apostrophe 3.58.0 → 3.59.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 3.59.0 (2023-11-03)
+
+### Changes
+
+* Webpack warnings about package size during the admin UI build process have been turned off by default. Warnings are still enabled for the public build, where a large bundle can be problematic for SEO.
+
+### Fixes
+
+* Apostrophe warns you if you have more than one piece page for the same piece type and you have not overridden `chooseParentPage`
+to help Apostrophe decide which page is suitable as the `_url` of each piece. Beginning with this release, Apostrophe can recognize
+when you have chosen to do this via `extendMethods`, so that you can call `_super()` to fall back to the default implementation without
+receiving this warning. The default implementation still just returns the first page found, but always following the
+`_super()` pattern here opens the door to npm modules that `improve` `@apostrophecms/piece-page` to do something more
+sophisticated by default.
+* `newInstance` always returns a reasonable non-null empty value for area and
+object fields in case the document is inserted without being passed through
+the editor, e.g. in a parked page like the home page. This simplifies
+the new external front feature.
+
+### Adds
+
+* An adapter for Astro is under development with support from Michelin.
+Starting with this release, adapters for external fronts, i.e. "back for front"
+frameworks such as Astro, may now be implemented more easily. Apostrophe recognizes the
+`x-requested-with: AposExternalFront` header and the `apos-external-front-key` header.
+If both are present and `apos-external-front-key` matches the `APOS_EXTERNAL_FRONT_KEY`
+environment variable, then Apostrophe returns JSON in place of a normal page response.
+This mechanism is also available for the `render-widget` route.
+* Like `type`, `metaType` is always included in projections. This helps
+ensure that `apos.util.getManagerOf()` can be used on any object returned
+by the Apostrophe APIs.
+
+## 3.58.1 (2023-10-18)
+
+### Security
+
+* Update `uploadfs` to guarantee users get a fix for a [potential security vulnerability in `sharp`](https://security.snyk.io/vuln/SNYK-JS-SHARP-5922108).
+This was theoretically exploitable only by users with permission to upload media to Apostrophe
+* Remove the webpack bundle analyzer feature, which had been nonfunctional for some time, to address a harmless npm audit warning
+* Note: there is one remaining `npm audit` warning regarding `postcss`. This is not a true vulnerability because only developers
+with access to the entire codebase can modify styles passed to `postcss` by Apostrophe, but we are working with upstream
+developers to determine the best steps to clear the warning
+
+### Fixes
+
+* Automatically add `type` to the projection only if there are no exclusions in the projection. Needed to prevent `Cannot do
+exclusion on field in inclusion projection` error.
+
 ## 3.58.0 (2023-10-12)
 
 ### Fixes

package/DEVELOPMENT.md

@@ -10,15 +10,3 @@ We generally aim to follow [Vue best practices](https://vuejs.org/v2/style-guide
 ### UI component styles
 
 As a rule, all user interface components should have their styles scoped (using the `scoped` attribute). This helps us write simpler CSS selectors and avoide a certain amount of style "bleed" across components. Global styles, and styles for top level Vue apps (e.g., `TheAposNotifications`), should be in `.scss` files and imported into the import file: `/modules/@apostrophecms/ui/ui/apos/scss/imports.scss`.
-
-## Analyzing bundle size
-
-It is possible to analyze the size of the admin UI webpack bundle:
-
-```
-APOS_BUNDLE_ANALYZER=1 node app @apostrophecms/asset:build
-```
-
-This will display a visualization in your browser.
-
-As of this writing, we are not optimizing the webpack build for production, so expect to see big numbers.

package/modules/@apostrophecms/area/index.js

@@ -68,6 +68,13 @@ module.exports = {
             return manager.loadIfSuitable(req, [ widget ]);
           }
           async function render() {
+            if (req.aposExternalFront) {
+              const result = {
+                ...req.data,
+                widget
+              };
+              return result;
+            }
             return self.renderWidget(req, type, widget, options);
           }
         }

package/modules/@apostrophecms/asset/index.js

@@ -253,13 +253,6 @@ module.exports = {
 
           await deploy(deployFiles);
 
