apostrophe 4.31.1-beta.1 → 4.32.0

package/test/pages-move-permissions.js

@@ -0,0 +1,317 @@
+// Regression tests for GHSA-wr5r-wqp2-x4fh:
+// "Missing destination-parent authorization in page move() allows a
+//  low-privileged editor to move and re-rank pages inside a restricted subtree"
+//
+// A regression in the move() authorization guard silently disabled the
+// destination "create" permission check for every normal (non-archive) move.
+// The only surviving gate was moved._edit ("can the actor edit the page being
+// moved"), which an editor legitimately holds for their own ordinary pages.
+// As a result a non-admin editor could relocate a page they control under a
+// parent of a restricted page type (e.g. one declaring editRole: 'admin')
+// that they have no create/edit rights over, and in doing so trigger an
+// unchecked updateMany that re-ranks the restricted parent's existing
+// children (documents the actor cannot edit).
+//
+// These tests exercise the real apos.page.move() code path (and the REST
+// route it backs) with a non-admin request and assert that the destination
+// authorization boundary is enforced, while confirming legitimate moves and
+// the archive restore flow are still permitted.
+
+const t = require('../test-lib/test.js');
+const assert = require('assert/strict');
+
+describe('pages - move destination permission (GHSA-wr5r-wqp2-x4fh)', function () {
+  this.timeout(t.timeout);
+
+  let apos;
+  let homeId;
+
+  after(async function () {
+    await t.destroy(apos);
+    apos = null;
+  });
+
+  before(async function () {
+    apos = await t.create({
+      root: module,
+      modules: {
+        // A restricted page type: only admins may create/edit pages of this
+        // type. This is the same shape as the core @apostrophecms/archive-page
+        // (editRole/publishRole: 'admin') and of restricted "section" page
+        // types projects commonly configure.
+        'secret-page': {
+          extend: '@apostrophecms/page-type',
+          options: {
+            editRole: 'admin',
+            publishRole: 'admin'
+          }
+        },
+        // An ordinary page type any editor may create/edit.
+        'public-page': {
+          extend: '@apostrophecms/page-type'
+        },
+        '@apostrophecms/page': {
+          options: {
+            park: [],
+            types: [
+              {
+                name: '@apostrophecms/home-page',
+                label: 'Home'
+              },
+              {
+                name: 'secret-page',
+                label: 'Secret'
+              },
+              {
+                name: 'public-page',
+                label: 'Public'
+              }
+            ]
+          }
+        }
+      }
+    });
+
+    const home = await apos.page
+      .find(apos.task.getReq({ role: 'admin' }), { level: 0 })
+      .toObject();
+    assert.ok(home, 'home page should exist');
+    homeId = home._id;
+  });
+
+  // A non-admin editor request. Editors may create/edit ordinary pages but
+  // NOT pages of a type gated by editRole: 'admin'.
+  function editorReq() {
+    return apos.task.getReq({
+      role: 'editor',
+      user: {
+        _id: 'editor-user',
+        title: 'Editor',
+        role: 'editor'
+      }
+    });
+  }
+
+  function adminReq() {
+    return apos.task.getReq({ role: 'admin' });
+  }
+
+  // Create an admin-only "secret" section with one pre-existing admin-only
+  // child, plus an ordinary editor-editable page under home. `slugPrefix`
+  // keeps each test's fixtures independent within the shared database.
+  async function fixtures(slugPrefix) {
+    const admin = adminReq();
+
+    const secret = await apos.page.insert(admin, homeId, 'lastChild', {
+      title: 'Secret Section',
+      type: 'secret-page',
+      slug: `/${slugPrefix}-secret`
+    });
+    const secretChild = await apos.page.insert(admin, secret._id, 'lastChild', {
+      title: 'Secret Child',
+      type: 'secret-page',
+      slug: `/${slugPrefix}-secret/child`
+    });
+    const mine = await apos.page.insert(admin, homeId, 'lastChild', {
+      title: 'My Page',
+      type: 'public-page',
+      slug: `/${slugPrefix}-mine`
+    });
+
+    return {
+      secret,
+      secretChild,
+      mine
+    };
+  }
+
+  it('precondition: an editor has no create/edit rights on an admin-only section', async function () {
+    const { secret } = await fixtures('precondition');
+
+    const secretForEditor = await apos.page
+      .find(editorReq(), { _id: secret._id })
+      .permission(false)
+      .toObject();
+
+    assert.ok(secretForEditor, 'the section is locatable regardless of rights');
+    assert.notEqual(
+      secretForEditor._create,
+      true,
+      'editor must NOT have create rights on the admin-only section'
+    );
+    assert.notEqual(
+      secretForEditor._edit,
+      true,
+      'editor must NOT have edit rights on the admin-only section'
+    );
+  });
+
+  it('forbids an editor from moving their page under an admin-only section', async function () {
+    const { secret, mine } = await fixtures('forbid-move');
+
+    await assert.rejects(
+      apos.page.move(editorReq(), mine._id, secret._id, 'firstChild'),
+      { name: 'forbidden' },
+      'moving a page under a parent the actor cannot create within must be forbidden'
+    );
+
+    // The page must NOT have been relocated under the restricted branch.
+    const moved = await apos.page
+      .find(adminReq(), { _id: mine._id })
+      .toObject();
+    assert.ok(
+      !moved.path.includes(secret.aposDocId),
+      'the editor must not have relocated their page under the admin-only section'
+    );
