apostrophe 4.27.1 → 4.28.1

package/modules/@apostrophecms/file/index.js

@@ -1,5 +1,3 @@
-const _ = require('lodash');
-
 // A subclass of `@apostrophecms/piece-type`, `@apostrophecms/file` establishes
 // a library of uploaded files, which may be of any type acceptable to the
 // [@apostrophecms/attachment](../@apostrophecms/attachment/index.html) module.
@@ -8,6 +6,8 @@ const _ = require('lodash');
 // module provides a simple way to add downloadable PDFs and the like to a
 // website, and to manage a library of them for reuse.
 
+const streamProxy = require('../../../lib/stream-proxy.js');
+
 module.exports = {
   extend: '@apostrophecms/piece-type',
   options: {
@@ -26,7 +26,9 @@ module.exports = {
     // Files should by default be considered "related documents" when localizing
     // another document that references them
     relatedDocument: true,
-    relationshipSuggestionIcon: 'file-document-icon'
+    relationshipSuggestionIcon: 'file-document-icon',
+    prettyUrls: false,
+    prettyUrlDir: '/files'
   },
   fields: {
     remove: [ 'visibility' ],
@@ -92,10 +94,72 @@ module.exports = {
   },
   methods(self) {
     return {
+      // File docs are attachment containers themselves — their
+      // attachments are discovered via relationship walking from
+      // the content docs that reference them.  Iterating all
+      // published files here would make the "used" scope
+      // equivalent to "all", defeating scoped attachment builds.
+      async getAllUrlMetadata() {
+        return {
+          metadata: [],
+          attachmentDocIds: []
+        };
+      },
       addUrls(req, files) {
-        _.each(files, function (file) {
-          file._url = self.apos.attachment.url(file.attachment);
-        });
+        for (const file of files) {
+          // Watch out for projections with no attachment property
+          // (the slug-taken route does that)
+          if (self.options.prettyUrls && file.attachment) {
+            const { extension } = file.attachment;
+            file._url = `${req.prefix}${self.options.prettyUrlDir}/${file.slug.replace(self.options.slugPrefix || '', '')}.${extension}`;
+            file.attachment._prettyUrl = file._url;
+          } else {
+            file._url = self.apos.attachment.url(file.attachment);
+          }
+        }
+      }
+    };
+  },
+  routes(self) {
+    if (!self.options.prettyUrls) {
+      return;
+    }
+    return {
+      get: {
+        async [`${self.options.prettyUrlDir}/*`](req, res) {
+          try {
+            const matches = (req.params[0] || '').match(/^([^.]+)\.\w+$/);
+            if (!matches) {
+              return res.status(400).send('invalid');
+            }
+            const [ , slug ] = matches;
+            if (slug.includes('..') || slug.includes('/')) {
+              return res.status(403).send('forbidden');
+            }
+            const file = await self.find(req, {
+              slug: `${self.options.slugPrefix}${slug}`
+            }).toObject();
+            if (!file) {
+              return res.status(404).send('not found');
+            }
+
+            // Determine the normal, "ugly" URL and stream the
+            // response from it, passing on the most important
+            // headers. Supporting range requests, which PDF viewers
+            // like to use for pagination, was considered but
+            // the potential interacts with gzip encoding are complex
+            // and we currently do use it by default with s3 for PDFs.
+            // Viewers will still display the document after
+            // completing the download
+            const uglyUrl = self.apos.attachment.url(file.attachment, {
+              prettyUrl: false
+            });
+            return await streamProxy(req, uglyUrl, { error: self.apos.util.error });
+          } catch (e) {
+            self.apos.util.error('Error in pretty URL route:', e);
+            return res.status(500).send('error');
+          }
+        }
       }
     };
   }

