apostrophe 3.13.0 → 3.14.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 3.14.0 (2022-02-22)
+
+### Adds
+
+* To reduce complications for those implementing caching strategies, the CSRF protection cookie now contains a simple constant string, and is not recorded in `req.session`. This is acceptable because the real purpose of the CSRF check is simply to verify that the browser has sent the cookie at all, which it will not allow a cross-origin script to do.
+* As a result of the above, a session cookie is not generated and sent at all unless `req.session` is actually used or a user logs in. Again, this reduces complications for those implementing caching strategies.
+* When logging out, the session cookie is now cleared in the browser. Formerly the session was destroyed on the server side only, which was sufficient for security purposes but could create caching issues.
+* Uses `express-cache-on-demand` lib to make similar and concurrent requests on pieces and pages faster.
+* Frontend build errors now stop app startup in development, and SCSS and JS/Vue build warnings are visible on the terminal console for the first time.
+
+### Fixes
+
+* Fixed a bug when editing a page more than once if the page has a relationship to itself, whether directly or indirectly. Widget ids were unnecessarily regenerated in this situation, causing in-context edits after the first to fail to save.
+* Pages no longer emit double `beforeUpdate` and `beforeSave` events.
+* When the home page extends `@apostrophecms/piece-page-type`, the "show page" URLs for individual pieces should not contain two slashes before the piece slug. Thanks to [Martí Bravo](https://github.com/martibravo) for the fix.
+* Fixes transitions between login page and `afterPasswordVerified` login steps.
+* Frontend build errors now stop the `@apostrophecms/asset:build` task properly in production.
+* `start` replaced with `flex-start` to address SCSS warnings.
+* Dead code removal, as a result of following up on JS/Vue build warnings.
+
 ## 3.13.0 - 2022-02-04
 
 ### Adds

package/modules/@apostrophecms/asset/index.js

@@ -249,15 +249,23 @@ module.exports = {
               fs.removeSync(`${bundleDir}/${outputFilename}`);
               const cssPath = `${bundleDir}/${outputFilename}`.replace(/\.js$/, '.css');
               fs.removeSync(cssPath);
-              await Promise.promisify(webpackModule)(require(`./lib/webpack/${name}/webpack.config`)(
-                {
-                  importFile,
-                  modulesDir,
-                  outputPath: bundleDir,
-                  outputFilename
-                },
-                self.apos
-              ));
+              const webpack = Promise.promisify(webpackModule);
+              const webpackBaseConfig = require(`./lib/webpack/${name}/webpack.config`);
+              const webpackInstanceConfig = webpackBaseConfig({
+                importFile,
+                modulesDir,
+                outputPath: bundleDir,
+                outputFilename
+              }, self.apos);
+              const result = await webpack(webpackInstanceConfig);
+              if (result.compilation.errors.length) {
+                // Throwing a string is appropriate in a command line task
+                throw cleanErrors(result.toString('errors'));
+              } else if (result.compilation.warnings.length) {
+                self.apos.util.warn(result.toString('errors-warnings'));
+              } else if (process.env.APOS_WEBPACK_VERBOSE) {
+                self.apos.util.info(result.toString('verbose'));
+              }
               if (fs.existsSync(cssPath)) {
                 fs.writeFileSync(cssPath, self.filterCss(fs.readFileSync(cssPath, 'utf8'), {
                   modulesPrefix: `${self.getAssetBaseUrl()}/modules`
@@ -518,6 +526,13 @@ module.exports = {
           function getComponentName(component, options, i) {
             return require('path').basename(component).replace(/\.\w+/, '') + (options.enumerateImports ? `_${i}` : '');
           }
+
+          function cleanErrors(errors) {
+            // Dev experience: remove confusing and inaccurate webpack warning about module loaders
+            // when straightforward JS parse errors occur, stackoverflow is full of people
+            // confused by this
+            return errors.replace(/(ERROR in[\s\S]*?Module parse failed[\s\S]*)You may need an appropriate loader.*/, '$1');
+          }
         }
       }
     };

package/modules/@apostrophecms/doc/index.js

@@ -1075,7 +1075,13 @@ module.exports = {
       },
       deduplicateWidgetIds(doc) {
         const seen = new Set();
-        self.apos.area.walk(doc, area => {
+        self.apos.area.walk(doc, (area, dotPath) => {
+          if (dotPath.includes('_')) {
+            // Ignore relationships so recursive references from a
+            // doc to itself can't result in random regeneration of
+            // widget ids in the doc proper
+            return;
+          }
           for (const widget of area.items || []) {
             if ((!widget._id) || seen.has(widget._id)) {
               widget._id = cuid();

package/modules/@apostrophecms/doc-type/ui/apos/components/AposDocContextMenu.vue

@@ -23,7 +23,6 @@ import { detectDocChange } from 'Modules/@apostrophecms/schema/lib/detectChange'
 import AposPublishMixin from 'Modules/@apostrophecms/ui/mixins/AposPublishMixin';
 import AposArchiveMixin from 'Modules/@apostrophecms/ui/mixins/AposArchiveMixin';
 import AposModifiedMixin from 'Modules/@apostrophecms/ui/mixins/AposModifiedMixin';
-import klona from 'klona';
 
 export default {
   name: 'AposDocContextMenu',
@@ -263,12 +262,6 @@ export default {
       // moduleOptions gives us the action, etc. but here we need the schema
       // which is always type specific, even for pages so get it ourselves
       let schema = (apos.modules[this.context.type].schema || []).filter(field => apos.schema.components.fields[field.type]);
-      if (this.restoreOnly) {
-        schema = klona(schema);
-        for (const field of schema) {
-          field.readOnly = true;
-        }
-      }
       // Archive UI is handled via action buttons
       schema = schema.filter(field => field.name !== 'archived');
       return schema;

package/modules/@apostrophecms/express/index.js

@@ -77,7 +77,15 @@
 //   rolling: true,
 //   secret: 'you should have a secret',
 //   name: self.apos.shortName + '.sid',
-//   cookie: {}
+//   cookie: {
+//     path: '/',
+//     httpOnly: true,
+//     secure: false,
+//     // using 'strict' will confuse users if you link to your site
+//     // with the expectation that the user is still logged in on arrival.
+//     // 'lax' still protects against CSRF attacks
+//     sameSite: 'lax'
+//   }
 // }
 // ```
 //
@@ -98,17 +106,16 @@
 //
 // ### `csrf`
 //
-// By default, Apostrophe implements Angular-compatible [CSRF protection](https://en.wikipedia.org/wiki/Cross-site_request_forgery)
-// via an `XSRF-TOKEN` cookie. The `@apostrophecms/asset` module pushes
-// a call to the browser to set a jQuery `ajaxPrefilter` which
-// adds an `X-XSRF-TOKEN` header to all requests, which must
-// match the cookie. This is effective because code running from
-// other sites or iframes will not be able to read the cookie and
-// send the header.
+// By default, Apostrophe implements [CSRF protection](https://en.wikipedia.org/wiki/Cross-site_request_forgery)
+// by setting a cookie with the value `csrf`, which all legitimate requests originating fromt he page will send
+// back (see the [same-origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy)).
+// All modern browsers will refuse to allow a CSRF attacker, such as a malicious `POST`-method `form` tag on a third
+// party site pointing to an Apostrophe site, to send cookies to the Apostrophe site.
 //
 // All non-safe HTTP requests (not `GET`, `HEAD`, `OPTIONS` or `TRACE`)
-// automatically receive this proection via the csrf middleware, which
-// rejects requests in which the CSRF token does not match the header.
+// automatically receive this protection via the csrf middleware, which
+// rejects requests in which the cookie is not present.
+//
 // If the request was made with a valid api key or bearer token it
 // bypasses this check.
 //
@@ -124,12 +131,6 @@
 // You may need to use this feature when implementing POST form
 // submissions that do not use AJAX and thus don't send the header.
 //
-// There is also a `minimumExceptions` option, which defaults
-// to `[ /login ]`. The login form is the only non-AJAX form
-// that ships with Apostrophe. XSRF protection for login forms
-// is unnecessary because the password itself is unknown to the
-// third party site; it effectively serves as an XSRF token.
-//
 // ### Adding your own middleware
 //
 // Use the `middleware` section in your module. That function should
@@ -323,12 +324,11 @@ module.exports = {
       },
       ...((self.options.csrf === false) ? {} : {
         // Angular-compatible CSRF protection middleware. On safe requests (GET, HEAD, OPTIONS, TRACE),
-        // set the XSRF-TOKEN cookie if missing. On unsafe requests (everything else),
-        // make sure our jQuery `ajaxPrefilter` set the X-XSRF-TOKEN header to match the
-        // cookie.
+        // set the csrf cookie if missing.
         //
-        // This works because if we're running via a script tag or iframe, we won't
-        // be able to read the cookie.
+        // This works because requests not meeting the expectations of the same-origin policy
+        // won't be able to send cookies to the origin at all, even though the value is
+        // well-known.
         csrf(req, res, next) {
           if (req.csrfExempt) {
             return next();
@@ -426,7 +426,11 @@ module.exports = {
         _.defaults(sessionOptions.cookie, {
           path: '/',
           httpOnly: true,
-          secure: false
+          secure: false,
+          // Ensure that Safari follows the same policy as other modern browsers
+          // to prevent CSRF attacks. "lax" just means that navigation links
+          // leading to the site will receive the cookie, it is not insecure
+          sameSite: 'lax'
           // maxAge is set for us by connect-mongo,
           // and defaults to 2 weeks
         });
@@ -506,28 +510,30 @@ module.exports = {
       // that this URL should be subject to CSRF.
 
