Aller au contenu principal
Jahia Store
FR

Jahia Store Template

community
Télécharger 5.0.1

Informations

Identifiant du module
jahia-store-template
Identifiant de groupe
org.jahia.modules.javascript
Statut
community
Catégorie
Platform
Auteur
JSG
Site web du développeur
https://github.com/Jahia/store-template
Nécessite Jahia
8.2.0.0
Mis à jour
2026-07-09

The Jahia Store Template - a Jahia 8.2 JavaScript module (server-side React on the javascript-modules-engine) that renders the Private App Store website and its in-site administration (Forge settings, Categories, Roles).

It is the presentation and authoring layer for the jahia-store Java module, which owns the backend logic and the JCR content model.

Captures d'écran

Versions

Security-hardening release — the storefront/editor half of the SECURITY-571 audit —
plus dependency updates. No functional or visual changes to the storefront; existing
sites are unaffected. Pairs with jahia-store 5.0.1.

🔒 Security (#29)

  • Client-side magic-byte validation of icon/screenshot uploads (#28) — the editor
    now reads the actual leading bytes of a picked file and confirms a real raster
    signature before uploading, catching a renamed SVG/HTML in the browser. It uploads
    the detected MIME type rather than the spoofable File.type. This pairs with the
    authoritative server-side re-validation shipped in jahia-store 5.0.1.
  • Defense-in-depth publish gate in the detail view (#54) — an unpublished
    module/package never renders its detail (description, FAQ, author, download URLs) to
    a visitor without edit rights, even if the backend render filter is bypassed. Owners
    keep the draft preview.
Nécessite Jahia 8.2.0.0Mis à jour 2026-07-02
5.0.0-SNAPSHOTbrouillonTélécharger

5.0.0 is a ground-up rewrite of the Private App Store storefront, delivered as a
Jahia JavaScript module (server-side React on the javascript-modules-engine)
instead of the previous JSP/JAR template set. The module was renamed from
store-template to jahia-store-template and now versions in lock-step with the
jahia-store backend (5.0.0).

Pairs with: jahia-store 5.0.0. The storefront also depends on the deployed
richtext-ckeditor5 module for authoring rich text.


Highlights

  • New architecture — SSR React with client-side "islands" for interactivity,
    built with Vite + Yarn to an OSGi-deployable .tgz. No JSP, no Moonstone, no Apollo
    in the bundle.
  • Reworked storefront — left-hand Status/Categories facet rail, server-side
    pagination & filtering, keyword + advanced search, a Newest/A–Z sort control, and a
    navigation loading bar. Grid is ordered by most-recent release by default.
  • Full in-page authoring — a tabbed module editor with CKEditor 5 rich text,
    icon/screenshot/video media, per-version changelogs, publish toggle, and
    add/remove-version controls, all gated by JCR permissions.
  • WCAG 2.2 Level AAA accessibility pass across the UI it controls.
  • Hardened security — production CSP, server-side render-time XSS sanitization,
    and a clean CodeQL surface.

Storefront

  • Status and Categories facet rail on the left; the header is keyword search only.
  • Server-side pagination and filtering (no client-side over-fetch); results
    ordered by latest release date.
  • Sort control (Newest | A–Z) in the filter rail, persisted in the URL alongside
    the active facets.
  • Advanced/header search matching title, id and description; clearing the search
    re-applies the active filter (keeps facets) via the native search event.
  • Navigation loading bar on filter/search/pagination changes.
  • Header with breadcrumb and account menu; Log out is a real button.
  • Module detail page aligned with store.jahia.com — Information panel,
    How-to-install / FAQ, and a header Download action.
  • Branding (logo, copyright, footer links) read from per-site configuration via an
    in-process OSGi-service bridge, so it renders for anonymous visitors.
  • Typography — self-hosted Nunito Sans variable font; body text tuned to the
    Moonstone gray for AAA contrast.

Authoring & editor

  • Tabbed module editor for owners, inline on the detail page.
  • Rich text via CKEditor 5, loaded at runtime as a federated remote from the
    richtext-ckeditor5 module (not bundled).
  • Media — icon upload, screenshot upload, and video management.
  • Per-version changelog, owner publish toggle, and add / remove version
    controls surfaced in the Versions tab.
  • Category picker as a tag-style chip selector; choosable author display
    (username / email / full name / organisation).
  • Module upload accepts JAR/TGZ only (WAR upload removed).

Accessibility (WCAG 2.2 AAA)

  • Color contrast raised to the AAA enhanced threshold (≥ 7:1) across controls and
    status/error text.
  • Interactive targets meet the ≥ 24px minimum; visible focus states throughout.
  • Correct landmark structure (single top-level <main>; the filter root is a plain
    region, not a nested complementary landmark), role=group/aria-label on control
    groups, and a native <dialog> lightbox with keyboard navigation and reduced-motion
    support.

Security

  • Production Content-Security-Policy with a per-request nonce for the engine
    importmap.
  • XSS — a server-side xss allowlist sanitizer is the primary render-time control;
    DOMPurify-on-save is defense-in-depth for authored rich text.
  • CodeQL alerts remediated (e.g. HTML double-escaping fix); remaining flags
    triaged as false positives.

Tooling & quality

  • Vitest unit-test harness (sanitization, version comparison, card/data
    transforms) plus a clean tsc --noEmit typecheck.
  • End-to-end coverage via the Cypress suite in jahia-store/tests.

