Merge remote-tracking branch 'origin/main' into SITES-15239

adobe · Sep 4, 2023 · 69c2e2d · 69c2e2d
2 parents d2a222e + 2569d9c
commit 69c2e2d
Show file tree

Hide file tree

Showing 17 changed files with 151 additions and 91 deletions.
diff --git a/all/pom.xml b/all/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>com.adobe.aem.guides</groupId>
         <artifactId>aem-guides-wknd</artifactId>
-        <version>3.1.1-SNAPSHOT</version>
+        <version>3.2.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/core/pom.xml b/core/pom.xml
@@ -19,7 +19,7 @@
     <parent>
         <groupId>com.adobe.aem.guides</groupId>
         <artifactId>aem-guides-wknd</artifactId>
-        <version>3.1.1-SNAPSHOT</version>
+        <version>3.2.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <artifactId>aem-guides-wknd.core</artifactId>

diff --git a/dispatcher/pom.xml b/dispatcher/pom.xml
@@ -7,7 +7,7 @@
   <parent>
     <groupId>com.adobe.aem.guides</groupId>
     <artifactId>aem-guides-wknd</artifactId>
-    <version>3.1.1-SNAPSHOT</version>
+    <version>3.2.1-SNAPSHOT</version>
     <relativePath>../pom.xml</relativePath>
   </parent>
 

diff --git a/dispatcher/src/conf.d/available_vhosts/wknd.vhost b/dispatcher/src/conf.d/available_vhosts/wknd.vhost
@@ -19,6 +19,79 @@ Include conf.d/variables/custom.vars
 	# Add header breadcrumbs for help in troubleshooting
 	<IfModule mod_headers.c>
 		Header add X-Vhost "publish"
+
+        ################## Start of CORS configuration ##################
+
+        # Enable CORS handling in the dispatcher
+        #
+        # By default, CORS is handled by the AEM publish server.
+        # By adding the section below, CORS will be handled in the dispatcher.
+        # See the default.vhost file for a suggested dispatcher configuration. Note that:
+        #   a. You will need to adapt the regex from default.vhost to match your CORS domains
+        #   b. Remove the "Origin" header (if it exists) from the clientheaders.any file
+        #   c. If you have any CORS domains configured in your AEM publish server origin, you have to move those to the dispatcher
+        #       (i.e. accordingly update regex in default.vhost to match those domains)
+        #
+
+        SetEnvIfExpr "req_novary('Origin') == ''" CORSType=none CORSProcessing=false
+        SetEnvIfExpr "req_novary('Origin') != ''" CORSType=cors CORSProcessing=true CORSTrusted=false
+
+        SetEnvIfExpr "req_novary('Access-Control-Request-Method') == '' && %{REQUEST_METHOD} == 'OPTIONS' && req_novary('Origin') != ''" CORSType=invalidpreflight CORSProcessing=false
+        SetEnvIfExpr "req_novary('Access-Control-Request-Method') != '' && %{REQUEST_METHOD} == 'OPTIONS' && req_novary('Origin') != ''" CORSType=preflight CORSProcessing=true CORSTrusted=false
+        SetEnvIfExpr "req_novary('Origin') -strcmatch '%{REQUEST_SCHEME}://%{HTTP_HOST}*'" CORSType=samedomain CORSProcessing=false
+
+        # For requests that require CORS processing, check if the Origin can be trusted
+        SetEnvIfExpr "%{HTTP_HOST} =~ /(.*)/ " ParsedHost=$1
+
+        ################## BEGIN EDITABLE SECTION: Adapt regex to match CORS origin(s) for applications
+
+        ################## The following provide access from common developer platforms, to accelerate AEM Headless access to WKND content.
+        # Developer Localhost
+        SetEnvIfExpr "env('CORSProcessing') == 'true' && req_novary('Origin') =~ m#(http://localhost(:\d+)?$)#" CORSTrusted=true
+        # Adobe AppBuilder
+        SetEnvIfExpr "env('CORSProcessing') == 'true' && req_novary('Origin') =~ m#(https://experience\.adobe\.com$)#" CORSTrusted=true          
+        # Developer Vercel app
+        SetEnvIfExpr "env('CORSProcessing') == 'true' && req_novary('Origin') =~ m#(https://.*\.vercel\.app$)#" CORSTrusted=true
+        # Developer Github.io app
+        SetEnvIfExpr "env('CORSProcessing') == 'true' && req_novary('Origin') =~ m#(https://.*\.github\.io$)#" CORSTrusted=true
+        # Developer Codesandbox.io app
+        SetEnvIfExpr "env('CORSProcessing') == 'true' && req_novary('Origin') =~ m#(https://.*\.csb\.app$)#" CORSTrusted=true
+        # Developer CodePen.io app
+        SetEnvIfExpr "env('CORSProcessing') == 'true' && req_novary('Origin') =~ m#(https://cdpn\.io$)#" CORSTrusted=true
+
+        ################## END EDITABLE SECTION
+
+        # Extract the Origin header
+        SetEnvIfNoCase ^Origin$ ^(.*)$ CORSTrustedOrigin=$1
+
+        # Flush If already set
+        Header unset Access-Control-Allow-Origin
+        Header unset Access-Control-Allow-Credentials
+
+        # Trusted
+        Header always set Access-Control-Allow-Credentials "true" "expr=reqenv('CORSTrusted') == 'true'"
+        Header always set Access-Control-Allow-Origin "%{CORSTrustedOrigin}e" "expr=reqenv('CORSTrusted') == 'true'"
+        Header always set Access-Control-Allow-Methods "GET" "expr=reqenv('CORSTrusted') == 'true'"
+        Header always set Access-Control-Max-Age 1800 "expr=reqenv('CORSTrusted') == 'true'"
+        Header always set Access-Control-Allow-Headers "Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers" "expr=reqenv('CORSTrusted') == 'true'"
+
+        # Non-CORS or Not Trusted
+        Header unset Access-Control-Allow-Credentials "expr=reqenv('CORSProcessing') == 'false' || reqenv('CORSTrusted') == 'false'"
+        Header unset Access-Control-Allow-Origin "expr=reqenv('CORSProcessing') == 'false' || reqenv('CORSTrusted') == 'false'"
+        Header unset Access-Control-Allow-Methods "expr=reqenv('CORSProcessing') == 'false' || reqenv('CORSTrusted') == 'false'"
+        Header unset Access-Control-Max-Age "expr=reqenv('CORSProcessing') == 'false' || reqenv('CORSTrusted') == 'false'"
+
+        # Always vary on origin, even if its not there.
+        Header merge Vary Origin
+
+        # CORS - send 204 for CORS requests which are not trusted
+        RewriteCond expr "reqenv('CORSProcessing') == 'true' && reqenv('CORSTrusted') == 'false'"
+        RewriteRule "^(.*)" - [R=204,L]
+
+        # Remove Origin before sending to AEM Publish
+        RequestHeader unset Origin
+
+        ################## End of CORS configuration ##################
 	</IfModule>
 	<Directory />
 		<IfModule disp_apache2.c>