-          if (process.env.APOS_BUNDLE_ANALYZER) {
-            return new Promise((resolve, reject) => {
-              // Intentionally never resolve it, so the task never exits
-              // and the UI stays up
-            });
-          }
-
           async function moduleOverrides(modulesDir, source, pnpmPaths) {
             await fs.remove(modulesDir);
             await fs.mkdirp(modulesDir);

package/modules/@apostrophecms/asset/lib/webpack/apos/webpack.config.js

@@ -4,12 +4,6 @@ const scss = require('./webpack.scss');
 const vue = require('./webpack.vue');
 const js = require('./webpack.js');
 
-let BundleAnalyzerPlugin;
-
-if (process.env.APOS_BUNDLE_ANALYZER) {
-  BundleAnalyzerPlugin = require('webpack-bundle-analyzer').BundleAnalyzerPlugin;
-}
-
 module.exports = ({
   importFile,
   modulesDir,
@@ -30,6 +24,9 @@ module.exports = ({
 
   const pnpmModulePath = apos.isPnpm ? [ path.join(apos.selfDir, '../') ] : [];
   const config = {
+    performance: {
+      hints: false
+    },
     entry: importFile,
     // Ensure that the correct version of vue-loader is found
     context: __dirname,
@@ -84,8 +81,7 @@ module.exports = ({
       ],
       symlinks: false
     },
-    stats: 'verbose',
-    plugins: process.env.APOS_BUNDLE_ANALYZER ? [ new BundleAnalyzerPlugin() ] : []
+    stats: 'verbose'
   };
 
   return merge(config, ...tasks);

package/modules/@apostrophecms/asset/lib/webpack/apos/webpack.vue.js

@@ -1,4 +1,4 @@
-const VueLoaderPlugin = require('vue-loader/lib/plugin');
+const { VueLoaderPlugin } = require('vue-loader');
 
 module.exports = (options, apos) => {
   return {

package/modules/@apostrophecms/asset/lib/webpack/src/webpack.config.js

@@ -3,12 +3,6 @@ const merge = require('webpack-merge').merge;
 const scssTask = require('./webpack.scss');
 const srcBuildNames = [ 'src-build', 'src-es5-build' ];
 
-let BundleAnalyzerPlugin;
-
-if (process.env.APOS_BUNDLE_ANALYZER) {
-  BundleAnalyzerPlugin = require('webpack-bundle-analyzer').BundleAnalyzerPlugin;
-}
-
 module.exports = ({
   importFile,
   modulesDir,
@@ -99,7 +93,7 @@ module.exports = ({
       symlinks: false
     },
     stats: 'verbose',
-    plugins: process.env.APOS_BUNDLE_ANALYZER ? [ new BundleAnalyzerPlugin() ] : []
+    plugins: []
   };
 
   if (es5) {

package/modules/@apostrophecms/doc-type/index.js

@@ -1626,8 +1626,10 @@ module.exports = {
             const remove = [];
 
             // Add type in projection by default
-            if (!_.isEmpty(projection)) {
+            const hasExclusion = Object.values(projection).some(value => !value);
+            if (!_.isEmpty(projection) && !hasExclusion) {
               add.push('type');
+              add.push('metaType');
             }
 
