deps: Lodash upgrade to 4.18.1 (#2882)

* test: fix session storage mock initialization

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3aafafb2-5e0b-49a1-b15d-ca56d5dd535e

* build: update lodash to 4.18.1

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3aafafb2-5e0b-49a1-b15d-ca56d5dd535e

* ci: pin validation to Node 20

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 3aafafb2-5e0b-49a1-b15d-ca56d5dd535e

* fix: load static data webpack configs asynchronously

* fix: handle undefined ARM_TOKEN in authenticators for tests

* refactor: deduplicate static data copy patterns

* fix: skip ARM token fetch in static data build to fix CI failure

webpack.staticData.js calls webpack.publisher.js which previously
always fetched an ARM token via getArmToken(). In CI there is no
AZURE_CLIENT_SECRET set, so it fell back to interactive browser auth
which fails with AuthenticationRequiredError.

The static data build does not need a real ARM token — startup.publish.ts
uses a hardcoded StaticSettingsProvider when NODE_ENV === staticDataEnvironment,
and StaticAuthenticator already handles undefined/empty ARM_TOKEN gracefully.

- Add optional skipArmToken parameter to webpack.publisher.js
- Pass { skipArmToken: true } from webpack.staticData.js

* fix: await async publisher webpack configs

* fix: set isLocalRun=true and root=http://localhost:8080 in config.validate.json to fix end2end-tests CI

* fix: use nullish coalescing for skipArmToken option in webpack.publisher.js

* fix: restore managementApiUrl fallback in MapiClient.setBaseUrl and static settings for mock publishing mode

* fix: remove redundant 'products/' prefix in getProduct calls in product-subscribe components

* fix: improve error message in MapiClient.setBaseUrl to reflect all config sources

* fix: pre-seed sessionStorage mock and add --exit to mocha to fix test failures and stuck process

---------

Co-authored-by: Roman Kolesnikov <rokolesnikov@microsoft.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/mainCI.yml

@@ -18,10 +18,13 @@ jobs:
       security-events: write
 
     steps:
-      - name: Use Node.js 20.x
+      - name: Checkout code
         uses: actions/checkout@v2
+
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: 20
 
       - name: Install
         run: npm install

.github/workflows/test.yml

@@ -13,6 +13,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v3
 
+      - name: Setup Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
       - name: Install
         run: npm install
 

package-lock.json

@@ -17,7 +17,7 @@
         "build-publisher": "webpack --config webpack.publisher.js",
         "build-runtime": "webpack --config webpack.runtime.js",
         "build-function": "webpack --config webpack.function.js",
-        "test": "node node_modules/mocha/bin/_mocha -r mocha.js src/**/*.spec.ts",
+        "test": "node node_modules/mocha/bin/_mocha -r mocha.js --exit src/**/*.spec.ts",
         "deploy-function": "npm run build-function && cd dist/function && func azure functionapp publish < function app name >",
         "publish": "webpack --config webpack.publisher.js && node dist/publisher/index.js && npm run serve-website",
         "serve-website": "webpack serve --open --static ./dist/website --no-stats",
@@ -116,6 +116,7 @@
         "knockout-mapping": "^2.6.0",
         "knockout.validation": "^2.0.4",
         "liquidjs": "^10.9.2",
+        "lodash": "4.18.1",
         "lunr": "^2.3.9",
         "mime": "^3.0.0",
         "moment": "^2.29.4",

package.json

@@ -6,6 +6,8 @@ import { ArmAuthenticator } from "./armAuthenticator";
 import { IAuthenticator } from "./IAuthenticator";
 import { IEditorSettings } from "./IEditorSettings";
 
+declare const ARM_TOKEN: string | undefined;
+
 export class AuthenticatorResolver {
     private loadPromise: Promise<IAuthenticator>;
 

src/authentication/authenticatorResolver.ts

@@ -1,5 +1,7 @@
 import { IAuthenticator, AccessToken } from ".";
 