diff --git a/dispatcher/src/conf.dispatcher.d/clientheaders/clientheaders.any b/dispatcher/src/conf.dispatcher.d/clientheaders/clientheaders.any
@@ -7,8 +7,4 @@
 # Allowing CORS headers to be passed through to the publish tier to support headless and SPA Editor use cases.
 # https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#the_http_request_headers
 
-"Origin"
-"Access-Control-Request-Method"
-"Access-Control-Request-Headers"
-
 $include "./default_clientheaders.any"
diff --git a/it.tests/pom.xml b/it.tests/pom.xml
@@ -19,7 +19,7 @@
     <parent>
         <groupId>com.adobe.aem.guides</groupId>
         <artifactId>aem-guides-wknd</artifactId>
-        <version>3.1.1-SNAPSHOT</version>
+        <version>3.2.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <artifactId>aem-guides-wknd.it.tests</artifactId>

diff --git a/it.tests/src/main/java/com/adobe/aem/guides/wknd/it/tests/GraphQlIT.java b/it.tests/src/main/java/com/adobe/aem/guides/wknd/it/tests/GraphQlIT.java
@@ -82,7 +82,6 @@ private static AEMHeadlessClient getHeadlessClient(InstanceConfiguration instanc
 
     @Test
     public void testQuery() {
-
         String query = "{\n" + //
                 "  articleList{\n" + //
                 "    items{ \n" + //
@@ -110,9 +109,7 @@ public void testQuery() {
 
     @Test
     public void testQueryWithSyntaxError() {
-
         thrown.expect(AEMHeadlessClientException.class);
-        thrown.expectMessage("Invalid Syntax : offending token");
 
