apostrophe 3.12.0 → 3.13.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 3.13.0 - 2022-02-04
+
+### Adds
+
+* Additional requirements and related UI may be imposed on native ApostropheCMS logins using the new `requirements` feature, which can be extended in modules that `improve` the `@apostrophecms/login` module. These requirements are not imposed for single sign-on logins via `@apostrophecms/passport-bridge`. See the documentation for more information.
+* Adds latest Slovak translation strings to SK.json in `i18n/` folder. Thanks to [Michael Huna](https://github.com/Miselrkba) for the contribution.
+* Verifies `afterPasswordVerified` requirements one by one when emitting done event, allows to manage errors ans success before to go to the next requirement. Stores and validate each requirement in the token. Checks the new `askForConfirmation` requirement option to go to the next step when emitting done event or waiting for the confirm event (in order to manage success messages). Removes support for `afterSubmit` for now.
+
+### Fixes
+
+* Decodes the testReq `param` property in `serveNotFound`. This fixes a problem where page titles using diacritics triggered false 404 errors.
+* Registers the default namespace in the Vue instance of i18n, fixing a lack of support for un-namespaced l10n keys in the UI.
+
 ## 3.12.0 - 2022-01-21
 
 ### Adds

package/modules/@apostrophecms/asset/lib/globalIcons.js

@@ -12,6 +12,8 @@ module.exports = {
   'checkbox-blank-icon': 'CheckboxBlankOutline',
   'check-all-icon': 'CheckAll',
   'check-bold-icon': 'CheckBold',
+  'check-circle-icon': 'CheckCircle',
+  'check-decagram-icon': 'CheckDecagram',
   'checkbox-marked-icon': 'CheckboxMarked',
   'chevron-down-icon': 'ChevronDown',
   'chevron-left-icon': 'ChevronLeft',

package/modules/@apostrophecms/attachment/index.js

@@ -1114,7 +1114,7 @@ module.exports = {
               await copyOut(uploadfsPath, tempFile);
               await self.sanitizeSvg(tempFile);
               await copyIn(tempFile, uploadfsPath);
-              await self.db.update({
+              await self.db.updateOne({
                 _id: attachment._id
               }, {
                 $set: {

package/modules/@apostrophecms/doc-type/index.js

@@ -194,11 +194,11 @@ module.exports = {
             _id: doc._id.replace(':draft', ':previous')
           });
           if (published) {
-            await self.apos.doc.db.remove({ _id: published._id });
+            await self.apos.doc.db.removeOne({ _id: published._id });
             await self.emit('afterDelete', req, published, { checkForChildren: false });
           }
           if (previous) {
-            await self.apos.doc.db.remove({ _id: previous._id });
+            await self.apos.doc.db.removeOne({ _id: previous._id });
             await self.emit('afterDelete', req, previous, { checkForChildren: false });
           }
         },

package/modules/@apostrophecms/express/index.js

@@ -307,7 +307,13 @@ module.exports = {
           // "expires" ourselves too
           const bearer = await self.apos.login.bearerTokens.findOne({
             _id: req.token,
-            expires: { $gte: new Date() }
+            expires: { $gte: new Date() },
+            // requirementsToVerify array should be empty or inexistant
+            // for the token to be usable to log in.
+            $or: [
+              { requirementsToVerify: { $exists: false } },
+              { requirementsToVerify: { $ne: [] } }
+            ]
           });
           return bearer && bearer.userId;
         }

package/modules/@apostrophecms/i18n/i18n/en.json

@@ -167,6 +167,7 @@
   "localizeNewRelated": "Localize new related documents",
   "localizingBusy": "Localizing Content",
   "login": "Login",
+  "loginErrorGeneric": "An error occurred. Please try again.",
   "loginDisabled": "Login Disabled",
   "loginPageBothRequired": "Both the username and the password are required.",
   "loginPageBadCredentials": "Your credentials are incorrect, or there is no such user",

