apostrophe 4.28.0 → 4.29.0

package/modules/@apostrophecms/doc-type/index.js

@@ -1261,6 +1261,17 @@ module.exports = {
           result = await actionModule.update(toReq, update);
         }
 
+        // Record when this document was localized. Uses a direct DB
+        // update so the timestamp survives regardless of the schema
+        // convert pipeline. Covers both single and batch localization
+        // (localizeBatch calls this method per document).
+        const localizedAt = new Date();
+        await self.apos.doc.db.updateOne(
+          { _id: result._id },
+          { $set: { localizedAt } }
+        );
+        result.localizedAt = localizedAt;
+
         await self.emit('afterLocalize', req, draft, result, eventOptions);
 
         return result;
@@ -1610,6 +1621,59 @@ module.exports = {
         return doc;
       },
 
+      // Returns true if the named filter is permitted to expose distinct
+      // values through the `choices` / `counts` query builders given the
+      // publicApiProjection. When no publicApiProjection is in effect
+      // (authenticated API callers), all fields are permitted.
+      //
+      // This guards against leaking distinct values of fields excluded by
+      // `publicApiProjection`, since MongoDB's `distinct` operator ignores
+      // projections. Projections set explicitly by authenticated users are
+      // not restricted — they are a voluntary narrowing of query results,
+      // not a security boundary.
+      choicesFieldAllowedByProjection(filter, projection) {
+        if (!projection || !Object.keys(projection).length) {
+          return true;
+        }
+        // Builders that aren't named after a top-level schema field are
+        // not gated by the projection.
+        const field = self.schema.find(f => f.name === filter);
+        if (!field) {
+          return true;
+        }
+        const topLevel = filter.split('.')[0];
+        const values = Object.values(projection);
+        const hasInclusion = values.some(v => v && v !== 0);
+        const hasExclusion = values.some(v => v === 0 || v === false);
+        if (hasInclusion) {
+          // Inclusion projection: field must be explicitly included.
+          return Boolean(projection[topLevel]);
+        }
+        if (hasExclusion) {
+          // Exclusion projection: field must not be explicitly excluded.
+          return projection[topLevel] !== 0 && projection[topLevel] !== false;
+        }
+        return true;
+      },
+
+      // Returns true if the current user is permitted to view the named
+      // schema field according to any schema-level `viewPermission`.
+      // Non-schema filters are permitted. A dot-notated filter is matched
+      // against the top-level schema field, since `viewPermission` is
+      // declared on top-level fields (see `removeForbiddenFields`).
+      choicesFieldAllowedByViewPermission(req, filter) {
+        const topLevel = filter.split('.')[0];
+        const field = self.schema.find(f => f.name === topLevel);
+        if (!field || !field.viewPermission) {
+          return true;
+        }
+        return self.apos.permission.can(
+          req,
+          field.viewPermission.action,
+          field.viewPermission.type
+        );
+      },
+
       composeFilters() {
         // TODO: keep in sync with page/index.js composeFilters
         self.filters = Object.entries(self.filters)
@@ -2157,24 +2221,6 @@ module.exports = {
           }
         },
 
-        // `.attachments(true)` annotates all attachment fields in the
-        // returned documents with URLs as documented for the
-        // `apos.attachment.all` method. Used by our REST APIs.
-
-        attachments: {
-          def: true,
-          after(results) {
-            const attachments = query.get('attachments');
-
-            if (attachments) {
-              self.apos.attachment.all(results, { annotate: true });
-            }
-          },
-          launder(b) {
-            return self.apos.launder.boolean(b);
-          }
-        },
-
         // `.autocomplete('sta')` limits results to docs which are a good match
         // for a partial string beginning with `sta`, for instance `station`.
         // Appropriate words must exist in the title or other text schema fields
@@ -2427,6 +2473,28 @@ module.exports = {
           }
         },
 