       csrfWithoutExceptions(req, res, next) {
-        let token;
         // OPTIONS request cannot set a cookie, so manipulating the session here
         // is not helpful. Do not attempt to set XSRF-TOKEN for OPTIONS
         if (req.method === 'OPTIONS') {
           return next();
         }
-        // Safe request establishes XSRF-TOKEN in session if not set already
+        // Safe request establishes CSRF cookie, whose purpose is only to check
+        // that the same-origin policy is followed, not to be unique and secure
+        // in itself
         if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'TRACE') {
-          token = req.session && req.session['XSRF-TOKEN'];
-          if (!token) {
-            token = self.apos.util.generateId();
-            req.session['XSRF-TOKEN'] = token;
-          }
-          // Reset the cookie so that if its lifetime somehow detaches from
-          // that of the session cookie we're still OK
-          res.cookie(self.apos.csrfCookieName, token);
+          // Use the same standard for the session and CSRF cookies
+          res.cookie(self.apos.csrfCookieName, 'csrf', {
+            // Will inherit sameSite: 'lax', which is important for
+            // CSRF protection in Safari
+            ...self.sessionOptions.cookie,
+            // 1 year (the limit). The value is known, we are relying
+            // on SameSite (modern browsers)
+            maxAge: 31536000
+          });
         } else {
-          // All non-safe requests must be preceded by a safe request that establishes
-          // the CSRF token, both as a cookie and in the session. Otherwise a user who is logged
-          // in but doesn't currently have a CSRF token is still vulnerable.
-          // See options.csrfExceptions
-          if (!req.cookies[self.apos.csrfCookieName] || req.get('X-XSRF-TOKEN') !== req.cookies[self.apos.csrfCookieName] || req.session['XSRF-TOKEN'] !== req.cookies[self.apos.csrfCookieName]) {
+          // Check that the request arrived with the CSRF cookie.
+          // This isn't meant to be a unique code that no one could guess,
+          // but rather a check that the request from the same origin,
+          // as cross-origin requests cannot set cookies on our origin at all.
+          if (req.cookies[self.apos.csrfCookieName] !== 'csrf') {
             res.statusCode = 403;
             return res.send({
               name: 'forbidden',

package/modules/@apostrophecms/http/index.js

@@ -86,9 +86,6 @@ module.exports = {
       // `parse` (can be 'json` to always parse the response body as JSON, otherwise the response body is
       // parsed as JSON only if the content-type is application/json)
       // `headers` (an object containing header names and values)
-      // `csrf` (if true, which is the default, and the `jar` contains the CSRF cookie for this Apostrophe site
-      // due to a previous GET request, send it as the X-XSRF-TOKEN header; if a string, send the current value of the cookie of that name
-      // in the `jar` as the X-XSRF-TOKEN header; if false, disable this feature)
       // `fullResponse` (if true, return an object with `status`, `headers` and `body`
       // properties, rather than returning the body directly; the individual `headers` are canonicalized
       // to lowercase names. If a header appears multiple times an array is returned for it)
@@ -113,9 +110,6 @@ module.exports = {
       // `parse` (can be 'json` to always parse the response body as JSON, otherwise the response body is
       // parsed as JSON only if the content-type is application/json)
       // `headers` (an object containing header names and values)
-      // `csrf` (if true, which is the default, and the `jar` contains the CSRF cookie for this Apostrophe site
-      // due to a previous GET request, send it as the X-XSRF-TOKEN header; if a string, send the current value of the cookie of that name
-      // in the `jar` as the X-XSRF-TOKEN header; if false, disable this feature)
       // `fullResponse` (if true, return an object with `status`, `headers` and `body`
       // properties, rather than returning the body directly; the individual `headers` are canonicalized
       // to lowercase names. If a header appears multiple times an array is returned for it)
@@ -140,9 +134,6 @@ module.exports = {
       // `parse` (can be 'json` to always parse the response body as JSON, otherwise the response body is
       // parsed as JSON only if the content-type is application/json)
       // `headers` (an object containing header names and values)
-      // `csrf` (if true, which is the default, and the `jar` contains the CSRF cookie for this Apostrophe site
-      // due to a previous GET request, send it as the X-XSRF-TOKEN header; if a string, send the current value of the cookie of that name
-      // in the `jar` as the X-XSRF-TOKEN header; if false, disable this feature)
       // `fullResponse` (if true, return an object with `status`, `headers` and `body`
       // properties, rather than returning the body directly; the individual `headers` are canonicalized
       // to lowercase names. If a header appears multiple times an array is returned for it)
@@ -167,9 +158,6 @@ module.exports = {
       // `parse` (can be 'json` to always parse the response body as JSON, otherwise the response body is
       // parsed as JSON only if the content-type is application/json)
       // `headers` (an object containing header names and values)
-      // `csrf` (if true, which is the default, and the `jar` contains the CSRF cookie for this Apostrophe site
-      // due to a previous GET request, send it as the X-XSRF-TOKEN header; if a string, send the current value of the cookie of that name
-      // in the `jar` as the X-XSRF-TOKEN header; if false, disable this feature)
       // `fullResponse` (if true, return an object with `status`, `headers` and `body`
       // properties, rather than returning the body directly; the individual `headers` are canonicalized
       // to lowercase names. If a header appears multiple times an array is returned for it)
@@ -228,14 +216,6 @@ module.exports = {
           options.headers = options.headers || {};
           options.headers['Content-Type'] = 'application/x-www-form-urlencoded';
         }
-        if ((options.csrf !== false) && options.jar) {
-          options.headers = options.headers || {};
-          const cookieName = ((typeof options.csrf) === 'string') ? options.csrf : self.apos.csrfCookieName;
-          const cookieValue = self.getCookie(options.jar, url, cookieName);
-          if (cookieValue != null) {
-            options.headers['x-xsrf-token'] = cookieValue;
-          }
-        }
         const res = await fetch(url, options);
         let body;
         if (options.jar) {

