apostrophe 4.31.0 → 4.32.0

package/modules/@apostrophecms/rich-text-widget/ui/apos/components/AposRichTextWidgetEditor.vue

@@ -52,6 +52,7 @@
       :editor="editor"
       role="listbox"
       tabindex="0"
+      @keydown="closeInsertMenu"
     >
       <div class="apos-rich-text-insert-menu-heading">
         {{ $t('apostrophe:richTextInsertMenuHeading') }}
@@ -60,7 +61,6 @@
         class="apos-rich-text-insert-menu-wrapper"
         @keydown.prevent.arrow-up="focusInsertMenuItem(true)"
         @keydown.prevent.arrow-down="focusInsertMenuItem()"
-        @keydown="closeInsertMenu"
       >
         <li
           v-for="(item, index) in insert"
@@ -152,6 +152,7 @@ import merge from 'lodash/merge';
 import { useAposStyles } from 'Modules/@apostrophecms/styles/composables/AposStyles.js';
 import { useModalStore } from 'Modules/@apostrophecms/ui/stores/modal';
 import { useWidgetStore } from 'Modules/@apostrophecms/ui/stores/widget';
+import removeSlash from 'Modules/@apostrophecms/rich-text-widget/lib/remove-slash.js';
 
 export default {
   name: 'AposRichTextWidgetEditor',
@@ -837,6 +838,14 @@ export default {
       ) {
         return;
       }
+      if (e.key === 'Backspace') {
+        // Don't let the global remove-widget shortcut see this key
+        e.preventDefault();
+        e.stopPropagation();
+        removeSlash(this.editor);
+        this.editor.commands.focus();
+        return;
+      }
       this.editor.commands.focus();
       this.activeInsertMenuComponent = false;
       // Only insert character keys

package/modules/@apostrophecms/rich-text-widget/ui/apos/components/AposTiptapInsertItem.vue

@@ -44,6 +44,8 @@
 
 <script setup>
 import { ref, computed } from 'vue';
+import removeEditorSlash from 'Modules/@apostrophecms/rich-text-widget/lib/remove-slash.js';
+
 const props = defineProps({
   name: {
     type: String,
@@ -87,20 +89,7 @@ function activate() {
 }
 
 function removeSlash() {
-  const state = props.editor.state;
-  const { $to } = state.selection;
-  if (state.selection.empty && $to?.nodeBefore?.text) {
-    const text = $to.nodeBefore.text;
-    if (text.slice(-1) === '/') {
-      const pos = props.editor.view.state.selection.$anchor.pos;
-      // Select the slash so an insert operation can replace it
-      props.editor.commands.setTextSelection({
-        from: pos - 1,
-        to: pos
-      });
-      props.editor.commands.deleteSelection();
-    }
-  }
+  removeEditorSlash(props.editor);
 }
 
 function closeInsertMenuItem() {

package/modules/@apostrophecms/rich-text-widget/ui/apos/lib/remove-slash.js

@@ -0,0 +1,18 @@
+// Delete the trailing "/" that opened the rich text insert menu.
+
+export default function removeSlash(editor) {
+  const state = editor.state;
+  const { $to } = state.selection;
+  if (state.selection.empty && $to?.nodeBefore?.text) {
+    const text = $to.nodeBefore.text;
+    if (text.slice(-1) === '/') {
+      const pos = editor.view.state.selection.$anchor.pos;
+      // Select the slash so an insert operation can replace it
+      editor.commands.setTextSelection({
+        from: pos - 1,
+        to: pos
+      });
+      editor.commands.deleteSelection();
+    }
+  }
+}

package/modules/@apostrophecms/schema/ui/apos/components/AposInputDateAndTime.vue

@@ -24,7 +24,7 @@
         >
         <span
           :id="`${uid}-at`"
-          class="apos-input--label"
+          class="apos-input--label apos-input--at"
         >
           {{ $t('apostrophe:at') }}
         </span>
@@ -50,27 +50,58 @@ export default {
 </script>
 <style scoped lang='scss'>
   .apos-input-wrapper {
-    display: flex;
+    container-type: inline-size;
+    display: grid;
+    grid-template-columns: auto minmax(0, 1fr);
     align-items: center;
-    justify-content: space-around;
+    gap: 8px 12px;
   }
 
   .apos-toggle {
-    margin-right: 12px;
+    grid-row: 1;
+    grid-column: 1;
   }
 
   .apos-input {
     padding: 10px;
 