             for (const [ key, val ] of Object.entries(projection)) {

package/modules/@apostrophecms/doc-type/ui/apos/components/AposDocEditor.vue

@@ -64,7 +64,7 @@
               :trigger-validation="triggerValidation"
               :utility-rail="false"
               :following-values="followingValues('other')"
-              :conditional-fields="conditionalFields('other')"
+              :conditional-fields="conditionalFields"
               :doc-id="docId"
               :value="docFields"
               :server-errors="serverErrors"
@@ -89,7 +89,7 @@
             :trigger-validation="triggerValidation"
             :utility-rail="true"
             :following-values="followingUtils"
-            :conditional-fields="conditionalFields('utility')"
+            :conditional-fields="conditionalFields"
             :doc-id="docId"
             :value="docFields"
             @input="updateDocFields"
@@ -321,7 +321,7 @@ export default {
   },
   watch: {
     'docFields.data.type': {
-      handler(newVal, oldVal) {
+      handler(newVal) {
         if (this.moduleName !== '@apostrophecms/page') {
           return;
         }
@@ -342,6 +342,7 @@ export default {
   },
   async mounted() {
     this.modal.active = true;
+    await this.evaluateExternalConditions();
     // After computed properties become available
     this.saveMenu = this.computeSaveMenu();
     this.cancelDescription = {
@@ -349,6 +350,7 @@ export default {
       type: this.$t(this.moduleOptions.label)
     };
     if (this.docId) {
+      this.evaluateConditions();
       await this.loadDoc();
       try {
         if (this.manuallyPublished) {
@@ -372,6 +374,8 @@ export default {
       }
       this.modal.triggerFocusRefresh++;
     } else if (this.copyOfId) {
+      this.evaluateConditions();
+
       // Because the page or piece manager might give us just a projected,
       // minimum number of properties otherwise, and because we need to
       // make sure we use our preferred module to fetch the content
@@ -405,6 +409,7 @@ export default {
     } else {
       this.$nextTick(async () => {
         await this.loadNewInstance();
+        this.evaluateConditions();
         this.modal.triggerFocusRefresh++;
       });
     }
@@ -452,7 +457,7 @@ export default {
         const canEdit = docData._edit || this.moduleOptions.canEdit;
         this.readOnly = canEdit === false;
         if (canEdit && !await this.lock(this.getOnePath, this.docId)) {
-          await this.lockNotAvailable();
+          this.lockNotAvailable();
           return;
         }
       } catch {
@@ -679,6 +684,8 @@ export default {
         ...this.docFields.data,
         ...value.data
       };
+
+      this.evaluateConditions();
     },
     getAposSchema(field) {
       if (field.group.name === 'utility') {

package/modules/@apostrophecms/express/index.js

@@ -162,6 +162,7 @@ module.exports = {
     self.createApp();
     self.prefix();
     self.trustProxy();
+    self.options.externalFrontKey = process.env.APOS_EXTERNAL_FRONT_KEY || self.options.externalFrontKey;
     if (self.options.baseUrl && !self.apos.baseUrl) {
       self.apos.util.error('WARNING: you have baseUrl set as an option to the `@apostrophecms/express` module.');
       self.apos.util.error('Set it as a global option (a property of the main object passed to apostrophe).');
@@ -249,6 +250,33 @@ module.exports = {
         url: '/api/v1',
         middleware: cors()
       },
+      externalFront(req, res, next) {
+        if (req.headers['x-requested-with'] !== 'AposExternalFront') {
+          return next();
+        }
+        if ((!self.options.externalFrontKey) || (req.headers['apos-external-front-key'] !== self.options.externalFrontKey)) {
+          if (!self.options.externalFrontKey) {
+            self.logError('externalFrontNotEnabled', 'An attempt was made to integrate an external front but the externalFrontKey option has not been set on the @apostrophecms/express module');
+          } else {
+            self.logError('externalFrontKeyInvalid', 'An attempt was made to integrate an external front but the apos-external-front-key header was missing or did not match the externalFrontKey option set on the @apostrophecms/express module');
+          }
+          return res.status(403).send('forbidden');
+        }
+        req.aposExternalFront = true;
+        res.redirect = function(...args) {
+          // The external front end needs to issue the actual redirect,
+          // not us
+          // Per Express handling of 1 arg versus 2
+          const status = args.length > 1 ? args[0] : 302;
+          const url = args[args.length - 1];
+          return res.send({
+            redirect: true,
+            url,
+            status
+          });
+        };
+        return next();
+      },
       attachUtilityMethods(req, res, next) {
         // We apply the super pattern variously to res.redirect,
         // make sure the original version is always available

package/modules/@apostrophecms/modal/ui/apos/mixins/AposDocErrorsMixin.js

@@ -4,7 +4,6 @@ export default {
   data: () => ({
     fieldErrors: {},
     errorCount: 0
-
   }),
   mounted () {
     this.prepErrors();
@@ -28,17 +27,19 @@ export default {
           }
         });
       }
+
       this.updateErrorCount();
     },
     updateErrorCount() {
       let count = 0;
-      for (const key in this.fieldErrors) {
-        for (const errKey in this.fieldErrors[key]) {
-          if (this.fieldErrors[key][errKey]) {
+      for (const group in this.fieldErrors) {
+        for (const field in this.fieldErrors[group]) {
+          if (this.fieldErrors[group][field]) {
             count++;
           }
         }
       }
+
       this.errorCount = count;
     },
     prepErrors() {

