apostrophe 3.24.0 → 3.26.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 3.26.0
+
+### Adds
+
+* Tasks can now be registered with the `afterModuleReady` flag, which is more useful than `afterModuleInit` because it waits for the module to be more fully initialized, including all "improvements" loaded via npm. The original `afterModuleInit` flag is still supported in case someone was counting on its behavior.
+* Add `/grid` `POST` route in permission module, in addition to the existing `GET` one, to improve extensibility.
+
+### Changes
+
+* Since Microsoft has ended support for IE11 and support for ES5 builds is responsible for a significant chunk of Apostrophe's installation time, the `es5: true` option no longer produces an IE11 build. For backwards compatibility, developers will receive a warning, but their build will proceed without IE11 support. IE11 ES5 builds can be brought back by installing the optional [@apostrophecms/asset-es5](https://github.com/apostrophecms/asset-es5) module.
+
+### Fixes
+
+* `testModule: true` works in unit tests of external Apostrophe modules again even with modern versions of `mocha`, thanks to [Amin Shazrin](https://github.com/ammein).
+* `getObjectManager` is now implemented for `Object` field types, fixing a bug that prevented the use of areas found in `object` schema fields within templates. Thanks to [James R T](https://github.com/jamestiotio).
+
+## 3.25.0 (2022-07-20)
+
+### Adds
+
+* `radio` and `checkboxes` input field types now support a server side `choices` function for supplying their `choices` array dynamically, just like `select` fields do. Future custom field types can opt into this functionality with the field type flag `dynamicChoices: true`.
+
+### Fixes
+
+* `AposSelect` now emits values on `change` event as they were originally given. Their values "just work" so you do not have to think about JSON anymore when you receive it.
+* Unpinned tiptap as the tiptap team has made releases that resolve the packaging errors that caused us to pin it in 3.22.1.
+* Pinned `vue-loader` to the `15.9.x` minor release series for now. The `15.10.0` release breaks support for using `npm link` to develop the `apostrophe` module itself.
+* Minimum version of `sanitize-html` bumped to ensure a potential denial-of-service vector is closed.
+
 ## 3.24.0 (2022-07-06)
 
 ### Adds

package/index.js

@@ -505,14 +505,18 @@ async function apostrophe(options, telemetry, rootSpan) {
     // and throws an exception if we don't
     function findTestModule() {
       let m = module;
+      const nodeModuleRegex = new RegExp(`node_modules${path.sep}mocha`);
+      if (!require.main.filename.match(nodeModuleRegex)) {
+        throw new Error('mocha does not seem to be running, is this really a test?');
+      }
       while (m) {
-        if (m.parent && m.parent.filename.match(/node_modules\/mocha/)) {
+        if (m.parent && m.parent.filename.match(nodeModuleRegex)) {
+          return m;
+        } else if (!m.parent) {
+          // Mocha v10 doesn't inject mocha paths inside `module`, therefore, we only detect the parent until the last parent. But we can get Mocha running using `require.main` - Amin
           return m;
         }
         m = m.parent;
-        if (!m) {
-          throw new Error('mocha does not seem to be running, is this really a test?');
-        }
       }
     }
   }
@@ -562,7 +566,8 @@ async function apostrophe(options, telemetry, rootSpan) {
     self.modules = {};
     for (const item of modulesToBeInstantiated()) {
       // module registers itself in self.modules
-      await self.synth.create(item, { apos: self });
+      const module = await self.synth.create(item, { apos: self });
+      await module.emit('moduleReady');
     }
   }
 

