fix: bake site UUID into generated guards (#86)

Author: ejntaylor

src/protect/install/adapters/next.ts

@@ -5,7 +5,7 @@
 
 import { writeFileSync, existsSync, mkdirSync, copyFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { read, log, templatesDir } from '../util.js';
+import { bakeSiteUuid, read, log, templatesDir } from '../util.js';
 import type { Adapter, WireOptions, WireResult, VerifyResult } from '../types.js';
 
 function hasNextDep(cwd: string): boolean {
@@ -64,6 +64,7 @@ function wire(cwd: string, opts: WireOptions): WireResult {
 
   // Fresh (or already-ours) → write the managed middleware.
   copyFileSync(join(templates, 'next-middleware.ts'), mwPath);
+  if (!opts.demo) bakeSiteUuid(cwd, mw.relFile);
   changed.push(mw.relFile);
   log(mw.exists ? `refreshed ${mw.relFile} (Patchstack middleware)` : `scaffolded ${mw.relFile} (Patchstack middleware)`);
   return { ok: true, changed: [...new Set(changed)] };

src/protect/install/adapters/tanstack-supabase.ts

@@ -7,7 +7,7 @@
 
 import { writeFileSync, existsSync, mkdirSync, copyFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { read, log, templatesDir } from '../util.js';
+import { bakeSiteUuid, read, log, templatesDir } from '../util.js';
 import type { Adapter, WireOptions, WireResult, VerifyResult } from '../types.js';
 
 const CLIENT_TUNNEL = [
@@ -133,40 +133,6 @@ function scaffold(cwd: string, opts: WireOptions): string[] {
   return changed;
 }
 
-// Bake the site UUID from .patchstackrc.json (written by `scan`) into the scaffolded guard, so the
-// deployed Worker calls the live Pulse rules API with zero user config. Left as the inert
-// placeholder when the app hasn't been scanned yet or the file can't be read. Returns whether it baked.
-function bakeSiteUuid(cwd: string): boolean {
-  const rc = join(cwd, '.patchstackrc.json');
-  if (!existsSync(rc)) {
-    log('no .patchstackrc.json — guard uses PATCHSTACK_SITE_UUID env or the bundled fallback');
-    return false;
-  }
-  let uuid: string | undefined;
-  try {
-    uuid = JSON.parse(read(rc)).siteUuid;
-  } catch {
-    log('.patchstackrc.json unreadable — skipping site-UUID bake');
-    return false;
-  }
-  // Guard on UUID format so a malformed value falls through to the inert placeholder rather than
-  // baking junk into a TS string literal (broken build / replace-token hazards).
-  if (!uuid || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(uuid)) {
-    log('.patchstackrc.json siteUuid missing or malformed — guard uses PATCHSTACK_SITE_UUID env or the bundled fallback');
-    return false;
-  }
-  const p = join(cwd, GUARD_FILE);
-  if (!existsSync(p)) return false;
-  const s = read(p);
-  if (!s.includes('__PATCHSTACK_SITE_UUID__')) {
-    log('guard.ts site UUID already baked');
-    return false;
-  }
-  writeFileSync(p, s.replace('__PATCHSTACK_SITE_UUID__', uuid));
-  log('baked site UUID into guard.ts — live rules from the Patchstack API');
-  return true;
-}
-
 function patchClient(cwd: string): boolean {
   const p = join(cwd, 'src/integrations/supabase/client.ts');
   const s = read(p);
@@ -238,7 +204,7 @@ function wire(cwd: string, opts: WireOptions): WireResult {
   const changed = scaffold(cwd, opts);
   // In demo mode, keep the local sample rules active — don't bake a site UUID (which would make
   // the guard fetch live Pulse rules instead of the bundled demo set).
-  if (!opts.demo && bakeSiteUuid(cwd)) changed.push(GUARD_FILE);
+  if (!opts.demo && bakeSiteUuid(cwd, GUARD_FILE)) changed.push(GUARD_FILE);
   if (patchClient(cwd)) changed.push('src/integrations/supabase/client.ts');
   if (patchStart(cwd)) changed.push('src/start.ts');
   log(

src/protect/install/generic.ts

@@ -5,7 +5,7 @@
 
 import { readFileSync, existsSync, mkdirSync, copyFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { read, templatesDir } from './util.js';
+import { bakeSiteUuid, read, templatesDir } from './util.js';
 import type { WireOptions, VerifyResult } from './types.js';
 
 const GUARD_MARKER = 'patchstack/guard';
@@ -21,6 +21,7 @@ export function scaffoldGeneric(cwd: string, opts: WireOptions, guardTemplate =
   mkdirSync(dst, { recursive: true });
   copyFileSync(join(templates, guardTemplate), join(dst, 'guard.ts'));
   const changed = [`${dir}/guard.ts`];
+  if (!opts.demo) bakeSiteUuid(cwd, `${dir}/guard.ts`);
   const rulesDst = join(dst, 'rules.json');
   if (opts.demo || !existsSync(rulesDst)) {
     copyFileSync(join(templates, opts.demo ? 'demo-rules.json' : 'rules.json'), rulesDst);

src/protect/install/seam.ts

@@ -5,7 +5,7 @@
 
 import { existsSync, mkdirSync, copyFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import { read, log, templatesDir } from './util.js';
+import { bakeSiteUuid, read, log, templatesDir } from './util.js';
 import type { WireOptions, WireResult, VerifyResult } from './types.js';
 
 export interface SeamSpec {
@@ -43,6 +43,7 @@ export function wireSeam(cwd: string, opts: WireOptions, spec: SeamSpec): WireRe
   }
 
   copyFileSync(join(templates, spec.templateName), join(cwd, seamRel));
+  if (!opts.demo) bakeSiteUuid(cwd, seamRel);
   changed.push(seamRel);
   log(existing ? `refreshed ${seamRel}` : `scaffolded ${seamRel}`);
   return { ok: true, changed: [...new Set(changed)] };

src/protect/install/util.ts

@@ -1,6 +1,6 @@
 // Shared helpers for the `patchstack-connect protect` scaffolder (adapters + orchestrator).
 