package/modules/@apostrophecms/login/index.js

@@ -42,6 +42,7 @@ const Passport = require('passport').Passport;
 const LocalStrategy = require('passport-local');
 const Promise = require('bluebird');
 const cuid = require('cuid');
+const expressSession = require('express-session');
 
 module.exports = {
   cascades: [ 'requirements' ],
@@ -133,7 +134,16 @@ module.exports = {
                 return req.session.destroy(callback);
               })();
             };
+            const cookie = req.session.cookie;
             await destroySession();
+            // Session cookie expiration isn't automatic with `req.session.destroy`.
+            // Fix that to reduce challenges for those attempting to implement custom
+            // caching strategies at the edge
+            // https://github.com/expressjs/session/issues/241
+            const expireCookie = new expressSession.Cookie(cookie);
+            expireCookie.expires = new Date(0);
+            const name = self.apos.modules['@apostrophecms/express'].sessionOptions.name;
+            req.res.header('set-cookie', expireCookie.serialize(name, 'deleted'));
           }
         },
         // invokes the `props(req, user)` function for the requirement specified by

package/modules/@apostrophecms/login/ui/apos/components/TheAposLogin.vue

@@ -6,8 +6,9 @@
       :class="themeClass"
     >
       <div class="apos-login__wrapper">
-        <transition name="fade-body">
+        <transition name="fade-body" mode="out-in">
           <div
+            key="1"
             class="apos-login__upper"
             v-if="loaded && phase === 'beforeSubmit'"
           >
@@ -18,25 +19,19 @@
             />
 
             <div class="apos-login__body">
-              <form
-                @submit.prevent="submit"
-              >
+              <form @submit.prevent="submit">
                 <AposSchema
                   :schema="schema"
                   v-model="doc"
                 />
-                <!-- Do not ask these components to render without their props,
-                  v-show is not enough -->
-                <template v-if="loaded">
-                  <Component
-                    v-for="requirement in beforeSubmitRequirements"
-                    :key="requirement.name"
-                    :is="requirement.component"
-                    v-bind="getRequirementProps(requirement.name)"
-                    @done="requirementDone(requirement, $event)"
-                    @block="requirementBlock(requirement)"
-                  />
-                </template>
+                <Component
+                  v-for="requirement in beforeSubmitRequirements"
+                  :key="requirement.name"
+                  :is="requirement.component"
+                  v-bind="getRequirementProps(requirement.name)"
+                  @done="requirementDone(requirement, $event)"
+                  @block="requirementBlock(requirement)"
+                />
                 <!-- TODO -->
                 <!-- <a href="#" class="apos-login__link">Forgot Password</a> -->
                 <AposButton
@@ -53,8 +48,9 @@
             </div>
           </div>
           <div
+            key="2"
             class="apos-login__upper"
-            v-else-if="activeSoloRequirement && !fetchingRequirementProps"
+            v-else-if="activeSoloRequirement"
           >
             <TheAposLoginHeader
               :env="context.env"
@@ -64,6 +60,7 @@
             />
             <div class="apos-login__body">
               <Component
+                v-if="!fetchingRequirementProps"
                 v-bind="getRequirementProps(activeSoloRequirement.name)"
                 :is="activeSoloRequirement.component"
                 :success="activeSoloRequirement.success"
@@ -392,12 +389,11 @@ function getRequirements() {
     transition-delay: 0.6s;
   }
 
-  .fade-leave-active {
+  .fade-body-leave-active {
     transition: all 0.25s linear;
-    transition-delay: 0;
   }
 
-  .fade-body-enter-to,.fade-body-leave {
+  .fade-body-enter-to, .fade-body-leave {
     transform: translateY(0);
   }
 
@@ -459,7 +455,7 @@ function getRequirements() {
       max-width: $login-container;
       margin: auto;
       align-items: center;
-      justify-content: start;
+      justify-content: flex-start;
     }
 
     &__project-version {

package/modules/@apostrophecms/login/ui/apos/components/TheAposLoginHeader.vue

@@ -50,7 +50,7 @@ export default {
     display: flex;
     flex-direction: column;
     justify-content: center;
-    align-items: start;
+    align-items: flex-start;
     width: max-content;
   }
 

package/modules/@apostrophecms/page/index.js

@@ -1,6 +1,7 @@
 const _ = require('lodash');
 const path = require('path');
 const { klona } = require('klona');
+const expressCacheOnDemand = require('express-cache-on-demand')();
 
 module.exports = {
   cascades: [ 'batchOperations' ],
@@ -47,6 +48,9 @@ module.exports = {
     }
   },
   async init(self) {
+    const { enableCacheOnDemand = true } = self.apos
+      .modules['@apostrophecms/express'].options;
+    self.enableCacheOnDemand = enableCacheOnDemand;
     self.typeChoices = self.options.types || [];
     // If "park" redeclares something with a parkedId present in "minimumPark",
     // the later one should win
@@ -58,6 +62,7 @@ module.exports = {
     await self.createIndexes();
   },
   restApiRoutes(self) {
+
     return {
       // Trees are arranged in a tree, not a list. So this API returns the home page,
       // with _children populated if ?_children=1 is in the query string. An editor can
@@ -77,95 +82,102 @@ module.exports = {
       // If querying for draft pages, you may add ?published=1 to attach a
       // `_publishedDoc` property to each draft that also exists in a published form.
 
