[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ACQPR1WRA751V4DXVC3AHF":3,"skill-same:01M6ACQPR1WRA751V4DXVC3AHF":68},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":21,"frontMatter":22,"refName":23,"commitSha":24,"skillDirectory":25,"forksCount":26,"repositoryHtmlUrl":27,"repositoryHomepageUrl":28,"ownerHtmlUrl":29,"ownerBlogUrl":30,"ownerDescription":6,"updatedAt":31,"install":32,"resources":45},"01M6ACQPR1WRA751V4DXVC3AHF","manage-webapps",null,"apache\u002Fofbiz-plugins","apache","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4","01M6AC83E6K4FDKK7HZ8WNMQKE","The Apache Software Foundation","01M6ACMJJ1Q4WYATY4GXZ2FAVD",178,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fapache\u002Fofbiz-plugins\u002Fblob\u002Ftrunk\u002Fai-agent-skills\u002Fmanage-webapps\u002FSKILL.md",[],[18],"manage webapps","2026-11-10 10:12:30",false,"\u003C!--\nLicensed to the Apache Software Foundation (ASF) under one\nor more contributor license agreements.  See the NOTICE file\ndistributed with this work for additional information\nregarding copyright ownership.  The ASF licenses this file\nto you under the Apache License, Version 2.0 (the\n\"License\"); you may not use this file except in compliance\nwith the License.  You may obtain a copy of the License at\n\nhttp:\u002F\u002Fwww.apache.org\u002Flicenses\u002FLICENSE-2.0\n\nUnless required by applicable law or agreed to in writing,\nsoftware distributed under the License is distributed on an\n\"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\nKIND, either express or implied.  See the License for the\nspecific language governing permissions and limitations\nunder the License.\n-->\n\n---\nname: manage-webapps\ndescription: Configure and manage OFBiz web applications, defining component webapp properties, servlet environments, and request routing through controller.xml.\n---\n\n# Manage Webapps Skill\n\nManage the registration, bootstrapping, and request routing of OFBiz web applications. This skill covers how webapps link to components, how the servlet environment is initialized, and how requests flow through the framework.\n\n## Triggers\n- Creating a new module or UI plugin.\n- Exposing a set of screens or services to the web.\n- Modifying servlet filters, listeners, or security settings.\n- Debugging request routing or dispatcher lookup issues.\n\n## Component Webapp Definition (`ofbiz-component.xml`)\n\nWebapps are registered in the `ofbiz-component.xml` file. A single component can contain multiple web applications (e.g., `ordermgr`, `facility`, `catalog`).\n\n### Key Attributes\n- **name**: Unique identifier for the webapp.\n- **title**: Display name; also used in headers when no UI Label is found.\n- **mount-point**: The context path (e.g., `\u002Fmywebapp`).\n- **app-bar-display**: `true`\u002F`false`. Controls if the app appears in the top navigation bar.\n- **base-permission**: Defines the **minimum security permission(s)** required to access the webapp. The user must have ALL listed permissions to enter.\n- **access-permission**: (Preferred) Modern replacement for `base-permission`. Takes precedence if both are defined.\n- **server**: Usually `default-server`.\n- **location**: Path to the webapp directory relative to the component root.\n- **menu-name**: Determines which application menu it belongs to (e.g., `main`, `secondary`).\n- **client-proxy-server**: Optional proxy server name for the webapp.\n- **description**: Internal documentation of the webapp's purpose.