         String query = "{\n" + //
                 "  articleList{\n" + //
@@ -125,13 +122,10 @@ public void testQueryWithSyntaxError() {
 
     @Test
     public void testQueryWithErrorResponse() {
-
         thrown.expect(AEMHeadlessClientException.class);
-        thrown.expectMessage("Field 'nonExisting' in type 'QueryType' is undefined");
 
         String query = "{ nonExisting { items{  _path } } }";
         headlessClientAuthor.runQuery(query);
-
     }
 
     @Test
@@ -182,7 +176,6 @@ public void testQueryWithParameters() {
 
     @Test
     public void testPersistedQuery() {
-
         GraphQlResponse response = headlessClientAuthor.runPersistedQuery("/wknd-shared/adventures-all");
         assertNull(response.getErrors());
         JsonNode responseData = response.getData();
@@ -193,25 +186,23 @@ public void testPersistedQuery() {
         JsonNode adventureListItems = adventureListList.get("items");
         assertNotNull(adventureListItems);
         assertEquals(16, adventureListItems.size());
-        JsonNode firstAdvantureItem = adventureListItems.get(0);
-        assertNotNull(firstAdvantureItem.get("_path"));
-        assertNotNull(firstAdvantureItem.get("title"));
-        assertNotNull(firstAdvantureItem.get("price"));
-        assertNotNull(firstAdvantureItem.get("tripLength"));
-        assertNotNull(firstAdvantureItem.get("primaryImage"));
+        JsonNode firstAdventureItem = adventureListItems.get(0);
+        assertNotNull(firstAdventureItem.get("_path"));
+        assertNotNull(firstAdventureItem.get("title"));
+        assertNotNull(firstAdventureItem.get("price"));
+        assertNotNull(firstAdventureItem.get("tripLength"));
+        assertNotNull(firstAdventureItem.get("primaryImage"));
 
     }
 
     @Test
     public void testListPersistedQueries() {
-
         List<PersistedQuery> listPersistedQueries = headlessClientAuthor.listPersistedQueries("wknd-shared");
 
         assertFalse(listPersistedQueries.isEmpty());
         PersistedQuery adventuresQuery = listPersistedQueries.stream()
                 .filter(p -> p.getShortPath().equals("/wknd-shared/adventures-all")).findFirst().get();
         assertEquals("/wknd-shared/settings/graphql/persistentQueries/adventures-all", adventuresQuery.getLongPath());
-        assertThat(adventuresQuery.getQuery(), containsString("adventureList {"));
+        assertThat(adventuresQuery.getQuery(), containsString("adventureList") );
     }
-
 }
diff --git a/pom.xml b/pom.xml
@@ -19,7 +19,7 @@
     <groupId>com.adobe.aem.guides</groupId>
     <artifactId>aem-guides-wknd</artifactId>
     <packaging>pom</packaging>
-    <version>3.1.1-SNAPSHOT</version>
+    <version>3.2.1-SNAPSHOT</version>
      <name>WKND Sites Project - Reactor Project</name>
     <description>WKND Sites Project</description>
     <url>https://github.com/adobe/aem-guides-wknd</url>

