feat(orchestrator): expose RJSF widget config to templates

workspaces/orchestrator/.changeset/public-rjsf-widget-config.md

@@ -0,0 +1,5 @@
+---
+'@red-hat-developer-hub/backstage-plugin-orchestrator-common': patch
+---
+
+Expose the dedicated `orchestrator.rjsf-widgets` configuration namespace to form widget templates. Values in this namespace are public to the frontend and must not contain secrets.

workspaces/orchestrator/docs/orchestratorFormWidgets.md

@@ -728,6 +728,16 @@ The widgets manage waiting for asynchronous promises and chains of functions to
 When exposing additional keys in the future, we will consider not only the [frontend-visibility](https://backstage.io/docs/conf/defining/#visibility) but security as well, since a malicious workflow can retrieve configuration of plugins or Backstage, eventually with their secrets.
 That’s the reason for listing the exposed keys explicitly.
 
+Values referenced through `rjsfConfig` are configured under `orchestrator.rjsf-widgets`:
+
+```yaml
+orchestrator:
+  rjsf-widgets:
+    defaultEnvironment: production
+```
+
+All values in this namespace are exposed to the frontend and must not contain secrets.
+
 |                                 Key Family                                  |                                                      Key                                                       |                                                                                                                                                                                                                                     Value of at runtime\<br\>(skipping promises for simplicity)                                                                                                                                                                                                                                     |
 | :-------------------------------------------------------------------------: | :------------------------------------------------------------------------------------------------------------: | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: |
 |                                   current                                   |                                           \[whatever property name\]                                           |                                                                                                                    Value of other field/property of the form. The properties build hierarchy separated by `.` (dots) matching the structure of fields/objects defined by the data input schema. Arrays or branches of a complex object structure can be passed as well, data are encoded into JSON in that case.                                                                                                                    |

workspaces/orchestrator/plugins/orchestrator-common/config.d.ts

@@ -83,6 +83,14 @@ export interface Config {
        */
       url: string;
     };
+    /**
+     * Public string values available to form widget templates through `rjsfConfig.<key>`.
+     * Do not store secrets in this configuration because workflow authors can access every value.
+     * @deepVisibility frontend
+     */
+    'rjsf-widgets'?: {
+      [key: string]: string;
+    };
     /**
      * Kafka configuration for event-triggered workflows (KafkaJS-style).
      * When present, the UI can show actions such as "Run as Event".

workspaces/orchestrator/plugins/orchestrator-form-widgets/src/utils/useTemplateUnitEvaluator.test.tsx

@@ -121,6 +121,17 @@ describe('useTemplateUnitEvaluator', () => {
     );
   });
 
+  it('evaluates rjsfConfig.* units from public widget configuration', async () => {
+    const { result } = renderHook(() => useTemplateUnitEvaluator());
+
+    await expect(
+      result.current('rjsfConfig.defaultEnvironment', {} as any),
+    ).resolves.toBe('from-config');
+    expect(configApi.getOptionalString).toHaveBeenCalledWith(
+      'orchestrator.rjsf-widgets.defaultEnvironment',
+    );
+  });
+
   it('evaluates fetch response selector units', async () => {
     mockedApplySelectorString.mockResolvedValue('resolved-value');
     const { result } = renderHook(() => useTemplateUnitEvaluator());