apostrophe 4.31.1-beta.1 → 4.32.0

package/modules/@apostrophecms/doc-type/index.js

@@ -1621,6 +1621,50 @@ module.exports = {
         return doc;
       },
 
+      // Resolve a `choices` / `counts` filter (i.e. a query builder name) to
+      // the schema field whose distinct values that builder would expose, or
+      // `undefined` when it does not correspond to a schema field.
+      //
+      // Most field types register a query builder named exactly after the
+      // field, so an exact-name match is enough. Relationship fields are the
+      // exception: they register additional builders whose names differ from
+      // the schema field name — the `And` variant of the field name
+      // (`_authorAnd`) and the "slug" builders that drop the leading
+      // underscore (`author`, `authorAnd`). All of those run
+      // `toDistinct(field.idsStorage)` against the host collection, so they
+      // must resolve back to the underlying relationship field to be gated
+      // exactly like the field itself. Dot-notated sub-field builders resolve
+      // to their top-level schema field.
+      choicesFilterField(filter) {
+        if (typeof filter !== 'string') {
+          return undefined;
+        }
+        // Exact match: covers every non-relationship field type, plus the
+        // relationship field's own `field.name` builder.
+        const exact = self.schema.find(f => f.name === filter);
+        if (exact) {
+          return exact;
+        }
+        // Dot-notated filters are gated by their top-level schema field.
+        const topLevel = filter.split('.')[0];
+        if (topLevel !== filter) {
+          const parent = self.schema.find(f => f.name === topLevel);
+          if (parent) {
+            return parent;
+          }
+        }
+        // Relationship alias builders. Strip an optional trailing `And`
+        // operator suffix, then match either the relationship field name
+        // (`_author`, reached via the `_authorAnd` operation builder) or the
+        // field name without its leading underscore (`author`, reached via
+        // the slug builders `author` / `authorAnd`).
+        const base = filter.replace(/And$/, '');
+        return self.schema.find(f =>
+          f.type === 'relationship' &&
+          (f.name === base || f.name.replace(/^_/, '') === base)
+        );
+      },
+
       // Returns true if the named filter is permitted to expose distinct
       // values through the `choices` / `counts` query builders given the
       // publicApiProjection. When no publicApiProjection is in effect
@@ -1635,35 +1679,49 @@ module.exports = {
         if (!projection || !Object.keys(projection).length) {
           return true;
         }
-        // Builders that aren't named after a top-level schema field are
-        // not gated by the projection.
-        const field = self.schema.find(f => f.name === filter);
+        // Resolve the builder to its underlying schema field, mapping
+        // relationship alias builders back to the relationship field so the
+        // projection check cannot be bypassed by requesting the alias name.
+        // Builders not backed by a schema field are not gated.
+        const field = self.choicesFilterField(filter);
         if (!field) {
           return true;
         }
-        const topLevel = filter.split('.')[0];
+        // Projection keys that would expose this field's values to the client.
+        // For a relationship, exposure of either the relationship property
+        // itself or its `idsStorage` (the property MongoDB's `distinct`
+        // actually reads) permits the choices.
+        const keys = [ field.name ];
+        if (field.idsStorage) {
+          keys.push(field.idsStorage);
+        }
         const values = Object.values(projection);
         const hasInclusion = values.some(v => v && v !== 0);
         const hasExclusion = values.some(v => v === 0 || v === false);
         if (hasInclusion) {
-          // Inclusion projection: field must be explicitly included.
-          return Boolean(projection[topLevel]);
+          // Inclusion projection: at least one relevant key must be included.
+          return keys.some(key => Boolean(projection[key]));
         }
         if (hasExclusion) {
-          // Exclusion projection: field must not be explicitly excluded.
-          return projection[topLevel] !== 0 && projection[topLevel] !== false;
+          // Exclusion projection: no relevant key may be explicitly excluded.
+          return keys.every(
+            key => projection[key] !== 0 && projection[key] !== false
+          );
         }
         return true;
       },
 