package/modules/@apostrophecms/i18n/index.js

@@ -222,7 +222,26 @@ module.exports = {
             const doc = localizations.find(doc => doc.aposLocale.split(':')[0] === name);
             if (doc && self.apos.permission.can(req, 'view', doc)) {
               doc.available = true;
-              doc._url = `${self.apos.prefix}${manager.action}/${context._id}/locale/${name}`;
+              // WARNING: the `addUrls` call below has a serious
+              // performance impact (extra DB queries per locale).
+              // Keep this gated for static builds only.
+              if (self.apos.url.isExternalFront(req) && self.apos.url.options.static) {
+                // Static builds can't follow the API redirect route
+                // (there is no server to handle it), so compute the
+                // real URL using the same mechanisms the query builders
+                // would.
+                if (self.apos.page.isPage(doc)) {
+                  doc._url = `${localeReq.prefix}${doc.slug}`;
+                } else if (manager.addUrls) {
+                  await manager.addUrls(localeReq, [ doc ]);
+                }
+              }
+              // Fall back to the API redirect route when no real URL
+              // was resolved (e.g. traditional Nunjucks frontend, non static
+              // external frontend).
+              if (!doc._url) {
+                doc._url = `${self.apos.prefix}${manager.action}/${context._id}/locale/${name}`;
+              }
               if (doc._id === context._id) {
                 doc.current = true;
               }

package/modules/@apostrophecms/image/index.js

@@ -400,6 +400,17 @@ module.exports = {
   },
   methods(self) {
     return {
+      // Image docs are attachment containers themselves — their
+      // attachments are discovered via relationship walking from
+      // the content docs that reference them.  Iterating all
+      // published images here would make the "used" scope
+      // equivalent to "all", defeating scoped attachment builds.
+      async getAllUrlMetadata() {
+        return {
+          metadata: [],
+          attachmentDocIds: []
+        };
+      },
       // This method is available as a template helper: apos.image.first
       //
       // Find the first image attachment referenced within an object that may

package/modules/@apostrophecms/layout-widget/ui/apos/components/AposAreaLayoutEditor.vue

@@ -4,14 +4,19 @@
     :data-apos-area="areaId"
     data-tablet-full="true"
     class="apos-area"
-    :class="themeClass"
+    :class="[
+      themeClass,
+      {
+        'apos-area--empty': next.length === 0
+      }
+    ]"
     :style="{
       '--colspan': gridModuleOptions.columns,
       '--colstart': 1,
       '--justify': 'stretch',
       '--align': 'stretch'
     }"
-    @click="setFocusedArea(areaId, $event)"
+    @click="setFocusedWidget(parentOptions.widgetId, areaId)"
   >
     <div
       v-if="next.length === 0 && !foreign && layoutMode === 'debug'"
@@ -92,6 +97,11 @@
             :rendering="rendering(widget)"
             :controls-disabled="true"
             :breadcrumb-disabled="true"
+            :style="{
+              'z-index': raisedWidgets.has(widget._id)
+                ? next.length + 1
+                : null
+            }"
             @up="up"
             @down="down"
             @remove="remove"
@@ -203,12 +213,17 @@ export default {
     // Intercept the columns focus, and emphasize the layout widget instead.
     async focusedWidget(widgetId) {
       if (!widgetId || !this.parentOptions.widgetId) {
+        this.switchLayoutMode({
+          widgetId: this.parentOptions.widgetId,
+          data: { value: 'content' }
+        });
+        this.setFocusedWidget(null, null);
         return;
       }
 