\n- **position**: Order of the app in the application bar or menu.\n- **use-autologin-cookie**: `true`\u002F`false`. Enables the \"remember me\" feature.\n- **session-cookie-max-age**: Duration in seconds for the session cookie.\n\n## The Request Pipeline\n\nUnderstanding the flow is critical for debugging and routing.\n\n### 1. Request Routing vs. Bootstrapping\n- **`web.xml`**: Bootstraps the servlet environment (Filters, Servlets, Listeners).\n- **`controller.xml`**: Handles the actual **Request Routing** logic.\n\n### 2. Standard Flow\n1. **Browser** sends request (e.g., `\u002Fordermgr\u002Fcontrol\u002FviewOrder`).\n2. **ControlServlet** (defined in `web.xml`) processes all controller requests.\n3. **ControlServlet** delegates to **`controller.xml`** by matching the request URI to a `\u003Crequest-map>`.\n4. **`controller.xml` Mapping**:\n    - **Request-Map**: Checks security and invokes events.\n    - **Event**: Logic-level execution (Service, Java, Groovy).\n    - **View-Map**: Determines the response type (view, redirect, request).\n    - **Screen**: If response type is `view`, a screen definition is called (e.g., `widget\u002FOrderScreens.xml`).\n    - **Widget**: The screen renders UI components (Form, Menu, Tree).\n\n## Web Application Configuration (`web.xml`)\n\nLocated in `webapp\u002F\u003Cwebapp-name>\u002FWEB-INF\u002Fweb.xml`.\n\n### The Filter Chain\nOFBiz uses a specific sequence of filters for security and context management. **Order is critical.**\n\n1. **ContextFilter**: Initializes the delegator and local dispatcher.\n2. **ControlFilter**: Handles URL redirections and allowed paths.\n3. **SameSiteFilter**: Manages session cookie flags.\n4. **SecurityFilter**: Handles request-level authentication\u002Fauthorization.\n5. **ResponseFilter**: Manages response headers (caching, security headers).\n\n### Servlet Configuration\n- **servlet-name**: Usually `ControlServlet`.\n- **servlet-class**: `org.apache.ofbiz.webapp.control.ControlServlet`.\n- **servlet-mapping**: Maps a URL pattern (standardly `\u002Fcontrol\u002F*`) to the `ControlServlet`.\n\n### Context Parameters (`context-param`)\n- **delegatorName**: The name of the entity delegator to use (e.g., `default`).\n- **localDispatcherName**: Connects the webapp to a unique service engine instance.\n    - **Guardrail**: It MUST match the webapp name (e.g., `ordermgr`) to ensure reliable service execution and logging.\n- **mainDecoratorLocation**: Path to the main decorator screen used by the webapp (e.g., `component:\u002F\u002Forder\u002Fwidget\u002FCommonScreens.xml`).\n\n## Three-Layer Security Model\n\nAccess control happens at three distinct levels:\n1. **Component Level**: `base-permission` in `ofbiz-component.xml` (The gatekeeper).\n2. **Controller Level**: `\u003Csecurity auth=\"true\"\u002F>` in `request-map` (Path protection).\n3. **Service Level**: `auth=\"true\"` in `services.xml` (Logic protection).\n\n## Static Resource Handling\nStatic assets (images, CSS, JS) reside in `webapp\u002F\u003Capp>\u002F`.\n- **Rule**: These are served directly by the servlet container. **Do not route static assets through the controller** via a request-map.\n\n## Procedure\n1. Define the webapp in `ofbiz-component.xml` with proper permissions and `app-bar-display`.\n2. Create the folder structure: `webapp\u002F\u003Capp>\u002FWEB-INF\u002F` and `webapp\u002F\u003Capp>\u002Fwidget\u002F`.\n3. Configure `web.xml` for bootstrapping (Filters, `ControlServlet`, `localDispatcherName`).