-      async getAll(req) {
-        self.publicApiCheck(req);
-        const all = self.apos.launder.boolean(req.query.all);
-        const archived = self.apos.launder.booleanOrNull(req.query.archived);
-        const flat = self.apos.launder.boolean(req.query.flat);
-        const autocomplete = self.apos.launder.string(req.query.autocomplete);
+      getAll: [
+        ...self.enableCacheOnDemand ? [ expressCacheOnDemand ] : [],
+        async (req) => {
+          self.publicApiCheck(req);
+          const all = self.apos.launder.boolean(req.query.all);
+          const archived = self.apos.launder.booleanOrNull(req.query.archived);
+          const flat = self.apos.launder.boolean(req.query.flat);
+          const autocomplete = self.apos.launder.string(req.query.autocomplete);
 
-        if (autocomplete.length) {
-          if (!self.apos.permission.can(req, 'edit', '@apostrophecms/any-page-type')) {
-            throw self.apos.error('forbidden');
+          if (autocomplete.length) {
+            if (!self.apos.permission.can(req, 'edit', '@apostrophecms/any-page-type')) {
+              throw self.apos.error('forbidden');
+            }
+            return {
+              // For consistency with the pieces REST API we
+              // use a results property when returning a flat list
+              results: await self.getRestQuery(req).limit(10).relationships(false)
+                .areas(false).toArray()
+            };
           }
-          return {
-            // For consistency with the pieces REST API we
-            // use a results property when returning a flat list
-            results: await self.getRestQuery(req).limit(10).relationships(false)
-              .areas(false).toArray()
-          };
-        }
 
-        if (all) {
-          if (!self.apos.permission.can(req, 'edit', '@apostrophecms/any-page-type')) {
-            throw self.apos.error('forbidden');
-          }
-          const page = await self.getRestQuery(req).and({ level: 0 }).children({
-            depth: 1000,
-            archived,
-            orphan: null,
-            relationships: false,
-            areas: false,
-            permission: false,
-            withPublished: self.apos.launder.boolean(req.query.withPublished),
-            project: self.getAllProjection()
-          }).toObject();
+          if (all) {
+            if (!self.apos.permission.can(req, 'edit', '@apostrophecms/any-page-type')) {
+              throw self.apos.error('forbidden');
+            }
+            const page = await self.getRestQuery(req).and({ level: 0 }).children({
+              depth: 1000,
+              archived,
+              orphan: null,
+              relationships: false,
+              areas: false,
+              permission: false,
+              withPublished: self.apos.launder.boolean(req.query.withPublished),
+              project: self.getAllProjection()
+            }).toObject();
 
-          if (!page) {
-            throw self.apos.error('notfound');
-          }
+            if (!page) {
+              throw self.apos.error('notfound');
+            }
 
-          if (flat) {
-            const result = [];
-            flatten(result, page);
+            if (flat) {
+              const result = [];
+              flatten(result, page);
 
-            return {
-              // For consistency with the pieces REST API we
-              // use a results property when returning a flat list
-              results: result
-            };
+              return {
+                // For consistency with the pieces REST API we
+                // use a results property when returning a flat list
+                results: result
+              };
+            } else {
+              return page;
+            }
           } else {
-            return page;
-          }
-        } else {
-          const result = await self.getRestQuery(req).and({ level: 0 }).toObject();
-          if (!result) {
-            throw self.apos.error('notfound');
-          }
+            const result = await self.getRestQuery(req).and({ level: 0 }).toObject();
+            if (!result) {
+              throw self.apos.error('notfound');
+            }
 
-          // Attach `_url` and `_urls` properties to the home page
-          self.apos.attachment.all(result, { annotate: true });
-          return result;
-        }
+            // Attach `_url` and `_urls` properties to the home page
+            self.apos.attachment.all(result, { annotate: true });
+            return result;
+          }
 
-        function flatten(result, node) {
-          const children = node._children;
-          node._children = _.map(node._children, '_id');
-          result.push(node);
-          _.each(children || [], function(child) {
-            flatten(result, child);
-          });
+          function flatten(result, node) {
+            const children = node._children;
+            node._children = _.map(node._children, '_id');
+            result.push(node);
+            _.each(children || [], function(child) {
+              flatten(result, child);
+            });
 