package/modules/@apostrophecms/modal/ui/apos/mixins/AposEditorMixin.js

@@ -15,7 +15,9 @@
  */
 
 import { klona } from 'klona';
-import { evaluateExternalConditions, conditionalFields } from 'Modules/@apostrophecms/schema/lib/conditionalFields.js';
+import {
+  evaluateExternalConditions, getConditionalFields, getConditionTypesObject
+} from 'Modules/@apostrophecms/schema/lib/conditionalFields.js';
 
 export default {
   data() {
@@ -27,7 +29,8 @@ export default {
       restoreOnly: false,
       readOnly: false,
       changed: [],
-      externalConditionsResults: {}
+      externalConditionsResults: getConditionTypesObject(),
+      conditionalFields: getConditionTypesObject()
     };
   },
 
@@ -57,10 +60,6 @@ export default {
     }
   },
 
-  async created() {
-    await this.evaluateExternalConditions();
-  },
-
   methods: {
     // Evaluate the external conditions found in each field
     // via API calls -made in parallel for performance-
@@ -129,8 +128,8 @@ export default {
     // the returned object will contain properties only for conditional fields
     // in that category, although they may be conditional upon fields in either
     // category.
-    conditionalFields(followedByCategory) {
-      return conditionalFields(
+    getConditionalFields(followedByCategory) {
+      return getConditionalFields(
         this.schema,
         this.getFieldsByCategory(followedByCategory),
         // currentDoc for arrays, docFields for all other editors
@@ -139,6 +138,10 @@ export default {
       );
     },
 
+    evaluateConditions() {
+      this.conditionalFields = this.getConditionalFields();
+    },
+
     // Overridden by components that split the fields into several AposSchemas
     getFieldValue(name) {
       return this.docFields.data[name];

package/modules/@apostrophecms/modal/ui/apos/mixins/AposModalTabsMixin.js

@@ -46,14 +46,15 @@ export default {
       const tabs = [];
       for (const key in this.groups) {
         if (key !== 'utility') {
-          // AposRelationshipEditor does not implement AposEditorMixin with the function conditionalFields
-          const conditionalFields = this.conditionalFields?.('other') || [];
+          // AposRelationshipEditor does not implement AposEditorMixin with the function getConditionalFields
           const fields = this.groups[key].fields;
           tabs.push({
             name: key,
             label: this.groups[key].label,
             fields,
-            isVisible: fields.some(field => conditionalFields[field] !== false)
+            isVisible: this.conditionalFields?.if
+              ? fields.some(field => this.conditionalFields.if[field] !== false)
+              : true
           });
         }
       }

package/modules/@apostrophecms/module/index.js

@@ -423,6 +423,12 @@ module.exports = {
       // for this part of the behavior of sendPage.
 
       async renderPage(req, template, data) {
+        if (req.aposExternalFront) {
+          await self.apos.template.annotateDataForExternalFront(req, template, data);
+          self.apos.template.pruneDataForExternalFront(req, template, data);
+          // Reply with JSON
+          return data;
+        }
         return self.apos.template.renderPageForModule(req, template, data, self);
       },
 

package/modules/@apostrophecms/piece-page-type/index.js

@@ -40,7 +40,7 @@ module.exports = {
     self.enableAddUrlsToPieces();
   },
   methods(self) {
-    return {
+    const methods = {
 
       // Extend this method for your piece type to call additional
       // query builders by default.
@@ -212,8 +212,11 @@ module.exports = {
       // for their design.
 
