Skip to content

fix(export): AM 2.0 export under management token — detect via plan-check, skip assets + loud warn (DX-9314)#308

Open
naman-contentstack wants to merge 2 commits into
v2-devfrom
feat/DX-9314
Open

fix(export): AM 2.0 export under management token — detect via plan-check, skip assets + loud warn (DX-9314)#308
naman-contentstack wants to merge 2 commits into
v2-devfrom
feat/DX-9314

Conversation

@naman-contentstack

@naman-contentstack naman-contentstack commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

What

Export-side fix for DX-9314. Exporting an AM 2.0 (spaces-based) stack with a management token previously fell back to the legacy asset layout silently, and a later import reported success while entry→asset references were broken (silent data loss).

Why

Management tokens are rejected by the CS Assets APIs, and get-linked-workspaces returns [] on any failure, so AM 2.0 went undetected under --alias and the export emitted the legacy layout with no signal.

How

  • Thread the command context into setupExportConfig.
  • Fetch AM 2.0 entitlement via the feature-status plan-check (isFeatureEnabled('amAssets')) — which accepts a management token — into config.planStatus.
  • In the assets module, when the org is AM 2.0 and auth is a management token, skip the AM 2.0 asset export with a loud warning instead of emitting the legacy layout. The skip is surfaced in the final summary (✗ ASSETS + reason) and logged to error.log.

Testing

  • AM 2.0 org + management token → loud warning; no spaces/ and no legacy assets/files/; ✗ ASSETS + reason in the summary; ⚠️ completed with failures; reason in error.log.
  • AM 2.0 org + login/OAuth → unchanged spaces layout (regression check).
  • Legacy (non-AM2.0) stack + management token → unchanged.

🤖 Generated with Claude Code

…nt token (DX-9314)

Exporting an AM 2.0 (spaces-based) stack with a management token silently produced the
legacy asset layout, and the subsequent import reported success while entry-to-asset
references were broken. Management tokens are rejected by the CS Assets APIs, and the
linked-workspaces lookup returns [] on any failure, so AM 2.0 went undetected under
--alias and the export emitted the wrong layout with no signal.

Detect AM 2.0 up front via the feature-status plan-check (which accepts a management
token) into config.planStatus. When the org is AM 2.0 and auth is a management token,
skip the AM 2.0 asset export with a loud warning instead of emitting the legacy layout;
the skip is surfaced in the final summary and logged to error.log.

Export-only; import-side fix and a first-class skipped summary status are tracked separately.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@naman-contentstack
naman-contentstack requested a review from a team as a code owner July 23, 2026 06:25
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 3 57 25 ✅ Passed
🟡 Medium Severity 0 1 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 1 90 / 365 days ⚠️ Warning
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 57
  • Medium without fixes: 1
  • Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

@naman-contentstack naman-contentstack self-assigned this Jul 23, 2026

// cli-utilities' CLIProgressManager.globalSummary is runtime-accessible but typed private. These
// shapes describe the slice we mutate; the single accessor (getGlobalSummary) owns the structural
// cast + feature-detect so applyAssetSummaryCounts and markAssetsSkippedInSummary don't each copy it.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Types should be in the types folders and imported here, and these types are generic

}

/**
* DX-9314 — record the AM 2.0 asset skip in the FINAL export summary without a live progress bar.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove the ticket details and all, write comments if it really required in that place

}

async start(): Promise<void> {
// AM 2.0 assets cannot be exported with a management token — the CS Assets API only

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid using AM or 2.0 etc use cs assets , new naming which we have adopted

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we need the comments, code and the logs tells everything , no complex business logic abstraction here, one rule of thumb, if code is self explainable avoid adding comments explaining it ,

// Add authentication details to config for context tracking
config.authenticationMethod = authenticationMethod;

// DX-9314: detect AM 2.0 via the plan-check API. Unlike the CS Assets API (which rejects

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove comments

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please remove everywhere else where comment is not really required, imagine we add this type of comments through out the code, will be hard find the code eventually and it makes the readability harder


const setupConfig = async (exportCmdFlags: any): Promise<ExportConfig> => {
const setupConfig = async (
exportCmdFlags: any,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please check the export config implementation in the asset scan branch, please follow the same appraoch ,else it will have conflicts

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 1 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 1 90 / 365 days ⚠️ Warning
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 0
  • Medium without fixes: 1
  • Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants