apostrophe 4.31.1-beta.1 → 4.32.0

package/modules/@apostrophecms/oembed/index.js

@@ -86,9 +86,7 @@ module.exports = {
       // The `options` object is passed on to `oembetter.fetch`.
       //
       // Responses are automatically cached, by default for one hour. See the
-      // cacheLifetime option to the module. Failures are cached as well, so
-      // that a bad or removed URL does not lead to repeated requests that can
-      // trigger rate-limiting (e.g. YouTube 429 errors and lockouts).
+      // cacheLifetime option to the module.
       async query(req, url, options) {
         if (!options) {
           options = {};
@@ -114,44 +112,18 @@ module.exports = {
           throw self.apos.error('invalid', req.t('apostrophe:oembedVideoUrlInvalid'));
         }
         const key = url + ':' + JSON.stringify(options);
-        const cached = await self.apos.cache.get('@apostrophecms/oembed', key);
-        if (cached !== undefined) {
-          // Cache entries are wrapped so that both successes and failures can
-          // be remembered. Caching failures prevents a bad or removed URL
-          // (such as a deleted YouTube video) from being requested over and
-          // over, which can trigger 429 rate-limiting and temporary lockouts.
-          //
-          // Legacy entries written before this wrapping existed are the raw
-          // oembed response object, so tolerate them by returning them as-is.
-          if (cached && cached.aposOembedCache) {
-            if (cached.error) {
-              throw self.apos.error('invalid', req.t('apostrophe:oembedVideoUrlInvalid'));
-            }
-            return cached.response;
-          }
-          return cached;
+        let response = await self.apos.cache.get('@apostrophecms/oembed', key);
+        if (response !== undefined) {
+          return response;
         }
-        let response;
-        try {
-          if (options.alwaysIframe) {
-            response = await self.iframe(req, url, options);
-          } else {
+        if (options.alwaysIframe) {
+          response = await self.iframe(req, url, options);
+        } else {
+          try {
             response = await require('util').promisify(self.oembetter.fetch)(url, options);
+          } catch (err) {
+            throw self.apos.error('invalid', req.t('apostrophe:oembedVideoUrlInvalid'));
           }
-        } catch (err) {
-          // Log the underlying cause first, since the higher-level error
-          // thrown below would otherwise obscure it.
-          self.logError(req, 'query-failed', err.message, {
-            url,
-            stack: err.stack
-          });
-          // Cache the failure too, so we don't keep hammering the provider
-          // for a URL that is currently failing.
-          await self.apos.cache.set('@apostrophecms/oembed', key, {
-            aposOembedCache: true,
-            error: true
-          }, self.options.cacheLifetime);
-          throw self.apos.error('invalid', req.t('apostrophe:oembedVideoUrlInvalid'));
         }
         // Make non-secure URLs protocol relative and
         // let the browser upgrade them to https if needed
@@ -165,13 +137,8 @@ module.exports = {
         if (response.html) {
           response.html = makeProtocolRelative(response.html);
         }
-        // Cache the successful response (by default for one hour; see the
-        // cacheLifetime option).
-        await self.apos.cache.set('@apostrophecms/oembed', key, {
-          aposOembedCache: true,
-          error: false,
-          response
-        }, self.options.cacheLifetime);
+        // cache oembed responses for one hour
+        await self.apos.cache.set('@apostrophecms/oembed', key, response, self.options.cacheLifetime);
         return response;
       },
       // Not currently used. Present for backwards compatibility