       await this.$nextTick();
       if (widgetId === this.parentOptions.widgetId && this.layoutMode === 'layout') {
-        this.setFocusedWidget(null, this.areaId);
+        apos.bus.$emit('suppress-focused-widget-controls');
         this.emphasizeGrid();
         return;
       }
@@ -218,6 +233,16 @@ export default {
       } else {
         this.deEmphasizeGrid();
       }
+
+      if (
+        !this.layoutColumnWidgetDeepIds.includes(widgetId) &&
+        widgetId !== this.parentOptions.widgetId
+      ) {
+        this.switchLayoutMode({
+          widgetId: this.parentOptions.widgetId,
+          data: { value: 'content' }
+        });
+      }
     },
     // Steal the columns hover, set it on the layout widget instead.
     hoveredWidget(widgetId) {
@@ -230,10 +255,9 @@ export default {
     },
     layoutMode(newMode) {
       if (newMode === 'layout') {
-        this.setFocusedWidget(null, this.areaId);
+        apos.bus.$emit('suppress-focused-widget-controls');
         this.emphasizeGrid();
       } else {
-        this.setFocusedWidget(this.parentOptions.widgetId, this.areaId);
         this.deEmphasizeGrid();
       }
     }
@@ -257,7 +281,8 @@ export default {
       'updateWidget',
       'setHoveredWidget',
       'addEmphasizedWidget',
-      'removeEmphasizedWidget'
+      'removeEmphasizedWidget',
+      'setFocusedWidget'
     ]),
     clickOnGrid() {
       if (this.parentOptions.widgetId) {

package/modules/@apostrophecms/layout-widget/ui/apos/components/AposGridLayout.vue

@@ -348,29 +348,31 @@ export default {
     margin-left: auto;
   }
 
-  &__grid.manage :deep(.apos-area),
-  &__grid.manage :deep(.apos-empty-area) {
+  &__grid.manage .apos-area--empty,
+  &__grid.manage .apos-empty-area {
     padding-top: 0;
     padding-bottom: 0;
   }
 
-  &__grid.manage :deep(.apos-layout__item-content),
-  &__grid.manage :deep(.apos-area-widget-wrapper),
-  &__grid.manage :deep(.apos-area-widget-inner),
-  &__grid.manage :deep(.apos-area-widget-inner > div),
-  &__grid.manage :deep(.apos-area),
-  &__grid.manage :deep(.apos-empty-area) {
+  &__grid.manage .apos-layout__item-content,
+  &__grid.manage .apos-area-widget-wrapper,
+  &__grid.manage .apos-area-widget-inner,
+  &__grid.manage .apos-area-widget-rendered-widget > div,
+  &__grid.manage .apos-area-widget-rendered-widget,
+  &__grid.manage .apos-area,
+  &__grid.manage .apos-empty-area {
     height: 100%;
   }
 
-  &__grid.manage :deep(.apos-empty-area::before) {
+  &__grid.manage .apos-empty-area::before {
     position: absolute;
     font-family: var(--a-family-default);
+    font-size: var(--a-type-base);
     text-align: center;
     content: var(--empty-area-text);
   }
 
-  &__grid.manage :deep(.apos-area-menu .apos-button) {
+  &__grid.manage .apos-area-menu .apos-button {
     display: none;
   }
 

package/modules/@apostrophecms/login/index.js

@@ -61,6 +61,8 @@ module.exports = {
     localLogin: true,
     passwordReset: false,
     passwordResetHours: 48,
+    // Maximum time to complete login (1 hour)
+    incompleteLifetime: 60 * 60 * 1000,
     scene: 'apos',
     csrfExceptions: [
       'login'
@@ -85,6 +87,7 @@ module.exports = {
     await self.enableBearerTokens();
     self.addToAdminBar();
     self.addCaseInsensitiveMigration();
+    self.cleanupInterval = setInterval(self.cleanup, self.options.incompleteLifetime);
   },
   handlers(self) {
     return {
@@ -97,6 +100,14 @@ module.exports = {
         async checkForUser() {
           await self.checkForUserAndAlert();
         }
+      },
+      'apostrophe:destroy': {
+        clearIntervals() {
+          if (self.cleanupInterval) {
+            clearInterval(self.cleanupInterval);
+            self.cleanupInterval = null;
+          }
+        }
       }
     };
   },
@@ -725,16 +736,12 @@ module.exports = {
 
         const user = await self.deserializeUser(token.userId);
         if (!user) {
-          await self.bearerTokens.removeOne({
-            _id: token.userId
-          });
+          await removeToken();
           throw self.apos.error('notfound');
         }
 
