theia-ide/extension-registry

An open-source registry for VS Code extensions

extension-registry's Issues

[webui] Don't include credentials when fetching resources unless necessary

When the server has an upstream registry configured, the resources may be fetched directly from the upstream instance. In that case I get

Access to fetch at 'https://…/api/DotJoshJohnson/xml/file/README.md' from origin '…' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

This should be avoided by not including credentials except where necessary.

Improve search

The search feature should be fine-tuned. Currently the order of results is not optimal: e.g. using the provided test extensions, searching for "powershell" lists the powershell extension at the third position, after php-intellisense and code-runner. Probably it has to do with the configuration of the ngram token filter.

[webui] Display API errors

Errors that occur when requesting stuff from the API are currently only visible in the console. They should be shown to the user somehow.

Further details to be shown on the extension detail page

See the VS Code Extension Manifest format.

• preview: whether the last published version is a preview
• markdown: control the Markdown rendering engine
• galleryColor, galleryTheme: control the gallery banner style
• qna: handle special values false and marketplace
• badges: render a list of badges
• dependencies, bundledExtensions: show links to extensions listed as dependencies

Migrate to Spring

I started migrating the server application to Spring on the spring branch. I marked commented-out code with //XXX so it's easier to find. What is left to do:

• Reimplement client routes
  • Configure view controllers in RouteConfig
  • Previous approach:
    • reroute paths like /foo/bar to /
    • reroute paths like /foo/bar/bundle.js to /bundle.js (detected when there is a . character in the last path segment)
    • don't touch paths with prefix /api
• Reimplement the Elasticsearch integration
  • Write search query in LocalRegistryService
  • Adapt search-related annotations in entities Extension, ExtensionVersion and Publisher
  • Previous analysis config is in AnalysisConfig (may be done differently)
  • Additional dependencies in build.gradle (not sure whether we'll need that)
  • Maybe fix #3 on the way
• Implement the upstream registry mode (#2)
  • An upstream registry instance should be configurable via environment variable (e.g. REGISTRY_UPSTREAM_URL)
  • Implement the IUpstreamRegistry interface by sending requests to the configured registry
  • Include that implementation in the getRegistries() method of RegistryAPI.
• Implement authentication (#1)
  • I commented out the previous basic login in UserAPI
  • Probably we can remove UserSessionReaper

[webui] Debounce search input

When typing into the search input field, a lot of requests are sent even when typing quickly. The user input should be debounced.

Implement "proxy mode" with an upstream registry instance

It should be possible to configure an upstream registry URL that is queried when the local database does not find any result. E.g. for the endpoint api/{publisher}/{extension}, first the database shall be queried, and if that fails the server shall send a request to {upstreamUrl}/api/{publisher}/{extension}.

[security] Block SVG images

See https://code.visualstudio.com/api/working-with-extensions/publishing-extension#publishing-extensions

Search view is not always filtered when coming from a detail page

When a user clicks on a category or tag on the detail page of an extension, she is routed back to the search page with the corresponding filter set up. But sometimes, the search page shows all extensions and not just the filtered list.

Show 404 pages in web UI

Two scenarios where a 404 page should be shown:

• The route does not exist.
• The extension or other resource does not exist (the server API returned 404).

Auth with GitHub

The registry currently features basic login functionality with a hard-coded dummy user. We should use an OAuth service. It would be great to set up a dummy OAuth implementation in Gitpod so we can test the login.