https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Bug ID: 43091 Summary: Staff-only Vue island chunks are emitted into the OPAC dist directory Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: paul.derscheid@lmscloud.de Reporter: paul.derscheid@lmscloud.de QA Contact: testopia@bugs.koha-community.org Depends on: 26355 Blocks: 41129 Target Milestone: --- The intranet and OPAC islands builds share the same entry point, koha-tmpl/intranet-tmpl/prog/js/vue/modules/islands.ts, which hardcodes every island in its componentRegistry. The islandsExport() factory in rspack.config.js (introduced by bug 26355) only varies the output path per application, so the OPAC compilation emits a lazy chunk for every registered island into koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/: - acquisitions-menu.[hash].esm.js - vendor-menu.[hash].esm.js - admin-menu.[hash].esm.js On top of that, the OPAC islands.esm.js bundles the staff-side Pinia stores (main, navigation, vendors) because hydrate() imports them unconditionally. These chunks are never executed on the OPAC. hydrate() only fetches a chunk when a matching custom element is present in the DOM, and no OPAC template renders one, so this is not a security issue in itself. But it publishes staff-interface code unauthenticated in the OPAC docroot, wastes build output, and is a leak channel by construction: any future staff-side island whose bundle contains something sensitive would land in the public web root by the same mechanism. The attached patch splits modules/islands.ts into shared machinery and per-application entry points (islands-intranet.ts, islands-opac.ts). Each entry declares its islands as a Map literal and feeds it through registerIsland(), so core islands take the same registration path as plugin islands (bug 42150), and passes its store definitions into hydrate() instead of the shared module importing every store. The plugin import surface of islands.esm.js (registerIsland, hydrate, the Vue re-exports used by the import map) is preserved on both entries via star re-exports. After the patch, the OPAC dist contains only islands.esm.js and the patron-self-renewal chunk. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26355 [Bug 26355] Allow patron account renewals through the OPAC https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41129 [Bug 41129] Migrate place_booking.js to a Vue island. -- You are receiving this mail because: You are watching all bug changes.