package/modules/@apostrophecms/i18n/i18n/sk.json

@@ -3,6 +3,7 @@
   "addItem": "Pridať položku",
   "addWidgetType": "Pridať {{ label }}",
   "admin": "Admin",
+  "affirmativeLabel": "Áno, pokračovať.",
   "altText": "Alternatívny text",
   "altTextHelp": "Alternatívny popis obrázkov pre zlepšenú prístupnosť",
   "any": "ľubovoľný",
@@ -10,6 +11,8 @@
   "applyToSubpages": "Aplikovať na podstánky",
   "arrayCancelDescription": "Chcete zahodiť zmeny v tomto zozname?",
   "archive": "Archív",
+  "archivingBatchConfirmation": "Naozaj chcete archivovať {{ count }} {{ type }}?",
+  "archivingBatchConfirmationButton": "Áno, archivovať obsah.",
   "archiveImage": "Archivovať obrázok",
   "archiveOnlyThisPage": "Archivovať len túto stránku",
   "archivePageAndSubpages": "Archivovať túto stránku a všetky podradené stránky",
@@ -121,6 +124,7 @@
   "errorPageMessage": "Došlo k chybe",
   "errorPageStatusCode": "500",
   "errorPageTitle": "Došlo k chybe v nadpise stánky",
+  "errorBatchOperationNoti": "Skupinová operácia {{ operation }} zlyhala.",
   "everythingElse": "Všetko ostatné",
   "exit": "Odísť",
   "fetchPublishedVersionFailed": "Pri načítaní zverejnenej verzie dokumentu sa vyskytla chyba.",
@@ -173,6 +177,8 @@
   "manageDocType": "Spravovať {{ type }}",
   "manageDraftSubmissions": "Spravujte návrhy príspevkov",
   "managePages": "Spravovať stránky",
+  "maxLabel": "Max:",
+  "maxUi": "Max: {{ number }}",
   "mediaCreatedDate": "Nahraté: {{ createdDate }}",
   "mediaDimensions": "Rozmery: {{ width }} 𝗑 {{ height }}",
   "mediaFileSize": "Veľkosť súboru: {{ fileSize }}",
@@ -180,6 +186,10 @@
   "mediaMB": "{{ size }}MB",
   "mediaUploadViaDrop": "Presuňte ich sem, keď budete pripravení",
   "mediaUploadViaExplorer": "Alebo kliknutím otvorte adresárovú štruktúru",
+  "minLabel": "Min:",
+  "minUi": "Min: {{ number }}",
+  "modify": "Zmeniť",
+  "modifyOrDelete": "Zmeniť / Vymazať",
   "moreOptions": "Viac možností",
   "moreOperations": "Viac úprav",
   "multipleEditors": "Viaceré editory",
@@ -202,17 +212,19 @@
   "notFoundPageStatusCode": "404",
   "notFoundPageTitle": "404 - Stránka nenájdená",
   "notInLocale": "Aktuálna stránka v {{ label }} neexistuje. Preložte verziu z {{ currentLocale }}?",
+  "notificationClearEventError": "Pri vymazávaní zaregistrovanej notifikačnej udalosti sa vyskytla chyba.",
   "noTypeFound": "Nenašiel sa žiadny {{ type }}",
   "parentNotLocalized": "Najprv preložte nadradenú stránku",
