apostrophe 4.31.1-beta.1 → 4.32.0

package/test/assets.js

@@ -171,6 +171,29 @@ describe('Assets', function() {
 
   this.timeout(5 * 60 * 1000);
 
+  it('should include the site prefix in asset URLs', async function() {
+    let prefixApos;
+
+    try {
+      prefixApos = await t.create({
+        root: module,
+        prefix: '/apos'
+      });
+
+      assert.equal(
+        prefixApos.asset.getAssetBaseUrl(),
+        '/apos/apos-frontend/default'
+      );
+
+      assert.equal(
+        prefixApos.asset.url('/modules/foo/bar.js'),
+        '/apos/apos-frontend/default/modules/foo/bar.js'
+      );
+    } finally {
+      await t.destroy(prefixApos);
+    }
+  });
+
   it('should exist on the apos object', async function() {
     apos = await t.create({
       root: module,
@@ -409,10 +432,10 @@ describe('Assets', function() {
     assert(meta2['default:src']);
 
     // Caching should provide a measurable speedup. The threshold is kept
-    // low (10%) to avoid flaky failures on loaded CI runners where the
+    // low (5%) to avoid flaky failures on loaded CI runners where the
     // cold run can be fast due to OS-level caching.
     const gain = (execTime - execTimeCached) / execTime * 100;
-    assert(gain >= 10, `Expected gain >=10%, got ${gain}%`);
+    assert(gain >= 5, `Expected gain >=5%, got ${gain}%`);
 
     // Modification times
     assert(meta['default:apos'].mdate);

package/test/config-cascade-merge.js

@@ -0,0 +1,73 @@
+const t = require('../test-lib/test.js');
+const assert = require('assert');
+
+// PRO-9564
+// This test pins an established moog-require contract so it is not "fixed" by
+// accident — changing it would silently break existing projects.
+//
+// Scope: the SAME module configured BOTH via the app.js object passed to
+// apostrophe() AND its project-level index.js. (NOT cascade merging across the
+// module chain via extends/improvements, which merges field-by-field as usual.)
+//
+// moog-require collapses the two sources with a shallow `_.defaults` before the
+// chain is built, so app.js wins for any top-level section declared in both.
+// `options` then gets a second pass that gap-fills from index.js, but no other
+// section does — so a cascade like `fields` is NOT merged: an app.js `fields`
+// replaces the index.js `fields` wholesale, dropping even unrelated
+// project-level fields. The options-only gap-fill is by design.
+//
+// Example — this test and its fixture:
+//   app.js   modules: { 'collision-piece': { fields: { add: { configField } } } }
+//   index.js test/modules/collision-piece/index.js -> fields: { add: { projectField } }
+//   result   schema has `configField`; `projectField` is gone, although the two
+//            fields are unrelated.
+//   options  app.js { alias: ... } still merges with any index.js options
+//            (gap-fill), unlike `fields`.
+//
+// Files: collapse in packages/apostrophe/lib/moog-require.js (~`_.defaults(
+// definition, projectLevelDefinition)`); cascade compiler that the dropped
+// section never reaches in packages/apostrophe/lib/moog.js; project-level
+// fixture in test/modules/collision-piece/index.js.
+
+describe('config-object vs project-level cascade merge (moog-require contract)', function () {
+  this.timeout(t.timeout);
+  let apos;
+  after(async () => {
+    await t.destroy(apos);
+  });
+
+  it('app.js `fields` wins over the project-level file when both declare it', async function () {
+    apos = await t.create({
+      root: module,
+      modules: {
+        'collision-piece': {
+          extend: '@apostrophecms/piece-type',
+          options: { alias: 'collisionPiece' },
+          fields: {
+            add: {
+              configField: {
+                type: 'string',
+                label: 'Config Field'
+              }
+            },
+            group: {
+              configGroup: {
+                label: 'Config Group',
+                fields: [ 'configField' ]
+              }
+            }
+          }
+        }
+      }
+    });
+
+    const names = apos.collisionPiece.schema.map(f => f.name);
+    // The app.js (config object) fields win.
+    assert(names.includes('configField'));
+    // The project-level file's fields are dropped wholesale — the contract.
+    assert(!names.includes('projectField'));
+    // Options are the exception: an index.js-only option is gap-filled in,
+    // where a project-level field would have been dropped.
+    assert.strictEqual(apos.collisionPiece.options.fromProjectFile, true);
+  });
+});