+    &--date,
+    &--time {
+      grid-column: 2;
+      min-width: 0;
+    }
+
+    &--date {
+      grid-row: 1;
+    }
+
+    &--time {
+      grid-row: 2;
+    }
+
     &--disabled {
       background-color: var(--a-white);
       border-color: var(--a-base-8);
       color: var(--a-base-2);
     }
 
-    &--label {
-      margin: 0 12px;
+    &--at {
+      grid-row: 2;
+      grid-column: 1;
+      justify-self: center;
       font-family: var(--a-family-default);
     }
   }
+
+  @container (min-width: 280px) {
+    .apos-input--at {
+      grid-row: 1;
+      grid-column: 3;
+    }
+
+    .apos-input--time {
+      grid-row: 1;
+      grid-column: 4;
+    }
+  }
 </style>

package/modules/@apostrophecms/url/index.js

@@ -58,6 +58,25 @@ module.exports = {
     };
   },
 
+  apiRoutes(self) {
+    return {
+      get: {
+        // GET /api/v1/@apostrophecms/url/literal-routes
+        //
+        // Returns `{ patterns: [ ... ] }`.
+        // See the `getLiteralContentRoutes` method.
+        'literal-routes': async (req) => {
+          if (!self.isExternalFront(req)) {
+            throw self.apos.error('forbidden');
+          }
+          return {
+            patterns: await self.getLiteralContentRoutes(req)
+          };
+        }
+      }
+    };
+  },
+
   handlers(self) {
     return {
       '@apostrophecms/page:beforeSend': {
@@ -94,6 +113,41 @@ module.exports = {
         return !!req.aposExternalFront;
       },
 
+      // Returns the list of "literal content" route patterns declared by
+      // modules — URLs that serve non-page content (e.g. `/robots.txt`,
+      // `/sitemap.xml`, `/sitemaps/*`) and must be proxied raw by an external
+      // front rather than routed through its page renderer.
+      //
+      // Emits `@apostrophecms/url:getLiteralContentRoutes`; handlers in any
+      // module push prefix-free path patterns onto the `patterns` array
+      // (exact like `/robots.txt`, or glob like `/sitemaps/*`). Patterns are
+      // declared unconditionally and independent of `req`: the consumer only
+      // needs to know "this path is literal content", and a pattern that 404s
+      // is harmless. This differs from `getAllUrlMetadata`, which enumerates
+      // exact, existing URLs per locale for static builds and sitemaps.
+      //
+      // Example module level implementation:
+      // ```js
+      // handlers(self) {
+      //   return {
+      //     '@apostrophecms/url:getLiteralContentRoutes': {
+      //       addSitemapRoutes(req, patterns) {
+      //         patterns.push('/sitemap.xml');
+      //         if (self.options.perLocale) {
+      //           patterns.push('/sitemaps/*');
+      //         }
+      //       }
+      //     }
+      //   };
+      // }
+      // ```
+      //
+      async getLiteralContentRoutes(req) {
+        const patterns = [];
+        await self.emit('getLiteralContentRoutes', req, patterns);
+        return [ ...new Set(patterns) ];
+      },
+
       // Returns the effective base URL for the given request.
       //
       // Resolution order:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apostrophe",
-  "version": "4.31.0",
+  "version": "4.32.0",
   "description": "The Apostrophe Content Management System.",
   "main": "index.js",
   "repository": {
@@ -10,7 +10,7 @@
   },
   "homepage": "https://github.com/apostrophecms/apostrophe/tree/main/packages/apostrophe",
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=22.0.0"
   },
   "keywords": [
     "apostrophe",
@@ -70,7 +70,7 @@
     "express-bearer-token": "^3.0.0",
     "express-session": "^1.18.2",
     "fs-extra": "^7.0.1",
-    "glob": "^10.4.5",
+    "glob": "^13.0.0",
     "he": "^1.2.0",
     "html-to-text": "^9.0.5",
     "i18next": "^20.3.2",
@@ -84,8 +84,7 @@
     "minimatch": "^3.1.4",
     "mkdirp": "^0.5.5",
     "multer": "^2.1.1",
-    "node-fetch": "^2.6.1",
-    "nodemailer": "^8.0.5",
+    "nodemailer": "^9.0.1",
     "nunjucks": "^3.2.1",
     "parseurl": "^1.3.3",
     "passport": "^0.6.0",
@@ -120,15 +119,15 @@
     "webpack": "^5.106.1",
     "webpack-merge": "^5.7.3",
     "xregexp": "^2.0.0",
-    "broadband": "^1.1.0",
-    "launder": "^1.7.1",
     "@apostrophecms/db-connect": "^1.0.1",
-    "oembetter": "^1.2.0",
-    "boring": "^1.1.1",
     "express-cache-on-demand": "^1.0.4",
-    "sanitize-html": "^2.17.5",
-    "uploadfs": "^1.26.1",
-    "postcss-viewport-to-container-toggle": "^2.3.0"
+    "launder": "^1.7.1",
+    "broadband": "^1.1.0",
+    "oembetter": "^1.2.1",
+    "boring": "^1.1.1",
+    "postcss-viewport-to-container-toggle": "^2.3.0",
+    "uploadfs": "^1.27.0",
+    "sanitize-html": "^2.17.6"
   },
   "devDependencies": {
     "chai": "^4.3.10",