   "notYetPublished": "Tento dokument ešte nebol zverejnený.",
   "nudgeDown": "Posunúť nadol",
   "nudgeUp": "Posunúť nahor",
+  "numberAdded": "{{ count }} Pridané",
   "office": "Kancelária",
   "openGlobal": "Otvorte globálne nastavenia webu",
   "page": "Stránka",
   "pageDoesNotExistYet": "Stránka zatiaľ neexistuje",
   "pageDoesNotExistYetDescription": "Stránka, ktorá poskytuje záznam pre tento diel, ešte nie je k dispozícii ako {{ mode }} v jazykovej mutácii {{ locale }}.",
-  "pageIsParked": "Táto stránka je zaparkovaná a nemožno ju presunúť",
+  "pageIsParked": "Táto stránka je uzamknutá nemožno ju presunúť",
   "pageNumber": "Stránka {{ number }}",
   "pageTitle": "Názov stránky",
   "pages": "Stránky",
@@ -242,6 +254,8 @@
   "richTextUndo": "Vrátiť späť",
   "richTextStyleConfigWarning": "Nesprávne nakonfigurovaný štýl: popiska: {{ label }}, {{ tag }}",
   "password": "Heslo",
+  "passwordErrorMin": "Minimum {{ min }} znakov",
+  "passwordErrorMax": "Maximum {{ max }} znakov",
   "passwordResetRequest": "Vaša žiadosť o obnovenie hesla zo stránky {{ site }}",
   "pasteWidget": "Prilepiť {{ widget }}",
   "pending": "Čaká na spracovanie",
@@ -277,6 +291,8 @@
   "relatedDocsOnly": "Len súvisiace dokumenty",
   "relatedDocsDefinition": "Súvisiace dokumenty sú dokumenty, na ktoré sa odkazuje v tomto dokumente. Obvykle to zahŕňa obrázky, obsah definovaný vzťahmi atď.",
   "restore": "Obnoviť",
+  "restoreBatchConfirmation": "Naozaj chcete obnoviť {{ count }} {{ type }}?",
+  "restoreBatchConfirmationButton": "Áno, obnoviť obsah.",
   "resolveErrorsBeforeSaving": "Pred uložením vyriešte chyby.",
   "resolveErrorsFirst": "Najprv vyriešte chyby.",
   "restoreOnlyThisPage": "Obnovte iba túto stránku",
@@ -305,6 +321,12 @@
   "select": "Vybrať",
   "selectedMenuItem": "✓ {{ label }}",
   "selectAll": "Vybrať všetko",
+  "selectBoxMessage": "{{ num }} {{ label }} vybraté.",
+  "selectBoxMessagePage": "{{ num }} {{ label }} na tejto stránke vybraté.",
+  "selectBoxMessageAllButton": "Vybrať všetko {{ num }} {{ label }}.",
+  "selectBoxMessageButton": "Vybrať {{ num }} {{ label }}.",
+  "selectBoxMessageSelected": "{{ num }} {{ label }} vybraté.",
+  "selectBoxMessageAllSelected": "Všetky {{ num }} {{ label }} vybraté.",
   "deselectAll": "Odznačiť všetko",
   "selectContent": "Vyberte obsah",
   "selectContentToLocalize": "Ktorý obsah chcete lokalizovať?",