+        // `.attachments(true)` annotates all attachment fields in the
+        // returned documents with URLs as documented for the
+        // `apos.attachment.all` method. Used by our REST APIs.
+        //
+        // Must appear after the `relationships` builder so that
+        // relationship `_fields` (e.g. crop coordinates) are
+        // available when `attachment.all` generates `_urls`.
+
+        attachments: {
+          def: true,
+          after(results) {
+            const attachments = query.get('attachments');
+
+            if (attachments) {
+              self.apos.attachment.all(results, { annotate: true });
+            }
+          },
+          launder(b) {
+            return self.apos.launder.boolean(b);
+          }
+        },
+
         // `.addUrls(true)`. Invokes the `addUrls` method of all doc type
         // managers with relevant docs among the results, if they have one.
         //
@@ -2450,20 +2518,47 @@ module.exports = {
             if (!val) {
               return;
             }
-            const byType = {};
-            for (const doc of results) {
-              byType[doc.type] = byType[doc.type] || [];
-              byType[doc.type].push(doc);
+
+            async function addUrlsByType(reqForUrls, docs) {
+              const byType = {};
+              for (const doc of docs) {
+                byType[doc.type] = byType[doc.type] || [];
+                byType[doc.type].push(doc);
+              }
+              for (const type of Object.keys(byType)) {
+                const manager = self.apos.doc.getManager(type);
+                if (manager?.addUrls) {
+                  await manager.addUrls(reqForUrls, byType[type]);
+                }
+              }
             }
-            const interesting = Object.keys(byType).filter(type => {
-              // Don't freak out if the projection was really conservative
-              // and the type is unknown, etc.
-              const manager = self.apos.doc.getManager(type);
-              return manager && manager.addUrls;
-            });
-            for (const type of interesting) {
-              await self.apos.doc.getManager(type).addUrls(req, byType[type]);
+
+            // When locale(null) was used, docs may span multiple
+            // locales. Group by locale and resolve URLs with a
+            // locale-appropriate req so each doc gets the correct
+            // _url for its own locale.
+            if (query.get('locale') === null) {
+              const locales = self.apos.i18n.locales;
+              const byLocale = {};
+              for (const doc of results) {
+                const locale =
+                  doc.aposLocale?.split(':')[0] || req.locale;
+                if (!locales[locale]) {
+                  continue;
+                }
+                byLocale[locale] = byLocale[locale] || [];
+                byLocale[locale].push(doc);
+              }
+              for (const [ locale, localeDocs ] of Object.entries(byLocale)) {
+                const localeReq = locale === req.locale
+                  ? req
+                  : req.clone({ locale });
+                await addUrlsByType(localeReq, localeDocs);
+              }
+              return;
             }
+
+            await addUrlsByType(req, results);
           }
         },
 
@@ -2510,10 +2605,34 @@ module.exports = {
         pageUrl: {
           def: true,
           after(results) {
+            const req = query.req;
+            const crossLocale = query.get('locale') === null;
+            const localeReqs = {};
             for (const result of results) {
-              if ((!result.archived) && result.slug && self.apos.page.isPage(result)) {
-                result._url = `${query.req.prefix}${result.slug}`;
+              if (
+                (!result.archived) &&
+                result.slug &&
+                self.apos.page.isPage(result)
+              ) {
+                const urlReq = getReqForLocale(result);
+                result._url = `${urlReq.prefix}${result.slug}`;
+              }
+            }
+            function getReqForLocale(doc) {
+              if (!crossLocale || !doc.aposLocale) {
+                return req;
+              }
+              const locale = doc.aposLocale.split(':')[0];
+              if (!self.apos.i18n.locales[locale]) {
+                return req;
+              }
+              if (!localeReqs[locale]) {
+                localeReqs[locale] =
+                  locale === req.locale
+                    ? req
+                    : req.clone({ locale });
               }
+              return localeReqs[locale];
             }
           }
         },
@@ -2641,6 +2760,7 @@ module.exports = {
             const choices = {};
             const baseQuery = query.get('choices-query-prefinalize');
             baseQuery.set('choices-query-prefinalize', null);
+            const publicApiProjection = query.get('publicApiProjection');
             for (const filter of filters) {
               // The choices for each filter should reflect the effect of all
               // filters except this one (filtering by topic pairs down the list
@@ -2656,6 +2776,19 @@ module.exports = {
               if (!query.builders[filter].launder) {
                 continue;
               }
+              // Do not leak distinct values of fields excluded by the
+              // publicApiProjection. MongoDB's `distinct` ignores projections,
+              // so we must enforce this ourselves here. Only applies to the
+              // public API; authenticated users who set their own projections
+              // are not restricted.
+              if (!self.choicesFieldAllowedByProjection(filter, publicApiProjection)) {
+                continue;
+              }
+              // Do not leak distinct values of fields the current user does
+              // not have permission to view via a schema-level viewPermission.
+              if (!self.choicesFieldAllowedByViewPermission(query.req, filter)) {
+                continue;
+              }
               // Now shut it off
               _query[filter](null);
               choices[filter] = await _query.toChoices(filter, { counts: query.get('counts') });