-      // Returns true if the current user is permitted to view the named
-      // schema field according to any schema-level `viewPermission`.
-      // Non-schema filters are permitted. A dot-notated filter is matched
-      // against the top-level schema field, since `viewPermission` is
-      // declared on top-level fields (see `removeForbiddenFields`).
+      // Returns true if the current user is permitted to view the field
+      // exposed by the named filter according to any schema-level
+      // `viewPermission`. Filters that don't resolve to a schema field are
+      // permitted. Relationship alias builders and dot-notated sub-field
+      // builders resolve to their underlying top-level field (see
+      // `choicesFilterField`), since `viewPermission` is declared on
+      // top-level fields (see `removeForbiddenFields`) — matching only the
+      // literal filter name would let the relationship alias builders bypass
+      // this check the same way they bypassed the projection check.
       choicesFieldAllowedByViewPermission(req, filter) {
-        const topLevel = filter.split('.')[0];
-        const field = self.schema.find(f => f.name === topLevel);
+        const field = self.choicesFilterField(filter);
         if (!field || !field.viewPermission) {
           return true;
         }

package/modules/@apostrophecms/http/index.js

@@ -1,9 +1,9 @@
 const _ = require('lodash');
 const qs = require('qs');
-const fetch = require('node-fetch');
 const tough = require('tough-cookie');
 const escapeHost = require('../../../lib/escape-host.js');
 const util = require('util');
+const { PassThrough } = require('node:stream');
 
 module.exports = {
   options: {
@@ -53,160 +53,151 @@ module.exports = {
         self.errors[name] = code;
       },
 
-      // Fetch the given URL and return the response body. Accepts the
-      // following options:
-      //
-      // `qs` (builds a query string with qs)
-      // `jar` (pass in a cookie jar obtained from apos.http.jar())
-      // `parse` (can be 'json` to always parse the response body as JSON,
-      // otherwise the response body is parsed as JSON only if the content-type
-      // is application/json) `headers` (an object containing header names and
-      // values) `fullResponse` (if true, return an object with `status`,
-      // `headers` and `body` properties, rather than returning the body
-      // directly; the individual `headers` are canonicalized to lowercase
-      // names. If a header appears multiple times an array is returned for it)
-      //
-      // If the status code is >= 400 an error is thrown. The error object will
-      // be similar to a `fullResponse` object, with a `status` property.
-      //
-      // If the URL is site-relative (starts with /) it will be requested from
-      // the apostrophe site itself.
+      /**
+       * Options accepted by the `apos.http.*` request methods. Any additional
+       * properties are passed through to the built-in `fetch` as-is (e.g.
+       * `redirect`, `signal`).
+       *
+       * @typedef {object} AposHttpOptions
+       * @property {object} [qs] Query-string parameters, serialized with `qs`
+       *   and appended to the URL.
+       * @property {object} [jar] A cookie jar from `apos.http.jar()`. Its
+       *   cookies are sent with the request, and any `Set-Cookie` in the
+       *   response is stored back into the jar.
+       * @property {'json'|'form'} [send] Force body encoding: `'json'` sends
+       *   `body` JSON-encoded, `'form'` sends it URL-encoded.
+       * @property {*} [body] Request body. A plain object or array is sent as
+       *   JSON; a `FormData` (the global or a `form-data` instance) is sent as
+       *   multipart; otherwise sent as-is. See `send` to force encoding.
+       * @property {'json'} [parse] Always parse the response body as JSON.
+       *   Without it, the body is parsed as JSON only when the response
+       *   content-type is `application/json`.
+       * @property {Object<string, string>} [headers] Request header names and
+       *   values. Per the fetch standard a `Host` header cannot be set.
+       * @property {boolean} [fullResponse] Resolve with `{ status, headers,
+       *   body }` instead of the body alone. Header names are lowercased; a
+       *   header seen multiple times is comma-joined.
+       * @property {boolean} [originalResponse] Resolve with the raw built-in
+       *   fetch `Response`. Its `body` is a WHATWG `ReadableStream` (use
+       *   `Readable.fromWeb()` to consume it as a Node stream).
+       * @property {number} [timeout] Per-request timeout in milliseconds,
+       *   applied via `AbortSignal.timeout`. A falsy value means no timeout.
+       * @property {AbortSignal} [signal] Abort signal; combined with `timeout`
+       *   when both are given.
+       * @property {object} [dispatcher] An undici `Dispatcher` (e.g. a proxy or
+       *   custom-TLS agent). Replaces the former node-fetch `agent` option.
+       */
 
