2021-04-30 10:10:48 +00:00
|
|
|
{
|
2022-06-22 01:53:28 +00:00
|
|
|
"name": "tooljet",
|
|
|
|
|
"version": "1.18.0",
|
|
|
|
|
"description": "ToolJet is an open-source low-code framework to build and deploy internal tools.",
|
2021-10-01 09:02:59 +00:00
|
|
|
"engines": {
|
2025-06-17 07:31:46 +00:00
|
|
|
"node": "22.15.1",
|
|
|
|
|
"npm": "10.9.2"
|
2021-10-01 09:02:59 +00:00
|
|
|
},
|
2021-09-27 12:57:06 +00:00
|
|
|
"lint-staged": {
|
2021-12-10 03:13:05 +00:00
|
|
|
"./frontend/src/**/*.{js,jsx}": [
|
2021-09-27 12:57:06 +00:00
|
|
|
"eslint --fix"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
"devDependencies": {
|
2022-11-15 05:20:38 +00:00
|
|
|
"@tooljet/cli": "^0.0.13",
|
2026-03-19 07:11:32 +00:00
|
|
|
"eslint": "^9.26.0",
|
2025-06-17 07:31:46 +00:00
|
|
|
"husky": "^9.1.7",
|
2026-01-22 06:04:05 +00:00
|
|
|
"lint-staged": "^16.1.0"
|
2021-09-27 12:57:06 +00:00
|
|
|
},
|
|
|
|
|
"scripts": {
|
2022-05-20 14:02:46 +00:00
|
|
|
"prebuild:plugins": "npm run install:plugins",
|
|
|
|
|
"install:plugins": "npm --prefix plugins install",
|
2022-01-27 09:38:32 +00:00
|
|
|
"build:plugins": "npm --prefix plugins run build",
|
2022-05-20 14:02:46 +00:00
|
|
|
"prebuild:plugins:prod": "npm run install:plugins",
|
|
|
|
|
"build:plugins:prod": "NODE_ENV=production npm run build:plugins",
|
|
|
|
|
"postbuild:plugins:prod": "npm --prefix plugins prune --production",
|
2022-08-18 08:05:42 +00:00
|
|
|
"prebuild:frontend": "npm --prefix frontend install --production=false",
|
2022-01-17 07:08:17 +00:00
|
|
|
"build:frontend": "NODE_ENV=production npm --prefix frontend run build",
|
Feature: Custom domains support for Cloud edition (#15228)
* feat(custom-domains): add custom domains module for Cloud edition
Full-stack implementation of custom domains feature:
- Backend: entity, migration, repository, CE module stubs, DTOs, ability/guard
- Backend: CloudFeatureGuard on all EE endpoints (Cloud-only)
- Frontend: API service, Zustand store, ManageCustomDomainPage
- License gating via LICENSE_FIELD.CUSTOM_DOMAINS
- Cloudflare Custom Hostnames API integration (EE provider)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): add CORS, cookie, scheduler, and e2e tests
- Dynamic CORS origin with 5-min cache for custom domain support
- Cookie SameSite=None when ENABLE_CUSTOM_DOMAINS is set
- Status polling scheduler for pending Cloudflare domain verification
- E2e test suite with Polly.js record/replay for cloud edition
- UI layout fix for custom domain settings page
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): add frontend domain detection and routing
- Add isCustomDomain() helper to detect non-TOOLJET_HOST hostnames
- Resolve custom domain to workspace in authorizeWorkspace before
session validation
- Resolve custom domain in AuthRoute for login page org config
- Load organization relation in findActiveDomain repository query
- Update e2e test to verify organizationSlug in resolve response
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: make all URLs custom-domain-aware
When a workspace has a custom domain configured, all generated URLs
(emails, SSO redirects, share links, settings pages) now use that
domain instead of TOOLJET_HOST.
Licensing:
- Add customDomains getter to LicenseBase with plan-level defaults
- Register LICENSE_FIELD.CUSTOM_DOMAINS in license helper
- Add customDomain to features response for frontend access
- Add customDomains to Terms interface
Frontend:
- Make getHostURL() custom-domain-aware using isCustomDomain()
- Replace 14 inline TOOLJET_HOST references with getHostURL()
(SSO modals, OAuth callbacks, invite links, app URLs, etc.)