+declare const ARM_TOKEN: string | undefined;
+
 /**
  * Static implementation of the IAuthenticator interface to mimic actual authentication in publish time.
  */
@@ -11,7 +13,7 @@ export class StaticAuthenticator implements IAuthenticator {
          * The ARM token injected acquired in build-time. It's used in on local development only.
          * TODO: Static authenticator is used in production publishing, therefore it's safer to introduce dedicated implementation.
          */
-        if (!ARM_TOKEN) {
+        if (typeof ARM_TOKEN === "undefined" || !ARM_TOKEN) {
             return;
         }
 

src/authentication/staticAuthenticator.ts

@@ -21,14 +21,18 @@ describe("Mapi Client", async () => {
 
     global.sessionStorage = {
         _values: new Map<string, string>(),
-        length: global.sessionStorage._values.size,
+        get length() { return this._values.size; },
         key: (index: number) => { return null; },
         getItem: (key: string) => { return global.sessionStorage._values.get(key); },
         setItem: (key: string, value: string) => { global.sessionStorage._values.set(key, value); },
         removeItem: (key: string) => { global.sessionStorage._values.delete(key); },
         clear: () => { global.sessionStorage._values.clear(); }
     }
 
+    // Pre-seed a valid non-expired SAS token so ArmAuthenticator.getAccessToken() returns from
+    // sessionStorage cache and never calls authenticate(), which relies on browser-only `location`.
+    global.sessionStorage.setItem("armAccessToken", createMockToken());
+
     const settingsProvider = new StaticSettingsProvider({
         managementApiUrl: "https://contoso.management.azure-api.net",
         backendUrl: "https://contoso.developer.azure-api.net",

src/clients/mapiClient.spec.ts

@@ -7,6 +7,7 @@ import * as Constants from "../constants";
 import ApiClient from "./apiClient";
 import { IRetryStrategy } from "./retryStrategy/retryStrategy";
 import { SettingNames } from "../constants";
+import { Utils } from "../utils";
 
 export class MapiClient extends ApiClient {
     constructor(
@@ -22,25 +23,29 @@ export class MapiClient extends ApiClient {
 
     protected override async setBaseUrl() {
         const settings = await this.settingsProvider.getSettings();
-        
+
+        const managementApiUrl = settings[Constants.SettingNames.managementApiUrl];
+        if (managementApiUrl) {
+            this.baseUrl = managementApiUrl;
+            return;
+        }
+
         const serviceName = settings[Constants.SettingNames.serviceName];
         const subscriptionId = settings[Constants.SettingNames.subscriptionId];
         const resourceGroupName = settings[Constants.SettingNames.resourceGroupName];
 
-        if (!serviceName) {
-            throw new Error("Service name setting is missing.");
+        if (serviceName && subscriptionId && resourceGroupName) {
+            this.baseUrl = `https://management.azure.com/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.ApiManagement/service/${serviceName}`;
+            return;
         }
 
-        if (!subscriptionId) {
-            throw new Error("Subscription ID setting is missing.");
+        const backendUrl = settings[Constants.SettingNames.backendUrl];
+        if (backendUrl) {
+            this.baseUrl = Utils.getBaseUrlWithMapiSuffix(backendUrl);
+            return;
         }
 
-        if (!resourceGroupName) {
-            throw new Error("Resource Group name setting is missing.");
-        }
-
-        this.baseUrl = `https://management.azure.com/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.ApiManagement/service/${serviceName}`;
-
+        throw new Error("Unable to determine management API URL: no valid configuration found (managementApiUrl, serviceName/subscriptionId/resourceGroupName, or backendUrl must be set).");
     }
 
     public async getTenantArmUriAsync(): Promise<string> {

src/clients/mapiClient.ts

@@ -81,7 +81,7 @@ export class ProductSubscribe {
                 return;
             }
 
-            const product = await this.productService.getProduct(`products/${productName}`);
+            const product = await this.productService.getProduct(productName);
 
             if (!product) {
                 return;

src/components/products/product-subscribe/ko/runtime/product-subscribe.ts

@@ -27,7 +27,7 @@ type ProductSubscribeRuntimeFCProps = ProductSubscribeRuntimeProps & {
 const loadProduct = async (usersService: UsersService, delegationService: IDelegationService, productService: ProductService, productName: string) => {
     const promises = [
         await delegationService.isSubscriptionDelegationEnabled(),
-        await productService.getProduct(`products/${productName}`),
+        await productService.getProduct(productName),
         await usersService.getCurrentUserId(),
     ] as const;
     const [isDelegationEnabled, product, userId] = await Promise.all(promises);