package/modules/@apostrophecms/asset/index.js

@@ -42,6 +42,7 @@ module.exports = {
   },
 
   async init(self) {
+
     self.restartId = self.apos.util.generateId();
     self.iconMap = {
       ...globalIcons
@@ -63,6 +64,7 @@ module.exports = {
     self.buildWatcherEnable = process.env.APOS_ASSET_WATCH !== '0' && self.options.watch !== false;
     self.buildWatcherDebounceMs = parseInt(self.options.watchDebounceMs || 1000, 10);
     self.buildWatcher = null;
+
   },
   handlers (self) {
     return {
@@ -121,6 +123,15 @@ module.exports = {
         usage: 'Build Apostrophe frontend CSS and JS bundles',
         afterModuleInit: true,
         async task(argv = {}) {
+          if (self.options.es5 && !self.es5TaskFn) {
+            self.apos.util.warnDev(stripIndent`
+              es5: true is set. IE11 compatibility builds now require that you
+              install the optional @apostrophecms/asset-es5 module. Until then,
+              for backwards compatibility, your build will succeed but
+              will not be IE11 compatible.
+            `);
+            self.options.es5 = false;
+          }
           // The lock could become huge, cache it, see computeCacheMeta()
           let packageLockContentCached;
           const req = self.apos.task.getReq();
@@ -350,7 +361,11 @@ module.exports = {
                 modulesDir,
                 outputPath: bundleDir,
                 outputFilename,
-                bundles: webpackExtraBundles
+                bundles: webpackExtraBundles,
+                // Added on the fly by the
+                // @apostrophecms/asset-es5 module,
+                // if it is present
+                es5TaskFn: self.es5TaskFn
               }, self.apos);
 
               const webpackInstanceConfigMerged = self.webpackExtensions
@@ -841,7 +856,7 @@ module.exports = {
 
       'clear-cache': {
         usage: 'Clear build cache',
-        afterModuleInit: true,
+        afterModuleReady: true,
         async task(argv) {
           const cacheBaseDir = self.getCacheBasePath();
 
@@ -1161,7 +1176,7 @@ module.exports = {
       // If you are trying to enable IE11 support for ui/src, use the
       // `es5: true` option (es5 builds are disabled by default).
       configureBuilds() {
-        const srcPrologue = stripIndent`
+        self.srcPrologue = stripIndent`
           (function() {
             window.apos = window.apos || {};
             var data = document.body && document.body.getAttribute('data-apos');
@@ -1188,26 +1203,7 @@ module.exports = {
             index: true,
             // Load only in browsers that support ES6 modules
             condition: 'module',
-            prologue: srcPrologue
-          },
-          'src-es5': {
-            // An alternative build from the same sources for IE11
-            source: 'src',
-            webpack: true,
-            scenes: [ 'public', 'apos' ],
-            // The CSS from the src build is identical, do not duplicate it
-            outputs: [ 'js' ],
-            label: 'apostrophe:ie11Build',
-            // Load index.js and index.scss from each module
-            index: true,
-            // The polyfills babel will be expecting
-            prologue: stripIndent`
-              import "core-js/stable";
-              import "regenerator-runtime/runtime";
-              ${srcPrologue}
-            `,
-            // Load only in browsers that do not support ES6 modules
-            condition: 'nomodule'
+            prologue: self.srcPrologue
           },
           public: {
             scenes: [ 'public', 'apos' ],
@@ -1236,9 +1232,6 @@ module.exports = {
           // We could add an apos-ie11 bundle that just pushes a "sorry charlie" prologue,
           // if we chose
         };
-        if (!self.options.es5) {
-          delete self.builds['src-es5'];
-        }
       },
       // Filter the given css performing any necessary transformations,
       // such as support for the /modules path regardless of where

package/modules/@apostrophecms/asset/lib/webpack/src/webpack.config.js

@@ -1,7 +1,6 @@
 const path = require('path');
 const merge = require('webpack-merge').merge;
 const scssTask = require('./webpack.scss');
-const es5Task = require('./webpack.es5');
 const srcBuildNames = [ 'src-build', 'src-es5-build' ];
 
 let BundleAnalyzerPlugin;
@@ -11,14 +10,11 @@ if (process.env.APOS_BUNDLE_ANALYZER) {
 }
 
 module.exports = ({
-  importFile, modulesDir, outputPath, outputFilename, bundles = {}, es5
+  importFile, modulesDir, outputPath, outputFilename, bundles = {}, es5, es5TaskFn
 }, apos) => {
   const mainBundleName = outputFilename.replace('.js', '');
-  const taskFns = [ scssTask ];
+  const taskFns = [ scssTask, ...(es5 ? [ es5TaskFn ] : []) ];
 
