FiB3 / ssjs-vsc

VSCode extension to streamline Server Side JS development for SalesForce Marketing Cloud.
https://fib3.vercel.app/ssjs-vsc
BSD 4-Clause "Original" or "Old" License
7 stars 0 forks source link

docs: how to get the cloudpage URL for testing? #5

Closed JoernBerkefeld closed 7 months ago

JoernBerkefeld commented 11 months ago

on https://fib3.github.io/ssjs-vsc/use/ you say that the command SSJS: Deploy Dev Page "generates" the cloudpage. I have personally not been able to create a cloudpage via API so if you found a ways i'd be thrilled.

anyhow, assuming your solution somehow does this, where do I get the URL from? find it in the SFMC GUI?

FiB3 commented 11 months ago

Yes, when naming the command, I thought it's going to be possible to create it programatically. Does not seem to be the case yet. :( You still need to create the Cloud Page (or Text Resource) manually, copy the provided code in there & publish.

I will try to update the docs a bit to properly reflect that, maybe renaming the command to something a bit more descriptive. Like SSJS: Generate Dev Page Code.

JoernBerkefeld commented 11 months ago

what we tend to do is create a cloud page, then put code in there to load a CONTENT BLOCK that we want to debug, then publish the cloudpage. onload of the page, it will parse the CURRENT version of the content block. now, for THIS extension you could advise people to create 1 content block + 1 cloudpage at first. the cloudpage loads the contentblock. the content block then is a placeholder itself, given that it can be updated via content builder API, to load whatever code snippet that you ACTUALLY want to test.

that way, the user can have x amounts of actual code-content blocks, 1 placeholder content block and 1 placeholder cloudpage. each time the user uploads a script your extension could then update that placeholder content block to load this new snippet.

the user would always have the same URL for testing

my 2 cents ;-)

didn't make sense in the context of mcdev but here that could be fun

FiB3 commented 11 months ago

That's actually pretty much, how the "Asset Provider" handles the development already. 1) On setup: you (manually) create one universal Dev Cloud Page (of Dev Text Resource) which will run your code. 2) On the development, you only develop your scripts, and they get automatically deployed as content blocks. (well, on the first go, you need to deploy using SSJS: Upload Script, which is done so you don't deploy scripts you want to keep to yourself). 3) The Command Get Dev Path is giving you the "secured" path to your resource. Like: ?token=?token=<GUID>&asset-id=<id-of-asset>

I guess, I really need to make a video showcasing the whole extension.

JoernBerkefeld commented 11 months ago

^^ ok, now i get it though. that's a really cool idea but it might lead to a security issue: if I can just use any id here, I can potentially load secret information. those id's are numeric which means if I know the URL to your testpage it's just a matter of time until I loaded all available content blocks.

lots of if's in the above statement but that would be a deal breaker from an enterprise perspective. I couldn't get approval from at least a good portion of my clients to use it like that given the said security implications

FiB3 commented 11 months ago

yes, I know. That's why I little bit prefer Server Provider, which loads the scripts from your laptop (the problem is however the fact, that you need to expose your computer via NGROK etc.).

But the initial security measure is the "token" in the path of the page. It's not the best way, but as I said, it's initial. I am thinking about making other options, but I need to take into consideration, that during the development, you need to pass those "credentials" along to other resources you are working on (e.g.: typical forms that post to another Cloud Page to process). Also, that this needs to be something, that you can use rather easily in the browser.

I am also thinking about options, how to rotate this token automatically, so it's valid for limited time only.

FiB3 commented 7 months ago

There are several feeatures now (or in the 0.4.4 I am about to release) that help with this. There's is an "Update Dev Page" command, button to more easily open the URL, and more documentation. Also, there's the option to use a HTML login instead of the token (basically Basic Auth).