[Bug 43091] New: Staff-only Vue island chunks are emitted into the OPAC dist directory
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Bug ID: 43091 Summary: Staff-only Vue island chunks are emitted into the OPAC dist directory Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: paul.derscheid@lmscloud.de Reporter: paul.derscheid@lmscloud.de QA Contact: testopia@bugs.koha-community.org Depends on: 26355 Blocks: 41129 Target Milestone: --- The intranet and OPAC islands builds share the same entry point, koha-tmpl/intranet-tmpl/prog/js/vue/modules/islands.ts, which hardcodes every island in its componentRegistry. The islandsExport() factory in rspack.config.js (introduced by bug 26355) only varies the output path per application, so the OPAC compilation emits a lazy chunk for every registered island into koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/: - acquisitions-menu.[hash].esm.js - vendor-menu.[hash].esm.js - admin-menu.[hash].esm.js On top of that, the OPAC islands.esm.js bundles the staff-side Pinia stores (main, navigation, vendors) because hydrate() imports them unconditionally. These chunks are never executed on the OPAC. hydrate() only fetches a chunk when a matching custom element is present in the DOM, and no OPAC template renders one, so this is not a security issue in itself. But it publishes staff-interface code unauthenticated in the OPAC docroot, wastes build output, and is a leak channel by construction: any future staff-side island whose bundle contains something sensitive would land in the public web root by the same mechanism. The attached patch splits modules/islands.ts into shared machinery and per-application entry points (islands-intranet.ts, islands-opac.ts). Each entry declares its islands as a Map literal and feeds it through registerIsland(), so core islands take the same registration path as plugin islands (bug 42150), and passes its store definitions into hydrate() instead of the shared module importing every store. The plugin import surface of islands.esm.js (registerIsland, hydrate, the Vue re-exports used by the import map) is preserved on both entries via star re-exports. After the patch, the OPAC dist contains only islands.esm.js and the patron-self-renewal chunk. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26355 [Bug 26355] Allow patron account renewals through the OPAC https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41129 [Bug 41129] Migrate place_booking.js to a Vue island. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #1 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 202008 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202008&action=edit Bug 43091: Stop emitting staff-only Vue islands into the OPAC dist Both islands builds share modules/islands.ts, which hardcodes every island. The OPAC compilation therefore emits staff-only lazy chunks (acquisitions-menu, vendor-menu, admin-menu) into koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/, and the OPAC islands.esm.js bundles the staff Pinia stores. - split modules/islands.ts into shared machinery and per-application entry points (islands-intranet.ts, islands-opac.ts) - declare each application's islands as a Map literal and feed it through registerIsland(), the same path plugin islands take - pass store definitions into hydrate() instead of importing every store in the shared module - keep the full plugin import surface (registerIsland, hydrate, Vue re-exports) on both entries via star re-exports - point the rspack islands entries at the per-application modules Test plan: 1. yarn build 2. ls koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ => only islands.esm.js and a patron-self-renewal chunk are emitted 3. ls koha-tmpl/intranet-tmpl/prog/js/vue/dist/ => acquisitions-menu, vendor-menu and admin-menu chunks are still present 4. In the staff interface, visit pages using the acquisitions, vendor and admin menu islands and verify they render 5. On the OPAC, log in as a patron with renewable checkouts and verify the self-renewal modal still works -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #202008|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #2 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 202009 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202009&action=edit Bug 43091: Stop emitting staff-only Vue islands into the OPAC dist Both islands builds share modules/islands.ts, which hardcodes every island. The OPAC compilation therefore emits staff-only lazy chunks (acquisitions-menu, vendor-menu, admin-menu) into koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/, and the OPAC islands.esm.js bundles the staff Pinia stores. - split modules/islands.ts into shared machinery and per-application entry points (islands-intranet.ts, islands-opac.ts) - declare each application's islands as a Map literal and feed it through registerIsland(), the same path plugin islands take - pass store definitions into hydrate() instead of importing every store in the shared