Expose allowed_domains on the app

packages/app/src/cli/models/app/app.ts

@@ -3,6 +3,7 @@ import {ensurePathStartsWithSlash} from './validation/common.js'
 import {Identifiers} from './identifiers.js'
 import {ExtensionInstance} from '../extensions/extension-instance.js'
 import {FunctionConfigType} from '../extensions/specifications/function.js'
+import {AdminConfigType} from '../extensions/specifications/admin.js'
 import {ExtensionSpecification, RemoteAwareExtensionSpecification} from '../extensions/specification.js'
 import {AppConfigurationUsedByCli} from '../extensions/specifications/types/app_config.js'
 import {EditorExtensionCollectionType} from '../extensions/specifications/editor_extension_collection.js'
@@ -230,6 +231,7 @@ export interface AppInterface<
   nonConfigExtensions: ExtensionInstance[]
   draftableExtensions: ExtensionInstance[]
   appAssetsConfigs: Record<string, string> | undefined
+  allowedDomains: string[] | undefined
   errors: AppErrors
   hiddenConfig: AppHiddenConfig
   includeConfigOnDeploy: boolean | undefined
@@ -344,6 +346,11 @@ export class App<
     }, {})
   }
 
+  get allowedDomains(): string[] | undefined {
+    const adminExt = this.realExtensions.find((ext) => ext.specification.identifier === 'admin')
+    return (adminExt?.configuration as AdminConfigType | undefined)?.admin?.allowed_domains
+  }
+
   setDevApplicationURLs(devApplicationURLs: ApplicationURLs) {
     this.patchAppConfiguration(devApplicationURLs)
     this.realExtensions.forEach((ext) => ext.patchWithAppDevURLs(devApplicationURLs))

packages/app/src/cli/models/extensions/specifications/admin.ts

@@ -7,11 +7,12 @@ const AdminSchema = zod.object({
   admin: zod
     .object({
       static_root: zod.string().optional(),
+      allowed_domains: zod.array(zod.string()).optional(),
     })
     .optional(),
 })
 
-type AdminConfigType = zod.infer<typeof AdminSchema> & BaseConfigType
+export type AdminConfigType = zod.infer<typeof AdminSchema> & BaseConfigType
 
 const adminSpecificationSpec = createExtensionSpecification<AdminConfigType>({
   identifier: 'admin',
@@ -33,6 +34,8 @@ const adminSpecificationSpec = createExtensionSpecification<AdminConfigType>({
       admin: {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         static_root: (remoteContent as any).admin.static_root,
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        allowed_domains: (remoteContent as any).admin.allowed_domains,
       },
     }
   },

packages/app/src/cli/services/dev/extension.ts

@@ -118,6 +118,11 @@ export interface ExtensionDevOptions {
    * Map of asset key to absolute directory path for app-level assets (e.g., admin static_root)
    */
   appAssets?: Record<string, string>
+
+  /**
+   * Allowed domains from the admin module config
+   */
+  allowedDomains?: string[]
 }
 
 export async function devUIExtensions(options: ExtensionDevOptions): Promise<void> {

packages/app/src/cli/services/dev/extension/payload/models.ts

@@ -14,6 +14,7 @@ interface ExtensionsPayloadInterface {
         lastUpdated: number
       }
     }
+    allowedDomains?: string[]
   }
   appId?: string
   store: string

packages/app/src/cli/services/dev/extension/payload/store.test.ts

@@ -52,6 +52,52 @@ describe('getExtensionsPayloadStoreRawPayload()', () => {
       extensions: [{mock: 'extension-payload'}, {mock: 'extension-payload'}, {mock: 'extension-payload'}],
     })
   })
+  test('includes allowedDomains in app when provided', async () => {
+    // Given
+    vi.spyOn(payload, 'getUIExtensionPayload').mockResolvedValue({
+      mock: 'extension-payload',
+    } as unknown as UIExtensionPayload)
+
+    const options = {
+      apiKey: 'mock-api-key',
+      appName: 'mock-app-name',
+      url: 'https://mock-url.com',
+      websocketURL: 'wss://mock-websocket-url.com',
+      extensions: [],
+      storeFqdn: 'mock-store-fqdn.myshopify.com',
+      manifestVersion: '3',
+      allowedDomains: ['example.com', 'cdn.example.com'],
+    } as unknown as ExtensionsPayloadStoreOptions
+
+    // When
+    const rawPayload = await getExtensionsPayloadStoreRawPayload(options, 'mock-bundle-path')
+
+    // Then
+    expect(rawPayload.app.allowedDomains).toEqual(['example.com', 'cdn.example.com'])
+  })
+
+  test('does not include allowedDomains in app when not provided', async () => {
+    // Given
+    vi.spyOn(payload, 'getUIExtensionPayload').mockResolvedValue({
+      mock: 'extension-payload',
+    } as unknown as UIExtensionPayload)
+
+    const options = {
+      apiKey: 'mock-api-key',
+      appName: 'mock-app-name',
+      url: 'https://mock-url.com',
+      websocketURL: 'wss://mock-websocket-url.com',
+      extensions: [],
+      storeFqdn: 'mock-store-fqdn.myshopify.com',
+      manifestVersion: '3',
+    } as unknown as ExtensionsPayloadStoreOptions
+
+    // When
+    const rawPayload = await getExtensionsPayloadStoreRawPayload(options, 'mock-bundle-path')
+
+    // Then
+    expect(rawPayload.app.allowedDomains).toBeUndefined()
+  })
 })
 
 describe('ExtensionsPayloadStore()', () => {

packages/app/src/cli/services/dev/extension/payload/store.ts

@@ -52,6 +52,11 @@ export async function getExtensionsPayloadStoreRawPayload(
     }
     payload.app.assets = assets
   }
+
+  if (options.allowedDomains) {
+    payload.app.allowedDomains = options.allowedDomains
+  }
+
   return payload
 }
 

packages/app/src/cli/services/dev/processes/previewable-extension.ts

@@ -25,6 +25,7 @@ interface PreviewableExtensionOptions {
   previewableExtensions: ExtensionInstance[]
   appWatcher: AppEventWatcher
   appAssetsConfigs: Record<string, string> | undefined
+  allowedDomains?: string[]
 }
 
 export interface PreviewableExtensionProcess extends BaseProcess<PreviewableExtensionOptions> {
@@ -49,6 +50,7 @@ export const launchPreviewableExtensionProcess: DevProcessFunction<PreviewableEx
     appDirectory,
     appWatcher,
     appAssetsConfigs,
+    allowedDomains,
   },
 ) => {
   await devUIExtensions({
@@ -71,6 +73,7 @@ export const launchPreviewableExtensionProcess: DevProcessFunction<PreviewableEx
     manifestVersion: MANIFEST_VERSION,
     appWatcher,
     appAssets: appAssetsConfigs,
+    allowedDomains,
   })
 }
 

packages/app/src/cli/services/dev/processes/setup-dev-processes.ts

@@ -163,6 +163,7 @@ export async function setupDevProcesses({
       appDirectory: reloadedApp.directory,
       appWatcher,
       appAssetsConfigs: reloadedApp.appAssetsConfigs,
+      allowedDomains: reloadedApp.allowedDomains,
     }),
     developerPlatformClient.supportsDevSessions
       ? await setupDevSessionProcess({