Backend:
- Add CustomDomainCacheService (Redis-backed, 5-min TTL)
- Add findActiveByOrganizationId() to repository
- Add optional host param to generateInviteURL/generateOrgInviteURL
- Add getHostForOrganization() helper for resolving org domains
- Inject cache service into EmailService and OauthService
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: remove unvalidated custom domains e2e test
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add customDomains feature flag to cloud license terms
Update ee submodule — adds customDomains to OrganizationPaymentService
so Pro plan correctly gets false and Team plan gets true.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: extend VerifyDomainResult interface with additional properties
* feat: move custom domain from workspace settings to instance settings
Update frontend/ee submodule to move the custom domain page out of
workspace settings and into instance settings sidebar for both cloud
and EE editions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: align custom domain buttons with white labelling and Figma design
Update frontend/ee submodule - cancel button always clickable,
test connection button sizing matches Figma (14px font, 6px radius),
save button pattern matches white labelling exactly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add CSRF origin check middleware with Sec-Fetch-Site hardening
Add setupCsrfOriginCheck middleware that validates Origin headers on
mutation requests when custom domains are enabled. Rejects requests
from origins not matching TOOLJET_HOST or active custom domains.
Tightens the null-Origin fallback using Sec-Fetch-Site: browser
requests with no Origin but Sec-Fetch-Site: cross-site are now
blocked, closing the stripped-Origin CSRF attack vector while
keeping cURL/Postman/server-to-server calls unaffected.
Also removes the in-memory CORS origin cache in favour of direct
DB lookups via fetchCustomDomainOrigins.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: register CSRF origin check middleware in bootstrap
Wire up setupCsrfOriginCheck in the application bootstrap so the
middleware is active when custom domains are enabled.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: guard sameSite=none cookies with HTTPS check
sameSite=none requires secure=true, which browsers reject on plain
HTTP. Add isHttpsEnabled() guard so custom domain cookie settings
only apply over HTTPS, preventing broken sessions in local dev.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: redirect to main host on custom domain workspace mismatch
When a custom domain resolves to a different workspace than the URL
slug, or when domain resolution fails with no slug fallback, redirect
to TOOLJET_HOST instead of showing a broken state.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add custom domain dev server hints and update lockfile
Add commented-out webpack devServer options for testing custom domains
locally (host binding, allowed hosts, cache-control). Update lockfile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: load Pyodide from CDN for cloud builds
For cloud (Cloudflare Pages) builds, load Pyodide from jsDelivr CDN
instead of bundling the 823MB local copy, avoiding the 25MB per-file
limit. Self-hosted/airgapped builds continue using the local bundle.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee submodule for custom domain workspace URL fix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee submodule for custom domain input fixes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee submodule for custom domain dark mode fixes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: update ee submodule for connection test toast and auto-reset
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add pre/post build hooks for cloud frontend build
Add prebuild:frontend:cloud and postbuild:frontend:cloud lifecycle hooks
to install devDependencies (webpack, html-webpack-plugin, etc.) before
the cloud build and prune them after, matching the existing
build:frontend pattern.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: CSRF origin check fails closed on DB error
Previously, if fetchCustomDomainOrigins() threw (DB down, connection
timeout), the .catch(() => next()) silently bypassed all CSRF
protection. Now blocks the request with 403 instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: stale custom hostname cleanup and license deadlock on delete/status
Remove license gate from DELETE, GET, STATUS endpoints so admins can
always view and remove custom domains even after license expiry. Add
scheduled cleanup job that removes stale pending domains from both
Cloudflare and DB after a configurable TTL (default 2 days).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: Cloudflare error handling — config validation, 404 tolerance, status mapping
- Update IDomainProvider interface: getHostnameStatus returns null on 404
- Update CE stub to match interface
- Add sslStatus mapping to scheduler (matching provider's mapSslStatus)
- Expand scheduler statusMap with active_redeploying and blocked
- Allow null sslStatus in VerifyDomainResult type
- Update ee submodule
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: update server/ee submodule — correct guard order on custom-domains
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: update frontend/ee submodule — workspace login URL uses custom domain
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: update server/ee submodule — OIDC redirect uses custom domain host
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: route workspace switch to target custom domain
When switching between workspaces with different custom domains, the URL
now navigates to the target workspace's custom domain instead of staying
on the current origin or falling back to TOOLJET_HOST.