-  if (es5) {
-    taskFns.push(es5Task);
-  }
   const tasks = taskFns.map(task =>
     task(
       {

package/modules/@apostrophecms/db/index.js

@@ -168,7 +168,7 @@ This database contains an Apostrophe 2.x website. Exiting to avoid content loss.
       // and start up your app, which will recreate them.
       reset: {
         usage: 'Usage: node app @apostrophecms/db:reset\n\nThis destroys ALL of your content. EVERYTHING in your database.\n',
-        afterModuleInit: true,
+        afterModuleReady: true,
         exitAfter: false,
         task: async () => {
           const argv = self.apos.argv;

package/modules/@apostrophecms/i18n/i18n/en.json

@@ -288,7 +288,6 @@
   "previousPage": "Previous Page",
   "public": "Public",
   "modernBuild": "Public-facing modern JavaScript and Sass",
-  "ie11Build": "Public-facing modern JavaScript and Sass (IE11 build)",
   "publish": "Publish",
   "publishBeforeUsingTooltip": "Publish this content before using it in a relationship",
   "published": "Published",

package/modules/@apostrophecms/i18n/i18n/es.json

@@ -265,7 +265,6 @@
   "previousPage": "Página Previa",
   "public": "Público",
   "modernBuild": "JavaScript y Sass moderno orientado al público",
-  "ie11Build": "JavaScript y Sass (edición IE11) moderno orientado al público",
   "publish": "Publicar",
   "publishBeforeUsingTooltip": "Publique este contenido antes de utilizarlo en una relación",
   "published": "Publicado",

package/modules/@apostrophecms/i18n/i18n/pt-BR.json

@@ -263,7 +263,6 @@
   "previousPage": "Página Anterior",
   "public": "Público",
   "modernBuild": "JavaScript and Sass modernos públicos",
-  "ie11Build": "JavaScript and Sass (IE11 build) modernos públicos",
   "publish": "Publicar",
   "publishBeforeUsingTooltip": "Publique esse conteúdo antes de usá-lo em um relacionamento",
   "published": "Publicado",

package/modules/@apostrophecms/i18n/i18n/sk.json

@@ -277,7 +277,6 @@
   "previousPage": "Predchádzajúca strana",
   "public": "Verejné",
   "modernBuild": "Verejnosti orientovaný moderný JavaScript a Sass",
-  "ie11Build": "Verejný moderný JavaScript a Sass (zostava IE11)",
   "publish": "Publikovať",
   "publishBeforeUsingTooltip": "Pred použitím v kontexte zverejnite tento obsah",
   "published": "Publikovaný",

package/modules/@apostrophecms/image/ui/apos/components/AposImageRelationshipEditor.vue

@@ -396,7 +396,7 @@ export default {
         };
     },
     updateAspectRatio(value) {
-      this.aspectRatio = parseFloat(value);
+      this.aspectRatio = value;
       this.computeMaxSizes();
       this.computeMinSizes();
     },

package/modules/@apostrophecms/module/index.js

@@ -705,8 +705,12 @@ module.exports = {
       },
 
       async executeAfterModuleInitTask() {
+        return self.executeAfterModuleTask('afterModuleInit');
+      },
+
+      async executeAfterModuleTask(when) {
         for (const [ name, info ] of Object.entries(self.tasks || {})) {
-          if (info.afterModuleInit) {
+          if (info[when]) {
             // Execute a task like @apostrophecms/asset:build or
             // @apostrophecms/db:reset which
             // must run before most modules are awake
@@ -764,6 +768,11 @@ module.exports = {
 
   handlers(self) {
     return {
+      moduleReady: {
+        executeAfterModuleReadyTask() {
+          return self.executeAfterModuleTask('afterModuleReady');
+        }
+      },
       'apostrophe:modulesRegistered': {
         addHelpers() {
           // We check this just to allow init in bootstrap tests that