package/modules/@apostrophecms/page/index.js

@@ -1651,11 +1651,27 @@ database.`);
             // Move outside tree
             throw self.apos.error('forbidden');
           }
+          // Enforce destination-parent authorization: a cross-parent move
+          // into a non-archive destination requires "create" permission on
+          // that destination (the same boundary the page-insert route
+          // enforces). The one exception is restoring a page out of the
+          // archive, which is permitted into any destination the actor may
+          // edit even without "create".
+          //
+          // That exception is NOT dead code: with @apostrophecms-pro/advanced-
+          // permission, per-document permissions grant edit (and view/publish)
+          // independently of type-level create, so a page can legitimately have
+          // _edit true while _create is false. Do not "simplify" this away.
+          //
+          // The exception must be negated and ANDed onto the guard, NOT ANDed
+          // on unnegated: doing the latter (a past regression, GHSA-wr5r-wqp2-
+          // x4fh) gated the whole check on "moving out of the archive" and
+          // disabled create enforcement for every normal move.
           if (
             (oldParent._id !== parent._id) &&
             (parent.type !== '@apostrophecms/archive-page') &&
             (!parent._create) &&
-            (oldParent.type === '@apostrophecms/archive-page' && !parent._edit)
+            !(oldParent.type === '@apostrophecms/archive-page' && parent._edit)
           ) {
             throw self.apos.error('forbidden');
           }

package/modules/@apostrophecms/rich-text-widget/ui/apos/components/AposRichTextWidgetEditor.vue

@@ -52,6 +52,7 @@
       :editor="editor"
       role="listbox"
       tabindex="0"
+      @keydown="closeInsertMenu"
     >
       <div class="apos-rich-text-insert-menu-heading">
         {{ $t('apostrophe:richTextInsertMenuHeading') }}
@@ -60,7 +61,6 @@
         class="apos-rich-text-insert-menu-wrapper"
         @keydown.prevent.arrow-up="focusInsertMenuItem(true)"
         @keydown.prevent.arrow-down="focusInsertMenuItem()"
-        @keydown="closeInsertMenu"
       >
         <li
           v-for="(item, index) in insert"
@@ -152,6 +152,7 @@ import merge from 'lodash/merge';
 import { useAposStyles } from 'Modules/@apostrophecms/styles/composables/AposStyles.js';
 import { useModalStore } from 'Modules/@apostrophecms/ui/stores/modal';
 import { useWidgetStore } from 'Modules/@apostrophecms/ui/stores/widget';
+import removeSlash from 'Modules/@apostrophecms/rich-text-widget/lib/remove-slash.js';
 
 export default {
   name: 'AposRichTextWidgetEditor',
@@ -837,6 +838,14 @@ export default {
       ) {
         return;
       }
+      if (e.key === 'Backspace') {
+        // Don't let the global remove-widget shortcut see this key
+        e.preventDefault();
+        e.stopPropagation();
+        removeSlash(this.editor);
+        this.editor.commands.focus();
+        return;
+      }
       this.editor.commands.focus();
       this.activeInsertMenuComponent = false;
       // Only insert character keys

package/modules/@apostrophecms/rich-text-widget/ui/apos/components/AposTiptapInsertItem.vue

@@ -44,6 +44,8 @@
 
 <script setup>
 import { ref, computed } from 'vue';
+import removeEditorSlash from 'Modules/@apostrophecms/rich-text-widget/lib/remove-slash.js';
+
 const props = defineProps({
   name: {
     type: String,
@@ -87,20 +89,7 @@ function activate() {
 }
 
 function removeSlash() {
-  const state = props.editor.state;
-  const { $to } = state.selection;
-  if (state.selection.empty && $to?.nodeBefore?.text) {
-    const text = $to.nodeBefore.text;
-    if (text.slice(-1) === '/') {
-      const pos = props.editor.view.state.selection.$anchor.pos;
-      // Select the slash so an insert operation can replace it
-      props.editor.commands.setTextSelection({
-        from: pos - 1,
-        to: pos
-      });
-      props.editor.commands.deleteSelection();
-    }
-  }
+  removeEditorSlash(props.editor);
 }
 
 function closeInsertMenuItem() {

package/modules/@apostrophecms/rich-text-widget/ui/apos/lib/remove-slash.js

@@ -0,0 +1,18 @@
+// Delete the trailing "/" that opened the rich text insert menu.
+
+export default function removeSlash(editor) {
+  const state = editor.state;
+  const { $to } = state.selection;
+  if (state.selection.empty && $to?.nodeBefore?.text) {
+    const text = $to.nodeBefore.text;
+    if (text.slice(-1) === '/') {
+      const pos = editor.view.state.selection.$anchor.pos;
+      // Select the slash so an insert operation can replace it
+      editor.commands.setTextSelection({
+        from: pos - 1,
+        to: pos
+      });
+      editor.commands.deleteSelection();
+    }
+  }
+}

package/modules/@apostrophecms/schema/ui/apos/components/AposInputDateAndTime.vue

