useComplete(): (error?: Error) => void;
-/**
- * Root wrapper for Ink trees. Owns the single `exit()` call site — children
- * signal completion via `useComplete()`, which sets state here. The `useEffect`
- * fires post-render, guaranteeing all batched state updates have been flushed
- * before the tree is torn down.
- */
-export declare function InkLifecycleRoot({ children }: {
- children: React.ReactNode;
-}): React.JSX.Element;
interface RenderOnceOptions {
logLevel?: LogLevel;
logger?: Logger;
renderOptions?: RenderOptions;
}
export declare function renderOnce(element: JSX.Element, { logLevel, renderOptions }: RenderOnceOptions): string | undefined;
-export declare function render(element: JSX.Element, options?: RenderOptions): Promise<void>;
+export declare function render(element: JSX.Element, options?: RenderOptions): Promise<unknown>;
export declare class Stdout extends EventEmitter {
columns: number;
rows: number;
readonly frames: string[];
private _lastFrame?;
constructor(options: {
columns?: number;
rows?: number;
});
write: (frame: string) => void;
lastFrame: () => string | undefined;
}
export declare function handleCtrlC(input: string, key: Key, exit?: () => void): void;
export {};
packages/cli-kit/dist/public/node/ui.d.ts@@ -34,7 +34,7 @@ export interface RenderConcurrentOptions extends PartialBy<ConcurrentOutputProps
* 00:00:00 │ frontend │ third frontend message
*
*/
-export declare function renderConcurrent({ renderOptions, ...props }: RenderConcurrentOptions): Promise<void>;
+export declare function renderConcurrent({ renderOptions, ...props }: RenderConcurrentOptions): Promise<unknown>;
export type AlertCustomSection = CustomSection;
export type RenderAlertOptions = Omit<AlertOptions, 'type'>;
/**
|
vividviolet
left a comment
There was a problem hiding this comment.
Could we nest these fields under app.admin instead? I think it would align with the other configs on the app toml better. I think we should do the same with static root too
|
@isaacroldan's PR : https://app.graphite.com/github/pr/Shopify/cli/7248 covers this. |

WHY are these changes introduced?
Part 1/2 in https://github.com/shop/issues-admin-extensibility/issues/2397
Exposes
allowed_domainsin app object sent through extensions websocket so that we can construct a CSP meta tag in dev mode for static apps.WHAT is this pull request doing?
allowed_domainsfrom the admin module config on the App model and pass it through the extension dev server payloadallowed_domainsto the admin spec's transformRemoteToLocal so the field round-trips correctlyallowedDomainsthrough the previewable extension process options down to the payload storeHow to test your changes?
Step 1: Build the CLI from source
From the repo root:
Step 2: Set up a test app with
allowed_domainsYou need a Shopify app directory with a
shopify.app.tomlthat includes the admin config.The key part of the TOML is:
Step 3: Run
shopify appdev using the local CLIpnpm shopify app dev --path /path/to/your/test/appThis will:
https://some-tunnel-url.trycloudflare.comStep 4: Inspect the HTTP payload
You can open this URL in your browser:
https://<your-tunnel>.trycloudflare.com/extensionsThis returns the full JSON payload. Look for
app.allowedDomainsin the response.You can also pipe it through
jqfor readability:curl https://<your-tunnel>.trycloudflare.com/extensions | jq '.app'You should see:
{ "apiKey": "...", "title": "...", "url": "...", "mobileUrl": "...", "assets": { ... }, "allowedDomains": ["example.com", "cdn.example.com"] }Step 5: Inspect WebSocket messages
allowedDomainsChecklist
pnpm changeset add