package/modules/@apostrophecms/permission/index.js

@@ -302,6 +302,29 @@ module.exports = {
         const manager = self.apos.doc.getManager(permissionSet.name);
         return manager.options.showPermissions;
       },
+      grid(req, role) {
+        if (!self.can(req, 'edit', '@apostrophecms/user')) {
+          throw self.apos.error('forbidden');
+        }
+        const permissionSets = [];
+        const effectiveRole = self.apos.launder.select(role, [ 'guest', 'contributor', 'editor', 'admin' ]);
+        if (!effectiveRole) {
+          throw self.apos.error('invalid', { role: effectiveRole });
+        }
+        const _req = self.apos.task.getReq({
+          role: effectiveRole,
+          mode: 'draft'
+        });
+        for (const module of Object.values(self.apos.modules)) {
+          if (self.apos.synth.instanceOf(module, '@apostrophecms/piece-type')) {
+            permissionSets.push(self.describePermissionSet(_req, module, { piece: true }));
+          }
+        }
+        permissionSets.push(self.describePermissionSet(_req, self.apos.modules['@apostrophecms/any-page-type']));
+        return {
+          permissionSets: self.presentPermissionSets(permissionSets)
+        };
+      },
       ...require('./lib/legacy-migrations')(self)
     };
   },
@@ -309,27 +332,12 @@ module.exports = {
     return {
       get: {
         async grid(req) {
-          if (!self.apos.permission.can(req, 'edit', '@apostrophecms/user')) {
-            throw self.apos.error('forbidden');
-          }
-          const permissionSets = [];
-          const effectiveRole = self.apos.launder.select(req.query.role, [ 'guest', 'contributor', 'editor', 'admin' ]);
-          if (!effectiveRole) {
-            throw self.apos.error('invalid', { role: effectiveRole });
-          }
-          const _req = self.apos.task.getReq({
-            role: effectiveRole,
-            mode: 'draft'
-          });
-          for (const module of Object.values(self.apos.modules)) {
-            if (self.apos.synth.instanceOf(module, '@apostrophecms/piece-type')) {
-              permissionSets.push(self.describePermissionSet(_req, module, { piece: true }));
-            }
-          }
-          permissionSets.push(self.describePermissionSet(_req, self.apos.modules['@apostrophecms/any-page-type']));
-          return {
-            permissionSets: self.presentPermissionSets(permissionSets)
-          };
+          return self.grid(req, req.query.role);
+        }
+      },
+      post: {
+        async grid(req) {
+          return self.grid(req, req.body.role);
         }
       }
     };

package/modules/@apostrophecms/permission/ui/apos/components/AposInputRole.vue

@@ -7,26 +7,15 @@
     :display-options="displayOptions"
   >
     <template #body>
-      <div class="apos-input-wrapper apos-input__role">
-        <select
-          class="apos-input apos-input--select apos-input--role" :id="uid"
-          @change="change($event.target.value)"
-          :disabled="field.readOnly"
-        >
-          <option
-            v-for="choice in choices" :key="JSON.stringify(choice.value)"
-            :value="JSON.stringify(choice.value)"
-            :selected="choice.value === value.data"
-          >
-            {{ $t(choice.label) }}
-          </option>
-        </select>
-        <AposIndicator
-          icon="menu-down-icon"
-          class="apos-input-icon"
-          :icon-size="20"
-        />
-      </div>
+      <AposSelect
+        :choices="choices"
+        :disabled="field.readOnly"
+        :selected="value.data"
+        :id="uid"
+        :classes="[ 'apos-input__role' ]"
+        :wrapper-classes="[ 'apos-input__role' ]"
+        @change="change"
+      />
       <div class="apos-input__role__permission-grid">
         <div
           v-for="permissionSet in permissionSets"
@@ -152,15 +141,17 @@ export default {
     },
     change(value) {
       // Allows expression of non-string values
-      this.next = this.choices.find(choice => choice.value === JSON.parse(value)).value;
+      this.next = this.choices.find(choice => choice.value === value).value;
     },
     async getPermissionSets(role) {
-      return (await apos.http.get(`${apos.permission.action}/grid`, {
-        qs: {
+      const { permissionSets } = await apos.http.post(`${apos.permission.action}/grid`, {
+        body: {
           role
         },
         busy: true
-      })).permissionSets;
+      });
+
+      return permissionSets;
     }
   }
 };

package/modules/@apostrophecms/schema/index.js

@@ -1405,6 +1405,10 @@ module.exports = {
       getArrayManager(name) {
         return self.arrayManagers[name];
       },
+      // This allows the getManagerOf method to operate on objects of type "object".
+      getObjectManager(name) {
+        return self.objectManagers[name];
+      },
       // Regenerate all array item, area and widget ids so they are considered
       // new. Useful when copying an entire doc.
       regenerateIds(req, schema, doc) {
@@ -1453,6 +1457,12 @@ module.exports = {
         _.each(self.apos.area.widgetManagers, function (manager, type) {
           self.register('widget', type, manager.schema);
         });
+      },
+
+      async getChoices(req, field) {
+        return typeof field.choices === 'string'
+          ? self.apos.modules[field.moduleName][field.choices](req)
+          : field.choices;
       }
 