@@ -24,7 +24,7 @@
         >
         <span
           :id="`${uid}-at`"
-          class="apos-input--label"
+          class="apos-input--label apos-input--at"
         >
           {{ $t('apostrophe:at') }}
         </span>
@@ -50,27 +50,58 @@ export default {
 </script>
 <style scoped lang='scss'>
   .apos-input-wrapper {
-    display: flex;
+    container-type: inline-size;
+    display: grid;
+    grid-template-columns: auto minmax(0, 1fr);
     align-items: center;
-    justify-content: space-around;
+    gap: 8px 12px;
   }
 
   .apos-toggle {
-    margin-right: 12px;
+    grid-row: 1;
+    grid-column: 1;
   }
 
   .apos-input {
     padding: 10px;
 
+    &--date,
+    &--time {
+      grid-column: 2;
+      min-width: 0;
+    }
+
+    &--date {
+      grid-row: 1;
+    }
+
+    &--time {
+      grid-row: 2;
+    }
+
     &--disabled {
       background-color: var(--a-white);
       border-color: var(--a-base-8);
       color: var(--a-base-2);
     }
 
-    &--label {
-      margin: 0 12px;
+    &--at {
+      grid-row: 2;
+      grid-column: 1;
+      justify-self: center;
       font-family: var(--a-family-default);
     }
   }
+
+  @container (min-width: 280px) {
+    .apos-input--at {
+      grid-row: 1;
+      grid-column: 3;
+    }
+
+    .apos-input--time {
+      grid-row: 1;
+      grid-column: 4;
+    }
+  }
 </style>

package/modules/@apostrophecms/url/index.js

@@ -58,6 +58,25 @@ module.exports = {
     };
   },
 
+  apiRoutes(self) {
+    return {
+      get: {
+        // GET /api/v1/@apostrophecms/url/literal-routes
+        //
+        // Returns `{ patterns: [ ... ] }`.
+        // See the `getLiteralContentRoutes` method.
+        'literal-routes': async (req) => {
+          if (!self.isExternalFront(req)) {
+            throw self.apos.error('forbidden');
+          }
+          return {
+            patterns: await self.getLiteralContentRoutes(req)
+          };
+        }
+      }
+    };
+  },
+
   handlers(self) {
     return {
       '@apostrophecms/page:beforeSend': {
@@ -94,6 +113,41 @@ module.exports = {
         return !!req.aposExternalFront;
       },
 