\n4. Define routing in `controller.xml` (`request-map`, `view-map`).\n5. Verify global framework settings in `url.properties` (affects all webapps).\n\n## Best Practices\n1. **Unique Mount Points**: Ensure mount points do not overlap across the framework.\n2. **Permission Consistency**: Align `base-permission` in `ofbiz-component.xml` with request-level security checks in `controller.xml`.\n3. **Dispatcher Naming Symmetry**: Always match `localDispatcherName` in `web.xml` to the webapp name defined in `ofbiz-component.xml`.\n4. **Context Path Safety**: Avoid hardcoding context roots (e.g., `\u002Fordermgr`) in URLs; use dynamic path lookups (e.g., `request.getContextPath()`).\n\n## Guardrails\n1. **Filter Order**: Never reorder filters in `web.xml` without deep framework knowledge.\n2. **Dispatcher Symmetry**: Always match `localDispatcherName` to the webapp name.\n3. **Servlet Mappings**: Do not modify `ControlServlet` mappings (`\u002Fcontrol\u002F*`) unless extending the core engine.\n4. **Context Safety**: Never expose sensitive logic or files outside of the `ControlServlet` routing.\n5. **Mount Point Uniqueness**: Ensure mount points do not overlap across the framework.\n\n## Anti-Patterns\n- **❌ Shared Dispatchers**: Multiple apps sharing one dispatcher name, leading to context collisions.\n- **❌ Controller-Routed Assets**: Creating request-maps for simple `.js` or `.css` files.\n- **❌ Hardcoded Context Paths**: Using `\u002Fordermgr` in HTML instead of dynamic context lookup.\n\n## Examples\n\n### 1. Minimal Webapp Setup Structure\n```text\nmy-component\u002F\n    ofbiz-component.xml\n    webapp\u002F\n        example\u002F               \u003C-- Webapp Location\n            images\u002F            \u003C-- Static Assets\n            WEB-INF\u002F\n                web.xml        \u003C-- Bootstrapping\n                controller.xml \u003C-- Request Routing\n            widget\u002F\n                ExampleScreens.xml \u003C-- UI Definitions\n```\n\n### 2. Webapp Registration (`ofbiz-component.xml`)\n```xml\n\u003Cwebapp name=\"example\"\n    title=\"Example App\"\n    server=\"default-server\"\n    location=\"webapp\u002Fexample\"\n    mount-point=\"\u002Fexample\"\n    app-bar-display=\"true\"\n    base-permission=\"OFBTOOLS,EXAMPLE_VIEW\"\u002F>\n```\n\n### 3. Request Routing (`controller.xml`)\n```xml\n\u003Crequest-map uri=\"viewOrder\">\n    \u003Csecurity auth=\"true\" https=\"true\"\u002F>\n    \u003Cevent type=\"service\" invoke=\"getOrderDetails\"\u002F>\n    \u003Cresponse name=\"success\" type=\"view\" value=\"OrderView\"\u002F>\n\u003C\u002Frequest-map>\n\n\u003Cview-map name=\"OrderView\" type=\"screen\" page=\"component:\u002F\u002Forder\u002Fwidget\u002FOrderScreens.xml#OrderView\"\u002F>\n```\n\n### 4. Global URL Settings (`url.properties`)\n> [!IMPORTANT]\n> Settings in `framework\u002Fwebapp\u002Fconfig\u002Furl.properties` apply **globally** to all webapps in the instance.\n- `no.http=Y`: Force HTTPS instance-wide.\n- `port.https=8443`: Global secure port.\n- **`content.url.prefix`**: Global prefix for media\u002Fcontent like images, JS, CSS, and URL (e.g., CDN or static server).