diff --git a/ui.apps.structure/pom.xml b/ui.apps.structure/pom.xml
@@ -8,7 +8,7 @@
     <parent>
         <groupId>com.adobe.aem.guides</groupId>
         <artifactId>aem-guides-wknd</artifactId>
-        <version>3.1.1-SNAPSHOT</version>
+        <version>3.2.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/ui.apps/pom.xml b/ui.apps/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>com.adobe.aem.guides</groupId>
         <artifactId>aem-guides-wknd</artifactId>
-        <version>3.1.1-SNAPSHOT</version>
+        <version>3.2.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/ui.config/pom.xml b/ui.config/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>com.adobe.aem.guides</groupId>
         <artifactId>aem-guides-wknd</artifactId>
-        <version>3.1.1-SNAPSHOT</version>
+        <version>3.2.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/...osgiconfig/config.author/com.adobe.granite.cors.impl.CORSPolicyImpl~wknd-graphql.cfg.json b/...osgiconfig/config.author/com.adobe.granite.cors.impl.CORSPolicyImpl~wknd-graphql.cfg.json
@@ -1,32 +1,30 @@
-// Configuration created by Apache Sling JCR Installer
 {
-  "supportscredentials":true,
-  "exposedheaders":[
-    ""
-  ],
-  "supportedmethods":[
-    "GET",
-    "HEAD",
-    "POST"
-  ],
-  "alloworigin":[
-    ""
-  ],
-  "maxage:Integer":1800,
-  "alloworiginregexp":[
-    "http://localhost:.*"
-  ],
-  "allowedpaths":[
-    "/content/_cq_graphql/wknd-shared/endpoint.json",
-    "/graphql/execute.json.*"
-  ],
-  "supportedheaders":[
-    "Origin",
-    "Accept",
-    "X-Requested-With",
-    "Content-Type",
-    "Access-Control-Request-Method",
-    "Access-Control-Request-Headers",
-    "authorization"
-  ]
+    "alloworigin":[
+      ""
+    ],
+    "alloworiginregexp":[
+      "http://localhost:.*"
+    ],
+    "allowedpaths": [
+      "/graphql/execute.json.*",
+      "/content/_cq_graphql/wknd-shared/endpoint.json",
+      "/content/experience-fragments/.*"
+    ],
+    "supportedheaders": [
+      "Origin",
+      "Accept",
+      "X-Requested-With",
+      "Content-Type",
+      "Access-Control-Request-Method",
+      "Access-Control-Request-Headers",
+      "Authorization"
+    ],
+    "supportedmethods":[
+      "GET",
+      "HEAD",
+      "POST"
+    ],
+    "maxage:Integer": 1800,
+    "supportscredentials": true,
+    "exposedheaders":[ "" ]
 }
diff --git a/...sgiconfig/config.publish/com.adobe.granite.cors.impl.CORSPolicyImpl~wknd-graphql.cfg.json b/...sgiconfig/config.publish/com.adobe.granite.cors.impl.CORSPolicyImpl~wknd-graphql.cfg.json
@@ -1,31 +1,32 @@
-// Configuration created by Apache Sling JCR Installer
+// This OSGi configuration is to support local development on the AEM SDK. 
+// The Dispatcher CORS configuration should be used when deploying to AEM as a Cloud Service.
+// See https://experienceleague.adobe.com/docs/experience-manager-learn/getting-started-with-aem-headless/deployments/configurations/cors.html
 {
-  "supportscredentials":false,
-  "exposedheaders":[
-    ""
-  ],
-  "supportedmethods":[
-    "GET",
-    "HEAD",
-    "POST"
-  ],
-  "alloworigin":[
-    ""
-  ],
-  "maxage:Integer":1800,
-  "alloworiginregexp":[
-    "http://localhost:.*"
-  ],
-  "allowedpaths":[
-    "/content/_cq_graphql/wknd-shared/endpoint.json",
-    "/graphql/execute.json.*"
-  ],
-  "supportedheaders":[
-    "Origin",
-    "Accept",
-    "X-Requested-With",
-    "Content-Type",
-    "Access-Control-Request-Method",
-    "Access-Control-Request-Headers"
-  ]
+    "alloworigin":[
+      ""
+    ],
+    "alloworiginregexp":[
+      "http://localhost:.*"
+    ],
+    "allowedpaths": [
+      "/graphql/execute.json.*",
+      "/content/_cq_graphql/wknd-shared/endpoint.json",
+      "/content/experience-fragments/.*"
+    ],
+    "supportedheaders": [
+      "Origin",
+      "Accept",
+      "X-Requested-With",
+      "Content-Type",
+      "Access-Control-Request-Method",
+      "Access-Control-Request-Headers"
+    ],
+    "supportedmethods":[
+      "GET",
+      "HEAD",
+      "POST"
+    ],
+    "maxage:Integer": 1800,
+    "supportscredentials": false,
+    "exposedheaders":[ "" ]
 }
diff --git a/ui.content.sample/pom.xml b/ui.content.sample/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>com.adobe.aem.guides</groupId>
         <artifactId>aem-guides-wknd</artifactId>
-        <version>3.1.1-SNAPSHOT</version>
+        <version>3.2.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/ui.content/pom.xml b/ui.content/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>com.adobe.aem.guides</groupId>
         <artifactId>aem-guides-wknd</artifactId>
-        <version>3.1.1-SNAPSHOT</version>
+        <version>3.2.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -125,4 +125,5 @@
             </properties>
         </profile>
     </profiles>
+
 </project>
diff --git a/ui.frontend/pom.xml b/ui.frontend/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>com.adobe.aem.guides</groupId>
         <artifactId>aem-guides-wknd</artifactId>
-        <version>3.1.1-SNAPSHOT</version>
+        <version>3.2.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>