.changeset/public-config-schema.md

@@ -0,0 +1,5 @@
+---
+'@directory/web': minor
+---
+
+Serve the bundled configuration editor schema publicly at `/schema.json`, without exposing instance settings or credentials.

apps/web/e2e/schema.e2e.ts

@@ -0,0 +1,45 @@
+import editorSchema from '@directory/config/schema.json' with { type: 'json' };
+import { expect, test } from '@playwright/test';
+import {
+	configuration,
+	privateSentinels,
+	siteDescription,
+	siteTitle
+} from './support/configuration.js';
+import { startServer } from './support/server.js';
+
+test('the production editor schema is public and contains no instance configuration', async () => {
+	const server = await startServer({ configuration: configuration() });
+	try {
+		await server.ready();
+		const home = await server.fetch('/', { headers: { accept: 'application/json' } });
+		expect(home.status).toBe(401);
+		for (const method of ['GET', 'HEAD']) {
+			const response = await server.fetch('/schema.json?include=config&path=/private.yaml', {
+				method
+			});
+			expect(response.status).toBe(200);
+			expect(response.headers.get('content-type')).toBe('application/schema+json; charset=utf-8');
+			expect(response.headers.get('cache-control')).toContain('no-store');
+			expect(response.headers.get('x-content-type-options')).toBe('nosniff');
+			expect(response.headers.has('location')).toBe(false);
+			const text = await response.text();
+			if (method === 'HEAD') {
+				expect(text).toBe('');
+				continue;
+			}
+			expect(JSON.parse(text)).toEqual(editorSchema);
+			for (const value of [
+				...privateSentinels,
+				siteTitle,
+				siteDescription,
+				server.path,
+				server.origin
+			]) {
+				expect(text).not.toContain(value);
+			}
+		}
+	} finally {
+		expect(await server.stop()).toEqual({ code: 0, signal: null });
+	}
+});

apps/web/src/routes/(public)/schema.json/+server.ts

@@ -0,0 +1,11 @@
+import { json } from '@sveltejs/kit';
+import editorSchema from '@directory/config/schema.json' with { type: 'json' };
+
+export function GET(): Response {
+	return json(editorSchema, {
+		headers: {
+			'content-type': 'application/schema+json; charset=utf-8',
+			'cache-control': 'no-store'
+		}
+	});
+}

docs/config.md

@@ -132,6 +132,12 @@ We all could use a little validation every now and then.
 We publish a json schema to give you little red squigglies but you can also use
 our cli when you are in a pinch.
 
+Find the schema at `/schema.json`:
+
+```yaml
+# yaml-language-server: $schema=http://localhost:3000/schema.json
+```
+
 From the folder containing `compose.yaml`:
 
 ```sh

docs/directory.example.yaml

@@ -1,3 +1,4 @@
+# yaml-language-server: $schema=http://localhost:3000/schema.json
 # Replace the placeholder addresses with your own.
 # Sign-in is disabled. Uncomment one auth example below to enable it.
 version: 1