+  });
+
+  it('does not re-rank an admin-only section\'s protected children on a forbidden move', async function () {
+    const {
+      secret, secretChild, mine
+    } = await fixtures('no-rerank');
+
+    const before = await apos.page
+      .find(adminReq(), { _id: secretChild._id })
+      .toObject();
+
+    // 'firstChild' would place the moved page at rank 0 and (if the move were
+    // wrongly allowed) nudge the pre-existing admin-only child from rank 0 to
+    // rank 1 via an unchecked updateMany.
+    await assert.rejects(
+      apos.page.move(editorReq(), mine._id, secret._id, 'firstChild'),
+      { name: 'forbidden' }
+    );
+
+    const after = await apos.page
+      .find(adminReq(), { _id: secretChild._id })
+      .toObject();
+
+    assert.equal(
+      after.rank,
+      before.rank,
+      'the protected sibling\'s rank must be untouched by a forbidden move'
+    );
+  });
+
+  it('still allows an editor to move their page under a parent they may create within', async function () {
+    const { mine } = await fixtures('allow-move');
+
+    // Another ordinary parent the editor legitimately controls.
+    const otherParent = await apos.page.insert(adminReq(), homeId, 'lastChild', {
+      title: 'Other Parent',
+      type: 'public-page',
+      slug: '/allow-move-other'
+    });
+
+    // Sanity: the editor genuinely has create rights on the destination.
+    const otherForEditor = await apos.page
+      .find(editorReq(), { _id: otherParent._id })
+      .permission(false)
+      .toObject();
+    assert.equal(
+      otherForEditor._create,
+      true,
+      'precondition: editor has create rights on the ordinary destination'
+    );
+
+    await assert.doesNotReject(
+      apos.page.move(editorReq(), mine._id, otherParent._id, 'firstChild'),
+      'a move into a destination the editor may create within must be allowed'
+    );
+
+    const moved = await apos.page.find(adminReq(), { _id: mine._id }).toObject();
+    assert.ok(
+      moved.path.includes(otherParent.aposDocId),
+      'the page should now live under the permitted destination'
+    );
+  });
+
+  it('still allows an admin to move a page under the admin-only section', async function () {
+    const { secret, mine } = await fixtures('admin-move');
+
+    await assert.doesNotReject(
+      apos.page.move(adminReq(), mine._id, secret._id, 'firstChild'),
+      'an admin has create rights on the section and may move pages into it'
+    );
+
+    const moved = await apos.page.find(adminReq(), { _id: mine._id }).toObject();
+    assert.ok(
+      moved.path.includes(secret.aposDocId),
+      'the admin-moved page should live under the section'
+    );
+  });
+
+  it('still allows archiving a page and restoring it out of the archive', async function () {
+    // Exercises the guard\'s archive-restore branch: a move whose old parent
+    // is the archive page must remain permitted for a destination the actor
+    // may edit. Using an editor on an ordinary page they fully control.
+    const { mine } = await fixtures('restore');
+
+    // Archive: moves the page under the archive (old parent becomes archive).
+    await assert.doesNotReject(
+      apos.page.archive(editorReq(), mine._id),
+      'an editor may archive their own ordinary page'
+    );
+
+    const archived = await apos.page
+      .find(adminReq(), { _id: mine._id })
+      .archived(null)
+      .ancestors({ archived: null })
+      .toObject();
+    assert.equal(archived.archived, true, 'the page should be archived');
+    assert.equal(
+      archived._ancestors[archived._ancestors.length - 1].type,
+      '@apostrophecms/archive-page',
+      'the archived page\'s parent should be the archive'
+    );
+
+    // Restore: move it back out of the archive, under home.
+    await assert.doesNotReject(
+      apos.page.move(editorReq(), mine._id, homeId, 'lastChild'),
+      'restoring a page out of the archive to a destination the actor may edit must be allowed'
+    );
+
+    const restored = await apos.page
+      .find(adminReq(), { _id: mine._id })
+      .toObject();
+    assert.ok(restored, 'the restored page should be live again');
+    assert.notEqual(restored.archived, true, 'the restored page should not be archived');
+  });
+
+  it('forbids the same move over the REST PATCH route for a logged-in editor', async function () {
+    const { secret, mine } = await fixtures('rest');
+
+    // A real, logged-in editor session.
+    await t.createUser(apos, 'editor', { username: 'rest-editor' });
+    const jar = await t.loginAs(apos, 'rest-editor');
+    // A safe request first, so the jar carries the CSRF cookie the write
+    // routes require. Otherwise the PATCH is rejected for CSRF before it can
+    // ever reach move(), which would mask the authorization check under test.
+    await apos.http.get('/', { jar });
+
+    const draftId = mine._id.replace(':published', ':draft');
+    const targetDraftId = secret._id.replace(':published', ':draft');
+
+    let status = null;
+    try {
+      await apos.http.patch(`/api/v1/@apostrophecms/page/${draftId}`, {
+        body: {
+          _targetId: targetDraftId,
+          _position: 'firstChild'
+        },
+        jar
+      });
+    } catch (e) {
+      status = e.status;
+    }
+
+    assert.equal(status, 403, 'the REST move must be rejected with 403 Forbidden');
+
+    // Confirm no relocation happened.
+    const moved = await apos.page.find(adminReq(), { _id: mine._id }).toObject();
+    assert.ok(
+      !moved.path.includes(secret.aposDocId),
+      'the editor must not have relocated their page under the admin-only section via REST'
+    );
+  });
+});