Backend enriches GET /api/organizations with custom_domain (batch query,
Cloud edition only). Frontend reads it and applies 3-way routing:
custom domain redirect, fallback to base domain, or same-origin switch.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: email links use custom domain instead of default TOOLJET_HOST
EmailModule was missing the CustomDomainsModule import, so
CustomDomainCacheService was never injected (always undefined due to
@Optional). All email URLs fell back to process.env.TOOLJET_HOST.
Additionally, several email event emissions were missing organizationId
in their payloads, preventing custom domain lookup even with proper DI.
Changes:
- Import CustomDomainsModule in EmailModule for DI wiring
- Pass organizationId in forgotPassword email payload
- Pass organizationId in 5 onboarding welcome-email payloads
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: block custom domain access after plan downgrade to Pro
- Frontend: always redirect to TOOLJET_HOST when custom domain resolve
fails (removes slug-based fallthrough that allowed bypassing the check)
- Frontend: extract redirectToMainHost() helper, add console.error logging
- Update server/ee submodule with license check in resolveCustomDomain
Closes #15228
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: proxy API through Cloudflare Worker to fix incognito sign-in on custom domains
Incognito browsers block third-party cookies, causing silent sign-in
failure on custom domains where the frontend origin differs from the
API server. Three changes:
- Frontend: override config.apiUrl to /api on custom domains so
requests route through the Cloudflare Worker proxy (first-party)
- Worker docs: add API/WebSocket proxy to the Cloudflare Worker with
proper forwarding headers and 502 fallback
- server/ee submodule: add ENABLE_CUSTOM_DOMAINS guard to OIDC cookie
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: update frontend/ee submodule — prefill default domain on clear
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: compare hostnames not origins for custom domain API proxy override
The origin comparison (`localhost:3000` vs `localhost:8082`) triggered the
proxy rewrite in local dev, routing API calls to webpack dev server which
returned index.html instead of JSON — breaking app initialization.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: update server/ee submodule — pass customDomainRepository to EE OrganizationsService
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* revert: remove "prefill default domain on clear" from custom domains
Reverts the frontend/ee submodule from a21b75aed back to e8191629e.
Showing a pre-filled default domain when the input is empty implies
the user owns that domain, which is misleading.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: harden custom domains — CORS caching, error handling, scheduler guards, and frontend safety
PR review fixes for #15228:
Backend:
- Cache CORS/CSRF custom domain origins in-memory (30s TTL) to avoid per-request DB queries
- Normalize TOOLJET_HOST (strip trailing slash) before origin comparison in CORS and CSRF middleware
- Add ENABLE_CUSTOM_DOMAINS guard to scheduler handleCron (was only on handleStaleCleanup)
- Log Cloudflare API errors in scheduler instead of silently continuing
- Fix scheduler stale cleanup TOCTOU: mark domain deleted before remove()
- Invalidate Redis cache after scheduler status transitions and stale cleanup
- Add Redis error handler, connectTimeout, and try-catch with DB fallback in cache service
- Add comment explaining CSRF exempt paths rationale
- Import CustomDomainsModule in AuthModule for @Optional() cache injection
- Remove dead 'no_records' variant from VerifyDomainResult.dnsStatus
- Update server/ee submodule (rate limiting, TOCTOU fix, DNS logging, auth response)
Frontend:
- Guard SwitchWorkspacePage against undefined TOOLJET_HOST
- Add console.error in isCustomDomain() and redirectToMainHost() for config issues
- Defensively strip protocol prefix in getTargetDomainURL()
- Add redirect-to-custom-domain logic in authorizeWorkspace with cooldown
- Enable webpack dev server proxy for custom domain local testing
Docs:
- Fix Cloudflare proxy statement: applies to any CF-hosted domain, not same-account
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: update server/ee submodule — OIDC redirect_uri uses request origin for custom domains
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: prevent flash of base-domain UI during custom domain redirect
- Move redirect check before setUser()/setOrganization() store updates
so no authenticated UI (avatar, org name) renders on the base domain
- Remove no-op clearRedirectAttempt() on custom domain — sessionStorage