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, writeFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -17,6 +17,49 @@ export function hasDependency(cwd: string, name: string): boolean {
   }
 }
 
+const SITE_UUID_PLACEHOLDER = '__PATCHSTACK_SITE_UUID__';
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * Bake the site UUID written by `scan` into a managed runtime-guard template.
+ *
+ * The UUID is public project configuration (the disclosure widget exposes the
+ * same value). Keeping the environment-variable fallback in the template lets
+ * unscanned projects remain inert and lets deployments override it explicitly.
+ */
+export function bakeSiteUuid(cwd: string, guardRelPath: string): boolean {
+  const rc = join(cwd, '.patchstackrc.json');
+  if (!existsSync(rc)) {
+    log('no .patchstackrc.json — guard uses PATCHSTACK_SITE_UUID env or the bundled fallback');
+    return false;
+  }
+
+  let uuid: unknown;
+  try {
+    uuid = JSON.parse(read(rc)).siteUuid;
+  } catch {
+    log('.patchstackrc.json unreadable — skipping site-UUID bake');
+    return false;
+  }
+
+  if (typeof uuid !== 'string' || !UUID_RE.test(uuid)) {
+    log('.patchstackrc.json siteUuid missing or malformed — guard uses PATCHSTACK_SITE_UUID env or the bundled fallback');
+    return false;
+  }
+
+  const guardPath = join(cwd, guardRelPath);
+  if (!existsSync(guardPath)) return false;
+  const source = read(guardPath);
+  if (!source.includes(SITE_UUID_PLACEHOLDER)) {
+    log(`${guardRelPath} site UUID already baked`);
+    return false;
+  }
+
+  writeFileSync(guardPath, source.replace(SITE_UUID_PLACEHOLDER, uuid));
+  log(`baked site UUID into ${guardRelPath} — live rules from the Patchstack API`);
+  return true;
+}
+
 // Guard templates ship next to the built CLI (dist/protect/templates). Resolve for the built
 // layout (this code is bundled into dist/cli.js at the dist root → protect/templates) and the
 // source layout (this file lives in src/protect/install/ → ../templates).

src/protect/templates/astro-middleware.ts

@@ -5,12 +5,14 @@ import type { MiddlewareHandler } from "astro";
 import { createProtection } from "@patchstack/connect/protect";
 import fallbackRules from "./patchstack.rules.json";
 
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+
 let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
 async function getProtection() {
   if (!_protection) {
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = process.env.PATCHSTACK_SITE_UUID;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
     const common = { mode, egress: true } as const;
     _protection = await createProtection(
       siteUuid

src/protect/templates/fastify-plugin.ts

@@ -5,12 +5,14 @@
 import { createProtection } from "@patchstack/connect/protect";
 import fallbackRules from "./rules.json";
 
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+
 let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
 async function getProtection() {
   if (!_protection) {
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = process.env.PATCHSTACK_SITE_UUID;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
     const common = { mode, egress: true } as const;
     _protection = await createProtection(
       siteUuid

src/protect/templates/generic-guard.ts

@@ -7,6 +7,9 @@
 import { createProtection } from "@patchstack/connect/protect";
 import fallbackRules from "./rules.json";
 
+// Baked by `patchstack-connect protect` from .patchstackrc.json when available.
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+
 let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
 
 /** One memoized protection policy. Rules come from the Patchstack API per-site (cached); the
@@ -15,7 +18,7 @@ export async function getProtection() {
   if (!_protection) {
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = process.env.PATCHSTACK_SITE_UUID;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
     const common = { mode, egress: true } as const;
     _protection = await createProtection(
       siteUuid

src/protect/templates/next-middleware.ts

@@ -5,12 +5,14 @@
 import { createProtection } from "@patchstack/connect/protect";
 import fallbackRules from "./patchstack.rules.json";
 
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+
 let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
 async function getProtection() {
   if (!_protection) {
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = process.env.PATCHSTACK_SITE_UUID;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
     const common = { mode, egress: true } as const;
     _protection = await createProtection(
       siteUuid

src/protect/templates/sveltekit-hooks.ts

@@ -5,12 +5,14 @@ import type { Handle } from "@sveltejs/kit";
 import { createProtection } from "@patchstack/connect/protect";
 import fallbackRules from "./patchstack.rules.json";
 
+const PS_SITE_UUID = "__PATCHSTACK_SITE_UUID__";
+
 let _protection: Awaited<ReturnType<typeof createProtection>> | undefined;
 async function getProtection() {
   if (!_protection) {
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
-    const siteUuid = process.env.PATCHSTACK_SITE_UUID;
+    const siteUuid = PS_SITE_UUID.startsWith("__") ? process.env.PATCHSTACK_SITE_UUID : PS_SITE_UUID;
     const common = { mode, egress: true } as const;
     _protection = await createProtection(
       siteUuid