     };
@@ -1466,7 +1476,7 @@ module.exports = {
           let choices = [];
           if (
             !field ||
-            field.type !== 'select' ||
+            !self.fieldTypes[field.type].dynamicChoices ||
             !(field.choices && typeof field.choices === 'string')
           ) {
             throw self.apos.error('invalid');

package/modules/@apostrophecms/schema/lib/addFieldTypes.js

@@ -231,7 +231,9 @@ module.exports = (self) => {
 
   self.addFieldType({
     name: 'checkboxes',
+    dynamicChoices: true,
     async convert(req, field, data, destination) {
+      const choices = await self.getChoices(req, field);
       if (typeof data[field.name] === 'string') {
         data[field.name] = self.apos.launder.string(data[field.name]).split(',');
 
@@ -241,14 +243,14 @@ module.exports = (self) => {
         }
 
         destination[field.name] = _.filter(data[field.name], function (choice) {
-          return _.includes(_.map(field.choices, 'value'), choice);
+          return _.includes(_.map(choices, 'value'), choice);
         });
       } else {
         if (!Array.isArray(data[field.name])) {
           destination[field.name] = [];
         } else {
           destination[field.name] = _.filter(data[field.name], function (choice) {
-            return _.includes(_.map(field.choices, 'value'), choice);
+            return _.includes(_.map(choices, 'value'), choice);
           });
         }
       }
@@ -303,13 +305,9 @@ module.exports = (self) => {
 
   self.addFieldType({
     name: 'select',
+    dynamicChoices: true,
     async convert(req, field, data, destination) {
-      let choices;
-      if ((typeof field.choices) === 'string') {
-        choices = await self.apos.modules[field.moduleName][field.choices](req);
-      } else {
-        choices = field.choices;
-      }
+      const choices = await self.getChoices(req, field);
       destination[field.name] = self.apos.launder.select(data[field.name], choices, field.def);
     },
     index: function (value, field, texts) {

package/modules/@apostrophecms/schema/ui/apos/components/AposInputCheckboxes.vue

@@ -8,7 +8,7 @@
     <template #body>
       <AposCheckbox
         :for="getChoiceId(uid, choice.value)"
-        v-for="choice in field.choices"
+        v-for="choice in choices"
         :key="choice.value"
         :id="getChoiceId(uid, choice.value)"
         :choice="choice"
@@ -21,10 +21,11 @@
 
 <script>
 import AposInputMixin from 'Modules/@apostrophecms/schema/mixins/AposInputMixin';
+import AposInputChoicesMixin from 'Modules/@apostrophecms/schema/mixins/AposInputChoicesMixin';
 
 export default {
   name: 'AposInputCheckboxes',
-  mixins: [ AposInputMixin ],
+  mixins: [ AposInputMixin, AposInputChoicesMixin ],
   beforeMount: function () {
     this.value.data = Array.isArray(this.value.data) ? this.value.data : [];
   },
@@ -38,7 +39,7 @@ export default {
     },
     validate(values) {
       // The choices and values should always be arrays.
-      if (!Array.isArray(this.field.choices) || !Array.isArray(values)) {
+      if (!Array.isArray(this.choices) || !Array.isArray(values)) {
         return 'malformed';
       }
 