package/test/asset-external.js

@@ -55,6 +55,7 @@ describe('Asset - External Build', function () {
                 };
               },
               async watch() { },
+              async clearCache() { },
               async startDevServer() {
                 actualDevServer = true;
                 return {
@@ -124,6 +125,7 @@ describe('Asset - External Build', function () {
             return {
               async build() { },
               async watch() { },
+              async clearCache() { },
               async startDevServer() {},
               async entrypoints() {
                 return [];
@@ -291,6 +293,7 @@ describe('Asset - External Build', function () {
                 };
               },
               async watch() { },
+              async clearCache() { },
               async startDevServer() {
                 return {
                   entrypoints: []

package/test/asset-lock-cache.js

@@ -0,0 +1,243 @@
+const t = require('../test-lib/test.js');
+const assert = require('assert');
+const fs = require('fs-extra');
+const path = require('node:path');
+
+// The build skip logic used to rely on the lock file modified time, which is
+// unreliable (fresh checkouts, restored CI/Docker build artifacts, clock
+// skew). When the lock file content changed but its mtime was not newer than a
+// leftover build, the admin UI build was skipped and a stale bundle served.
+// These tests cover the content-hash based detection that forces a rebuild and
+// clears the bundler caches on a lock file change.
+describe('Assets - lock file cache invalidation', function() {
+  this.timeout(5 * 60 * 1000);
+
+  let apos;
+  const lockPath = path.join(process.cwd(), 'test/package-lock.json');
+  let lockSnapshot;
+
+  before(async function() {
+    lockSnapshot = await fs.readFile(lockPath, 'utf8');
+    apos = await t.create({
+      root: module,
+      modules: {}
+    });
+  });
+
+  after(async function() {
+    await fs.writeFile(lockPath, lockSnapshot);
+    await fs.remove(apos.asset.getLockFileHashPath());
+    await t.destroy(apos);
+  });
+
+  afterEach(async function() {
+    // Restore the lock file after any test that mutated it.
+    await fs.writeFile(lockPath, lockSnapshot);
+  });
+
+  beforeEach(function() {
+    // Each test starts as if the process had just booted.
+    apos.asset.lockFileChecked = false;
+  });
+
+  function mutateLock(key) {
+    const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+    lock[key] = (lock[key] || 0) + 1;
+    fs.writeFileSync(lockPath, JSON.stringify(lock, null, 2), 'utf8');
+  }
+
+  it('hashes the lock file content, stable across reads', async function() {
+    const hash = await apos.asset.getLockFileHash();
+    assert(typeof hash === 'string' && hash.length > 0);
+    assert.strictEqual(await apos.asset.getLockFileHash(), hash);
+  });
+
+  it('produces a different hash when the lock content changes', async function() {
+    const before = await apos.asset.getLockFileHash();
+    mutateLock('__test');
+    const after = await apos.asset.getLockFileHash();
+    assert.notStrictEqual(before, after);
+  });
+
+  it('round-trips the saved lock file hash', async function() {
+    await apos.asset.saveLockFileHash('abc123');
+    assert.strictEqual(await apos.asset.readSavedLockFileHash(), 'abc123');
+    await apos.asset.saveLockFileHash(null);
+    assert.strictEqual(await apos.asset.readSavedLockFileHash(), null);
+  });
+
+  it('reports no change when the saved hash matches', async function() {
+    await apos.asset.saveLockFileHash(await apos.asset.getLockFileHash());
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, false);
+  });
+
+  it('reports a change when content differs', async function() {
+    await apos.asset.saveLockFileHash('a-different-old-hash');
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, true);
+  });
+
+  it('treats a first build (no saved hash) as a change', async function() {
+    await apos.asset.saveLockFileHash(null);
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, true);
+  });
+
+  it('runs the lock check once per process', async function() {
+    await apos.asset.saveLockFileHash('an-old-hash');
+    const first = await apos.asset.checkLockFile();
+    assert.strictEqual(first.committed, false);
+    assert.strictEqual(first.changed, true);
+    await apos.asset.commitLockFileCheck(first);
+
+    // A watcher-triggered rebuild in the same process reports no change,
+    // even if the lock content mutated meanwhile.
+    mutateLock('__test-memo');
+    const again = await apos.asset.checkLockFile();
+    assert.strictEqual(again.committed, true);
+    assert.strictEqual(again.changed, false);
+  });
+