module - keep the full plugin import surface (registerIsland, hydrate, Vue re-exports) on both entries via star re-exports - point the rspack islands entries at the per-application modules Test plan: 1. yarn build 2. ls koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ => only islands.esm.js and a patron-self-renewal chunk are emitted 3. ls koha-tmpl/intranet-tmpl/prog/js/vue/dist/ => acquisitions-menu, vendor-menu and admin-menu chunks are still present 4. In the staff interface, visit pages using the acquisitions, vendor and admin menu islands and verify they render 5. Enable self-renewal for a patron's category and put the patron inside the availability window, e.g.: UPDATE categories SET self_renewal_enabled = 1 WHERE categorycode = (SELECT categorycode FROM borrowers WHERE userid = 'koha'); UPDATE borrowers SET dateexpiry = DATE_ADD(CURDATE(), INTERVAL 7 DAY), debarred = NULL WHERE userid = 'koha'; 6. Log into the OPAC as that patron and open 'your summary' => the patron-self-renewal chunk loads from /opac-tmpl/bootstrap/js/vue/dist/ and the self-renewal modal completes successfully -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #3 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Sorry last item of that test plan of the first submission was wrong, confused renewal of checkouts with renewal of patron membership. Corrected in the second one and added some sql to quickly create the required state. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com, | |matt.blenkinsop@openfifth.c | |o.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #4 from Jonathan Druart <jonathan.druart@gmail.com> --- Also noticed that `yarn js:clean` is not removing opac dist files. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #5 from Paul Derscheid <paul.derscheid@lmscloud.de> --- I think it makes sense to add it within this patch as well, one sec. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #6 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 202020 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202020&action=edit Bug 43091: Clean the OPAC Vue dist directory in js:clean js:clean predates the OPAC islands build (bug 26355) and only removes the intranet and Cypress dist directories, so stale chunks survive in koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ across rebuilds. - add the OPAC Vue dist directory to js:clean Test plan: 1. yarn js:build, then apply this patch series and yarn js:clean 2. ls koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ => empty, no stale staff-only chunks remain 3. yarn js:build => only islands.esm.js and a patron-self-renewal chunk are emitted -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #7 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Added, sorry had to setup perl-git-bz locally, too many proxy stacks running :D -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #202009|0 |1 is obsolete| | Attachment #202020|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #8 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 202089 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202089&action=edit Bug 43091: Stop emitting staff-only Vue islands into the OPAC dist Both islands builds share modules/islands.ts, which hardcodes every island. The OPAC compilation therefore emits staff-only lazy chunks (acquisitions-menu, vendor-menu, admin-menu) into koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/, and the OPAC islands.esm.js bundles the staff Pinia stores. - split modules/islands.ts into shared machinery and per-application entry points (islands-intranet.ts, islands-opac.ts) - declare each application's islands as a Map literal and feed it through registerIsland(), the same path plugin islands take - pass store definitions into hydrate() instead of importing every store in the shared module - keep the full plugin import surface (registerIsland, hydrate, Vue re-exports) on both entries via star re-exports - point the rspack islands entries at the per-application modules Test plan: 1. yarn build 2. ls koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ => only islands.esm.js and a patron-self-renewal chunk are emitted 3. ls koha-tmpl/intranet-tmpl/prog/js/vue/dist/ => acquisitions-menu, vendor-menu and admin-menu chunks are still present 4. In the staff interface, visit pages using the acquisitions, vendor and admin menu islands and verify they render 5. Enable self-renewal for a patron's category and put the patron inside the availability window, e.g.: UPDATE categories SET self_renewal_enabled = 1 WHERE categorycode = (SELECT categorycode FROM borrowers WHERE userid = 'koha'); UPDATE borrowers SET dateexpiry = DATE_ADD(CURDATE(), INTERVAL 7 DAY), debarred = NULL WHERE userid = 'koha'; 6. Log into the OPAC as that patron and open 'your summary' => the patron-self-renewal chunk loads from /opac-tmpl/bootstrap/js/vue/dist/ and the self-renewal modal completes successfully Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #9 from Jonathan