+      // Returns the list of "literal content" route patterns declared by
+      // modules — URLs that serve non-page content (e.g. `/robots.txt`,
+      // `/sitemap.xml`, `/sitemaps/*`) and must be proxied raw by an external
+      // front rather than routed through its page renderer.
+      //
+      // Emits `@apostrophecms/url:getLiteralContentRoutes`; handlers in any
+      // module push prefix-free path patterns onto the `patterns` array
+      // (exact like `/robots.txt`, or glob like `/sitemaps/*`). Patterns are
+      // declared unconditionally and independent of `req`: the consumer only
+      // needs to know "this path is literal content", and a pattern that 404s
+      // is harmless. This differs from `getAllUrlMetadata`, which enumerates
+      // exact, existing URLs per locale for static builds and sitemaps.
+      //
+      // Example module level implementation:
+      // ```js
+      // handlers(self) {
+      //   return {
+      //     '@apostrophecms/url:getLiteralContentRoutes': {
+      //       addSitemapRoutes(req, patterns) {
+      //         patterns.push('/sitemap.xml');
+      //         if (self.options.perLocale) {
+      //           patterns.push('/sitemaps/*');
+      //         }
+      //       }
+      //     }
+      //   };
+      // }
+      // ```
+      //
+      async getLiteralContentRoutes(req) {
+        const patterns = [];
+        await self.emit('getLiteralContentRoutes', req, patterns);
+        return [ ...new Set(patterns) ];
+      },
+
       // Returns the effective base URL for the given request.
       //
       // Resolution order:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apostrophe",
-  "version": "4.31.1-beta.1",
+  "version": "4.32.0",
   "description": "The Apostrophe Content Management System.",
   "main": "index.js",
   "repository": {
@@ -10,7 +10,7 @@
   },
   "homepage": "https://github.com/apostrophecms/apostrophe/tree/main/packages/apostrophe",
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=22.0.0"
   },
   "keywords": [
     "apostrophe",
@@ -70,7 +70,7 @@
     "express-bearer-token": "^3.0.0",
     "express-session": "^1.18.2",
     "fs-extra": "^7.0.1",
-    "glob": "^10.4.5",
+    "glob": "^13.0.0",
     "he": "^1.2.0",
     "html-to-text": "^9.0.5",
     "i18next": "^20.3.2",
@@ -84,8 +84,7 @@
     "minimatch": "^3.1.4",
     "mkdirp": "^0.5.5",
     "multer": "^2.1.1",
-    "node-fetch": "^2.6.1",
-    "nodemailer": "^8.0.5",
+    "nodemailer": "^9.0.1",
     "nunjucks": "^3.2.1",
     "parseurl": "^1.3.3",
     "passport": "^0.6.0",
@@ -121,14 +120,14 @@
     "webpack-merge": "^5.7.3",
     "xregexp": "^2.0.0",
     "@apostrophecms/db-connect": "^1.0.1",
-    "broadband": "^1.1.0",
-    "boring": "^1.1.1",
     "express-cache-on-demand": "^1.0.4",
     "launder": "^1.7.1",
+    "broadband": "^1.1.0",
+    "oembetter": "^1.2.1",
+    "boring": "^1.1.1",
     "postcss-viewport-to-container-toggle": "^2.3.0",
-    "oembetter": "^1.2.0",
-    "sanitize-html": "^2.17.5",
-    "uploadfs": "^1.26.1"
+    "uploadfs": "^1.27.0",
+    "sanitize-html": "^2.17.6"
   },
   "devDependencies": {
     "chai": "^4.3.10",
@@ -137,8 +136,8 @@
     "mocha": "^11.7.5",
     "nyc": "^17.1.0",
     "stylelint": "^16.5.0",
-    "stylelint-config-apostrophe": "^4.4.0",
-    "eslint-config-apostrophe": "^6.0.2"
+    "eslint-config-apostrophe": "^6.0.2",
+    "stylelint-config-apostrophe": "^4.4.0"
   },
   "browserslist": [
     "ie >= 10"

package/test/asset-external.js

@@ -55,6 +55,7 @@ describe('Asset - External Build', function () {
                 };
               },
               async watch() { },
+              async clearCache() { },
               async startDevServer() {
                 actualDevServer = true;
                 return {
@@ -124,6 +125,7 @@ describe('Asset - External Build', function () {
             return {
               async build() { },
               async watch() { },
+              async clearCache() { },
               async startDevServer() {},
               async entrypoints() {
                 return [];
@@ -291,6 +293,7 @@ describe('Asset - External Build', function () {
                 };
               },
               async watch() { },
+              async clearCache() { },
               async startDevServer() {
                 return {
                   entrypoints: []