         if (session) {
-          await self.bearerTokens.removeOne({
-            _id: token.userId
-          });
+          await removeToken();
           await self.passportLogin(req, user);
           // No access to login attempts in the final phase.
           self.logInfo(req, 'complete', {
@@ -742,9 +749,12 @@ module.exports = {
           });
         } else {
           delete token.requirementsToVerify;
-          self.bearerTokens.updateOne(token, {
+          await self.bearerTokens.updateOne(token, {
             $unset: {
               requirementsToVerify: 1
+            },
+            $set: {
+              expires: Date.now() + self.getBearerTokenLifetime()
             }
           });
           self.logInfo(req, 'complete', {
@@ -754,6 +764,12 @@ module.exports = {
             token
           };
         }
+
+        async function removeToken() {
+          await self.bearerTokens.removeOne({
+            _id: token._id
+          });
+        }
       },
 
       // Implementation detail of the login route and the requirementProps
@@ -765,7 +781,9 @@ module.exports = {
           _id: self.apos.launder.string(token),
           requirementsToVerify: {
             $exists: true,
-            $ne: []
+            $not: {
+              $size: 0
+            }
           },
           expires: {
             $gte: new Date()
@@ -858,7 +876,7 @@ module.exports = {
               // Default lifetime of 1 hour is generous to permit situations
               // like installing a TOTP app for the first time
               expires: new Date(
-                new Date().getTime() + (self.options.incompleteLifetime || 60 * 60 * 1000)
+                Date.now() + self.options.incompleteLifetime
               )
             });
 
@@ -884,8 +902,8 @@ module.exports = {
               _id: token,
               userId: user._id,
               expires: new Date(
-                new Date().getTime() +
-                (self.options.bearerTokens.lifetime || (86400 * 7 * 2)) * 1000
+                Date.now() +
+                self.getBearerTokenLifetime()
               )
             });
 
@@ -1071,6 +1089,20 @@ module.exports = {
             { failed: duplicatedUsernames }
           );
         }
+      },
+      getBearerTokenLifetime() {
+        return (self.options.bearerTokens.lifetime || (86400 * 7 * 2)) * 1000;
+      },
+      // Periodic cleanup. Expired bearer tokens are only honored until they expire, but
+      // it also makes sense to free the resources after expiration
+      async cleanup() {
+        return self.bearerTokens.deleteMany(
+          {
+            expires: {
+              $lt: new Date()
+            }
+          }
+        );
       }
     };
   },

package/modules/@apostrophecms/modal/ui/apos/components/AposDocsManagerToolbar.vue

@@ -48,7 +48,8 @@
             label,
             icon,
             iconOnly: true,
-            type: 'outline'
+            type: 'outline',
+            modifiers: ['small']
           }"
           :disabled="!checkedCount"
           :menu="operations"

package/modules/@apostrophecms/modal/ui/apos/components/AposModal.vue

@@ -13,6 +13,7 @@
       aria-modal="true"
       :aria-labelledby="props.modalData.id"
       data-apos-modal
+      :data-apos-graph-key="props.graphKey || undefined"
       tabindex="0"
       @focus.capture="captureFocus"
       @keyup.tab="onKeyup"
@@ -188,6 +189,10 @@ const props = defineProps({
   modalData: {
     type: Object,
     required: true
+  },
+  graphKey: {
+    type: String,
+    default: null
   }
 });
 