+      /**
+       * Make a GET request and resolve with the response body.
+       *
+       * If the URL is site-relative (starts with `/`) it is requested from the
+       * apostrophe site itself. Throws if the status code is >= 400; the error
+       * resembles a `fullResponse` object with a `status` property.
+       *
+       * @param {string} url
+       * @param {AposHttpOptions} [options]
+       * @returns {Promise<*>} The response body, or a `fullResponse` /
+       *   `originalResponse` object when those options are set.
+       */
       async get(url, options) {
         return self.remote('GET', url, options);
       },
 
-      // Make a HEAD request for the given URL and return the response object,
-      // which will include a `status` property as well as `headers`.
-      //
-      // Options:
-      //
-      // `qs` (builds a query string with qs)
-      // `jar` (pass in a cookie jar obtained from apos.http.jar())
-      // `headers` (an object containing header names and values)
-      //
-      // If the status code is >= 400 an error is thrown. The error object
-      // will have a `status` property.
-      //
-      // If the URL is site-relative (starts with /) it will be requested from
-      // the apostrophe site itself.
-
+      /**
+       * Make a HEAD request. Resolves with the (empty) response body; pass
+       * `fullResponse: true` to read the `status` and `headers`.
+       *
+       * If the URL is site-relative (starts with `/`) it is requested from the
+       * apostrophe site itself. Throws if the status code is >= 400.
+       *
+       * @param {string} url
+       * @param {AposHttpOptions} [options]
+       * @returns {Promise<*>}
+       */
       async head(url, options) {
         return self.remote('HEAD', url, options);
       },
 
-      // Send a POST request to the given URL and return the response body.
-      // Accepts the following options:
-      //
-      // `qs` (pass object; builds a query string with qs)
-      // `jar` (pass in a cookie jar obtained from apos.http.jar())
-      // `send` (can be 'json' to always send `options.body` JSON encoded, or
-      // 'form' to send it URL-encoded) `body` (request body; if an object or
-      // array, sent as JSON, otherwise sent as-is, unless the `send` option is
-      // set) `parse` (can be 'json` to always parse the response body as JSON,
-      // otherwise the response body is parsed as JSON only if the content-type
-      // is application/json) `headers` (an object containing header names and
-      // values) `fullResponse` (if true, return an object with `status`,
-      // `headers` and `body` properties, rather than returning the body
-      // directly; the individual `headers` are canonicalized to lowercase
-      // names. If a header appears multiple times an array is returned for it)
-      //
-      // If the status code is >= 400 an error is thrown. The error object will
-      // be similar to a `fullResponse` object, with a `status` property.
-      //
-      // If the URL is site-relative (starts with /) it will be requested from
-      // the apostrophe site itself.
-
+      /**
+       * Send a POST request and resolve with the response body.
+       *
+       * If the URL is site-relative (starts with `/`) it is requested from the
+       * apostrophe site itself. Throws if the status code is >= 400; the error
+       * resembles a `fullResponse` object with a `status` property.
+       *
+       * @param {string} url
+       * @param {AposHttpOptions} [options]
+       * @returns {Promise<*>} The response body, or a `fullResponse` /
+       *   `originalResponse` object when those options are set.
+       */
       async post(url, options) {
         return self.remote('POST', url, options);
       },
 