\n\n",{},"trunk","6c6c27710443de03e9247605d33a2e2f5bc3d1e2","ai-agent-skills\u002Fmanage-webapps",222,"https:\u002F\u002Fgithub.com\u002Fapache\u002Fofbiz-plugins","https:\u002F\u002Fofbiz.apache.org\u002F","https:\u002F\u002Fgithub.com\u002Fapache","https:\u002F\u002Fwww.apache.org\u002F","2026-11-10 15:50:39",{"source":7,"skillName":5,"commands":33,"prompt":43,"zipAvailable":44},[34,37,40],{"tool":35,"command":36},"npx","npx skills add apache\u002Fofbiz-plugins --skill manage-webapps",{"tool":38,"command":39},"bunx","bunx skills add apache\u002Fofbiz-plugins --skill manage-webapps",{"tool":41,"command":42},"pnpm","pnpm dlx skills add apache\u002Fofbiz-plugins --skill manage-webapps","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fapache\u002Fofbiz-plugins\u002Fblob\u002Ftrunk\u002Fai-agent-skills\u002Fmanage-webapps\u002FSKILL.md",true,[46,52,56,60,64],{"path":47,"resourceType":48,"resourceTypeDesc":49,"sizeBytes":50,"sourceHtmlUrl":51},"references\u002Flanguage-patterns.md","REFERENCE","参考文档",5341,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-review\u002Freferences\u002Flanguage-patterns.md",{"path":53,"resourceType":48,"resourceTypeDesc":49,"sizeBytes":54,"sourceHtmlUrl":55},"references\u002Freport-format.md",6780,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-review\u002Freferences\u002Freport-format.md",{"path":57,"resourceType":48,"resourceTypeDesc":49,"sizeBytes":58,"sourceHtmlUrl":59},"references\u002Fsecret-patterns.md",3524,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-review\u002Freferences\u002Fsecret-patterns.md",{"path":61,"resourceType":48,"resourceTypeDesc":49,"sizeBytes":62,"sourceHtmlUrl":63},"references\u002Fvuln-categories.md",7913,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-review\u002Freferences\u002Fvuln-categories.md",{"path":65,"resourceType":48,"resourceTypeDesc":49,"sizeBytes":66,"sourceHtmlUrl":67},"references\u002Fvulnerable-packages.md",3979,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Fblob\u002Fmain\u002Fskills\u002Fsecurity-review\u002Freferences\u002Fvulnerable-packages.md",[69,76,83,90,97,104],{"skillNo":70,"name":71,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":19},"01M6ACQSN90YKJZ92MQ52D9R8H","prepush-readiness","https:\u002F\u002Fgithub.com\u002Fapache\u002Fofbiz-plugins\u002Fblob\u002Ftrunk\u002Fai-agent-skills\u002Fprepush-readiness\u002FSKILL.md",[],[75],"prepush readiness",{"skillNo":77,"name":78,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":19},"01M6ACQMCX8Z7NY2CE08NCV6ND","manage-themes","https:\u002F\u002Fgithub.com\u002Fapache\u002Fofbiz-plugins\u002Fblob\u002Ftrunk\u002Fai-agent-skills\u002Fmanage-themes\u002FSKILL.md",[],[82],"manage themes",{"skillNo":84,"name":85,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M6ACQHYN20AFWF6TKK4RGQ8A","manage-tests","https:\u002F\u002Fgithub.com\u002Fapache\u002Fofbiz-plugins\u002Fblob\u002Ftrunk\u002Fai-agent-skills\u002Fmanage-tests\u002FSKILL.md",[],[89],"manage tests",{"skillNo":91,"name":92,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":19},"01M6ACQFRMW7R45YD3HRAXPGWF","manage-templates","https:\u002F\u002Fgithub.com\u002Fapache\u002Fofbiz-plugins\u002Fblob\u002Ftrunk\u002Fai-agent-skills\u002Fmanage-templates\u002FSKILL.md",[],[96],"manage templates",{"skillNo":98,"name":99,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":19},"01M6ACQCSSDZQMD8VX2K3WRR93","manage-strategies","https:\u002F\u002Fgithub.com\u002Fapache\u002Fofbiz-plugins\u002Fblob\u002Ftrunk\u002Fai-agent-skills\u002Fmanage-strategies\u002FSKILL.md",[],[103],"manage strategies",{"skillNo":105,"name":106,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":19},"01M6ACQA1CZ2QW6GAM6HPFR21V","manage-services","https:\u002F\u002Fgithub.com\u002Fapache\u002Fofbiz-plugins\u002Fblob\u002Ftrunk\u002Fai-agent-skills\u002Fmanage-services\u002FSKILL.md",[],[110],"manage services"]