Follow-up from the architecture review of the feature/js-server-extensions branch (PR #687); this is the "intended evolution" recorded in ADR-0008.
Context. The v1 actions dispatcher (GenericActionEndpoint) rides the legacy org.jahia.bin.Action mechanism. That was the right v1 call (Jahia's auth valves, sessions and URL resolution for free), but it leaks legacy constraints into the modern feature:
- stub URLs are page-bound (
location.pathname + .html stripping) instead of module-scoped;
- the error envelope always travels on HTTP 200 because the render servlet only writes JSON bodies for 2xx action results;
- the endpoint needs a CSRF-guard whitelist entry even though its real protection is the mandatory
X-JS-Action header.
Proposal. Replace the endpoint with a dedicated servlet (e.g. /modules/javascript/actions/<module>/<export>), giving proper HTTP status codes (400 validation / 404 unknown / 500 failure), page-independent URLs and no jahia-csrf-guard coupling. Key prerequisite to investigate: how Jahia's authentication valve chain applies to module/whiteboard servlets (the reason this was deferred — see protected-servlet-sample in OSGi-modules-samples as a starting point).
Important property: this is NOT a breaking change for module authors. Both ends of the wire protocol are generated/owned by the platform (vite-plugin client stubs + engine endpoint), so the transport can be swapped without touching any module code — only stubs and endpoint change together.
Acceptance. Same Cypress coverage as v1 (wire + through-island) passing against the servlet; auth behavior verified for guest and authenticated users; CSRF whitelist entry and the HTTP-200 envelope note removed from ADR-0008/guides.
Follow-up from the architecture review of the
feature/js-server-extensionsbranch (PR #687); this is the "intended evolution" recorded in ADR-0008.Context. The v1 actions dispatcher (
GenericActionEndpoint) rides the legacyorg.jahia.bin.Actionmechanism. That was the right v1 call (Jahia's auth valves, sessions and URL resolution for free), but it leaks legacy constraints into the modern feature:location.pathname+.htmlstripping) instead of module-scoped;X-JS-Actionheader.Proposal. Replace the endpoint with a dedicated servlet (e.g.
/modules/javascript/actions/<module>/<export>), giving proper HTTP status codes (400 validation / 404 unknown / 500 failure), page-independent URLs and no jahia-csrf-guard coupling. Key prerequisite to investigate: how Jahia's authentication valve chain applies to module/whiteboard servlets (the reason this was deferred — seeprotected-servlet-samplein OSGi-modules-samples as a starting point).Important property: this is NOT a breaking change for module authors. Both ends of the wire protocol are generated/owned by the platform (vite-plugin client stubs + engine endpoint), so the transport can be swapped without touching any module code — only stubs and endpoint change together.
Acceptance. Same Cypress coverage as v1 (wire + through-island) passing against the servlet; auth behavior verified for guest and authenticated users; CSRF whitelist entry and the HTTP-200 envelope note removed from ADR-0008/guides.