@@ -48,7 +49,7 @@ export default {
 
       if (Array.isArray(values)) {
         values.forEach(chosen => {
-          if (!this.field.choices.map(choice => {
+          if (!this.choices.map(choice => {
             return choice.value;
           }).includes(chosen)) {
             return 'invalid';

package/modules/@apostrophecms/schema/ui/apos/components/AposInputRadio.vue

@@ -8,7 +8,7 @@
     <template #body>
       <label
         class="apos-choice-label" :for="getChoiceId(uid, choice.value)"
-        v-for="choice in field.choices" :key="choice.value"
+        v-for="choice in choices" :key="choice.value"
         :class="{'apos-choice-label--disabled': field.readOnly}"
       >
         <input
@@ -43,12 +43,13 @@
 
 <script>
 import AposInputMixin from 'Modules/@apostrophecms/schema/mixins/AposInputMixin';
+import AposInputChoicesMixin from 'Modules/@apostrophecms/schema/mixins/AposInputChoicesMixin';
 import InformationIcon from 'vue-material-design-icons/Information.vue';
 
 export default {
   name: 'AposInputRadio',
   components: { InformationIcon },
-  mixins: [ AposInputMixin ],
+  mixins: [ AposInputMixin, AposInputChoicesMixin ],
   methods: {
     getChoiceId(uid, value) {
       return (uid + JSON.stringify(value)).replace(/\s+/g, '');
@@ -58,7 +59,7 @@ export default {
         return 'required';
       }
 
-      if (value && !this.field.choices.find(choice => choice.value === value)) {
+      if (value && !this.choices.find(choice => choice.value === value)) {
         return 'invalid';
       }
 
@@ -66,7 +67,7 @@ export default {
     },
     change(value) {
       // Allows expression of non-string values
-      this.next = this.field.choices.find(choice => choice.value === JSON.parse(value)).value;
+      this.next = this.choices.find(choice => choice.value === JSON.parse(value)).value;
     }
   }
 };

package/modules/@apostrophecms/schema/ui/apos/components/AposInputSelect.vue

@@ -20,10 +20,11 @@
 
 <script>
 import AposInputMixin from 'Modules/@apostrophecms/schema/mixins/AposInputMixin';
+import AposInputChoicesMixin from 'Modules/@apostrophecms/schema/mixins/AposInputChoicesMixin';
 
 export default {
   name: 'AposInputSelect',
-  mixins: [ AposInputMixin ],
+  mixins: [ AposInputMixin, AposInputChoicesMixin ],
   props: {
     icon: {
       type: String,
@@ -37,34 +38,15 @@ export default {
     };
   },
   async mounted() {
-    let choices;
-    if (typeof this.field.choices === 'string') {
-      const action = this.options.action;
-      const response = await apos.http.get(
-        `${action}/choices`,
-        {
-          qs: {
-            fieldId: this.field._id
-          },
-          busy: true
-        }
-      );
-      if (response.choices) {
-        choices = response.choices;
-      }
-    } else {
-      choices = this.field.choices;
-    }
     // Add an null option if there isn't one already
-    if (!this.field.required && !choices.find(choice => {
+    if (!this.field.required && !this.choices.find(choice => {
       return choice.value === null;
     })) {
-      this.choices.push({
+      this.choices.unshift({
         label: '',
         value: null
       });
     }
-    this.choices = this.choices.concat(choices);
     this.$nextTick(() => {
       // this has to happen on nextTick to avoid emitting before schemaReady is
       // set in AposSchema
@@ -87,7 +69,7 @@ export default {
     },
     change(value) {
       // Allows expression of non-string values
-      this.next = this.choices.find(choice => choice.value === JSON.parse(value)).value;
+      this.next = this.choices.find(choice => choice.value === value).value;
     }
   }
 };

package/modules/@apostrophecms/schema/ui/apos/mixins/AposInputChoicesMixin.js

@@ -0,0 +1,32 @@
+/*
+* Provides prep work for fetching choices from the server
+* or defaulting to the choices provided with the field.
+*/
+
+export default {
+  data() {
+    return {
+      choices: []
+    };
+  },
+
+  async mounted() {
+    if (typeof this.field.choices === 'string') {
+      const action = this.options.action;
+      const response = await apos.http.get(
+        `${action}/choices`,
+        {
+          qs: {
+            fieldId: this.field._id
+          },
+          busy: true
+        }
+      );
+      if (response.choices) {
+        this.choices = response.choices;
+      }
+    } else {
+      this.choices = this.field.choices;
+    }
+  }
+};