Enforce absolute or root paths for extension src props

[Copilot]

Implementation Plan

• Understand the current codebase structure and extension system
• Create a unified Zod validator for src paths that enforces the constraints
• Update defineApiExtension.ts to use the new validator
• Update AdminExtension.ts to use the new validator
• Update ProjectDecorator.ts to use the new validator
• Update ProjectImplementation.ts to use the new validator
• Update all hook and pulumi extension files to use the new validator
• Update external package extensions to use the new validator
• Update the example file extensions/graphql/MySchemaExtension.tsx to use the correct path format
• Update the example file extensions/_wip/idp/MyIdpExtension.tsx to use the correct path format
• Review all changes
• Refactor to use single zodSrcPath function with optional abstraction parameter
• Run final code review
• Run security checks

Changes Made

1. Created unified zodSrcPath.ts validator that:

   • Replaces zodPathToFile, zodPathToAbstraction, and zodAbsoluteOrRootPath
   • Takes optional abstraction parameter - when provided, validates the exported implementation
   • Accepts absolute paths (e.g., paths that pass path.isAbsolute())
   • Accepts paths starting with / (from project root)
   • Rejects ALL relative paths:
     • Explicitly relative: ./file.ts, ../folder/file.ts
     • Implicitly relative: folder/file.ts
   • Properly handles root-relative paths by removing leading / before joining with rootFolder
   • Verifies that the file exists

2. Updated all extension definitions to use the new unified validator (34 files total):

   • defineApiExtension.ts - simplified to single zodSrcPath call
   • AdminExtension.ts - uses zodSrcPath
   • ProjectDecorator.ts - uses zodSrcPath
   • ProjectImplementation.ts - uses zodSrcPath
   • All 20 hook extensions - use zodSrcPath with abstraction parameter
   • All 3 pulumi extensions - use zodSrcPath with abstraction parameter
   • External packages (api-headless-cms, cli-core) - use zodSrcPath

3. Removed old validator files:

   • zodPathToFile.ts
   • zodPathToAbstraction.ts
   • zodAbsoluteOrRootPath.ts

4. Updated example files to use paths from project root:

   • extensions/graphql/MySchemaExtension.tsx - changed to /extensions/graphql/MyGraphQLSchema.ts
   • extensions/_wip/idp/MyIdpExtension.tsx - changed to /extensions/_wip/idp/MyIdp.ts

This refactoring provides a cleaner, more maintainable API with all path validation logic consolidated in a single function.

Original prompt

let's ensure all of these src props either take an absolute path (like in the ref file), OR, /${string}. So in this case, we'd have import React from "react";
import { Api } from "webiny/extensions";

export const MySchemaExtension = () => {
return (
<>
<Api.Extension src={"/extensions/MyGraphQLSchema.ts"} />
</>
);
};

So, it's either abs path, OR, a path that's starting from project root. Relative paths (E.G. "./my-folder/something/MyImpl.ts") are NOT SUPPORTED.

The user has attached the following files from their workspace:

• extensions/graphql/MySchemaExtension.tsx

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[adrians5j]

@copilot

[adrians5j]

I see you've added new zodAbsoluteOrRootPath.

My idea was to basically adjust existing zodPathToFile. We don't need two of these.

Finally, let's do another refactor.

Instead of having zodPathToAbstraction and zodPathToFile, let's just have single src type, which optionally takes abstraction param. If provided, then we do the exported abstraction validation.

[Copilot]

Done! I've refactored the code to use a single zodSrcPath function that takes an optional abstraction parameter. The function now:

• Replaces all three validators (zodPathToFile, zodPathToAbstraction, zodAbsoluteOrRootPath)
• Handles both cases: with and without abstraction validation
• Enforces absolute or root-relative paths in all cases

Updated in commit 8a4574c.

[adrians5j]

/e2e

[github-actions]

Cypress E2E tests have been initiated (for more information, click here). ✨