-      // Send a DELETE request to the given URL and return the response body.
-      // Accepts the following options:
-      //
-      // `qs` (pass object; builds a query string with qs)
-      // `jar` (pass in a cookie jar obtained from apos.http.jar())
-      // `send` (can be 'json' to always send `options.body` JSON encoded, or
-      // 'form' to send it URL-encoded) `body` (request body; if an object or
-      // array, sent as JSON, otherwise sent as-is, unless the `send` option is
-      // set) `parse` (can be 'json` to always parse the response body as JSON,
-      // otherwise the response body is parsed as JSON only if the content-type
-      // is application/json) `headers` (an object containing header names and
-      // values) `fullResponse` (if true, return an object with `status`,
-      // `headers` and `body` properties, rather than returning the body
-      // directly; the individual `headers` are canonicalized to lowercase
-      // names. If a header appears multiple times an array is returned for it)
-      //
-      // If the status code is >= 400 an error is thrown. The error object will
-      // be similar to a `fullResponse` object, with a `status` property.
-      //
-      // If the URL is site-relative (starts with /) it will be requested from
-      // the apostrophe site itself.
-
+      /**
+       * Send a DELETE request and resolve with the response body.
+       *
+       * If the URL is site-relative (starts with `/`) it is requested from the
+       * apostrophe site itself. Throws if the status code is >= 400; the error
+       * resembles a `fullResponse` object with a `status` property.
+       *
+       * @param {string} url
+       * @param {AposHttpOptions} [options]
+       * @returns {Promise<*>} The response body, or a `fullResponse` /
+       *   `originalResponse` object when those options are set.
+       */
       async delete(url, options) {
         return self.remote('DELETE', url, options);
       },
 
-      // Send a PUT request to the given URL and return the response body.
-      // Accepts the following options:
-      //
-      // `qs` (pass object; builds a query string with qs)
-      // `jar` (pass in a cookie jar obtained from apos.http.jar())
-      // `send` (can be 'json' to always send `options.body` JSON encoded, or
-      // 'form' to send it URL-encoded) `body` (request body; if an object or
-      // array, sent as JSON, otherwise sent as-is, unless the `send` option is
-      // set) `parse` (can be 'json` to always parse the response body as JSON,
-      // otherwise the response body is parsed as JSON only if the content-type
-      // is application/json) `headers` (an object containing header names and
-      // values) `fullResponse` (if true, return an object with `status`,
-      // `headers` and `body` properties, rather than returning the body
-      // directly; the individual `headers` are canonicalized to lowercase
-      // names. If a header appears multiple times an array is returned for it)
-      //
-      // If the status code is >= 400 an error is thrown. The error object will
-      // be similar to a `fullResponse` object, with a `status` property.
-      //
-      // If the URL is site-relative (starts with /) it will be requested from
-      // the apostrophe site itself.
-
+      /**
+       * Send a PUT request and resolve with the response body.
+       *
+       * If the URL is site-relative (starts with `/`) it is requested from the
+       * apostrophe site itself. Throws if the status code is >= 400; the error
+       * resembles a `fullResponse` object with a `status` property.
+       *
+       * @param {string} url
+       * @param {AposHttpOptions} [options]
+       * @returns {Promise<*>} The response body, or a `fullResponse` /
+       *   `originalResponse` object when those options are set.
+       */
       async put(url, options) {
         return self.remote('PUT', url, options);
       },
 