is origin-scoped so it can't clear the base domain's flag; the cooldown
expires naturally after REDIRECT_COOLDOWN_MS
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove ThrottlerGuard from custom domain resolve endpoint
Update server/ee submodule — ThrottlerGuard on the resolve endpoint
caused a NestJS dependency crash (THROTTLER:MODULE_OPTIONS missing
in CustomDomainsModule). CloudFeatureGuard is sufficient protection
for this unauthenticated, cloud-only endpoint.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract applyCustomDomainCookieOptions, fix org list for super admins
- Extract duplicated cookie SameSite/Secure logic into shared applyCustomDomainCookieOptions() helper
- Replace 3 inline copies (session util x2, OIDC service) with one-liner calls
- Rename customDomain → custom_domain in OrganizationWithPlan for consistent API casing
- Refactor fetchOrganizations so super admins also get license/custom domain enrichment
- Add @Req() param to OpenID redirect controller for custom domain host detection
- Update server/ee submodule
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: remove dead verifyDomain from IDomainProvider, fix cookie type
- Remove verifyDomain() from IDomainProvider interface and all implementations
(service does inline DNS resolution, method was never called)
- Fix applyCustomDomainCookieOptions type: sameSite accepts string | boolean
- Update server/ee submodule
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* revert: remove dev-only webpack proxy and host overrides for custom domains
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: remove internal custom domains Cloudflare setup doc
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: rename 'Workspace ID' label to 'Workspace URL' on custom domain page
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: match custom domain save button loading style with whitelabelling
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: reduce custom domain redirect cooldown from 5 minutes to 10 seconds
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: strip trailing slash from TOOLJET_HOST in URL helpers
Prevents double-slash URLs when TOOLJET_HOST is configured with a
trailing slash (e.g. `https://example.com/` → `https://example.com//error/404`).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: strip trailing slash from TOOLJET_HOST in workspace switchers
Same defensive fix as the URL helpers — raw TOOLJET_HOST concatenation
in SwitchWorkspacePage and BaseOrganizationList could produce
double-slash URLs when the host has a trailing slash.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): add rebuildOriginsSet/getOriginsSet to cache service
Stores active custom domain origins in a Redis Set for cross-pod
CORS/CSRF consistency. rebuildOriginsSet uses a pipeline (DEL + SADD +
EXPIRE) for atomicity. getOriginsSet returns null on empty/error so
callers can fall back to DB.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): use Redis for CORS/CSRF origins in middleware
fetchCustomDomainOrigins now reads from Redis Set first, falls back to
DB. Local cache TTL reduced from 30s to 5s. Both setupCsrfOriginCheck
and setSecurityHeaders lazily capture CustomDomainCacheService via a
shared tryGetCacheService helper (DRY, CE-safe with strict: false).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): rebuild Redis origins set in scheduler and EE service
Status poll, stale cleanup, and all EE domain lifecycle operations now
trigger rebuildOriginsSet() so CORS origins stay consistent after
background status changes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): seed Redis CORS origins set on startup
Ensures the origins set is populated immediately when the server starts,
before any CORS/CSRF checks are needed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): increase Redis origins TTL and fix success logging
Raise ORIGINS_TTL_SECONDS from 300s to 700s so the key outlasts the
10-minute scheduler interval (avoids sustained DB fallback). Skip the
success log when individual pipeline commands fail.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): add Redis pending-flag methods to cache service
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): gate scheduler polling behind Redis pending flag
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): set pending flag on domain creation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): resolve redirect loop between base and custom domain
After login, excludeWorkspaceIdFromURL stripped the workspace slug from the
redirect URL, producing bare paths like /home. On the custom domain,
getWorkspaceIdOrSlugFromURL then misinterpreted 'home' as a workspace slug,
triggering redirectToMainHost and creating an infinite loop.