package/modules/@apostrophecms/doc-type/ui/apos/components/AposDocEditor.vue

@@ -990,7 +990,7 @@ export default {
 
       const isLocalized = await apos.modal.execute('AposI18nLocalize', {
         doc: saved || this.original,
-        locale,
+        targetLocale: locale,
         moduleName: this.moduleName,
         shouldRedirect: false
       });

package/modules/@apostrophecms/doc-type/ui/apos/logic/AposDocContextMenu.js

@@ -92,6 +92,16 @@ export default {
     moduleLabels: {
       type: Object,
       default: null
+    },
+    showUnpublish: {
+      type: Boolean,
+      default() {
+        return true;
+      }
+    },
+    crossLocale: {
+      type: Boolean,
+      default: false
     }
   },
   emits: [ 'menu-open', 'menu-close', 'close' ],
@@ -105,6 +115,12 @@ export default {
   },
   computed: {
     menu() {
+      // TODO: Register core context actions (edit, preview,
+      // copy, localize, archive, etc.) as custom operations
+      // via `addContextOperation`. This would let us unify
+      // cross-locale gating through the `crossLocale`
+      // flag on each operation, eliminating the manual
+      // `!this.crossLocale` wrapping below.
       const menu = [
         // TODO
         // ...(this.isModifiedFromPublished ? [
@@ -128,64 +144,76 @@ export default {
             }
           ]
           : []),
-        ...((this.showDismissSubmission && this.canDismissSubmission)
+        // In cross-locale mode, only Edit and Preview are safe.
+        // All other built-in ops are hidden.
+        ...(!this.crossLocale
           ? [
-            {
-              label: 'apostrophe:dismissSubmission',
-              action: 'dismissSubmission'
-            }
-          ]
-          : []),
-        ...(this.showCopy && this.canCopy
-          ? [
-            {
-              label: 'apostrophe:duplicate',
-              action: 'copy'
-            }
-          ]
-          : []),
-        ...(this.canLocalize
-          ? [
-            {
-              label: 'apostrophe:localize',
-              action: 'localize'
-            }
+            ...((this.showDismissSubmission && this.canDismissSubmission)
+              ? [
+                {
+                  label: 'apostrophe:dismissSubmission',
+                  action: 'dismissSubmission'
+                }
+              ]
+              : []),
+            ...(this.showCopy && this.canCopy
+              ? [
+                {
+                  label: 'apostrophe:duplicate',
+                  action: 'copy'
+                }
+              ]
+              : []),
+            ...(this.canLocalize
+              ? [
+                {
+                  label: 'apostrophe:localize',
+                  action: 'localize'
+                }
+              ]
+              : [])
           ]
           : []),
         ...this.customMenusByContext,
-        ...((this.showDiscardDraft && this.canDiscardDraft)
+        ...(!this.crossLocale
           ? [
-            {
-              label: this.context.lastPublishedAt ? 'apostrophe:discardDraft' : 'apostrophe:deleteDraft',
-              action: 'discardDraft',
-              modifiers: [ 'danger' ]
-            }
-          ]
-          : []),
-        ...(this.showArchive && this.canArchive
-          ? [
-            {
-              label: 'apostrophe:archive',
-              action: 'archive',
-              modifiers: [ 'danger' ]
-            }
-          ]
-          : []),
-        ...(this.canUnpublish
-          ? [
-            {
-              label: 'apostrophe:unpublish',
-              action: 'unpublish',
-              modifiers: [ 'danger' ]
-            }
-          ]
-          : []),
-        ...(this.showRestore && this.canRestore
-          ? [
-            {
-              label: 'apostrophe:restore',
-              action: 'restore'
-            }
+            ...((this.showDiscardDraft && this.canDiscardDraft)
+              ? [
+                {
+                  label: this.context.lastPublishedAt
+                    ? 'apostrophe:discardDraft'
+                    : 'apostrophe:deleteDraft',
+                  action: 'discardDraft',
+                  modifiers: [ 'danger' ]
+                }
+              ]
+              : []),
+            ...(this.showArchive && this.canArchive
+              ? [
+                {
+                  label: 'apostrophe:archive',
+                  action: 'archive',
+                  modifiers: [ 'danger' ]
+                }
+              ]
+              : []),
+            ...(this.showUnpublish && this.canUnpublish
+              ? [
+                {
+                  label: 'apostrophe:unpublish',
+                  action: 'unpublish',
+                  modifiers: [ 'danger' ]
+                }
+              ]
+              : []),
+            ...(this.showRestore && this.canRestore
+              ? [
+                {
+                  label: 'apostrophe:restore',
+                  action: 'restore'
+                }
+              ]
+              : [])
           ]
           : [])
       ];
@@ -208,8 +236,14 @@ export default {
     },
     customOperationsByContext() {
       return this.customOperations.filter(({
-        manuallyPublished, hasUrl, conditions, context, if: ifProps, moduleIf
+        manuallyPublished, hasUrl, conditions, context,
+        if: ifProps, moduleIf, crossLocale
       }) => {
+        // In cross-locale mode, only show operations explicitly marked as safe
+        if (this.crossLocale && !crossLocale) {
+          return false;
+        }
+
         if (typeof manuallyPublished === 'boolean' && manuallyPublished !== this.manuallyPublished) {
           return false;
         }
@@ -433,13 +467,19 @@ export default {
       this[item.action](this.context);
     },
     async edit(doc) {
+      const props = {
+        moduleName: this.moduleName,
+        docId: doc._id,
+        type: doc.type
+      };
+      // Cross-locale mode suported.
+      if (this.crossLocale && doc.aposLocale) {
+        props.locale = doc.aposLocale.split(':')[0];
+      }
       await apos.modal.execute(
         doc._aposEditorModal || this.moduleOptions.components.editorModal,
-        {
-          moduleName: this.moduleName,
-          docId: doc._id,
-          type: doc.type
-        });
+        props
+      );
     },
     preview(doc) {
       window.open(doc._url, '_blank').focus();
@@ -490,6 +530,11 @@ export default {
         ...docProps(doc),
         ...operation.props
       };
+      // In cross-locale mode, pass the doc's locale so the modal
+      // opens in the correct locale context.
+      if (this.crossLocale && doc.aposLocale) {
+        props.locale = doc.aposLocale.split(':')[0];
+      }
       if (operation.type === 'event') {
         apos.bus.$emit(operation.action, props);
         return;

