Skip to content

fix: give a path-prefixed domain its own UCP settings and no profile - #306

Merged
Dominik Grothaus (dgrothaus-sw) merged 3 commits into
mainfrom
fix-path-prefixed-domain-profile
Oct 21, 2026
Merged

fix: give a path-prefixed domain its own UCP settings and no profile#306
Dominik Grothaus (dgrothaus-sw) merged 3 commits into
mainfrom
fix-path-prefixed-domain-profile

Conversation

@dgrothaus-sw

@dgrothaus-sw Dominik Grothaus (dgrothaus-sw) commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Requests under a sales channel domain with a path, such as https://shop.example/de, now use that sales channel's own UCP settings. Until now they used the settings of the host's root domain. Under the strict signature policy, correctly signed requests to such a domain are no longer refused.

A domain with a path no longer serves a UCP profile. Agents look for a business profile only at /.well-known/ucp on the root of a domain, because well-known URIs exist only there (RFC 8615, section 3). The UCP specification also requires that URL for the profile a business names in its signed webhooks (signatures.md), so conformant platforms reject the webhooks of such a sales channel. Until now /de/.well-known/ucp served the profile of the host's root domain. It now answers 404. Storefront pages, llms.txt, agents.md, ai-catalog.json and api-catalog of such a domain no longer link a profile. ucp:config:validate now warns about a UCP sales channel whose domains all have a path. A standard way to publish profiles for path-based storefronts is proposed in UCP #937.

Merchants who separate languages or markets by path on one host now get each sales channel's own UCP settings. For agents to find a sales channel, it needs a domain without a path, such as https://de.shop.example.

QA can check this with two storefront sales channels on one host, one on / and one on /de, both with UCP activated. /.well-known/ucp serves the profile of the / sales channel. /de/.well-known/ucp answers 404. Storefront pages under /de/ carry no service-meta link. /de/llms.txt has no UCP section. With the signature policy strict on /de, a correctly signed request from an agent to /de/ucp/v1/… is accepted. Under the same policy, a request with a tampered signature is refused. bin/console ucp:config:validate reports the warning path_prefixed_domain for the /de sales channel.

Closes #264

  • Tests cover the change, or it needs none, such as documentation or CI configuration.
  • A change merchants notice has an entry under # next version in both changelogs.
  • The change works on Shopware 6.5, 6.6 and 6.7 from one codebase.

@dgrothaus-sw
fix: resolve a path-prefixed domain to its own sales channel
7fbe046 
The UCP profile, the UCP routes, the MCP proxy, the embedded pages and
the storefront `service-meta` link looked up the sales channel from the
request URI after core's `RequestTransformer` had removed the domain's
path prefix. A domain such as `https://shop.example/de` therefore
resolved to the host's root domain. They now resolve the sales channel
from core's original request URI (`sw-original-request-uri`). The
`service-meta` link now carries the domain's path.

Request signatures are now verified against that original URI as well.
The agent signs the path with the prefix, so under the `strict`
signature policy every correctly signed request to such a domain was
refused with `signature_invalid`. Added a decorator of the SDK's
`HttpRequestContextFactoryInterface`, so the SDK receives the original
URI.

The acceptance spec for path-prefixed domains moved from
`UcpKnownBlocked` to `UcpProtocol`. It covers the signature policy.
Known blocker D8 was removed.
Open
@dgrothaus-sw
feat: warn about a UCP sales channel that only has path-prefixed domains
304d240 
`ucp:config:validate` now reports the warning `path_prefixed_domain`
when every storefront domain of a UCP sales channel has a path. Agents
only discover a business profile at `/.well-known/ucp` on the root of an
origin (RFC 8615, section 3). The UCP specification requires that URL
for the profile a business names in its signed webhooks. The warning
links RFC 8615. It asks for a domain without a path.

The changelog entries for path-prefixed domains now say that such a
sales channel gets its own UCP settings. They also say that agents only
find such a sales channel on a domain without a path.
@dgrothaus-sw
fix: serve no UCP profile below a domain's path prefix
e398a2a 
A domain with a path, such as `https://shop.example/de`, no longer
serves a UCP profile. `/de/.well-known/ucp` now answers `404`.
Well-known URIs exist only at the root of an origin (RFC 8615, section
3). UCP requires a business profile URL to point to `/.well-known/ucp`.

The new `UcpProfileLocator` decides where a domain's profile lives. The
`service-meta` link, `api-catalog`, `ai-catalog.json`, `llms.txt`,
`agents.md` and the summary of `ucp:setup` ask it. They leave the
profile out for a domain with a path. Core passes a base URL only to
`ai-catalog.json`, so the new Twig function
`swag_agentic_commerce_ucp_profile_url` falls back to the requested
domain for the other files.

The acceptance specs for path-prefixed domains now expect no profile and
no profile links.
@dgrothaus-sw Dominik Grothaus (dgrothaus-sw) changed the title fix: resolve a path-prefixed domain to its own sales channel fix: give a path-prefixed domain its own UCP settings and no profile Oct 21, 2026
@BrocksiNet

Björn Meyer (BrocksiNet) commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

LGTM 🎉

@dgrothaus-sw
Dominik Grothaus (dgrothaus-sw) deleted the fix-path-prefixed-domain-profile branch October 21, 2026 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BrocksiNet Björn Meyer (BrocksiNet) BrocksiNet approved these changes
@joberthel Johannes Berthel (joberthel) joberthel approved these changes

Assignees

@dgrothaus-sw Dominik Grothaus (dgrothaus-sw)

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

A domain with a path serves the UCP profile of the host's root domain

3 participants

@dgrothaus-sw @BrocksiNet @joberthel