package/modules/@apostrophecms/i18n/index.js

@@ -47,6 +47,7 @@ module.exports = {
     }
   },
   async init(self) {
+    self.defaultNamespace = 'default';
     self.namespaces = {};
     self.debug = process.env.APOS_DEBUG_I18N ? true : self.options.debug;
     self.show = process.env.APOS_SHOW_I18N ? true : self.options.show;
@@ -84,7 +85,7 @@ module.exports = {
         // Nunjucks and Vue will already do this
         escapeValue: false
       },
-      defaultNS: 'default',
+      defaultNS: self.defaultNamespace,
       debug: self.debug
     });
     if (self.show) {
@@ -540,6 +541,7 @@ module.exports = {
           i18n,
           locale: req.locale,
           defaultLocale: self.defaultLocale,
+          defaultNamespace: self.defaultNamespace,
           locales: self.locales,
           debug: self.debug,
           show: self.show,

package/modules/@apostrophecms/login/index.js

@@ -44,6 +44,7 @@ const Promise = require('bluebird');
 const cuid = require('cuid');
 
 module.exports = {
+  cascades: [ 'requirements' ],
   options: {
     alias: 'login',
     localLogin: true,
@@ -106,34 +107,13 @@ module.exports = {
     return {
       post: {
         async login(req) {
-          const username = self.apos.launder.string(req.body.username);
-          const password = self.apos.launder.string(req.body.password);
-          const session = self.apos.launder.boolean(req.body.session);
-          if (!(username && password)) {
-            throw self.apos.error('invalid', req.t('apostrophe:loginPageBothRequired'));
-          }
-          const user = await self.apos.login.verifyLogin(username, password);
-          if (!user) {
-            // For security reasons we may not tell the user which case applies
-            throw self.apos.error('invalid', req.t('apostrophe:loginPageBadCredentials'));
-          }
-          if (session) {
-            const passportLogin = (user) => {
-              return require('util').promisify(function(user, callback) {
-                return req.login(user, callback);
-              })(user);
-            };
-            await passportLogin(user);
+          // Don't make verify functions worry about whether this object
+          // is present, just the value of their own sub-property
+          req.body.requirements = req.body.requirements || {};
+          if (req.body.incompleteToken) {
+            return self.finalizeIncompleteLogin(req);
           } else {
-            const token = cuid();
-            await self.bearerTokens.insert({
-              _id: token,
-              userId: user._id,
-              expires: new Date(new Date().getTime() + (self.options.bearerTokens.lifetime || (86400 * 7 * 2)) * 1000)
-            });
-            return {
-              token
-            };
+            return self.initialLogin(req);
           }
         },
         async logout(req) {
@@ -141,7 +121,7 @@ module.exports = {
             throw self.apos.error('forbidden', req.t('apostrophe:logOutNotLoggedIn'));
           }
           if (req.token) {
-            await self.bearerTokens.remove({
+            await self.bearerTokens.removeOne({
               userId: req.user._id,
               _id: req.token
             });
@@ -156,6 +136,68 @@ module.exports = {
             await destroySession();
           }
         },
+        // invokes the `props(req, user)` function for the requirement specified by
+        // `body.name`. Invoked before displaying each `afterPasswordVerified`
+        // requirement. The return value of the function, which should
+        // be an object, is delivered as the API response
+        async requirementProps(req) {
+          const { user } = await self.findIncompleteTokenAndUser(req, req.body.incompleteToken);
+
+          const name = self.apos.launder.string(req.body.name);
+
+          const requirement = self.requirements[name];
+          if (!requirement) {
+            throw self.apos.error('notfound');
+          }
+          if (!requirement.props) {
+            return {};
+          }
+          return requirement.props(req, user);
+        },
+        async requirementVerify(req) {
+          const name = self.apos.launder.string(req.body.name);
+
+          const { user } = await self.findIncompleteTokenAndUser(req, req.body.incompleteToken);
+
+          const requirement = self.requirements[name];
+
+          if (!requirement) {
+            throw self.apos.error('notfound');
+          }
+
+          if (!requirement.verify) {
+            throw self.apos.error('invalid', 'You must provide a verify method in your requirement');
+          }
+
+          try {
+            await requirement.verify(req, req.body.value, user);
+
+            const token = await self.bearerTokens.findOne({
+              _id: self.apos.launder.string(req.body.incompleteToken),
+              requirementsToVerify: { $exists: true },
+              expires: {
+                $gte: new Date()
+              }
+            });
+
+            if (!token) {
+              throw self.apos.error('notfound');
+            }
+
+            await self.bearerTokens.updateOne(token, {
+              $pull: { requirementsToVerify: name }
+            });
+
+            return {};
+          } catch (err) {
+            err.data = err.data || {};
+            err.data.requirement = name;
+            throw err;
+          }
+        },
+        async context(req) {
+          return self.getContext(req);
+        },
         ...(self.options.passwordReset ? {
           async resetRequest(req) {
             const site = (req.headers.host || '').replace(/:\d+$/, '');
@@ -217,19 +259,12 @@ module.exports = {
         } : {})
       },
       get: {
-        context () {
-          let aposPackage = {};
-          try {
-            aposPackage = require('../../../package.json');
-          } catch (err) {
-            self.apos.util.error(err);
-          }
-
-          return {
-            env: process.env.NODE_ENV || 'development',
-            name: (process.env.npm_package_name && process.env.npm_package_name.replace(/-/g, ' ')) || 'Apostrophe',
-            version: aposPackage.version || '3'
-          };
+        // For bc this route is still available via GET, however
+        // it should be accessed via POST because the result
+        // may differ by individual user session and should not
+        // be cached
+        async context(req) {
+          return self.getContext(req);
         }
       }
     };
@@ -237,6 +272,33 @@ module.exports = {
   methods(self) {
     return {
 
