Conversation
…s the 503 red. head.html still decides whether a site exists, so a site not yet previewed on the requested ref is refused at 404 with its document already read and discarded. an upstream that cannot be reached still reports the failure in a return value, and a preview host that throws still reaches the browser as a 500 with no body. the full suite aborts on load, because src/storage/site.js does not exist yet.
…ce means head.html decided whether a site exists, so a site not yet previewed on the requested ref was refused at 404 with its document already read and discarded. config.aem.page answers both questions in one read: whether there is such a site, and which store holds its content. content.source.url is the field helix-admin sets x-api-upgrade-available from, so it is the boolean /ping conveyed. the /ping probe and HLX_ADMIN are gone. three upstreams reported a failure by returning a value, and two swallowed one. reach() names the upstream and rethrows a typed UpstreamError, and each route entry point catches once and builds the 503 its method takes. x-error names the upstream every time, not only on the site lookup. a 401 or 403 cannot be retried, so it is not a 503. neither is a 404. the preview host and the config store fall back on all three and log the refusal, and only a status that means no answer becomes an UpstreamError. a throw that is not an UpstreamError reaches the worker boundary, which logs it and answers 500. Relates to #258
…repo pins HLX_ADMIN goes out of all three environments: its only reader was the deleted /ping probe. dev points at dev/config-shim.js on 4713, which stands in for config.aem.page so the worker runs locally without the shared secret, and .gitignore gains the glob because npm start runs --env dev and wrangler reads .dev.vars.dev before .dev.vars. the deploy job had no npm ci, so wrangler-action installed its own default, 3.90.0, which has no secrets key and would deploy past a missing HLX_CONFIG_SERVICE_TOKEN. da-admin and da-collab install and run npm run deploy instead of using the action; this matches them. node 24, above the floor wrangler and miniflare declare.
…aration
v3 installs its own wrangler 3.90.0, which has no secrets key in its config
schema, so `secrets = { required = [...] }` is ignored and a deploy without
HLX_CONFIG_SERVICE_TOKEN goes out green. v4 defaults to wrangler 4.
same two lines as #214.
…nd the head red. the head arrives with the existence answer, so one pipeline read replaces the admin scope, and the source-bus flag comes off admin.hlx.page/ping again.
…t exists green. the pipeline scope answers existence and head.html in one read, so the admin scope goes, and with it the CDN token and api key metadata the worker was reading. a write asks /ping only.
red. header-absent-on-5xx read as legacy, which sends a source-bus write to da-admin where nothing serves it back.
the header is read ahead of the status, so the edge dictionary still answers for an origin that is rate limited. a refusal without it now throws.
red. /ping answers 200 with no header for a source-bus site in exactly that window, since helix-admin reads the same config and swallows the failure.
red. it answered with the store-did-not-answer text, and no store was asked.
the store answer comes from the same config, so an outage that hides one hides the other. a wrong store cannot be walked back from, and the 503 now names the destination as undetermined rather than the store as unreachable.
Co-authored-by: Tobias Bocanegra <tripod@bocanegra.ch>
Co-authored-by: Tobias Bocanegra <tripod@bocanegra.ch>
the config service returns the raw code-bus head.html, which UE cannot serve: the CSP meta lands as a header claiming 'nonce-aem' and the injected UE scripts carry no nonce, so the browser refuses them. the preview host runs the pipeline that rewrites those. non-UE hosts render the composed page as-is, so the raw head is fine there.
the config service returns head.html unrewritten, so the CSP meta lands as a header claiming 'nonce-aem' and the injected UE scripts do not match it. the preview host runs the pipeline that rewrites both. non-UE renders the composed page as-is, so #270's config service head still fits there. the fetch runs alongside the source read, so a UE page is still one round-trip. allSettled, not all, so a preview-host failure on a nonexistent site does not overwrite the 404 with a 503.
benpeter
marked this pull request as draft
August 18, 2026 22:59
Contributor
Author
|
tested against stage (in sync with reads
writes
auth
|
benpeter
marked this pull request as ready for review
August 18, 2026 23:22
benpeter
marked this pull request as draft
August 18, 2026 23:25
Contributor
Author
|
testing the UE regression against the worker on stage:
|
the stage experience shell (experience-stage.adobe.com) needs to reach the stage worker so /gimme_cookie mints against a stage IMS identity. without this, the stage UE path is unreachable except by minting the cookie from prod experience.adobe.com with a stage token side-loaded.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
reapplies #270 and fixes the UE regression it introduced.
the config service returns head.html unrewritten, so the 'nonce-aem'
meta lands as a real CSP header and the UE-injected scripts don't
match. the preview host runs the pipeline that rewrites both. non-UE
keeps #270's config-service head.
test plan on stage:
https://experience.adobe.com/#/@{IMS-Org-Slug}/aem/editor/canvas/{ref}--{site}--{org}.stage-ue.da.live/was 503 on #270, must now load the editor.