package/modules/@apostrophecms/page/index.js

@@ -2855,18 +2855,16 @@ database.`);
         );
       },
       // Returns the effective base URL for the given request.
-      // If Apostrophe's top-level `baseUrl` option is set, or a hostname is
-      // defined for the active locale, then that is consulted, otherwise the
-      // base URL is the empty string. This makes it easier to build absolute
-      // URLs (when `baseUrl` is configured), or to harmlessly prepend the empty
-      // string (when it is not configured). The Apostrophe queries used to
-      // fetch Apostrophe pages consult this method.
+      // Delegates to `apos.url.getBaseUrl(req)` which is
+      // now the single source of truth.
+      // See `@apostrophecms/url` module for full documentation
+      // and the `strict` option.
+      //
+      // Note: `prefix: false` preserves backward compatibility —
+      // callers of `page.getBaseUrl` historically received only
+      // the origin, without the global prefix.
       getBaseUrl(req) {
-        const hostname = self.apos.i18n.locales[req.locale]?.hostname;
-
-        return hostname
-          ? `${req.protocol}://${hostname}`
-          : (self.apos.baseUrl || '');
+        return self.apos.url.getBaseUrl(req, { prefix: false });
       },
 
       // Implements a simple batch operation like publish or unpublish.

package/modules/@apostrophecms/page-type/index.js

@@ -107,12 +107,17 @@ module.exports = {
       'slug'
     ]);
     self.rules = {};
-    self.dispatchAll();
     self.composeFilters();
     self.composeColumns();
   },
   handlers(self) {
     return {
+      'apostrophe:modulesRegistered': {
+        dispatchAll() {
+          // Late enough that all subclasses have contributed things to self
+          self.dispatchAll();
+        }
+      },
       '@apostrophecms/page:serve': {
         async dispatchPage(req) {
           if (!req.data.bestPage) {

package/modules/@apostrophecms/piece-page-type/index.js

@@ -15,7 +15,7 @@
 //
 // ### `piecesFilters`
 //
-// If present, this is an array of objects with `name` properties.This works
+// If present, this is an array of objects with `name` properties. This works
 // only if the corresponding query builders exist and have a `launder` method.
 // An array of choices for each is populated in `req.data.piecesFilters`. The
 // choices in the array are objects with `label` and `value` properties.
@@ -199,6 +199,26 @@ module.exports = {
 
       dispatchAll() {
         self.dispatch('/', self.indexPage);
+        if (self.apos.url.options.static) {
+          // 1. SEO friendly pagination URLs
+          self.dispatch('/page/:pagenum', req => {
+            req.query.page = req.params.pagenum;
+            return self.indexPage(req);
+          });
+          for (const filter of self.piecesFilters) {
+            // 2. SEO friendly filter URLs
+            self.dispatch(`/${filter.name}/:filterValue`, req => {
+              req.query[filter.name] = req.params.filterValue;
+              return self.indexPage(req);
+            });
+            // 3. SEO friendly filter + pagination URLs
+            self.dispatch(`/${filter.name}/:filterValue/page/:pagenum`, req => {
+              req.query[filter.name] = req.params.filterValue;
+              req.query.page = req.params.pagenum;
+              return self.indexPage(req);
+            });
+          }
+        }
         self.dispatch('/:slug', self.showPage);
       },
 
@@ -325,30 +345,62 @@ module.exports = {
         return !!(await self.find(req, {}).areas(false).relationships(false).toObject());
       },
 
-      // Populate `req.data.piecesFilters` with arrays of choice objects,
-      // with label and value properties, for each filter configured in the
-      // `piecesFilters` array option. Each filter in that array must have a
-      // `name` property. Distinct values are fetched for the corresponding
-      // query builder (note that most schema fields automatically get a
-      // corresponding query builder method). Each filter's choices are
-      // reduced by the other filters; for instance, "tags" might only reveal
+      // Populate `req.data.filters` based on the `piecesFilters` option.
+      // Each entry in the option array must have a `name` property, and a
+      // corresponding query builder with a `launder` method must exist
+      // (note that most schema fields automatically get one).
+      //
+      // `req.data.filters` is an array of filter objects, each containing
+      // the original configuration properties (e.g. `name`, `counts`) plus
+      // a `choices` array. Each choice has `label`, `value`, `_url`, and
+      // optionally `active` and `count` properties. Choices are reduced by
+      // the other active filters; for instance, "tags" might only reveal
       // choices not ruled out by the current "topic" filter setting.
       //
-      // If a filter in the array has its `counts` property set to true,
-      // Apostrophe will supply a `count` property for each distinct value,
-      // whenever possible. This has a performance impact.
+      // If a filter has its `counts` property set to `true`, each choice
+      // will also include a `count`. This has a performance impact.
+      //
+      // Legacy: `req.data.piecesFilters` is also populated as an object
+      // keyed by filter name, where each value is that filter's choices
+      // array. Still supported for backward compatibility but
+      // `req.data.filters` is preferred.
 
