fix: sanitize aem paths to da content paths for library (#928)

Author: usman-khalid

blocks/edit/da-library/da-library.js

@@ -6,7 +6,14 @@ import getSheet from '../../shared/sheet.js';
 import inlinesvg from '../../shared/inlinesvg.js';
 import { daFetch } from '../../shared/utils.js';
 import searchFor from './helpers/search.js';
-import { OOTB_PLUGINS, loadLibrary, getItemDetails, getPreviewStatus, ref } from './helpers/helpers.js';
+import {
+  OOTB_PLUGINS,
+  loadLibrary,
+  getItemDetails,
+  getPreviewStatus,
+  aemToContentUrl,
+  ref,
+} from './helpers/helpers.js';
 
 const sheet = await getSheet('/blocks/edit/da-library/da-library.css');
 const buttons = await getSheet(`${getNx()}/styles/buttons.css`);
@@ -184,7 +191,7 @@ class DaLibrary extends LitElement {
   }
 
   async handleTemplateClick(item) {
-    const resp = await daFetch(`${item.value}`);
+    const resp = await daFetch(aemToContentUrl(item.value));
     if (!resp.ok) return;
     let text = await resp.text();
 

blocks/edit/da-library/helpers/helpers.js

@@ -2,6 +2,7 @@
 import { DOMParser } from 'da-y-wrapper';
 import getPathDetails from '../../../shared/pathDetails.js';
 import { daFetch, aemAdmin, fetchDaConfigs, getFirstSheet, getSheetByName } from '../../../shared/utils.js';
+import { CON_ORIGIN } from '../../../shared/constants.js';
 import { openAssets } from '../../da-assets/da-assets.js';
 import { fetchKeyAutocompleteData } from '../../prose/plugins/slashMenu/keyAutocomplete.js';
 import { sanitizeName } from '../../../../scripts/utils.js';
@@ -44,11 +45,27 @@ function setupBlockOptions(library) {
   if (blockJsonUrl) fetchKeyAutocompleteData(blockJsonUrl);
 }
 
+const AEM_CONTENT_HOST = /\.(aem|hlx)\.(page|live)$/;
+
+export function aemToContentUrl(url) {
+  try {
+    const { hostname, pathname, search } = new URL(url);
+    if (!AEM_CONTENT_HOST.test(hostname)) return url;
+    const parts = hostname.split('--');
+    if (parts.length !== 3) return url;
+    const [, site, orgWithTld] = parts;
+    const [org] = orgWithTld.split('.');
+    return `${CON_ORIGIN}/${org}/${site}${pathname}${search}`;
+  } catch {
+    return url;
+  }
+}
+
 export async function getItems(sources, format) {
   const items = [];
   for (const source of sources) {
     try {
-      const resp = await daFetch(source);
+      const resp = await daFetch(aemToContentUrl(source));
       const json = await resp.json();
       if (json.data) {
         items.push(...formatData(json.data, format));

blocks/edit/da-library/helpers/index.js

@@ -1,6 +1,6 @@
 import { daFetch, getFirstSheet } from '../../../shared/utils.js';
 import { getMetadata } from '../../utils/helpers.js';
-import { parseDom } from './helpers.js';
+import { parseDom, aemToContentUrl } from './helpers.js';
 
 const AEM_ORIGIN = ['hlx.page', 'hlx.live', 'aem.page', 'aem.live'];
 
@@ -191,7 +191,7 @@ export async function getBlocks(sources) {
         }
 
         try {
-          const resp = await daFetch(url, { noRedirect: true });
+          const resp = await daFetch(aemToContentUrl(url), { noRedirect: true });
           if (!resp.ok) throw new Error('Something went wrong.');
           const data = await resp.json();
           urlCache.set(url, data);
@@ -210,7 +210,7 @@ export async function getBlocks(sources) {
             if (block.name && block.path) {
               acc.push({
                 ...block,
-                loadVariants: getBlockVariants(block.path),
+                loadVariants: getBlockVariants(aemToContentUrl(block.path)),
               });
             }
           });

test/unit/blocks/edit/da-library/helpers.test.js

@@ -8,6 +8,7 @@ const {
   getMetadata,
   getPreviewUrl,
   getAemUrlVars,
+  aemToContentUrl,
   getItemDetails,
   getItems,
   getPreviewStatus,
@@ -118,6 +119,35 @@ describe('da-library/helpers exports', () => {
     });
   });
 
+  describe('aemToContentUrl', () => {
+    it('Rewrites aem.page preview URLs to content.da.live', () => {
+      expect(aemToContentUrl('https://main--site--org.aem.page/blocks/cards'))
+        .to.equal('https://content.da.live/org/site/blocks/cards');
+    });
+
+    it('Rewrites aem.live, hlx.page and hlx.live URLs the same way', () => {
+      expect(aemToContentUrl('https://main--site--org.aem.live/blocks/cards'))
+        .to.equal('https://content.da.live/org/site/blocks/cards');
+      expect(aemToContentUrl('https://main--site--org.hlx.page/blocks/cards'))
+        .to.equal('https://content.da.live/org/site/blocks/cards');
+      expect(aemToContentUrl('https://feature--site--org.hlx.live/deep/nested/path'))
+        .to.equal('https://content.da.live/org/site/deep/nested/path');
+    });
+
+    it('Leaves content.da.live and admin.da.live URLs unchanged', () => {
+      const con = 'https://content.da.live/org/site/blocks/cards';
+      expect(aemToContentUrl(con)).to.equal(con);
+      const admin = 'https://admin.da.live/source/org/site/blocks/cards';
+      expect(aemToContentUrl(admin)).to.equal(admin);
+    });
+
+    it('Leaves unrelated origins, relative paths and non-URL strings unchanged', () => {
+      expect(aemToContentUrl('https://example.com/blocks/cards')).to.equal('https://example.com/blocks/cards');
+      expect(aemToContentUrl('/blocks/cards.json')).to.equal('/blocks/cards.json');
+      expect(aemToContentUrl('not a url')).to.equal('not a url');
+    });
+  });
+
   describe('getItemDetails', () => {
     it('Parses an aem.live URL', () => {
       const result = getItemDetails({ path: 'https://main--repo--org.aem.live/folder/page' });
@@ -236,6 +266,19 @@ describe('da-library/helpers/index getBlocks', () => {
     expect(result).to.deep.equal([]);
   });
 
+  it('Rewrites an AEM source URL to content.da.live before fetching', async () => {
+    let captured;
+    window.fetch = (url) => {
+      captured = url;
+      return Promise.resolve(new Response(
+        JSON.stringify({ ':type': 'sheet', data: [] }),
+        { status: 200 },
+      ));
+    };
+    await getBlocks(['https://main--repo--org.aem.page/blocks.json']);
+    expect(captured).to.equal('https://content.da.live/org/repo/blocks.json');
+  });
+
   it('Caches fetched source data so subsequent calls do not refetch', async () => {
     let calls = 0;
     window.fetch = () => {