package/modules/@apostrophecms/file/index.js

@@ -105,19 +105,112 @@ module.exports = {
           attachmentDocIds: []
         };
       },
-      addUrls(req, files) {
+      // Returns the pretty URL base path (e.g. `/files`) when
+      // pretty URLs are enabled, or `null` otherwise.
+      // The returned path is prefix-qualified. If `options.relative`
+      // is true, the path is relative (no origin).
+      getPrettyUrlBase(req, { relative = false } = {}) {
+        if (!self.options.prettyUrls) {
+          return null;
+        }
+        const base = relative
+          ? self.apos.url.getBaseUrl(req, {
+            relative: true,
+            localePrefix: true
+          })
+          : req.prefix;
+        return `${base}${self.options.prettyUrlDir}`;
+      },
+      // Returns the pretty-URL path component for a file doc.
+      // E.g. `/my-document.pdf` — just the filename portion,
+      // without any base, prefix, or origin.
+      // Returns `null` when pretty URLs are disabled or the
+      // doc has no attachment.  Works with any object that has
+      // `slug` and `attachment.extension` (including the
+      // lightweight projections used by `applyPrettyUrlPaths`).
+      getPrettyPath(doc) {
+        if (!self.options.prettyUrls || !doc.attachment) {
+          return null;
+        }
+        const slug = doc.slug.replace(self.options.slugPrefix || '', '');
+        return `/${slug}.${doc.attachment.extension}`;
+      },
+      // When `options.relative` is true, pretty URLs are built
+      // with only the prefix + prettyUrlDir (no origin).
+      addUrls(req, files, { relative = false } = {}) {
+        const prettyBase = self.getPrettyUrlBase(req, { relative });
         for (const file of files) {
-          // Watch out for projections with no attachment property
-          // (the slug-taken route does that)
-          if (self.options.prettyUrls && file.attachment) {
-            const { extension } = file.attachment;
-            const baseUrl = self.apos.url.getBaseUrl(req, { prefix: true });
-            file._url = `${baseUrl}${self.options.prettyUrlDir}/${file.slug.replace(self.options.slugPrefix || '', '')}.${extension}`;
+          const prettyPath = self.getPrettyPath(file);
+          if (prettyBase && prettyPath) {
+            file._url = `${prettyBase}${prettyPath}`;
             file.attachment._prettyUrl = file._url;
-          } else {
+          } else if (file.attachment) {
             file._url = self.apos.attachment.url(file.attachment);
           }
         }
+      },
+      // Mutates `attachmentMeta.results` in-place, replacing
+      // uploadfs paths with pretty URL paths for file pieces
+      // that have pretty URLs enabled.  Adds a `base` property
+      // to each affected entry so the consumer can override the
+      // global `uploadsUrl` for those entries.
+      //
+      // Uses a lightweight direct DB query (no builders) to
+      // find file docs by attachment ID.  Returns nothing —
+      // the mutation is performed on the input object.
+      //
+      // Does nothing when pretty URLs are disabled.
+      // For the shape of the `attachmentMeta` object, see the
+      // `@apostrophecms/url:getAllAttachmentMetadata` method documentation.
+      async applyPrettyUrlPaths(req, attachmentMeta) {
+        if (!self.options.prettyUrls || !attachmentMeta?.results?.length) {