       async populatePiecesFilters(query) {
         const req = query.req;
-        req.data.piecesFilters = req.data.piecesFilters || {};
+        const filtersWithChoices = await self.getFiltersWithChoices(query);
+        req.data.filters = filtersWithChoices;
+        // for bc (less useful)
+        req.data.piecesFilters = {};
+        for (const filter of filtersWithChoices) {
+          req.data.piecesFilters[filter.name] = filter.choices;
+        }
+      },
+
+      async getFiltersWithChoices(query, { allCounts = false } = {}) {
+        const results = [];
         for (const filter of self.piecesFilters) {
           // The choices for each filter should reflect the effect of all
           // filters except this one (filtering by topic pares down the list of
           // categories and vice versa)
           const _query = query.clone();
           _query[filter.name](undefined);
-          req.data.piecesFilters[filter.name] = await _query.toChoices(filter.name, _.pick(filter, 'counts'));
+          const countsOption = allCounts ? { counts: true } : _.pick(filter, 'counts');
+          const choices = await _query.toChoices(filter.name, countsOption);
+          for (const choice of choices) {
+            if (query.req.data.page) {
+              choice._url = query.req.data.page._url +
+                self.apos.url.getChoiceFilter(filter.name, choice.value, 1);
+            }
+            if (query.req.query[filter.name] === choice.value) {
+              choice.active = true;
+            }
+          }
+          results.push({
+            ...filter,
+            choices
+          });
         }
+        return results;
       }
     };
 
@@ -368,6 +420,41 @@ module.exports = {
         } else {
           return data;
         }
+      },
+      async getUrlMetadata(_super, req, doc) {
+        const metadata = await _super(req, doc);
+        if (!metadata.length) {
+          return metadata;
+        }
+        const [ pm ] = metadata;
+        const query = self.indexQuery(req);
+        const filters = await self.getFiltersWithChoices(query, { allCounts: true });
+
+        // 1. Enumerate every filter + choice combination
+        for (const filter of filters) {
+          for (const choice of filter.choices) {
+            const totalPages = Math.max(1, Math.ceil(choice.count / self.perPage));
+            for (let p = 1; p <= totalPages; p++) {
+              metadata.push({
+                ...pm,
+                i18nId: `${pm.i18nId}.${self.apos.util.slugify(filter.name)}.${self.apos.util.slugify(choice.value)}.${p}`,
+                url: pm.url + self.apos.url
+                  .getChoiceFilter(filter.name, choice.value, p)
+              });
+            }
+          }
+        }
+        await query.toCount();
+        const totalPages = query.get('totalPages');
+        // 2. Enumerate pagination (starting at page 2; page 1 is the base URL)
+        for (let p = 2; p <= totalPages; p++) {
+          metadata.push({
+            ...pm,
+            i18nId: `${pm.i18nId}.${p}`,
+            url: pm.url + self.apos.url.getPageFilter(p)
+          });
+        }
+        return metadata;
       }
     };
   }

package/modules/@apostrophecms/rich-text-widget/ui/apos/components/AposImageControlDialog.vue

@@ -191,6 +191,7 @@ export default {
         ...this.schemaHtmlAttributes.reduce((acc, field) => {
           const value = this.docFields.data[field.name];
           if (field.type === 'checkboxes' && !value?.[0]) {
+            acc[field.htmlAttribute] = null;
             return acc;
           }
           if (field.type === 'boolean') {