- Re-prepend workspace slug to the custom domain redirect URL
- Always trust the resolved slug on custom domains (1:1 mapping)
- Remove mismatch guard in AuthRoute that redirected back to main host
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): session transfer token + OAuth redirect_uri fix
Two problems with the custom domain redirect flow:
1. Session lost on redirect: tj_auth_token cookie is domain-scoped — doesn't
follow the user from gcpstage.tooljet.ai to app.company.com. Added a one-time
Redis transfer token (30s TTL, GETDEL atomic) — the frontend creates a token,
redirects to /api/session/transfer on the custom domain, the CF Worker proxies
to the backend which sets the cookie as first-party via 302.
2. OAuth redirect_uri mismatch: Google/OIDC redirect_uri used the custom domain
hostname via getHostURL()/resolveRedirectHost(). If the IdP doesn't have the
custom domain registered, auth fails. Now always use TOOLJET_HOST for
redirect_uri. Session transfer handles the hop to the custom domain after auth.
Changes:
- Add CE session-transfer module stubs (SubModule pattern)
- Add frontend session-transfer service
- Update authorizeWorkspace.js: transfer token flow replaces direct redirect
- Update GoogleSSOLoginButton.jsx: use TOOLJET_HOST for redirect_uri
- Register SessionTransferModule conditionally for Cloud edition in AppModule
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): update server/ee submodule — restore OIDC redirect_uri resolution
Points to server/ee commit that restores request-origin based
redirect_uri for OIDC, supporting both base domain and custom domain
IdP registrations.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(custom-domains): add session transfer to workspace switching
Use session transfer tokens for cross-domain workspace switches so
the auth cookie is set on the target domain. Passes target org ID
in the token to land on the correct workspace immediately.
- Extract useSessionTransferRedirect hook (shared debounce + redirect)
- Add TOOLJET_HOST null guard in BaseOrganizationList
- Debounce new-tab opens with 500ms cooldown
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): defer HttpClient host resolution to request time
HttpClient eagerly captured config.apiUrl at module load time, before
index.jsx overrides it to '/api' on custom domains. This caused
tooljet-db, comments, and plugins services to make cross-origin
requests directly to the backend, bypassing the CF Worker proxy.
The cookie (scoped to the custom domain) wasn't sent, resulting in
401s and an infinite reload loop.
Use a lazy getter so config.apiUrl is read at request time. Also
convert marketplace.service.js to use hostFn callback for the same
lazy resolution.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): cross-domain logout — clear base domain session
Logging out from a custom domain only killed the custom domain's
session. The base domain session survived, causing authorizeWorkspace
to re-authenticate the user via session transfer.
Two fixes:
1. clearCookie now passes matching cookie options (sameSite, secure,
httpOnly) so the browser actually deletes the cookie
2. Frontend makes a parallel cross-origin logout call to the base
domain when on a custom domain (works because cookies are
sameSite=none and CORS allows custom domain origins)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): use base domain for workspace creation on custom domains
When creating a workspace from a custom domain, the workspace link
preview incorrectly showed the custom domain URL and the post-creation
redirect stayed on the custom domain (which is bound to a different
workspace). Now the link preview always shows TOOLJET_HOST and the
redirect uses session transfer to carry auth to the base domain.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): update ee-frontend submodule — SSO redirect URLs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(custom-domains): reuse getBaseHostURL() in workspace creation redirect
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): update ee-frontend submodule — SAML ACS URL fix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): SAML SSO custom domain support + update server/ee submodule