Druart <jonathan.druart@gmail.com> --- Created attachment 202090 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202090&action=edit Bug 43091: Clean the OPAC Vue dist directory in js:clean js:clean predates the OPAC islands build (bug 26355) and only removes the intranet and Cypress dist directories, so stale chunks survive in koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ across rebuilds. - add the OPAC Vue dist directory to js:clean Test plan: 1. yarn js:build, then apply this patch series and yarn js:clean 2. ls koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ => empty, no stale staff-only chunks remain 3. yarn js:build => only islands.esm.js and a patron-self-renewal chunk are emitted Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #10 from Jonathan Druart <jonathan.druart@gmail.com> --- [SKIP] package.json SKIP new_line_at_the_end_of_file This is not valid, you can ignore it. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |matt.blenkinsop@openfifth.c |y.org |o.uk CC| |lisette@bywatersolutions.co | |m -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #202089|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #202090|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #11 from Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> --- Created attachment 202181 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202181&action=edit Bug 43091: Stop emitting staff-only Vue islands into the OPAC dist Both islands builds share modules/islands.ts, which hardcodes every island. The OPAC compilation therefore emits staff-only lazy chunks (acquisitions-menu, vendor-menu, admin-menu) into koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/, and the OPAC islands.esm.js bundles the staff Pinia stores. - split modules/islands.ts into shared machinery and per-application entry points (islands-intranet.ts, islands-opac.ts) - declare each application's islands as a Map literal and feed it through registerIsland(), the same path plugin islands take - pass store definitions into hydrate() instead of importing every store in the shared module - keep the full plugin import surface (registerIsland, hydrate, Vue re-exports) on both entries via star re-exports - point the rspack islands entries at the per-application modules Test plan: 1. yarn build 2. ls koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ => only islands.esm.js and a patron-self-renewal chunk are emitted 3. ls koha-tmpl/intranet-tmpl/prog/js/vue/dist/ => acquisitions-menu, vendor-menu and admin-menu chunks are still present 4. In the staff interface, visit pages using the acquisitions, vendor and admin menu islands and verify they render 5. Enable self-renewal for a patron's category and put the patron inside the availability window, e.g.: UPDATE categories SET self_renewal_enabled = 1 WHERE categorycode = (SELECT categorycode FROM borrowers WHERE userid = 'koha'); UPDATE borrowers SET dateexpiry = DATE_ADD(CURDATE(), INTERVAL 7 DAY), debarred = NULL WHERE userid = 'koha'; 6. Log into the OPAC as that patron and open 'your summary' => the patron-self-renewal chunk loads from /opac-tmpl/bootstrap/js/vue/dist/ and the self-renewal modal completes successfully Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #12 from Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> --- Created attachment 202182 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202182&action=edit Bug 43091: Clean the OPAC Vue dist directory in js:clean js:clean predates the OPAC islands build (bug 26355) and only removes the intranet and Cypress dist directories, so stale chunks survive in koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ across rebuilds. - add the OPAC Vue dist directory to js:clean Test plan: 1. yarn js:build, then apply this patch series and yarn js:clean 2. ls koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/ => empty, no stale staff-only chunks remain 3. yarn js:build => only islands.esm.js and a patron-self-renewal chunk are emitted Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |26.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #13 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Thanks everyone! Pushed to main for 26.11! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091 --- Comment #14 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Created attachment 203781 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=203781&action=edit Bug 43091: (RM follow-up) Give the OPAC self-renewal island a Pinia store hydrate() only installs Pinia for an island when its config.stores is non-empty. patron-self-renewal kept config: {} after islands-opac.ts was split out, so it never got one. http-client.js's post() calls submitting(), which needs Pinia's useMainStore(). With none active, it throws before fetch() runs - get() skips submitting() by default, so only the actual renewal submission failed. Test plan: prove t/cypress/integration/Islands/SelfRenewal.ts -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org