package/test/files.js

@@ -1,6 +1,9 @@
 const t = require('../test-lib/test.js');
 const assert = require('assert/strict');
 const fs = require('fs');
+// rawGet (raw node:http) lets this suite send a spoofed `Host` header, which
+// the built-in fetch used by apos.http would drop as a forbidden header.
+const { rawGet } = t;
 
 describe('Files', function() {
 
@@ -142,17 +145,13 @@ describe('Files', function() {
       const attachment = apos.attachment.first(file);
       const url = apos.attachment.url(attachment);
       assert(url);
-      // Send an attacker-controlled Host header (e.g. the cloud metadata
-      // address from the advisory). The upstream fetch must be resolved
-      // against the server-trusted baseUrl, not this header, so the
-      // legitimate content is still served and the request is never
-      // steered at the spoofed host.
-      const response = await apos.http.get(url, {
-        headers: {
-          Host: '169.254.169.254'
-        },
-        fullResponse: true
-      });
+      // Spoof the Host header (the cloud-metadata address from the advisory)
+      // over a raw request: apos.http uses the built-in fetch, which drops a
+      // forbidden `Host` header and so cannot deliver the spoof. The server
+      // must resolve the upstream fetch against its trusted baseUrl, not this
+      // header, so the legitimate content is still served and the request is
+      // never steered at the spoofed host.
+      const response = await rawGet(apos, url, { Host: '169.254.169.254' });
       assert.strictEqual(response.status, 200);
       assert.strictEqual(response.body, attachment.data);
     } finally {

package/test/image-tags.js

@@ -0,0 +1,103 @@
+const t = require('../test-lib/test.js');
+const assert = require('assert/strict');
+
+describe('Image tags', function() {
+
+  let apos;
+  let jar;
+
+  this.timeout(t.timeout);
+
+  // Initialization, not a test: boot apostrophe and log in an admin, so any
+  // single test below can run in isolation (e.g. with `.only`).
+  before(async function() {
+    apos = await t.create({
+      root: module
+    });
+    assert(apos.image);
+    assert(apos.modules['@apostrophecms/image-tag']);
+
+    const user = apos.user.newInstance();
+    Object.assign(user, {
+      title: 'admin',
+      username: 'admin',
+      password: 'admin',
+      email: 'ad@min.com',
+      role: 'admin'
+    });
+    await apos.user.insert(apos.task.getReq(), user);
+    jar = await login('admin');
+  });
+
+  after(function() {
+    return t.destroy(apos);
+  });
+
+  it('should reuse an existing tag instead of creating a duplicate', async function() {
+    const manager = apos.modules['@apostrophecms/image-tag'];
+    // A tag the editor's popover would not necessarily have loaded.
+    const existing = await manager.insert(apos.task.getReq(), {
+      ...manager.newInstance(),
+      title: 'Reused Tag'
+    });
+
+    const response = await tagCreate('Reused Tag');
+    assert(response.jobId);
+
+    const ids = await distinctTagIds('Reused Tag');
+    assert.equal(ids.length, 1, 'exactly one image-tag for the title');
+    assert.equal(ids[0], existing.aposDocId, 'the existing tag was reused');
+  });
+
+  it('should not create duplicates under concurrent create requests', async function() {
+    const title = 'Concurrent Tag';
+
+    await Promise.all([
+      tagCreate(title),
+      tagCreate(title)
+    ]);
+
+    const ids = await distinctTagIds(title);
+    assert.equal(ids.length, 1, 'exactly one image-tag despite concurrent creates');
+  });
+
+  // The `tag` route runs the find-or-create before the (here empty) batch
+  // job, so no images are needed to exercise it.
+  async function tagCreate(title) {
+    return apos.http.post('/api/v1/@apostrophecms/image/tag', {
+      body: {
+        _ids: [],
+        operation: 'create',
+        title
+      },
+      jar
+    });
+  }
+
+  async function distinctTagIds(title) {
+    const docs = await apos.doc.db
+      .find({
+        type: '@apostrophecms/image-tag',
+        title
+      })
+      .toArray();
+    return [ ...new Set(docs.map(doc => doc.aposDocId)) ];
+  }
+
+  async function login(username, password = username) {
+    const loginJar = apos.http.jar();
+    let page = await apos.http.get('/', { jar: loginJar });
+    assert(page.match(/logged out/));
+    await apos.http.post('/api/v1/@apostrophecms/login/login', {
+      body: {
+        username,
+        password,
+        session: true
+      },
+      jar: loginJar
+    });
+    page = await apos.http.get('/', { jar: loginJar });
+    assert(page.match(/logged in/));
+    return loginJar;
+  }
+});