       chooseParentPage(pages, piece) {
-        if (pages.length > 1) {
-          self.apos.util.warnDevOnce(`${self.__meta.name}/chooseParentPage`, `Your site has more than one ${self.name} page, but does not override the chooseParentPage method in ${self.__meta.name} to choose the right one for individual ${self.pieces.name}. You should also override filterByIndexPage. for ${self.pieces.name} will point to an arbitrarily chosen page.`);
+        // Complain if this method is called with more than one page without an
+        // extension to make it smart enough to presumably do something intelligent
+        // in that situation. Don't complain though if this is just a call to _super
+        if ((self.originalChooseParentPage === self.chooseParentPage) && (pages.length > 1)) {
+          self.apos.util.warnDevOnce(`${self.__meta.name}/chooseParentPage`, `Your site has more than one ${self.name} page, but does not extend the chooseParentPage\nmethod in ${self.__meta.name} to choose the right one for individual ${self.pieces.name}. You should also extend filterByIndexPage.\nOtherwise URLs for each ${self.pieces.name} will point to an arbitrarily chosen page.`);
         }
         return pages[0];
       },
@@ -309,6 +312,9 @@ module.exports = {
         }
       }
     };
+
+    self.originalChooseParentPage = methods.chooseParentPage;
+    return methods;
   },
   extendMethods(self) {
     return {

package/modules/@apostrophecms/rich-text-widget/ui/apos/components/AposImageControlDialog.vue

@@ -20,7 +20,8 @@
         :key="lastSelectionTime"
         :generation="generation"
         :following-values="followingValues()"
-        :conditional-fields="conditionalFields()"
+        :conditional-fields="conditionalFields"
+        @input="evaluateConditions()"
       />
       <footer class="apos-image-control__footer">
         <AposButton
@@ -29,9 +30,11 @@
           :modifiers="formModifiers"
         />
         <AposButton
-          type="primary" label="apostrophe:save"
-          @click="save"
+          type="primary"
+          label="apostrophe:save"
           :modifiers="formModifiers"
+          :disabled="docFields.hasErrors"
+          @click="save"
         />
       </footer>
     </AposContextMenuDialog>
@@ -112,6 +115,10 @@ export default {
       }
     }
   },
+  async mounted() {
+    await this.evaluateExternalConditions();
+    this.evaluateConditions();
+  },
   methods: {
     cancel() {
       this.$emit('cancel');

package/modules/@apostrophecms/rich-text-widget/ui/apos/components/AposTiptapAnchor.vue

@@ -42,7 +42,8 @@
           :key="lastSelectionTime"
           :generation="generation"
           :following-values="followingValues()"
-          :conditional-fields="conditionalFields()"
+          :conditional-fields="conditionalFields"
+          @input="evaluateConditions()"
         />
         <footer class="apos-anchor-control__footer">
           <AposButton
@@ -139,6 +140,10 @@ export default {
       }
     }
   },
+  async mounted() {
+    await this.evaluateExternalConditions();
+    this.evaluateConditions();
+  },
   methods: {
     removeAnchor() {
       this.docFields.data = {};

package/modules/@apostrophecms/rich-text-widget/ui/apos/components/AposTiptapLink.vue

@@ -43,7 +43,8 @@
           :key="lastSelectionTime"
           :generation="generation"
           :following-values="followingValues()"
-          :conditional-fields="conditionalFields()"
+          :conditional-fields="conditionalFields"
+          @input="evaluateConditions()"
         />
         <footer class="apos-link-control__footer">
           <AposButton
@@ -52,9 +53,11 @@
             :modifiers="formModifiers"
           />
           <AposButton
-            type="primary" label="apostrophe:save"
-            @click="save"
+            type="primary"
+            label="apostrophe:save"
             :modifiers="formModifiers"
+            :disabled="docFields.hasErrors"
+            @click="save"
           />
         </footer>
       </AposContextMenuDialog>
@@ -145,6 +148,7 @@ export default {
           name: 'href',
           label: this.$t('apostrophe:url'),
           type: 'string',
+          required: true,
           if: {
             linkTo: '_url'
           }
@@ -201,6 +205,10 @@ export default {
       }
     }
   },
+  async mounted() {
+    await this.evaluateExternalConditions();
+    this.evaluateConditions();
+  },
   methods: {
     removeLink() {
       this.docFields.data = {};
@@ -211,6 +219,7 @@ export default {
       if (this.hasSelection) {
         this.active = !this.active;
         this.populateFields();
+        this.evaluateConditions();
       }
     },
     close() {