+          }
         }
-      },
+      ],
       // _id may be a page _id, or the convenient shorthands
       // `_home` or `_archive`
-      async getOne(req, _id) {
-        _id = self.inferIdLocaleAndMode(req, _id);
-        // Edit access to draft is sufficient to fetch either
-        self.publicApiCheck(req);
-        const criteria = self.getIdCriteria(_id);
-        const result = await self.getRestQuery(req).and(criteria).toObject();
-        if (!result) {
-          throw self.apos.error('notfound');
-        }
-        if (self.apos.launder.boolean(req.query['render-areas']) === true) {
-          await self.apos.area.renderDocsAreas(req, [ result ]);
+
+      getOne: [
+        ...self.enableCacheOnDemand ? [ expressCacheOnDemand ] : [],
+        async (req, _id) => {
+          _id = self.inferIdLocaleAndMode(req, _id);
+          // Edit access to draft is sufficient to fetch either
+          self.publicApiCheck(req);
+          const criteria = self.getIdCriteria(_id);
+          const result = await self.getRestQuery(req).and(criteria).toObject();
+          if (!result) {
+            throw self.apos.error('notfound');
+          }
+          if (self.apos.launder.boolean(req.query['render-areas']) === true) {
+            await self.apos.area.renderDocsAreas(req, [ result ]);
+          }
+          // Attach `_url` and `_urls` properties
+          self.apos.attachment.all(result, { annotate: true });
+          return result;
         }
-        // Attach `_url` and `_urls` properties
-        self.apos.attachment.all(result, { annotate: true });
-        return result;
-      },
+      ],
       // POST a new page to the site. The schema fields should be part of the JSON request body.
       //
       // You may pass `_targetId` and `_position` to specify the location in the page tree.
@@ -576,7 +588,14 @@ database.`);
       },
       'apostrophe:ready': {
         addServeRoute() {
-          self.apos.app.get('*', self.serve);
+          self.apos.app.get('*',
+            (req, res, next) => {
+              return self.enableCacheOnDemand
+                ? expressCacheOnDemand(req, res, next)
+                : next();
+            },
+            self.serve
+          );
         }
       }
     };
@@ -1298,9 +1317,6 @@ database.`);
         if (!options) {
           options = {};
         }
-        const manager = self.apos.doc.getManager(page.type);
-        await manager.emit('beforeUpdate', req, page, options);
-        await manager.emit('beforeSave', req, page, options);
         await self.apos.doc.update(req, page, options);
         return page;
       },

package/modules/@apostrophecms/piece-page-type/index.js

@@ -220,7 +220,7 @@ module.exports = {
         if (!page) {
           return false;
         }
-        return page._url + '/' + piece.slug;
+        return self.apos.util.addSlashIfNeeded(page._url) + piece.slug;
       },
 
       // Adds the `._url` property to all of the provided pieces,

package/modules/@apostrophecms/piece-type/index.js

@@ -1,4 +1,5 @@
 const _ = require('lodash');
+const expressCacheOnDemand = require('express-cache-on-demand')();
 