+      // Implements the context route, which provides basic
+      // information about the site being logged into and also
+      // props for beforeSubmit requirements
+      async getContext(req) {
+        const aposPackage = require('../../../package.json');
+        // For performance beforeSubmit requirement props all happen together here
+        const requirementProps = {};
+        for (const [ name, requirement ] of Object.entries(self.requirements)) {
+          if ((requirement.phase !== 'afterPasswordVerified') && requirement.props) {
+            try {
+              requirementProps[name] = await requirement.props(req);
+            } catch (e) {
+              if (e.body && e.body.data) {
+                e.body.data.requirement = name;
+              }
+              throw e;
+            }
+          }
+        }
+        return {
+          env: process.env.NODE_ENV || 'development',
+          name: (process.env.npm_package_name && process.env.npm_package_name.replace(/-/g, ' ')) || 'Apostrophe',
+          version: aposPackage.version || '3',
+          requirementProps
+        };
+      },
+
       // return the loginUrl option
       login(url) {
         return self.options.loginUrl ? self.options.loginUrl : '/login';
@@ -368,7 +430,17 @@ module.exports = {
               username: req.user.username,
               email: req.user.email
             }
-          } : {})
+          } : {}),
+          requirements: Object.fromEntries(
+            Object.entries(self.requirements).map(([ name, requirement ]) => {
+              const browserRequirement = {
+                phase: requirement.phase,
+                propsRequired: !!requirement.props,
+                askForConfirmation: requirement.askForConfirmation || false
+              };
+              return [ name, browserRequirement ];
+            })
+          )
         };
       },
 
