
Security News
Next.js Patches Critical Middleware Vulnerability (CVE-2025-29927)
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
A template for billing & payments applications
Having an Account Manager that is a React App, it was decided to write the guest apps as NPM modules which will be imported by the hosting app. This repo contains the bp app template with which all other guest apps will be created.
bp-[APP_NAME]
convention.bp-app-template
, using the following command:git pull git@github.com:WeConnect/bp-app-template.git master
{
...
"name": [APP_NAME],
...
}
output.library
to the name of your app:...
output: {
...
library: [APP_NAME],
...
}
...
The initial template has an example component named example and a corresponding story file.
You can view these to get a feel of how the components should behave, then delete the example
folder once you're ready
to start.
Pay attention that this component is used in the routes.js file, more on this later.
Your App.js component receives a baseUrl
prop from the host app. Use it to initialize your
routes.
Under routes.js you can view the initial default routes, which correspond to the example component.
Each route object in the exported routes
array is mapped in App.js to a <Route>
component.
You can read here about the props <Route>
receives.
After reviewing the different routes, adjust them according to your app.
🚨 IMPORTANT 🚨 - your App.js component receives a baseUrl
prop from the host app. Use it to initialize your
routes.
Contexts provide a way to pass data through the component tree without having to pass props down manually at every level. Apps created by this template take under consideration that the host app already wraps this app with different context providers (e.g. - locations provider which is responsible to pass props of the current location).
To handle the possibility that a context isn't defined, the host app exposes a getContext
function that receives the
name of the context and returns the context
object which includes the context itself, its provider and consumer.
Import:
import getContext from "contexts";
Usage:
const { context, Provider, Consumer } = getContext("locations");
Use the provided contexts to get information about the current location, auth info, etc.
No need to init a GraphQL client by yourself or have a REST client config anymore.
The imports are from clients/graphQL
or clients/rest
.
The GraphQL client is initiated out-of-the-box by the host app.
All you have to do is call the query
function that is exported.
The function receives two arguments:
The function returns a promise with the query result/error.
Import:
import { query } from 'clients/graphQL';
Usage:
const queryString = `
query ($userId: number!) {
user($userId: $userId) {
name,
birthday
}
}
`;
query(
queryString,
{ userId: 1 }
).then(result => {
// Do something with result
}).catch(error => {
// Do something with error
});
The REST client receives an config object with the following attributes:
url
- the server URL that will be used for the requestmethod
- the request method to be used when making the requestbody
- the data to be sent as the request bodyheaders
- the headers that the server responded with. All header names are lower casedparams
- the URL parameters to be sent with the request. Must be a plain objectresponseType
indicates the type of data that the server will respond with. options are: 'arraybuffer', 'document',
'json', 'text', 'stream' (browser only: 'blob')The function returns a promise with the result/error.
Import:
import restClient from 'clients/rest';
Usage:
restClient(
{
method: 'get',
url: "www.wework.com",
params: {
userId: 1
},
responseType: 'blob',
}
).then(result => {
// Do something with result
}).catch(error => {
// Do something with error
});
As this app is going to be hosted in another app, all environment variables and config will be defined
by the host app.
To get a variable you need to import the config object and call the config.get
function with the name of the variable.
Import:
import config from "config";
Usage:
const API_URL = config.get("API_URL");
If the variable isn't defined by the host app, the function will return undefined
.
When migrating an existing app, simply transfer all components to the components folder. Make sure that App.js imports these components.
You should have all your js source code under the src folder.
Install all the dependencies from your existing app.
If necessary, add an .npmrc
file with wework's NPM_TOKEN.
Change all imports of GraphQL and REST clients according to the GraphQL and REST clients.
Remove the GraphQL init function call if you used it.
If you're passing props like accountUuid
or locationUuid
from component to component, start using the contexts that the
host app exposes. Read about it under contexts.
If your app uses portalFunctions
, remove all usages, as now the layout will be determined according to the route.
Currently these are functions such as requestFullScreen
which are a leftover of our past architecture.
To start the development server, run yarn start
.
The entire development server config resides in the dev-server folder.
The dev-server's main job is to simulate running the app inside a host app, which is the root.js file. This means it contains everything the host app contains, including:
<Router>
componentconfig.get()
function. In order for you to develop locally, make
sure you have a local .env
with the environment variables you need, and make sure that config.js
exposes these variables. The .env
file will not be added to your git commit, as the actual variables will be provided
by the host app.These apps are NPM modules by behavior, but in order for us to always work with the latest version and so we could always have the same version (instead of bumping the version multiple times), we will install the apps using their Git urls.
You can read about it here.
When installing a guest app in your host app, simply run the following command (the example is using yarn):
yarn add git+ssh://git@github.com/WeConnect/[APP_NAME].git#[BRANCH]
The app will be added as a dependency, using its name as appears in its package.json.
To install the latest version, simply uninstall & install it again.
FAQs
Billing & Payments application template
The npm package bp-teams receives a total of 0 weekly downloads. As such, bp-teams popularity was classified as not popular.
We found that bp-teams demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
Security News
A survey of 500 cybersecurity pros reveals high pay isn't enough—lack of growth and flexibility is driving attrition and risking organizational security.
Product
Socket, the leader in open source security, is now available on Google Cloud Marketplace for simplified procurement and enhanced protection against supply chain attacks.