+  it('reports no change on rebuilds when there is no lock file', async function() {
+    const original = apos.asset.getLockFileHash;
+    apos.asset.getLockFileHash = async () => null;
+    try {
+      // No lock file: the first build of the process is forced...
+      const first = await apos.asset.checkLockFile();
+      assert.strictEqual(first.changed, true);
+      assert.strictEqual(first.hash, null);
+      await apos.asset.commitLockFileCheck(first);
+      // ...but watcher-triggered rebuilds are not.
+      const again = await apos.asset.checkLockFile();
+      assert.strictEqual(again.committed, true);
+      assert.strictEqual(again.changed, false);
+    } finally {
+      apos.asset.getLockFileHash = original;
+    }
+  });
+
+  it('forces a rebuild when content changed but the lock mtime is older', async function() {
+    const tsFile = path.join(
+      apos.asset.getBundleRootDir(), 'apos-build-timestamp.txt'
+    );
+
+    // Cold build: establishes the bundle, its timestamp and the saved hash.
+    await apos.asset.tasks.build.task({ 'check-apos-build': false });
+    const ts1 = parseInt(await fs.readFile(tsFile, 'utf8'), 10);
+    assert.strictEqual(
+      await apos.asset.readSavedLockFileHash(),
+      await apos.asset.getLockFileHash()
+    );
+
+    // Dependency change: the lock content changes, but its mtime is OLDER than
+    // the freshly built artifacts (fresh checkout / restored build cache).
+    // This happens across process starts, so reset the per-process check.
+    apos.asset.lockFileChecked = false;
+    mutateLock('__test2');
+    const older = new Date(Date.now() - 5 * 60 * 1000);
+    await fs.utimes(lockPath, older, older);
+
+    // The auto build (skip path) must not skip - it should rebuild.
+    await apos.asset.tasks.build.task({ 'check-apos-build': true });
+    const ts2 = parseInt(await fs.readFile(tsFile, 'utf8'), 10);
+
+    assert(ts2 > ts1, `expected a rebuild (ts2=${ts2} > ts1=${ts1})`);
+    assert.strictEqual(
+      await apos.asset.readSavedLockFileHash(),
+      await apos.asset.getLockFileHash()
+    );
+  });
+});
+
+// The webpack file system cache is keyed on the lock file content, but an
+// external build module (e.g. @apostrophecms/vite) keeps a cache that is not,
+// so it must be cleared explicitly when the lock file changes.
+describe('Assets - build module cache cleared on lock change', function() {
+  this.timeout(t.timeout);
+
+  let apos;
+  let clearCalls = 0;
+
+  before(async function() {
+    apos = await t.create({
+      root: module,
+      autoBuild: false,
+      modules: {
+        'asset-vite-mock': {
+          before: '@apostrophecms/asset',
+          handlers(self) {
+            return {
+              '@apostrophecms/asset:afterInit': {
+                async registerExternalBuild() {
+                  self.apos.asset.configureBuildModule(self, {
+                    alias: 'vite',
+                    devServer: false,
+                    hmr: false
+                  });
+                }
+              }
+            };
+          },
+          methods(self) {
+            return {
+              async build() {
+                return { entrypoints: [] };
+              },
+              async watch() {},
+              async startDevServer() {
+                return { entrypoints: [] };
+              },
+              async entrypoints() {
+                return [];
+              },
+              async clearCache() {
+                clearCalls++;
+              }
+            };
+          }
+        }
+      }
+    });
+  });
+
+  after(async function() {
+    await fs.remove(apos.asset.getLockFileHashPath());
+    await t.destroy(apos);
+  });
+
+  it('clears the build module cache when the lock content changes', async function() {
+    await apos.asset.saveLockFileHash('an-old-hash');
+    clearCalls = 0;
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, true);
+    assert.strictEqual(clearCalls, 1);
+  });
+
+  it('leaves the build module cache alone when the lock is unchanged', async function() {
+    await apos.asset.saveLockFileHash(await apos.asset.getLockFileHash());
+    clearCalls = 0;
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, false);
+    assert.strictEqual(clearCalls, 0);
+  });
+
+  it('forces a rebuild but keeps the cache when no lock file is found', async function() {
+    await apos.asset.saveLockFileHash('an-old-hash');
+    clearCalls = 0;
+    // null hash => no lock file present
+    const changed = await apos.asset.checkLockFileChanged(null);
+    assert.strictEqual(changed, true);
+    assert.strictEqual(clearCalls, 0);
+  });
+});

package/test/assets.js

@@ -171,6 +171,29 @@ describe('Assets', function() {
 
   this.timeout(5 * 60 * 1000);
 
