Skip to content

Bump pan-domain-node to v1.2.0#23

Merged
LAKSHMIRPILLAI merged 1 commit intomainfrom
lp-update-pan-domain-node-1.2
Aug 1, 2025
Merged

Bump pan-domain-node to v1.2.0#23
LAKSHMIRPILLAI merged 1 commit intomainfrom
lp-update-pan-domain-node-1.2

Conversation

@LAKSHMIRPILLAI
Copy link
Contributor

@LAKSHMIRPILLAI LAKSHMIRPILLAI commented Jul 30, 2025

What does this change?

This PR is to bump pan-domain-node to v1.2
This is done to address the high severity vulnerability reported as FSBP S3.8 the bucket pan-domain-auth-settings should block public access here

This pull request bumps the pan-domain-node dependency to version 1.2.0 so that it reads the public key files by AWS SDK rather than unauthenticated direct HTTP request.

Changes are done in pan-domain-node library (guardian/pan-domain-node#47) to get the public key files with AWS SDK that requires AWS credentials in the execution environment.

How to test

Test in CODE (IN PROGRESS)

Steps

  1. Deploy the branch to Editorial Tools::Editorial Collaboration

  2. Open Composer CODE and load the page.

  3. Enable Enable collaborative editing: this currently logs steps out to the console feature switch and reload the page

  4. Check the Network tab to look for the POST requests to https://editorial-collaboration.code.dev-gutools.co.uk .We need to edit the body in order to trigger this

  5. If it returns 200/201 or ok , it seems the changes are working

  6. Also look for any error messages in the logs

@LAKSHMIRPILLAI LAKSHMIRPILLAI force-pushed the lp-update-pan-domain-node-1.2 branch from e0e4fdf to d3148c4 Compare July 31, 2025 12:15
@LAKSHMIRPILLAI LAKSHMIRPILLAI marked this pull request as ready for review July 31, 2025 16:34
Copy link
Contributor

@waisingyiu waisingyiu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks great, thank you @LAKSHMIRPILLAI .

Currently the CD has not been set up for PROD, but there is a PROD stack, presumably from one of the past commits of the main branch. So this PR will not be deployed to the PROD even after being merged. After we enable "block all public access" option in the panda S3 bucket, the PROD stack will probably stop working.

Having discussed with the team, we didn't think it was much of a concern because the editorial collaboration was not in production use at all.

@LAKSHMIRPILLAI LAKSHMIRPILLAI merged commit 080612a into main Aug 1, 2025
4 checks passed
@LAKSHMIRPILLAI LAKSHMIRPILLAI deleted the lp-update-pan-domain-node-1.2 branch August 1, 2025 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bump pan-domain-node in editorial collaboration to load public settings using AWS SDK

2 participants