feat: add stable tenant:alias access for embedded widgets - #702
Open
SteveLauC wants to merge 4 commits into
Open
feat: add stable tenant:alias access for embedded widgets #702SteveLauC wants to merge 4 commits into
tenant:alias access for embedded widgets #702SteveLauC wants to merge 4 commits into
Conversation
SteveLauC
force-pushed
the
integration_alias
branch
from
August 26, 2026 08:41
2e68fe7 to
3c1b2c9
Compare
Widget embed codes reference the server-generated document ID, so recreating a widget breaks every snippet embedded on external sites. A widget can now carry a unique (tenant, alias) pair, and the public wrapper route accepts it in place of the ID, e.g. /integration/infinilabs:coco-website-searchbox/widget. The pair rides the existing /integration/:id/widget route as a single path segment joined by ":", which never occurs in UUID document IDs and is excluded from the alias charset, so both forms stay unambiguous; a dedicated route is not possible because the framework router rejects a path parameter placed next to the static "widget" and "chat" children. Create and update validate the pair (charset, set or cleared together, global uniqueness) and the wrapper still injects the real document ID, so APP-INTEGRATION-ID header auth and the CORS origin cache are unaffected. The two fields are marshaled without omitempty because updates are ES partial docs: an omitted empty string would silently keep the previously stored alias instead of clearing it. The edit form gathers tenant and alias in a single Alias row (two inputs joined by a ":"), embed code and preview prefer the alias URL when the pair is set and fall back to the ID otherwise, and the widget list gains an alias column. scenario4.dsl covers the by-ID and by-alias wrapper APIs, duplicate rejection, clearing the pair and unknown-alias 404s.
The framework recently added a unified POST /account/login that
expects a "login" field and registers the same pattern lazily,
silently replacing coco's own email-based handler. The web app still
posted {email, password}, which the unified handler ignores, so login
failed with "login and password are required".
Send "login" from the login form, drop coco's legacy login handler
and its now-unused helpers from plugins/security so the route has a
single owner, and move the DSL test suites' login bodies to the new
field.
SteveLauC
force-pushed
the
integration_alias
branch
from
August 26, 2026 08:45
3c1b2c9 to
5ca4a85
Compare
The framework now requires newer golang.org/x, go.opentelemetry.io and google.golang.org module versions (e.g. github.com/go-logr/stdr v1.2.2 and go.opentelemetry.io/auto/sdk v1.2.1), so CI builds failed with "updates to go.mod needed" against the previous go.mod. Realign the versions via go mod tidy.
SteveLauC
force-pushed
the
integration_alias
branch
from
August 26, 2026 09:15
6e18cfa to
3d233db
Compare
The enrich_documents pipeline in the CI coco.yml still referenced the file_extraction processor, which no longer exists in coco. The consumer processor panics on that (instead of returning the error), the panic is swallowed by the task runner's recover, and createPipelineTask then deadlocks waiting on its ready channel — so app.Setup never reaches the AfterSetup callbacks and the framework's ORM security hooks (owner and share filtering) are never registered. The server still serves requests (the web module starts earlier), but every search runs unfiltered, which broke the sharing assertions in the assistant scenarios. Replace the pipeline section with the current production set (process_documents, process_attachments, merge_documents, ingest_documents, connector_dispatcher) from the repo-root coco.yml. Verified against a replica of the CI environment (Easysearch 2.1.2 plus the seed snapshot): the hooks register again and scenario1 passes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do
Rationale for this change
Standards checklist