@adobe/spacecat-shared-data-access 4.15.1 → 4.15.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [@adobe/spacecat-shared-data-access-v4.15.2](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.15.1...@adobe/spacecat-shared-data-access-v4.15.2) (2026-07-29)
+
+### Bug Fixes
+
+* **site:** guard config writes against the config schema ([#1852](https://github.com/adobe/spacecat-shared/issues/1852)) ([dafbea2](https://github.com/adobe/spacecat-shared/commit/dafbea2619d1ff65f27b0fe5ca47734b2622619d)), closes [#1850](https://github.com/adobe/spacecat-shared/issues/1850)
+
 ## [@adobe/spacecat-shared-data-access-v4.15.1](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-data-access-v4.15.0...@adobe/spacecat-shared-data-access-v4.15.1) (2026-07-29)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/spacecat-shared-data-access",
-  "version": "4.15.1",
+  "version": "4.15.2",
   "description": "Shared modules of the Spacecat Services - Data Access",
   "type": "module",
   "engines": {

package/src/models/site/site.model.js

@@ -18,6 +18,8 @@ import {
   AUTHORING_TYPES,
 } from '@adobe/spacecat-shared-utils';
 import BaseModel from '../base/base.model.js';
+import { validateConfiguration } from './config.js';
+import { guardConfigValidation } from '../../util/config-validation-guard.js';
 
 const HLX_HOST = /\.(?:aem|hlx)\.(?:page|live)$/i;
 export const AEM_CS_HOST = /^author-p(\d+)-e(\d+)/i;
@@ -84,6 +86,34 @@ class Site extends BaseModel {
     return this;
   }
 
+  /**
+   * Sets the site config, guarding it against the config schema
+   * (`validateConfiguration`). Overrides the auto-generated setter so every
+   * writer (e.g. the `PATCH /sites/{id}` config merge) is checked at one
+   * chokepoint. Behavior is governed by `CONFIG_VALIDATION_ENFORCEMENT`
+   * (default `warn`; `enforce` throws; `off` skips) — see
+   * config-validation-guard.js for the rollout rationale.
+   *
+   * Note: this only guards writes. Reads still go through the lenient
+   * `Config()` getter (attribute `get:` transform), which intentionally
+   * tolerates legacy invalid config already stored on existing sites so a
+   * bad historical record doesn't break every read of that site.
+   *
+   * @param {object} value - candidate config object
+   * @returns {this}
+   */
+  setConfig(value) {
+    guardConfigValidation({
+      entityName: Site.ENTITY_NAME,
+      entityId: this.getId(),
+      value,
+      validate: validateConfiguration,
+      log: this.log,
+    });
+    this.patcher.patchValue('config', value, false);
+    return this;
+  }
+
   /**
    * Resolves the site's base URL to a final URL by fetching the URL,
    * following the redirects and returning the final URL.

package/src/util/config-validation-guard.js

@@ -0,0 +1,76 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { ValidationError } from '../errors/index.js';
+
+export const ENFORCEMENT_MODES = {
+  OFF: 'off',
+  WARN: 'warn',
+  ENFORCE: 'enforce',
+};
+
+/**
+ * Resolves the config-validation enforcement mode from the environment.
+ *
+ * `CONFIG_VALIDATION_ENFORCEMENT` ∈ { off, warn, enforce }; defaults to `warn`.
+ * Read at call time so deployments (and tests) can flip it without a re-import.
+ *
+ * Rollout rationale: `Site.setConfig()` previously accepted any value with no
+ * schema validation at all on the update path (only entity `create()` runs
+ * attribute validation — see base.collection.js `#validateItem`/`#prepareItem`).
+ * Some existing sites carry legacy config that already fails today's Joi
+ * schema (e.g. an `imports` entry that predates a stricter schema addition).
+ * Flipping straight to `enforce` would reject unrelated PATCH requests on
+ * those sites. Ship `warn` first to surface violations in logs, then flip to
+ * `enforce` once legacy data is cleaned up or confirmed rare.
+ *
+ * @returns {string} one of ENFORCEMENT_MODES
+ */
+export const getConfigEnforcementMode = () => {
+  const raw = (process.env.CONFIG_VALIDATION_ENFORCEMENT || '').trim().toLowerCase();
+  return Object.values(ENFORCEMENT_MODES).includes(raw) ? raw : ENFORCEMENT_MODES.WARN;
+};
+
+/**
+ * Guards a config write. Validates `value` against the config schema via
+ * `validateConfiguration`. A valid config passes silently. An invalid config
+ * is, depending on the enforcement mode, ignored (`off`), logged without
+ * blocking (`warn`), or rejected (`enforce`).
+ *
+ * @param {object} params
+ * @param {string} params.entityName - e.g. 'Site' (for the log message)
+ * @param {string} [params.entityId] - entity id (for the log message)
+ * @param {object} params.value - the candidate config object
+ * @param {(value: object) => object} params.validate - validateConfiguration
+ * @param {object} [params.log] - logger with a `warn` method
+ * @throws {ValidationError} in `enforce` mode when validation fails
+ */
+export const guardConfigValidation = ({
+  entityName, entityId, value, validate, log,
+}) => {
+  const mode = getConfigEnforcementMode();
+  if (mode === ENFORCEMENT_MODES.OFF) {
+    return;
+  }
+
+  try {
+    validate(value);
+  } catch (error) {
+    const message = `config validation violation: ${entityName} ${entityId ?? '<unknown>'}: ${error.message}`;
+    if (log) {
+      log.warn(message);
+    }
+
+    if (mode === ENFORCEMENT_MODES.ENFORCE) {
+      throw new ValidationError(`Invalid config for ${entityName}: ${error.message}`);
+    }
+  }
+};