@@ -384,6 +456,164 @@ module.exports = {
       async enableBearerTokens() {
         self.bearerTokens = self.apos.db.collection('aposBearerTokens');
         await self.bearerTokens.createIndex({ expires: 1 }, { expireAfterSeconds: 0 });
+      },
+
+      // Finalize an incomplete login based on the provided incompleteToken
+      // and various `requirements` subproperties. Implementation detail of the login route
+      async finalizeIncompleteLogin(req) {
+        const session = self.apos.launder.boolean(req.body.session);
+        // Completing a previous incomplete login
+        // (password was verified but post-password-verification
+        // requirements were not supplied)
+        const token = await self.bearerTokens.findOne({
+          _id: self.apos.launder.string(req.body.incompleteToken),
+          requirementsToVerify: {
+            $exists: true
+          },
+          expires: {
+            $gte: new Date()
+          }
+        });
+
+        if (!token) {
+          throw self.apos.error('notfound');
+        }
+
+        if (token.requirementsToVerify.length) {
+          throw self.apos.error('forbidden', 'All requirements must be verified');
+        }
+
+        const user = await self.deserializeUser(token.userId);
+        if (!user) {
+          await self.bearerTokens.removeOne({
+            _id: token.userId
+          });
+          throw self.apos.error('notfound');
+        }
+
+        if (session) {
+          await self.bearerTokens.removeOne({
+            _id: token.userId
+          });
+          await self.passportLogin(req, user);
+        } else {
+          delete token.requirementsToVerify;
+          self.bearerTokens.updateOne(token, {
+            $unset: {
+              requirementsToVerify: 1
+            }
+          });
+          return {
+            token
+          };
+        }
+      },
+
+      // Implementation detail of the login route and the requirementProps mechanism for
+      // custom login requirements. Given the string `token`, returns
+      // `{ token, user }`. Throws an exception if the token is not found.
+      // `token` is sanitized before passing to mongodb.
+      async findIncompleteTokenAndUser(req, token) {
+        token = await self.bearerTokens.findOne({
+          _id: self.apos.launder.string(token),
+          requirementsToVerify: {
+            $exists: true,
+            $ne: []
+          },
+          expires: {
+            $gte: new Date()
+          }
+        });
+        if (!token) {
+          throw self.apos.error('notfound');
+        }
+        const user = await self.deserializeUser(token.userId);
+        if (!user) {
+          await self.bearerTokens.removeOne({
+            _id: token._id
+          });
+          throw self.apos.error('notfound');
+        }
+        return {
+          token,
+          user
+        };
+      },
+
+      // Implementation detail of the login route. Log in the user, or if there are
+      // `requirements` that require password verification occur first, return an incomplete token.
+      async initialLogin(req) {
+        // Initial login step
+        const username = self.apos.launder.string(req.body.username);
+        const password = self.apos.launder.string(req.body.password);
+        if (!(username && password)) {
+          throw self.apos.error('invalid', req.t('apostrophe:loginPageBothRequired'));
+        }
+        const { earlyRequirements, lateRequirements } = self.filterRequirements();
+        for (const [ name, requirement ] of Object.entries(earlyRequirements)) {
+          try {
+            await requirement.verify(req, req.body.requirements && req.body.requirements[name]);
+          } catch (e) {
+            e.data = e.data || {};
+            e.data.requirement = name;
+            throw e;
+          }
+        }
+        const user = await self.apos.login.verifyLogin(username, password);
+        if (!user) {
+          // For security reasons we may not tell the user which case applies
+          throw self.apos.error('invalid', req.t('apostrophe:loginPageBadCredentials'));
+        }
+
+        const requirementsToVerify = Object.keys(lateRequirements);
+
+        if (requirementsToVerify.length) {
+          const token = cuid();
+
+          await self.bearerTokens.insert({
+            _id: token,
+            userId: user._id,
+            requirementsToVerify,
+            // Default lifetime of 1 hour is generous to permit situations like
+            // installing a TOTP app for the first time
+            expires: new Date(new Date().getTime() + (self.options.incompleteLifetime || 60 * 60 * 1000))
+          });
+          return {
+            incompleteToken: token
+          };
+        } else {
+          const session = self.apos.launder.boolean(req.body.session);
+          if (session) {
+            await self.passportLogin(req, user);
+          } else {
+            const token = cuid();
+            await self.bearerTokens.insert({
+              _id: token,
+              userId: user._id,
+              expires: new Date(new Date().getTime() + (self.options.bearerTokens.lifetime || (86400 * 7 * 2)) * 1000)
+            });
+            return {
+              token
+            };
+          }
+        }
+      },
+
+      filterRequirements() {
+        return {
+          earlyRequirements: Object.fromEntries(Object.entries(self.requirements).filter(([ name, requirement ]) => requirement.phase === 'beforeSubmit')),
+          lateRequirements: Object.fromEntries(Object.entries(self.requirements).filter(([ name, requirement ]) => requirement.phase === 'afterPasswordVerified'))
+        };
+      },
+
+      // Awaitable wrapper for req.login. An implementation detail of the login route
+      async passportLogin(req, user) {
+        const passportLogin = (user) => {
+          return require('util').promisify(function(user, callback) {
+            return req.login(user, callback);
+          })(user);
+        };
+        await passportLogin(user);
       }
     };
   },