Upgrade notes / breaking changes

  • Module renamed store-template → jahia-store-template (artifact id and
    bundle). Uninstall the old template set; deploy the new one. Requires
    jahia-store 5.0.0 and the richtext-ckeditor5 module.
  • Store settings moved out of JCR. Per-site settings (Nexus connection + branding)
    are now a file-backed OSGi factory configuration on the backend. Settings created by
    pre-5.0.0 (JCR jmix:forgeSettings) builds are not migrated — re-save them once
    in the store administration UI after upgrading.
  • Review/rating feature removed.
  • WAR module upload removed — publish modules as JAR or TGZ.
  • Deploying the same -SNAPSHOT over a running instance requires uninstalling the
    previous one first; bump the module version when shipping changed import content.

Dependencies

  • React 19, Vite 8, TypeScript 5
  • @jahia/javascript-modules-engine (SSR + island runtime)
  • richtext-ckeditor5 (federated CKEditor 5 remote, runtime)
Nécessite Jahia 8.2.0.0Mis à jour 2026-06-25

5.0.0 is a ground-up rewrite of the Private App Store storefront, delivered as a
Jahia JavaScript module (server-side React on the javascript-modules-engine)
instead of the previous JSP/JAR template set. The module was renamed from
store-template to jahia-store-template and now versions in lock-step with the
jahia-store backend (5.0.0).

Pairs with: jahia-store 5.0.0. The storefront also depends on the deployed
richtext-ckeditor5 module for authoring rich text.


Highlights

  • New architecture — SSR React with client-side "islands" for interactivity,
    built with Vite + Yarn to an OSGi-deployable .tgz. No JSP, no Moonstone, no Apollo
    in the bundle.
  • Reworked storefront — left-hand Status/Categories facet rail, server-side
    pagination & filtering, keyword + advanced search, a Newest/A–Z sort control, and a
    navigation loading bar. Grid is ordered by most-recent release by default.
  • Full in-page authoring — a tabbed module editor with CKEditor 5 rich text,
    icon/screenshot/video media, per-version changelogs, publish toggle, and
    add/remove-version controls, all gated by JCR permissions.
  • WCAG 2.2 Level AAA accessibility pass across the UI it controls.
  • Hardened security — production CSP, server-side render-time XSS sanitization,
    and a clean CodeQL surface.

Storefront

  • Status and Categories facet rail on the left; the header is keyword search only.
  • Server-side pagination and filtering (no client-side over-fetch); results
    ordered by latest release date.
  • Sort control (Newest | A–Z) in the filter rail, persisted in the URL alongside
    the active facets.
  • Advanced/header search matching title, id and description; clearing the search
    re-applies the active filter (keeps facets) via the native search event.
  • Navigation loading bar on filter/search/pagination changes.
  • Header with breadcrumb and account menu; Log out is a real button.
  • Module detail page aligned with store.jahia.com — Information panel,
    How-to-install / FAQ, and a header Download action.
  • Branding (logo, copyright, footer links) read from per-site configuration via an
    in-process OSGi-service bridge, so it renders for anonymous visitors.
  • Typography — self-hosted Nunito Sans variable font; body text tuned to the
    Moonstone gray for AAA contrast.

Authoring & editor

  • Tabbed module editor for owners, inline on the detail page.
  • Rich text via CKEditor 5, loaded at runtime as a federated remote from the
    richtext-ckeditor5 module (not bundled).
  • Media — icon upload, screenshot upload, and video management.
  • Per-version changelog, owner publish toggle, and add / remove version
    controls surfaced in the Versions tab.
  • Category picker as a tag-style chip selector; choosable author display
    (username / email / full name / organisation).
  • Module upload accepts JAR/TGZ only (WAR upload removed).

Accessibility (WCAG 2.2 AAA)

  • Color contrast raised to the AAA enhanced threshold (≥ 7:1) across controls and
    status/error text.
  • Interactive targets meet the ≥ 24px minimum; visible focus states throughout.
  • Correct landmark structure (single top-level <main>; the filter root is a plain
    region, not a nested complementary landmark), role=group/aria-label on control
    groups, and a native <dialog> lightbox with keyboard navigation and reduced-motion
    support.

Security

  • Production Content-Security-Policy with a per-request nonce for the engine
    importmap.
  • XSS — a server-side xss allowlist sanitizer is the primary render-time control;
    DOMPurify-on-save is defense-in-depth for authored rich text.
  • CodeQL alerts remediated (e.g. HTML double-escaping fix); remaining flags
    triaged as false positives.

Tooling & quality

  • Vitest unit-test harness (sanitization, version comparison, card/data
    transforms) plus a clean tsc --noEmit typecheck.
  • End-to-end coverage via the Cypress suite in jahia-store/tests.

Upgrade notes / breaking changes

  • Module renamed store-template → jahia-store-template (artifact id and
    bundle). Uninstall the old template set; deploy the new one. Requires
    jahia-store 5.0.0 and the richtext-ckeditor5 module.
  • Store settings moved out of JCR. Per-site settings (Nexus connection + branding)
    are now a file-backed OSGi factory configuration on the backend. Settings created by
    pre-5.0.0 (JCR jmix:forgeSettings) builds are not migrated — re-save them once
    in the store administration UI after upgrading.
  • Review/rating feature removed.
  • WAR module upload removed — publish modules as JAR or TGZ.
  • Deploying the same -SNAPSHOT over a running instance requires uninstalling the
    previous one first; bump the module version when shipping changed import content.

Dependencies

  • React 19, Vite 8, TypeScript 5
  • @jahia/javascript-modules-engine (SSR + island runtime)
  • richtext-ckeditor5 (federated CKEditor 5 remote, runtime)
Nécessite Jahia 8.2.0.0Mis à jour 2026-06-25