-      // Send a PATCH request to the given URL and return the response body.
-      // Accepts the following options:
-      //
-      // `qs` (pass object; builds a query string with qs)
-      // `jar` (pass in a cookie jar obtained from apos.http.jar())
-      // `send` (can be 'json' to always send `options.body` JSON encoded, or
-      // 'form' to send it URL-encoded) `body` (request body; if an object or
-      // array, sent as JSON, otherwise sent as-is, unless the `send` option is
-      // set) `parse` (can be 'json` to always parse the response body as JSON,
-      // otherwise the response body is parsed as JSON only if the content-type
-      // is application/json) `headers` (an object containing header names and
-      // values) `fullResponse` (if true, return an object with `status`,
-      // `headers` and `body` properties, rather than returning the body
-      // directly; the individual `headers` are canonicalized to lowercase
-      // names. If a header appears multiple times an array is returned for it)
-      // `originalResponse` (if true, return the response object exactly as it
-      // is returned by node-fetch)
-      //
-      // If the status code is >= 400 an error is thrown. The error object will
-      // be similar to a `fullResponse` object, with a `status` property.
-      //
-      // If the URL is site-relative (starts with /) it will be requested from
-      // the apostrophe site itself.
-
+      /**
+       * Send a PATCH request and resolve with the response body.
+       *
+       * If the URL is site-relative (starts with `/`) it is requested from the
+       * apostrophe site itself. Throws if the status code is >= 400; the error
+       * resembles a `fullResponse` object with a `status` property.
+       *
+       * @param {string} url
+       * @param {AposHttpOptions} [options]
+       * @returns {Promise<*>} The response body, or a `fullResponse` /
+       *   `originalResponse` object when those options are set.
+       */
       async patch(url, options) {
         return self.remote('PATCH', url, options);
       },
 
-      // Invoke a remote HTTP API with the named method. Use .get, .post, etc.
-      // This is an implementation method invoked by these
-      //
-      // If the URL is site-relative (starts with /) it will be requested from
-      // the apostrophe site itself.
-
+      /**
+       * Invoke a remote HTTP API with the given method. The implementation
+       * behind `get`, `post`, `put`, `patch`, `delete` and `head` — prefer
+       * those.
+       *
+       * If the URL is site-relative (starts with `/`) it is requested from the
+       * apostrophe site itself. Throws if the status code is >= 400; the error
+       * resembles a `fullResponse` object with a `status` property.
+       *
+       * @param {string} method HTTP method, e.g. `'GET'`.
+       * @param {string} url
+       * @param {AposHttpOptions} [options]
+       * @returns {Promise<*>} The response body, or a `fullResponse` /
+       *   `originalResponse` object when those options are set.
+       */
       async remote(method, url, options) {
         let awaitedBody = false;
         if (!options) {
@@ -216,6 +207,24 @@ module.exports = {
           ...options,
           method
         };
+        // `agent` was a node-fetch option with no equivalent in the built-in
+        // fetch: an http.Agent is not an undici Dispatcher. Fail loudly rather
+        // than silently ignore a proxy/TLS/keep-alive intention. Power users
+        // can pass an undici `dispatcher` instead, which fetch accepts as-is.
+        if (options.agent) {
+          throw new Error('apos.http no longer supports the `agent` option (the built-in fetch has no equivalent). Pass an undici `dispatcher` instead.');
+        }
+        // `timeout` was a node-fetch option; the built-in fetch uses an
+        // AbortSignal. Translate it to preserve the behavior, combining it with
+        // any caller-supplied signal. As with node-fetch, a falsy timeout (0,
+        // undefined) means "no timeout".
+        if (options.timeout) {
+          const timeoutSignal = AbortSignal.timeout(options.timeout);
+          options.signal = options.signal
+            ? AbortSignal.any([ options.signal, timeoutSignal ])
+            : timeoutSignal;
+          delete options.timeout;
+        }
         if (url.match(/^\//)) {
           url = `${self.getBase()}${url}`;
         }
@@ -228,14 +237,35 @@ module.exports = {
           options.headers = options.headers || {};
           options.headers.cookie = cookies.join('; ');
         }
-        if (options.body && options.body.constructor && (options.body.constructor.name === 'FormData')) {
-          // If we don't do this multiparty will not parse it properly
+        if (
+          options.body &&
+          (typeof options.body.getHeaders === 'function') &&
+          (typeof options.body.pipe === 'function')
+        ) {
+          // A `form-data` package instance. The built-in fetch does not
+          // recognize it (passed directly it is coerced to a useless string
+          // body), so we adapt it ourselves: take its multipart Content-Type
+          // (with boundary) from getHeaders(), set Content-Length so multiparty
+          // can parse it, and stream it through a PassThrough, which the
+          // built-in fetch does accept as a request body.
+          const form = options.body;
           const contentLength = await util.promisify((callback) => {
-            return options.body.getLength(callback);
+            return form.getLength(callback);
           })();
-          options.headers = options.headers || {};
-          options.headers['Content-Length'] = contentLength;
-          // node-fetch will set the Content-Type
+          options.headers = {
+            ...form.getHeaders(),
+            ...options.headers,
+            'Content-Length': contentLength
+          };
+          const pass = new PassThrough();
+          form.pipe(pass);
+          options.body = pass;
+          // Required by the built-in fetch when the body is a stream.
+          options.duplex = 'half';
+        } else if (options.body instanceof FormData) {
+          // A native (WHATWG) FormData: the built-in fetch sets the multipart
+          // Content-Type (with boundary) and streams it. Nothing to do here,
+          // and we must not fall through to the JSON branch below.
         } else if (((options.body != null) && ((typeof options.body) === 'object')) || (options.send === 'json')) {
           options.body = JSON.stringify(options.body);
           options.headers = options.headers || {};
@@ -248,9 +278,9 @@ module.exports = {
         const res = await fetch(url, options);
         let body;
         if (options.jar) {
-          // This is node-fetch specific, browsers limit what JS can see about
-          // this header
-          (res.headers.raw()['set-cookie'] || []).forEach(cookie => {
+          // getSetCookie() returns each Set-Cookie value separately; browsers
+          // limit what JS can see about this header
+          res.headers.getSetCookie().forEach(cookie => {
             options.jar.setCookieSync(cookie, url);
           });
         }
@@ -279,6 +309,12 @@ module.exports = {
             // Usually just a source of bugs
             headers[name] = value;
           });
+          // node-fetch resolved a redirect's Location to an absolute URL; the
+          // built-in fetch returns it as sent (often relative). Resolve it
+          // against the request URL to preserve the absolute form callers expect.
+          if ((res.status >= 300) && (res.status < 400) && headers.location) {
+            headers.location = new URL(headers.location, url).href;
+          }
           return {
             status: res.status,
             headers,

