feat: Add Endpoints Required to Support a Web Administrator (#335) - #336
Open
gibson9583 wants to merge 8 commits into
Open
feat: Add Endpoints Required to Support a Web Administrator (#335)#336gibson9583 wants to merge 8 commits into
gibson9583 wants to merge 8 commits into
Conversation
gibson9583
requested review from
a team,
NicoPiel,
jonbartels,
kayyagari,
kpalang,
mgaffigan,
ssrowe and
tonygermano
July 2, 2026 17:23
kayyagari
reviewed
Jul 7, 2026
gibson9583
force-pushed
the
feat/web-support
branch
from
July 7, 2026 15:57
1fb04a5 to
8149bab
Compare
kayyagari
reviewed
Jul 7, 2026
pacmano1
requested changes
Jul 27, 2026
Contributor
There was a problem hiding this comment.
We are on Gradle now, please rebase.
Needs tests. RequestedWithFilterTest already exists and you added a branch to it without adding a case. The traversal guard in getWebPluginResource is the one I actually care about.
Headers got deleted instead of replaced, so six files ship with no license at all. Add the SPDX pair like AbstractXMLReader.java.
Add engine REST support so the standalone web administrator can run fully
against the engine — serving plugin UIs, exact serialization, and script
tooling — with no local JVM sidecar or shared filesystem.
Endpoints (all session-authed, no extra permission, auditable=false):
- GET /api/webplugins — enabled extensions that ship a webadmin/ UI
- GET /api/webplugins/{extensionPath}/{file} — serve an extension's webadmin/ assets
- POST /api/javascript/_validate — validate JS (Rhino compiler)
- POST /api/javascript/_prettyPrint — format JS (Rhino-AST formatter)
- POST /api/datatypes/_serialize — serialize a message via a data type (message trees)
Supporting changes:
- RequestedWithFilter: exempt read-only GET /api/webplugins/* from the
X-Requested-With CSRF requirement (browser module/script loads can't set headers).
- DataTypeServerPlugin: add getVocabulary(version, type); override in HL7v2, EDI,
NCPDP, and DICOM so /api/datatypes/_serialize returns element descriptions.
New servlets auto-register via the existing package scan; no wiring changes.
Signed-off-by: gibson9583 <cgibson@outlook.com>
Not need - this just uses JS Beautify Signed-off-by: gibson9583 <cgibson@outlook.com>
Signed-off-by: gibson9583 <cgibson@outlook.com>
Signed-off-by: gibson9583 <cgibson@outlook.com>
Signed-off-by: gibson9583 <cgibson@outlook.com>
The header-strip commit left the six new files with no license. Add the MPL-2.0 SPDX pair used elsewhere in the tree. Signed-off-by: gibson9583 <cgibson@outlook.com>
Match DataTypeServlet and drop the hand-rolled escaper. Signed-off-by: gibson9583 <cgibson@outlook.com>
RequestedWithFilterTest: the GET-only exemption for /webplugins/ assets by path info and by request URI; POST, the discovery list, and other GETs still need the header. WebPluginServletTest: discovery lists only enabled extensions with a manifest; asset serving rejects parent, nested, cross-extension, absolute, unsafe-segment, and symlink escapes. JavaScriptServletTest: response shape and JSON validity. Signed-off-by: gibson9583 <cgibson@outlook.com>
gibson9583
force-pushed
the
feat/web-support
branch
from
September 4, 2026 13:58
acb3880 to
baa511d
Compare
Contributor
|
I agree with adding the support endpoints (vocabulary, validate, ...). Should you wish to reduce this PR to those only, I am happy to approve as is. I do not understand the goal of avoiding WAR files. WAR is the format for shipping static files. This seems to be re-inventing a plugin-specific file serving concept. I would agree with having a way for plugins to deliver a manifest via API - that should be aggregated into a single merged document, though, not N requests to arbitrary URL's, though. Should we have to serve static resources from plugin jars, then I would say that should be via #176 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add engine REST support so a standalone web administrator can run fully against the engine by serving plugin UIs, exact serialization, and script tooling with no local JVM sidecar or shared filesystem.
Endpoints (all session-authed, no extra permission, auditable=false):
Supporting changes:
New servlets auto-register via the existing package scan. No wiring changes.