package/test/asset-lock-cache.js

@@ -0,0 +1,243 @@
+const t = require('../test-lib/test.js');
+const assert = require('assert');
+const fs = require('fs-extra');
+const path = require('node:path');
+
+// The build skip logic used to rely on the lock file modified time, which is
+// unreliable (fresh checkouts, restored CI/Docker build artifacts, clock
+// skew). When the lock file content changed but its mtime was not newer than a
+// leftover build, the admin UI build was skipped and a stale bundle served.
+// These tests cover the content-hash based detection that forces a rebuild and
+// clears the bundler caches on a lock file change.
+describe('Assets - lock file cache invalidation', function() {
+  this.timeout(5 * 60 * 1000);
+
+  let apos;
+  const lockPath = path.join(process.cwd(), 'test/package-lock.json');
+  let lockSnapshot;
+
+  before(async function() {
+    lockSnapshot = await fs.readFile(lockPath, 'utf8');
+    apos = await t.create({
+      root: module,
+      modules: {}
+    });
+  });
+
+  after(async function() {
+    await fs.writeFile(lockPath, lockSnapshot);
+    await fs.remove(apos.asset.getLockFileHashPath());
+    await t.destroy(apos);
+  });
+
+  afterEach(async function() {
+    // Restore the lock file after any test that mutated it.
+    await fs.writeFile(lockPath, lockSnapshot);
+  });
+
+  beforeEach(function() {
+    // Each test starts as if the process had just booted.
+    apos.asset.lockFileChecked = false;
+  });
+
+  function mutateLock(key) {
+    const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+    lock[key] = (lock[key] || 0) + 1;
+    fs.writeFileSync(lockPath, JSON.stringify(lock, null, 2), 'utf8');
+  }
+
+  it('hashes the lock file content, stable across reads', async function() {
+    const hash = await apos.asset.getLockFileHash();
+    assert(typeof hash === 'string' && hash.length > 0);
+    assert.strictEqual(await apos.asset.getLockFileHash(), hash);
+  });
+
+  it('produces a different hash when the lock content changes', async function() {
+    const before = await apos.asset.getLockFileHash();
+    mutateLock('__test');
+    const after = await apos.asset.getLockFileHash();
+    assert.notStrictEqual(before, after);
+  });
+
+  it('round-trips the saved lock file hash', async function() {
+    await apos.asset.saveLockFileHash('abc123');
+    assert.strictEqual(await apos.asset.readSavedLockFileHash(), 'abc123');
+    await apos.asset.saveLockFileHash(null);
+    assert.strictEqual(await apos.asset.readSavedLockFileHash(), null);
+  });
+
+  it('reports no change when the saved hash matches', async function() {
+    await apos.asset.saveLockFileHash(await apos.asset.getLockFileHash());
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, false);
+  });
+
+  it('reports a change when content differs', async function() {
+    await apos.asset.saveLockFileHash('a-different-old-hash');
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, true);
+  });
+
+  it('treats a first build (no saved hash) as a change', async function() {
+    await apos.asset.saveLockFileHash(null);
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, true);
+  });
+
+  it('runs the lock check once per process', async function() {
+    await apos.asset.saveLockFileHash('an-old-hash');
+    const first = await apos.asset.checkLockFile();
+    assert.strictEqual(first.committed, false);
+    assert.strictEqual(first.changed, true);
+    await apos.asset.commitLockFileCheck(first);
+
+    // A watcher-triggered rebuild in the same process reports no change,
+    // even if the lock content mutated meanwhile.
+    mutateLock('__test-memo');
+    const again = await apos.asset.checkLockFile();
+    assert.strictEqual(again.committed, true);
+    assert.strictEqual(again.changed, false);
+  });
+
+  it('reports no change on rebuilds when there is no lock file', async function() {
+    const original = apos.asset.getLockFileHash;
+    apos.asset.getLockFileHash = async () => null;
+    try {
+      // No lock file: the first build of the process is forced...
+      const first = await apos.asset.checkLockFile();
+      assert.strictEqual(first.changed, true);
+      assert.strictEqual(first.hash, null);
+      await apos.asset.commitLockFileCheck(first);