+  it('should include the site prefix in asset URLs', async function() {
+    let prefixApos;
+
+    try {
+      prefixApos = await t.create({
+        root: module,
+        prefix: '/apos'
+      });
+
+      assert.equal(
+        prefixApos.asset.getAssetBaseUrl(),
+        '/apos/apos-frontend/default'
+      );
+
+      assert.equal(
+        prefixApos.asset.url('/modules/foo/bar.js'),
+        '/apos/apos-frontend/default/modules/foo/bar.js'
+      );
+    } finally {
+      await t.destroy(prefixApos);
+    }
+  });
+
   it('should exist on the apos object', async function() {
     apos = await t.create({
       root: module,
@@ -409,10 +432,10 @@ describe('Assets', function() {
     assert(meta2['default:src']);
 
     // Caching should provide a measurable speedup. The threshold is kept
-    // low (10%) to avoid flaky failures on loaded CI runners where the
+    // low (5%) to avoid flaky failures on loaded CI runners where the
     // cold run can be fast due to OS-level caching.
     const gain = (execTime - execTimeCached) / execTime * 100;
-    assert(gain >= 10, `Expected gain >=10%, got ${gain}%`);
+    assert(gain >= 5, `Expected gain >=5%, got ${gain}%`);
 
     // Modification times
     assert(meta['default:apos'].mdate);

package/test/config-cascade-merge.js

@@ -0,0 +1,73 @@
+const t = require('../test-lib/test.js');
+const assert = require('assert');
+
+// PRO-9564
+// This test pins an established moog-require contract so it is not "fixed" by
+// accident — changing it would silently break existing projects.
+//
+// Scope: the SAME module configured BOTH via the app.js object passed to
+// apostrophe() AND its project-level index.js. (NOT cascade merging across the
+// module chain via extends/improvements, which merges field-by-field as usual.)
+//
+// moog-require collapses the two sources with a shallow `_.defaults` before the
+// chain is built, so app.js wins for any top-level section declared in both.
+// `options` then gets a second pass that gap-fills from index.js, but no other
+// section does — so a cascade like `fields` is NOT merged: an app.js `fields`
+// replaces the index.js `fields` wholesale, dropping even unrelated
+// project-level fields. The options-only gap-fill is by design.
+//
+// Example — this test and its fixture:
+//   app.js   modules: { 'collision-piece': { fields: { add: { configField } } } }
+//   index.js test/modules/collision-piece/index.js -> fields: { add: { projectField } }
+//   result   schema has `configField`; `projectField` is gone, although the two
+//            fields are unrelated.
+//   options  app.js { alias: ... } still merges with any index.js options
+//            (gap-fill), unlike `fields`.
+//
+// Files: collapse in packages/apostrophe/lib/moog-require.js (~`_.defaults(
+// definition, projectLevelDefinition)`); cascade compiler that the dropped
+// section never reaches in packages/apostrophe/lib/moog.js; project-level
+// fixture in test/modules/collision-piece/index.js.
+
+describe('config-object vs project-level cascade merge (moog-require contract)', function () {
+  this.timeout(t.timeout);
+  let apos;
+  after(async () => {
+    await t.destroy(apos);
+  });
+
+  it('app.js `fields` wins over the project-level file when both declare it', async function () {
+    apos = await t.create({
+      root: module,
+      modules: {
+        'collision-piece': {
+          extend: '@apostrophecms/piece-type',
+          options: { alias: 'collisionPiece' },
+          fields: {
+            add: {
+              configField: {
+                type: 'string',
+                label: 'Config Field'
+              }
+            },
+            group: {
+              configGroup: {
+                label: 'Config Group',
+                fields: [ 'configField' ]
+              }
+            }
+          }
+        }
+      }
+    });
+
+    const names = apos.collisionPiece.schema.map(f => f.name);
+    // The app.js (config object) fields win.
+    assert(names.includes('configField'));
+    // The project-level file's fields are dropped wholesale — the contract.
+    assert(!names.includes('projectField'));
+    // Options are the exception: an index.js-only option is gap-filled in,
+    // where a project-level field would have been dropped.
+    assert.strictEqual(apos.collisionPiece.options.fromProjectFile, true);
+  });
+});