`JavaScriptComponent` config entities must support default images: `File` content entity dependency, base64-encoded upon export

I wrote this issue summary together with @f.mazeikis 🤓

.

larowlan → credited mstrelan → .

@mstrelan pointed out we have the 8.4 polyfill in 11.2 but not in 11.1

Pushed all the work so far, including working tests. @larowlan had some feedback, I think I've addressed most of it, but happy to get back to it if there's more.

Moving into ready for review.

#6: That should be fine, because XB bumped its requirement to 11.2 in 🐛 PHPUnit Next Major tests failing Active ? That's what's in 0.5.0-alpha1 → , so <0.5 is for Drupal <11.2, >=0.5 is for Drupal >=11.2

That was pretty fast! Reviewing… 🤓

We can work around this in beta by uploading images to media library and manually referencing them in component code. This is obviously not great and doesn't allow components to be moved from environment to another so we definitely still need this. Just trying to avoid rushing this before the beta.

Re polyfill:
Regardless of core version no reason XB couldn't add it as a dep, just give it a loose constraint so it doesn't conflict with core.

Looking promising!

1. This needs to have preliminary internal HTTP API support. "preliminary", because it might be imperfect, and that's fine. But we need to have the FE folks unblocked to build the entire feature; we can then still refine it later 👍
2. That MUST come with updated test coverage in \Drupal\Tests\experience_builder\Functional\XbConfigEntityHttpApiTest::testJavaScriptComponent()
3. Some missing test coverage to ensure that saved config entities in config entity storage do not actually contain these base64 blobs

Addressed everything on MR and in #11.

Great work @f.mazeikis - did another review and added some comments/observations

🏓 Responded to @f.mazeikis' most pressing question; didn't do a full review, but … the scope here is now no longer so narrow, but generic, thanks to ✨ Define JSON Schema $refs for linking/embedding videos and linking documents Active + ✨ Add a Video prop type to the Code Component editor Active .

I've addressed most of the feedback, replied with reasoning for the rest. This might not be complete, but a second pass review and further feedback on Comment on lines +802 to +804 would be beneficial.

I'll review tomorrow — it's possible @larowlan will beat me to it, so not yet self-assigning.

Thanks for the excellent docs addition, that made it 10x easier to review this! Still in the process of doing so.

Created ✨ [PP-1] Add support for example images for Code Components' image props Postponed for the actual feature that this is intended to unblock.

Finished reviewing the MR. Epic work! 🤩 Confirmed that it meets all 5 goals outlined in the issue summary! 👍

My commits/self-addressed:

• Comment nits.
• A fix for using root-relative URLs for the example images rather than absolute ones

Remaining feedback:

• Spotted a few bits of missing test coverage.
• Everywhere this MR uses "default", it should use "example", because of 🐛 DX & authoring experience: for SDC+code components, the example is treated as the default, may not be desirable Active . (Yes, I know this is how we've been talking about it for a while, but that doesn't mean we shouldn't realize our mistake and get better. Not your fault, but this MR understandably introduces a lot more uses of this terminology! So: time to rectify it now.)
• Concern: manually creating a File entity in a test — what am I missing?
• Major concern: the way this paves the path for ✨ [PP-1] Add support for example images for Code Components' image props Postponed is nice but AFAICT insecure 😅 — I think it actually might be better to REMOVE this bit from the MR, because of the security aspects, but also because it's not in scope for this issue (for that very reason).
• In fact, a similar concern exists when just using encoded_files itself; a config export+import could become an attack vector. See https://git.drupalcode.org/project/experience_builder/-/merge_requests/1... + https://git.drupalcode.org/project/experience_builder/-/merge_requests/1... + https://git.drupalcode.org/project/experience_builder/-/merge_requests/1...

Thanks, @larowlan for creating 📌 [PP-1] Consider adding ramsey/uuid for hash-based UUID (v5) generation for default files Postponed: needs info — linked to it 👍

Asked @larowlan to double-check my security concerns, and per https://git.drupalcode.org/project/experience_builder/-/merge_requests/1... seems like he's +1 😅