mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
Florian ForsterandGitHub
0999e44821
This pull request introduces several improvements and security enhancements to the documentation build scripts in `apps/docs/scripts/fetch-remote-content.mjs`, as well as updates to the test configuration in `apps/docs/package.json` and `apps/docs/project.json`. The main focus is on enabling local development workflows, improving safety when handling refs and file paths, and making the codebase more robust against injection and traversal attacks. **Security and validation improvements:** * Added `safeLog` and `isValidRef` helper functions to sanitize logs and validate refs, preventing log and command injection vulnerabilities. * Updated logic for reading local files and external content to ensure paths are securely resolved and checked, preventing directory traversal and unauthorized file access. **Local development and workflow enhancements:** * Refactored content fetching logic to support copying local content and public assets when the source ref matches the local branch, enabling easier local testing and development. [[1]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L70-R202) [[2]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1R230-L145) [[3]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L155-R250) * Improved handling of external files (like `defaults.yaml` and `setup/steps.yaml`) in local and remote workflows, including secure copying and conditional downloading. [[1]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L70-R202) [[2]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1R266-R364) * Enhanced relative import fixing logic to robustly rewrite paths and ensure external files are downloaded or copied as needed, with clearer separation of cases for content, public, and external assets. (F768070bL263R373, [[1]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L310-R398) [[2]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L345-L349) [[3]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L360-R425) **Testing and configuration updates:** * Added a new `test:scripts` npm script for running script-level tests, and updated the Nx test command to use this script for the docs app. [[1]](diffhunk://#diff-d03d2ce97fad5059ad6248fca5f5919994b09bca360f883318c03f1f817ae677R19) [[2]](diffhunk://#diff-92d9997980c0871325f1a46a6d363cc28da597bd19ed327e979774d9e7838cabL216-R216) These changes improve the reliability, security, and developer experience of the documentation build process.
@zitadel/docs
Documentation for Zitadel, built with Fumadocs and Next.js.
Getting Started
Ensure you have followed the root quick start to set up dependencies.
Local Development
Start the development server:
pnpm nx run @zitadel/docs:dev
The site will be available at http://localhost:3000.
Scripts
Key scripts for documentation workflows:
| Script | Description |
|---|---|
dev |
Starts the development server. |
build |
Builds the production application. |
fetch:remote-content |
Fetches remote tags and referenced content. |
generate |
Runs all generation steps (fetch:remote-content, generate:proto-docs, generate:api-reference, generate:index-pages). |
check:links |
Validates content integrity (broken links, missing frontmatter, schema errors). |
check-types |
Validates typescript types. |
test |
Runs all validation steps (check-types, check:links). |
lint |
checks for code style and syntax errors (ESLint). |
clean |
Cleans the build output and generated files. |
Validation
- Code Quality: Run
pnpm lintto check for syntax and style issues in JS/TS/MDX files. - Content Integrity: Run
pnpm check:linksto validate content structure, including:- Broken internal links
- Missing required frontmatter (e.g.,
title) - Image references
Contributing
Build Process
The docs build process automatically handling the following steps via generate:
- Downloads required protoc plugins.
- Generates gRPC documentation from proto files.
- Generates API documentation from OpenAPI specs.
- Generates index files for directory structures.
Style Guide
- Variables: Use environment variables in code snippets where possible.
- Embedded Content: Use
_filename.mdxfor content embedded in other pages (not indexed individually). - Code Embedding: Use the
fileproperty in code blocks to embed code from the repo. - Voice: Use active voice and sentence case for titles.
Refer to the Google Developer Style Guide for general guidelines.
Adding Content
All documentation content is located in the content directory. Note that the system strictly accepts only .mdx files.
To add a new page:
- Create a
.mdxfile in the appropriate subdirectory ofcontent. - Register the new page in the sidebar configuration at
lib/sidebar-data.tsto make it accessible in the navigation.
Pull Requests
Use docs(<scope>): <short summary> for PR titles.
Pass quality checks before submitting:
pnpm nx run @zitadel/docs:build
pnpm nx run @zitadel/docs:check:links
You can also run specific steps individually:
pnpm fetch:remote-contentpnpm generate:api-reference