 module.exports = {
   extend: '@apostrophecms/doc-type',
@@ -164,79 +165,91 @@ module.exports = {
     self.addManagerModal();
     self.addEditorModal();
   },
-  restApiRoutes: (self) => ({
-    async getAll(req) {
-      self.publicApiCheck(req);
-      const query = self.getRestQuery(req);
-      if (!query.get('perPage')) {
-        query.perPage(
-          self.options.perPage
-        );
-      }
-      const result = {};
-      // Also populates totalPages when perPage is present
-      const count = await query.toCount();
-      if (self.apos.launder.boolean(req.query.count)) {
-        return {
-          count
-        };
-      }
-      result.pages = query.get('totalPages');
-      result.currentPage = query.get('page') || 1;
-      result.results = await query.toArray();
-      if (self.apos.launder.boolean(req.query['render-areas']) === true) {
-        await self.apos.area.renderDocsAreas(req, result.results);
-      }
-      if (query.get('choicesResults')) {
-        result.choices = query.get('choicesResults');
-      }
-      if (query.get('countsResults')) {
-        result.counts = query.get('countsResults');
-      }
-      return result;
-    },
-    async getOne(req, _id) {
-      _id = self.inferIdLocaleAndMode(req, _id);
-      self.publicApiCheck(req);
-      const doc = await self.getRestQuery(req).and({ _id }).toObject();
-      if (!doc) {
-        throw self.apos.error('notfound');
-      }
-      if (self.apos.launder.boolean(req.query['render-areas']) === true) {
-        await self.apos.area.renderDocsAreas(req, [ doc ]);
-      }
-      self.apos.attachment.all(doc, { annotate: true });
-      return doc;
-    },
-    async post(req) {
-      self.publicApiCheck(req);
-      if (req.body._newInstance) {
-        const newInstance = self.newInstance();
-        newInstance._previewable = self.addUrlsViaModule && (await self.addUrlsViaModule.readyToAddUrlsToPieces(req, self.name));
-        delete newInstance._url;
-        return newInstance;
+  restApiRoutes(self) {
+    const { enableCacheOnDemand = true } = self.apos
+      .modules['@apostrophecms/express'].options;
+
+    return {
+      getAll: [
+        ...enableCacheOnDemand ? [ expressCacheOnDemand ] : [],
+        async (req) => {
+          self.publicApiCheck(req);
+          const query = self.getRestQuery(req);
+          if (!query.get('perPage')) {
+            query.perPage(
+              self.options.perPage
+            );
+          }
+          const result = {};
+          // Also populates totalPages when perPage is present
+          const count = await query.toCount();
+          if (self.apos.launder.boolean(req.query.count)) {
+            return {
+              count
+            };
+          }
+          result.pages = query.get('totalPages');
+          result.currentPage = query.get('page') || 1;
+          result.results = await query.toArray();
+          if (self.apos.launder.boolean(req.query['render-areas']) === true) {
+            await self.apos.area.renderDocsAreas(req, result.results);
+          }
+          if (query.get('choicesResults')) {
+            result.choices = query.get('choicesResults');
+          }
+          if (query.get('countsResults')) {
+            result.counts = query.get('countsResults');
+          }
+          return result;
+        }
+      ],
+      getOne: [
+        ...enableCacheOnDemand ? [ expressCacheOnDemand ] : [],
+        async (req, _id) => {
+          _id = self.inferIdLocaleAndMode(req, _id);
+          self.publicApiCheck(req);
+          const doc = await self.getRestQuery(req).and({ _id }).toObject();
+          if (!doc) {
+            throw self.apos.error('notfound');
+          }
+          if (self.apos.launder.boolean(req.query['render-areas']) === true) {
+            await self.apos.area.renderDocsAreas(req, [ doc ]);
+          }
+          self.apos.attachment.all(doc, { annotate: true });
+          return doc;
+        }
+      ],
+      async post(req) {
+        self.publicApiCheck(req);
+        if (req.body._newInstance) {
+          const newInstance = self.newInstance();
+          newInstance._previewable = self.addUrlsViaModule && (await self.addUrlsViaModule.readyToAddUrlsToPieces(req, self.name));
+          delete newInstance._url;
+          return newInstance;
+        }
+        return await self.convertInsertAndRefresh(req, req.body);
+      },
+      async put(req, _id) {
+        _id = self.inferIdLocaleAndMode(req, _id);
+        self.publicApiCheck(req);
+        return self.convertUpdateAndRefresh(req, req.body, _id);
+      },
+      async delete(req, _id) {
+        _id = self.inferIdLocaleAndMode(req, _id);
+        self.publicApiCheck(req);
+        const piece = await self.findOneForEditing(req, {
+          _id
+        });
+        return self.delete(req, piece);
+      },
+      async patch(req, _id) {
+        _id = self.inferIdLocaleAndMode(req, _id);
+        self.publicApiCheck(req);
+        return self.convertPatchAndRefresh(req, req.body, _id);
       }
-      return await self.convertInsertAndRefresh(req, req.body);
-    },
-    async put(req, _id) {
-      _id = self.inferIdLocaleAndMode(req, _id);
-      self.publicApiCheck(req);
-      return self.convertUpdateAndRefresh(req, req.body, _id);
-    },
-    async delete(req, _id) {
-      _id = self.inferIdLocaleAndMode(req, _id);
-      self.publicApiCheck(req);
-      const piece = await self.findOneForEditing(req, {
-        _id
-      });
-      return self.delete(req, piece);
-    },
-    async patch(req, _id) {
-      _id = self.inferIdLocaleAndMode(req, _id);
-      self.publicApiCheck(req);
-      return self.convertPatchAndRefresh(req, req.body, _id);
-    }
-  }),
+    };
+
+  },
   apiRoutes(self) {
     return {
       get: {

package/modules/@apostrophecms/util/ui/src/http.js

@@ -65,7 +65,6 @@ export default () => {
   // parsed as JSON only if the content-type is application/json)
   // `headers` (an object containing header names and values)
   // `draft` (if true, always add aposMode=draft to the query string, creating one if needed)
-  // `csrf` (unless explicitly set to `false`, send the X-XSRF-TOKEN header when talking to the same site)
   // `fullResponse` (if true, return an object with `status`, `headers` and `body`
   // properties, rather than returning the body directly; the individual `headers` are canonicalized
   // to lowercase names. If there are duplicate headers after canonicalization only the
@@ -140,10 +139,10 @@ export default () => {
 
     const busyName = options.busy === true ? 'busy' : options.busy;
     const xmlhttp = new XMLHttpRequest();
-    const csrfToken = apos.csrfCookieName ? apos.util.getCookie(apos.csrfCookieName) : 'csrf-fallback';
     let data = options.body;
     let keys;
     let i;
+
     if (options.qs) {
       url = apos.http.addQueryToUrl(url, options.qs);
     }
@@ -166,11 +165,6 @@ export default () => {
     if (sendJson) {
       xmlhttp.setRequestHeader('Content-Type', 'application/json');
     }
-    if (csrfToken && (options.csrf !== false)) {
-      if (apos.util.sameSite(url)) {
-        xmlhttp.setRequestHeader('X-XSRF-TOKEN', csrfToken);
-      }
-    }
     if (options.headers) {
       keys = Object.keys(options.headers);
       for (i = 0; (i < keys.length); i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apostrophe",
-  "version": "3.13.0",
+  "version": "3.14.0",
   "description": "The Apostrophe Content Management System.",
   "main": "index.js",
   "scripts": {
@@ -61,6 +61,7 @@
     "eslint-plugin-promise": "^5.1.0",
     "express": "^4.16.4",
     "express-bearer-token": "^2.4.0",
+    "express-cache-on-demand": "^1.0.3",
     "express-session": "^1.17.1",
     "form-data": "^4.0.0",
     "fs-extra": "^7.0.1",

package/test/express.js

@@ -39,37 +39,13 @@ describe('Express', function() {
     assert(body.toString() === 'ok');
   });
 