package/modules/@apostrophecms/image/index.js

@@ -333,15 +333,24 @@ module.exports = {
         });
 
         const imageTagManager = self.apos.doc.getManager('@apostrophecms/image-tag');
-        const tag = (operation === 'create')
-          ? await imageTagManager.insert(
-            req,
-            {
+        let tag;
+        if (operation === 'create') {
+          // Reuse an existing tag with the same slug instead of inserting a
+          // duplicate.
+          const desiredSlug = self.apos.util.slugify(title);
+          const lockName = `@apostrophecms/image-tag:create:${req.locale}:${desiredSlug}`;
+          tag = await self.apos.lock.withLock(lockName, async () => {
+            const existing = await imageTagManager
+              .find(req, { slug: desiredSlug })
+              .toObject();
+            return existing || imageTagManager.insert(req, {
               ...imageTagManager.newInstance(),
               title
-            }
-          )
-          : await imageTagManager.find(req, { slug }).toObject();
+            });
+          });
+        } else {
+          tag = await imageTagManager.find(req, { slug }).toObject();
+        }
 
         return self.apos.modules['@apostrophecms/job'].runBatch(
           req,

package/modules/@apostrophecms/image/ui/apos/components/AposMediaManager.vue

@@ -816,6 +816,13 @@ export default {
           return [];
         }
 
+        const { count } = await apos.http.get(action, {
+          draft: true,
+          qs: {
+            count: true
+          }
+        });
+
         const response = await apos.http.get(
           action,
           {
@@ -823,7 +830,8 @@ export default {
             qs: {
               sort: {
                 title: 1
-              }
+              },
+              perPage: Math.max(count, 1)
             }
           }
         );

package/modules/@apostrophecms/job/index.js

@@ -110,7 +110,9 @@ module.exports = {
           // sends a response with a jobId to the browser
           job = await self.start(options);
 
-          self.setTotal(job, ids.length);
+          // Persist the total before work begins so the completed notification
+          // and job document always report it, even if processing finishes fast.
+          await self.setTotal(job, ids.length);
           // Runs after response is already sent
           run();