+      // ...but watcher-triggered rebuilds are not.
+      const again = await apos.asset.checkLockFile();
+      assert.strictEqual(again.committed, true);
+      assert.strictEqual(again.changed, false);
+    } finally {
+      apos.asset.getLockFileHash = original;
+    }
+  });
+
+  it('forces a rebuild when content changed but the lock mtime is older', async function() {
+    const tsFile = path.join(
+      apos.asset.getBundleRootDir(), 'apos-build-timestamp.txt'
+    );
+
+    // Cold build: establishes the bundle, its timestamp and the saved hash.
+    await apos.asset.tasks.build.task({ 'check-apos-build': false });
+    const ts1 = parseInt(await fs.readFile(tsFile, 'utf8'), 10);
+    assert.strictEqual(
+      await apos.asset.readSavedLockFileHash(),
+      await apos.asset.getLockFileHash()
+    );
+
+    // Dependency change: the lock content changes, but its mtime is OLDER than
+    // the freshly built artifacts (fresh checkout / restored build cache).
+    // This happens across process starts, so reset the per-process check.
+    apos.asset.lockFileChecked = false;
+    mutateLock('__test2');
+    const older = new Date(Date.now() - 5 * 60 * 1000);
+    await fs.utimes(lockPath, older, older);
+
+    // The auto build (skip path) must not skip - it should rebuild.
+    await apos.asset.tasks.build.task({ 'check-apos-build': true });
+    const ts2 = parseInt(await fs.readFile(tsFile, 'utf8'), 10);
+
+    assert(ts2 > ts1, `expected a rebuild (ts2=${ts2} > ts1=${ts1})`);
+    assert.strictEqual(
+      await apos.asset.readSavedLockFileHash(),
+      await apos.asset.getLockFileHash()
+    );
+  });
+});
+
+// The webpack file system cache is keyed on the lock file content, but an
+// external build module (e.g. @apostrophecms/vite) keeps a cache that is not,
+// so it must be cleared explicitly when the lock file changes.
+describe('Assets - build module cache cleared on lock change', function() {
+  this.timeout(t.timeout);
+
+  let apos;
+  let clearCalls = 0;
+
+  before(async function() {
+    apos = await t.create({
+      root: module,
+      autoBuild: false,
+      modules: {
+        'asset-vite-mock': {
+          before: '@apostrophecms/asset',
+          handlers(self) {
+            return {
+              '@apostrophecms/asset:afterInit': {
+                async registerExternalBuild() {
+                  self.apos.asset.configureBuildModule(self, {
+                    alias: 'vite',
+                    devServer: false,
+                    hmr: false
+                  });
+                }
+              }
+            };
+          },
+          methods(self) {
+            return {
+              async build() {
+                return { entrypoints: [] };
+              },
+              async watch() {},
+              async startDevServer() {
+                return { entrypoints: [] };
+              },
+              async entrypoints() {
+                return [];
+              },
+              async clearCache() {
+                clearCalls++;
+              }
+            };
+          }
+        }
+      }
+    });
+  });
+
+  after(async function() {
+    await fs.remove(apos.asset.getLockFileHashPath());
+    await t.destroy(apos);
+  });
+
+  it('clears the build module cache when the lock content changes', async function() {
+    await apos.asset.saveLockFileHash('an-old-hash');
+    clearCalls = 0;
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, true);
+    assert.strictEqual(clearCalls, 1);
+  });
+
+  it('leaves the build module cache alone when the lock is unchanged', async function() {
+    await apos.asset.saveLockFileHash(await apos.asset.getLockFileHash());
+    clearCalls = 0;
+    const changed = await apos.asset.checkLockFileChanged(
+      await apos.asset.getLockFileHash()
+    );
+    assert.strictEqual(changed, false);
+    assert.strictEqual(clearCalls, 0);
+  });
+
+  it('forces a rebuild but keeps the cache when no lock file is found', async function() {
+    await apos.asset.saveLockFileHash('an-old-hash');
+    clearCalls = 0;
+    // null hash => no lock file present
+    const changed = await apos.asset.checkLockFileChanged(null);
+    assert.strictEqual(changed, true);
+    assert.strictEqual(clearCalls, 0);
+  });
+});