Repository navigation
#1128 - Read FORCE_CONFIG_PATH at runtime in production builds - #1161
EmbryoSpace wants to merge 1 commit into
Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| mmgisglobal.groups = "#{groups}"; | ||
| mmgisglobal.NODE_ENV = "#{NODE_ENV}"; | ||
| mmgisglobal.FORCE_CONFIG_PATH = "%FORCE_CONFIG_PATH%"; | ||
| mmgisglobal.FORCE_CONFIG_PATH = "#{FORCE_CONFIG_PATH}"; |
There was a problem hiding this comment.
🟡 Forced configuration paths with ampersands fail
When FORCE_CONFIG_PATH contains &, Pug inserts & into the JavaScript string. loadConfigJson fetches the altered path, so the configured mission fails to load.
Learn more
Production builds convert this HTML into a Pug template, which escapes interpolated values as HTML. Script elements do not decode HTML entities, so an escaped character becomes part of the URL passed to loadConfigJson. This affects ampersands, apostrophes, and other escaped characters in an otherwise valid forced configuration path.
Example: With FORCE_CONFIG_PATH=public/R&D/config.json, the page sets the path to public/R&D/config.json. The browser requests that encoded path rather than public/R&D/config.json, and the mission fails to load.
Recommended fix: Serialize the runtime value as a JavaScript string for the script context rather than HTML-escaping it. Account for the HTML script closing sequence when generating the string, and test paths containing & and apostrophes in a rendered production page.
Was this helpful? React with 👍 or 👎 to provide feedback.
Purpose
FORCE_CONFIG_PATHis ignored in production builds. The production branch ofpublic/index.htmluses the build-time%FORCE_CONFIG_PATH%placeholder, so the value is fixed to whatever was set when the client was built (empty in the published images). This restores the runtime value thatscripts/server.jsalready passes tobuild/index.pug.Proposed Changes
#{FORCE_CONFIG_PATH}in the production branch ofpublic/index.html, matching the other values in that branch. The non-production branch is unchanged.Issues
Testing
Built the client twice with
npm run buildfromdevelopmentat 63003cd, with and without this change, then ranscripts/server.jswithNODE_ENV=productionagainst PostGIS 16 (node:22-bookworm in Docker) and opened the page in a browser. The forced config was a copy of a Reference Mission blueprint served frompublic/.FORCE_CONFIG_PATHmmgisglobal.FORCE_CONFIG_PATH""missionsand shows the mission list""missionsand shows the mission list, as beforeAn unset variable also renders as an empty string in the template.
I also reproduced the issue's scenario on the published
ghcr.io/nasa-ammos/mmgis:developmentimage (5.5.1-20261105), withNODE_ENV=production,HIDE_CONFIG=true, and a mission holding one config in the database and a different one in the forced file. The patched run bind-mounts abuild/index.pugwith this one line changed./?mission=<name>/api/configure/get; forced file never requested/api/configure/getnot calledPlaywright with this change, using the
.envfromplaywright-tests.ymland a production client build:tests/e2e/startup,tests/e2e/smoke.spec.jsandtests/e2e/reference-mission.spec.json chromium, 16 passed. The adjacent servers were not running. I did not run the rest of the suite.