-  it('should flunk a POST request with no X-XSRF-TOKEN header', async function() {
+  it('should flunk a POST request without the CSRF cookie', async function() {
     try {
       await apos.http.post('/tests/body', {
         body: {
           person: {
             age: '30'
           }
-        },
-        jar,
-        csrf: false
-      });
-      assert(false);
-    } catch (e) {
-      assert(e);
-    }
-  });
-
-  it('should flunk a POST request with the wrong CSRF token', async function() {
-    const csrfToken = 'BOGOSITY';
-
-    try {
-      await apos.http.post('/tests/body', {
-        body: {
-          person: {
-            age: '30'
-          }
-        },
-        jar,
-        csrf: false,
-        headers: {
-          'X-XSRF-TOKEN': csrfToken
         }
       });
       assert(false);
@@ -78,7 +54,7 @@ describe('Express', function() {
     }
   });
 
-  it('should use the extended bodyParser for submitted forms', async function() {
+  it('should use the extended bodyParser for submitted forms, and pass CSRF with the cookie', async function() {
 
     const response = await apos.http.post('/tests/body', {
       send: 'form',

package/test/http.js

@@ -40,30 +40,6 @@ describe('Http', function() {
     assert(result.match(/logged out/));
   });
 
-  it('should not be able to make an http POST request without csrf header', async () => {
-    try {
-      await apos.http.post('/csrf-test', {
-        jar,
-        csrf: false
-      });
-      assert(false);
-    } catch (e) {
-      assert(e.status === 403);
-    }
-  });
-
-  it('should be able to make an http POST request with manually built csrf header', async () => {
-    const response = await apos.http.post('/csrf-test?manual=1', {
-      jar,
-      headers: {
-        'X-XSRF-TOKEN': apos.http.getCookie(jar, '/', `${apos.options.shortName}.csrf`)
-      },
-      body: {},
-      csrf: false
-    });
-    assert(response.ok === true);
-  });
-
   it('should be able to make an http POST request with csrf header via default csrf convenience of http.post', async () => {
     const response = await apos.http.post('/csrf-test', {
       jar,

package/test/pieces-page-type.js

@@ -34,6 +34,24 @@ describe('Pieces Pages', function() {
             perPage: 10
           }
         },
+        home: {
+          extend: '@apostrophecms/piece-type',
+          options: {
+            name: 'home',
+            label: 'Home',
+            alias: 'home',
+            sort: { title: 1 }
+          }
+        },
+        'home-page': {
+          extend: '@apostrophecms/piece-page-type',
+          options: {
+            name: 'homePiecePage',
+            label: 'Home Piece Page',
+            alias: 'homePiecePage',
+            perPage: 10
+          }
+        },
         '@apostrophecms/page': {
           options: {
             park: [
@@ -42,6 +60,12 @@ describe('Pieces Pages', function() {
                 type: 'eventPage',
                 slug: '/events',
                 parkedId: 'events'
+              },
+              {
+                title: 'Home piece page',
+                type: 'homePiecePage',
+                slug: '/',
+                parkedId: 'home'
               }
             ]
           }
@@ -81,6 +105,36 @@ describe('Pieces Pages', function() {
     return apos.doc.db.insertMany(testItems);
   });
 
+  it('should be able to use db to insert test "home" pieces', async function() {
+    assert(apos.modules.home);
+    const testItems = [];
+    const total = 100;
+    for (let i = 1; (i <= total); i++) {
+      const paddedInt = apos.launder.padInteger(i, 3);
+
+      testItems.push({
+        _id: 'home' + paddedInt,
+        slug: 'home-' + paddedInt,
+        visibility: 'public',
+        type: 'home',
+        title: 'Home ' + paddedInt,
+        titleSortified: 'home ' + paddedInt,
+        body: {
+          metaType: 'area',
+          _id: apos.util.generateId(),
+          items: [
+            {
+              metaType: 'widget',
+              type: '@apostrophecms/rich-text',
+              content: '<p>This is some content.</p>'
+            }
+          ]
+        }
+      });
+    }
+
+    return apos.doc.db.insertMany(testItems);
+  });
   it('should populate the ._url property of pieces in any docs query', async function() {
     const piece = await apos.doc.find(apos.task.getAnonReq(), {
       type: 'event',
@@ -104,6 +158,15 @@ describe('Pieces Pages', function() {
     assert((!piece._url) || (piece._url.match(/undefined/)));
   });
 
+  it('should not create a double-slashed _url on a piece-page-type set as the homepage', async function() {
+    const piece = await apos.doc.find(apos.task.getAnonReq(), {
+      type: 'home',
+      title: 'Home 001'
+    }).toObject();
+    assert(piece);
+    assert(piece._url === '/home-001');
+  });
+
   it('should correctly populate the ._url property of pieces in a docs query if _url itself is "projected"', async function() {
     const piece = await apos.doc.find(apos.task.getAnonReq(), {
       type: 'event',