Update CE interfaces and base classes to accept optional host/requestHost
parameters for SAML custom domain resolution. Updates server/ee submodule
with the full SAML custom domain fix.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): update ee-frontend submodule — hide custom domain for non-cloud
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): update server/ee submodule — SAML audience mismatch fix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): update server/ee submodule — SAML issuer fix + error handling
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(custom-domains): update submodules — SAML ACS URL fix for all topologies
- server/ee: Add #resolveBackendBaseUrl() fallback chain for ACS URL;
only pass host override for custom domains
- frontend/ee: Show correct backend-derived ACS URL in SAML modal
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-16 16:44:16 +00:00
|
|
|
"prebuild:frontend:cloud": "npm --prefix frontend install --production=false",
|
|
|
|
|
"build:frontend:cloud": "NODE_ENV=production TOOLJET_EDITION=cloud npm --prefix frontend run build:cloud",
|
|
|
|
|
"postbuild:frontend:cloud": "npm --prefix frontend prune --production",
|
2022-05-20 14:02:46 +00:00
|
|
|
"postbuild:frontend": "npm --prefix frontend prune --production",
|
2022-08-23 08:04:50 +00:00
|
|
|
"prebuild:server": "npm --prefix server install --production=false",
|
2022-01-17 07:08:17 +00:00
|
|
|
"build:server": "NODE_ENV=production npm --prefix server run build",
|
2022-05-20 14:02:46 +00:00
|
|
|
"postbuild:server": "npm --prefix server prune --production",
|
|
|
|
|
"build": "npm run build:plugins:prod && npm run build:frontend && npm run build:server",
|
2021-09-27 12:57:06 +00:00
|
|
|
"start:prod": "npm --prefix server run start:prod",
|
2025-06-20 07:29:17 +00:00
|
|
|
"cloud:setup": "npm run db:setup && npm run plugins:install && npm run plugins:uninstall && npm run plugins:reload",
|
|
|
|
|
"cloud:setup:prod": "npm run db:setup:prod && npm run plugins:install:prod && npm run plugins:uninstall:prod && npm run plugins:reload:prod",
|
2021-09-27 12:57:06 +00:00
|
|
|
"db:create": "npm --prefix server run db:create",
|
2022-05-31 13:12:36 +00:00
|
|
|
"db:create:prod": "npm --prefix server run db:create:prod",
|
2021-09-27 12:57:06 +00:00
|
|
|
"db:migrate": "npm --prefix server run db:migrate",
|
2022-05-31 13:12:36 +00:00
|
|
|
"db:migrate:prod": "npm --prefix server run db:migrate:prod",
|
2022-01-17 12:08:44 +00:00
|
|
|
"db:seed": "npm --prefix server run db:seed",
|
2022-05-31 13:12:36 +00:00
|
|
|
"db:seed:prod": "npm --prefix server run db:seed:prod",
|
|
|
|
|
"db:setup": "npm --prefix server run db:setup",
|
|
|
|
|
"db:setup:prod": "npm --prefix server run db:setup:prod",
|
2021-09-27 12:57:06 +00:00
|
|
|
"db:reset": "npm --prefix server run db:reset",
|
|
|
|
|
"db:drop": "npm --prefix server run db:drop",
|
|
|
|
|
"deploy": "cp -a frontend/build/. public/",
|
2025-07-02 07:05:22 +00:00
|
|
|
"worker:prod": "npm --prefix server run worker:prod",
|
2025-06-20 07:29:17 +00:00
|
|
|
"plugins:install": "npm --prefix server run plugins:install",
|
|
|
|
|
"plugins:install:prod": "npm --prefix server run plugins:install:prod",
|
|
|
|
|
"plugins:uninstall": "npm --prefix server run plugins:uninstall",
|
|
|
|
|
"plugins:uninstall:prod": "npm --prefix server run plugins:uninstall:prod",
|
|
|
|
|
"plugins:reload": "npm --prefix server run plugins:reload",
|
|
|
|
|
"plugins:reload:prod": "npm --prefix server run plugins:reload:prod",
|
2025-12-23 16:30:07 +00:00
|
|
|
"rotate:keys": "npm --prefix server run rotate:keys --",
|
|
|
|
|
"rotate:keys:prod": "npm --prefix server run rotate:keys:prod --",
|
2022-01-17 07:08:17 +00:00
|
|
|
"heroku-postbuild": "./heroku-postbuild.sh",
|
2023-09-04 04:30:14 +00:00
|
|
|
"prepare": "husky install",
|
|
|
|
|
"update-version": "node update-version.js"
|
2024-06-11 06:18:12 +00:00
|
|
|
},
|
2026-03-19 07:11:32 +00:00
|
|
|
"dependencies": {}
|
2026-01-22 06:04:05 +00:00
|
|
|
}
|