rollup-plugin-bake-allowlist

Fetches a line-oriented list at build time, validates every line, and bakes it into the bundle in place of a configured placeholder identifier. Nothing fetched is ever written to disk or committed, so the shipped list can never go stale in source control.

Built for lists that act as a security control (for example an allowlist the application enforces at runtime):

• The authenticated source of truth is always preferred. An optional public mirror is used only as a local-dev fallback and as a drift tripwire.
• A build that cannot fetch and fully validate the list fails loudly. There is deliberately no fallback to a stale copy, and a CI agent without credentials fails rather than silently baking mirror content.

Usage

// rollup.config.js
import bakeAllowlist from "rollup-plugin-bake-allowlist";

export default {
	plugins: [
		bakeAllowlist({
			placeholder: "__MY_BAKED_LIST__",
			sourceUrl: "https://dev.azure.com/{org}/{project}/_apis/git/repositories/{repo}/items?path=/list.txt&versionDescriptor.version=main&versionDescriptor.versionType=branch&download=true&api-version=7.1",
			mirrorUrl: "https://raw.githubusercontent.com/{org}/{repo}/main/list.txt",
			environment: process.env
		})
	]
};

// somewhere in your source
const LIST = __MY_BAKED_LIST__; // replaced at build time with a JSON array literal

Options

| Option | Required | Default | Description | | ------------- | -------- | ---------------------- | ----------- | | placeholder | yes | — | Identifier substituted with the JSON array literal. Choose something private to your build. | | sourceUrl | yes | — | Authenticated source-of-truth URL. | | environment | yes | — | Env value map, normally process.env. Injected explicitly so the credential source is visible in your build config. | | mirrorUrl | no | — | Public mirror. Local-dev fallback and drift tripwire. | | linePattern | no | /^[a-f0-9]{32}$/u | Every line must match; otherwise the build fails. | | oauthEnv | no | SYSTEM_ACCESSTOKEN | Env var holding an OAuth token (sent as bearer). Azure Pipelines: map $(System.AccessToken) into the step env. | | tokenEnv | no | BAKE_ALLOWLIST_TOKEN | Env var holding a PAT (sent as basic) or an AAD access token (sent as bearer). | | ciEnv | no | TF_BUILD | Env var that marks a CI agent. |

Behavior matrix

| Credentials | CI agent | Result | | ----------- | -------- | ------ | | yes | any | Bake from sourceUrl; cross-check mirrorUrl and warn on drift. | | no | yes | Build fails — a shipping build must never silently bake unauthenticated mirror content. | | no | no | Bake from mirrorUrl with a loud warning (local dev convenience). Fails if no mirrorUrl. |

Why bake at build time instead of fetching at runtime

A runtime fetch from a public URL makes end-user behavior depend on an unauthenticated external endpoint — DNS/TLS interception, hosting outages, or a compromised mirror could change what the application enforces, silently, in the field. Baking pins the list into a reviewed, signed artifact: the list can only change through a build, and the build is the single place where fetching, validation and provenance are enforced.

Development

npm install
npm test        # vitest
npm run coverage
npm run lint