Add HTTP API endpoint for canvasData.v0 to support useSiteData() in Workbench

Overview

getSiteData() and getPageData() in the drupal-canvas package read synchronously from window.drupalSettings?.canvasData?.v0 — data that Drupal injects only when rendering a full page with the relevant canvas/canvasData.v0.* asset libraries attached. No HTTP endpoint exposes this data. Workbench runs as a local Vite dev server with no Drupal page render, so it cannot call these functions to get live site or page data.

Proposed resolution

PHP: new API route and controller

Add a route canvas.api.v0.site_data at GET /canvas/api/v0/site-data in canvas.routing.yml, following the same authentication and access pattern as other read-only Canvas API routes:

canvas.api.site_data:
  path: '/canvas/api/v0/site-data'
  defaults:
    _controller: 'Drupal\canvas\Controller\SiteDataController'
  requirements:
    _canvas_authentication_required: TRUE
    _canvas_ui_access: 'TRUE'
    _format: 'json'
  methods: [GET]
  options:
    canvas_external_api: true

Add \Drupal\canvas\Controller\SiteDataController. It calls all relevant CodeComponentDataProvider methods — the same methods already wired in ComponentSourceHooks::jsSettingsAlter() via ASSET_LIBRARY_METHOD_MAPPING — and returns a JsonResponse with the merged canvasData.v0 shape:

{
  "baseUrl": "https://example.com",
  "branding": { "homeUrl": "/", "siteName": "My Site", "siteSlogan": "" },
  "themeAssets": {
    "logo": { "url": "/themes/custom/my_theme/logo.svg" },
    "favicon": { "url": "/favicon.ico", "mimeType": "image/x-icon" }
  }
}

PHP: OAuth authentication coverage

Add canvas.api.site_data to the $named_routes array in \Drupal\canvas_oauth\Authentication\Provider\CanvasOauthAuthenticationProvider::applies(). The provider explicitly enumerates route names; it will not pick up the new route automatically. This ensures OAuth2 Bearer token requests from the CLI and Workbench are authenticated the same way as artifact upload and push lifecycle routes.

TypeScript: Workbench bootstrap via @drupal-canvas/vite-plugin

@drupal-canvas/vite-plugin already uses transformIndexHtml to build a window.drupalSettings = { canvasData: { v0: ... } } script tag and inject it into the page at bootstrap. It currently populates only baseUrl and jsonapiSettings from local environment config.

Extend the plugin so that when a Drupal site URL is available, it fetches /canvas/api/v0/canvas-data at bootstrap time (using the CLI's OAuth-authenticated HTTP client) and merges the response into the canvasData.v0 object before the script tag is emitted. Because Workbench uses @drupal-canvas/vite-plugin via vite-compat, this means window.drupalSettings.canvasData.v0 is fully populated before any component code runs — and the existing getSiteData() and getPageData() functions work with no changes.

The endpoint response includes jsonapiSettings (from CodeComponentDataProvider::getCanvasDataJsonApiSettingsV0()), so the jsonapiPrefix option and CANVAS_JSONAPI_PREFIX env var in the vite-plugin become unnecessary when the HTTP fetch is used — Workbench no longer needs that value configured separately.

User interface changes

None.