package/test/modules/collision-piece/index.js

@@ -0,0 +1,23 @@
+// Project-level file for a module that is ALSO configured (with fields)
+// via the apostrophe() config object, to reproduce PRO-9564.
+module.exports = {
+  // An index.js-only option: it should survive via the gap-fill pass, unlike
+  // the project-level fields, which get dropped wholesale.
+  options: {
+    fromProjectFile: true
+  },
+  fields: {
+    add: {
+      projectField: {
+        type: 'string',
+        label: 'Project Field'
+      }
+    },
+    group: {
+      projectGroup: {
+        label: 'Project Group',
+        fields: [ 'projectField' ]
+      }
+    }
+  }
+};

package/test/oembed.js

@@ -53,102 +53,4 @@ describe('Oembed', function() {
   //   const data = JSON.parse(response.body);
   //   assert(data.type === 'video');
   // });
-
-  it('should cache successful responses and not re-fetch them', async function() {
-    const req = apos.task.getReq();
-    const url = 'https://example.com/good-video';
-    let calls = 0;
-    const original = apos.oembed.oembetter.fetch;
-    apos.oembed.oembetter.fetch = (fetchUrl, options, cb) => {
-      calls++;
-      return cb(null, {
-        type: 'video',
-        title: 'Success',
-        html: '<iframe src="//example.com/embed"></iframe>'
-      });
-    };
-
-    try {
-      const first = await apos.oembed.query(req, url);
-      assert.strictEqual(first.title, 'Success');
-      assert.strictEqual(calls, 1);
-
-      // Second call must be served from the cache, not re-fetched
-      const second = await apos.oembed.query(req, url);
-      assert.strictEqual(second.title, 'Success');
-      assert.strictEqual(calls, 1);
-    } finally {
-      apos.oembed.oembetter.fetch = original;
-    }
-  });
-
-  it('should cache failures so a bad URL is not requested repeatedly, and log the original error', async function() {
-    const req = apos.task.getReq();
-    const url = 'https://example.com/bad-video';
-    let calls = 0;
-    const original = apos.oembed.oembetter.fetch;
-    apos.oembed.oembetter.fetch = (fetchUrl, options, cb) => {
-      calls++;
-      return cb(new Error('simulated provider failure'));
-    };
-
-    // Capture structured log output to confirm the original error is logged
-    const originalLogError = apos.oembed.logError;
-    const logged = [];
-    apos.oembed.logError = (...args) => logged.push(args);
-
-    try {
-      await assert.rejects(
-        () => apos.oembed.query(req, url),
-        { name: 'invalid' }
-      );
-      assert.strictEqual(calls, 1);
-
-      // The underlying cause is logged before the higher-level error is thrown
-      assert.strictEqual(logged.length, 1);
-      const [ loggedReq, eventType, message ] = logged[0];
-      assert.strictEqual(loggedReq, req);
-      assert.strictEqual(eventType, 'query-failed');
-      assert.strictEqual(message, 'simulated provider failure');
-
-      // Second call must be served from the cached failure, not re-fetched
-      await assert.rejects(
-        () => apos.oembed.query(req, url),
-        { name: 'invalid' }
-      );
-      assert.strictEqual(calls, 1);
-    } finally {
-      apos.oembed.oembetter.fetch = original;
-      apos.oembed.logError = originalLogError;
-    }
-  });
-
-  it('should tolerate legacy (unwrapped) cache entries without crashing', async function() {
-    const req = apos.task.getReq();
-    const url = 'https://example.com/legacy-video';
-    const legacyResponse = {
-      type: 'video',
-      title: 'Legacy',
-      html: '<iframe src="//example.com/legacy"></iframe>'
-    };
-
-    // Simulate a raw response cached by an older version of this module
-    const originalGet = apos.cache.get;
-    apos.cache.get = async () => legacyResponse;
-
-    // Fetching must not happen when the cache already has data
-    const originalFetch = apos.oembed.oembetter.fetch;
-    apos.oembed.oembetter.fetch = (fetchUrl, options, cb) => {
-      return cb(new Error('should not be called for a cache hit'));
-    };
-
-    try {
-      const result = await apos.oembed.query(req, url);
-      assert.strictEqual(result.title, 'Legacy');
-      assert.strictEqual(result.type, 'video');
-    } finally {
-      apos.cache.get = originalGet;
-      apos.oembed.oembetter.fetch = originalFetch;
-    }
-  });
 });