+          return;
+        }
+
+        const base = self.getPrettyUrlBase(req, { relative: true });
+        const batchSize = 100;
+
+        for (let i = 0; i < attachmentMeta.results.length; i += batchSize) {
+          const batch = attachmentMeta.results.slice(i, i + batchSize);
+          const batchIds = batch.map(a => a._id);
+
+          // Lightweight direct query — no builders, no relationship
+          // resolution.  Only needs slug and attachment ID/extension.
+          const fileDocs = await self.apos.doc.db.find({
+            type: self.options.name,
+            'attachment._id': { $in: batchIds },
+            aposLocale: `${req.locale}:${req.mode}`,
+            archived: { $ne: true }
+          }, {
+            projection: {
+              slug: 1,
+              'attachment._id': 1,
+              'attachment.extension': 1
+            }
+          }).toArray();
+
+          if (!fileDocs.length) {
+            continue;
+          }
+
+          const byAttId = new Map();
+          for (const entry of batch) {
+            byAttId.set(entry._id, entry);
+          }
+
+          for (const doc of fileDocs) {
+            const entry = byAttId.get(doc.attachment._id);
+            if (!entry) {
+              continue;
+            }
+            const prettyPath = self.getPrettyPath(doc);
+            if (!prettyPath) {
+              continue;
+            }
+            entry.urls = [ { path: prettyPath } ];
+            entry.base = base;
+          }
+        }
       }
     };
   },
@@ -155,7 +248,14 @@ module.exports = {
             const uglyUrl = self.apos.attachment.url(file.attachment, {
               prettyUrl: false
             });
-            return await streamProxy(req, uglyUrl, { error: self.apos.util.error });
+            // For relative URLs (local uploadfs, not CDN), resolve
+            // against the current server's origin so the proxy can
+            // make the self-request.  During static builds
+            // `attachment.url()` may return only a path.
+            const proxyUrl = uglyUrl.startsWith('/')
+              ? `${req.protocol}://${req.get('host')}${uglyUrl}`
+              : uglyUrl;
+            return await streamProxy(req, proxyUrl, { error: self.apos.util.error });
           } catch (e) {
             self.apos.util.error('Error in pretty URL route:', e);
             return res.status(500).send('error');

package/modules/@apostrophecms/i18n/i18n/de.json

@@ -71,7 +71,6 @@
   "batchRestoreProgress": "Wiederherstellung {{ type }}...",
   "batchTagProgress": "Taggen von {{ count }} {{ type }}...",
   "batchUntagProgress": "Entfernen der Markierung von {{ count }} {{ type }}...",
-  "batchRestoreProgress": "Wiederherstellung {{ type }}...",
   "boxFieldAriaLabelAll": "Wert - alle Seiten",
   "boxFieldAriaLabelIndividual": "- {{ side }} Wert",
   "boxFieldEditAll": "Alle Werte bearbeiten",
@@ -325,7 +324,6 @@
   "localizeLocalized": "Lokalisierte",
   "localizeNewRelated": "Übersetze alle neuen zugehörige Dokumente",
   "localizeNotYetLocalized": "Noch nicht lokalisiert",
-  "localized": "{{ type }} {{ title }} auf {{ locale }} übersetzt",
   "localizedBatch": "Verarbeitet {{ count }} {{ type }}",
   "localizedBatchFailed": "Lokalisierung von {{ type }} fehlgeschlagen",
   "localizedBatchWithFailures": "Verarbeitet {{ count }} {{ type }} ({{ bad }} von {{ total }} fehlgeschlagen)",