package/test/pages.js

@@ -1,6 +1,12 @@
 const t = require('../test-lib/test.js');
 const assert = require('assert');
 const _ = require('lodash');
+// The REST API etag tests below issue their conditional request via rawGet
+// (raw node:http): the built-in fetch used by apos.http adds Cache-Control:
+// no-cache to any request carrying a conditional header (Fetch standard), which
+// would suppress the asserted 304s. The page-serving etag tests stay on
+// apos.http (those routes set 304 explicitly).
+const { rawGet } = t;
 
 describe('Pages', function() {
   let apos;
@@ -1087,11 +1093,8 @@ describe('Pages', function() {
     };
 
     const response1 = await apos.http.get(`/api/v1/@apostrophecms/page/${homeId}`, { fullResponse: true });
-    const response2 = await apos.http.get(`/api/v1/@apostrophecms/page/${homeId}`, {
-      fullResponse: true,
-      headers: {
-        'if-none-match': response1.headers.etag
-      }
+    const response2 = await rawGet(apos, `/api/v1/@apostrophecms/page/${homeId}`, {
+      'if-none-match': response1.headers.etag
     });
 
     assert(response1.status === 200);
@@ -1125,11 +1128,8 @@ describe('Pages', function() {
     // so requesting it again should not return a 304 status code
     const pageUpdateResponse = await apos.doc.update(apos.task.getReq(), pageDoc);
 
-    const response2 = await apos.http.get(`/api/v1/@apostrophecms/page/${homeId}`, {
-      fullResponse: true,
-      headers: {
-        'if-none-match': response1.headers.etag
-      }
+    const response2 = await rawGet(apos, `/api/v1/@apostrophecms/page/${homeId}`, {
+      'if-none-match': response1.headers.etag
     });
 
     const eTag1Parts = response1.headers.etag.split(':');
@@ -1165,11 +1165,8 @@ describe('Pages', function() {
     outOfDateETagParts[2] = Number(outOfDateETagParts[2]) -
       (4444 + 1) * 1000; // 1s outdated
 
-    const response2 = await apos.http.get(`/api/v1/@apostrophecms/page/${homeId}`, {
-      fullResponse: true,
-      headers: {
-        'if-none-match': outOfDateETagParts.join(':')
-      }
+    const response2 = await rawGet(apos, `/api/v1/@apostrophecms/page/${homeId}`, {
+      'if-none-match': outOfDateETagParts.join(':')
     });
 
     const eTag1Parts = response1.headers.etag.split(':');

package/test/pieces-public-api-relationship-choices.js

@@ -0,0 +1,245 @@
+const t = require('../test-lib/test.js');
+const assert = require('assert');
+
+// A blocked filter contributes no entry (or an empty array) to the
+// choices/counts bag the REST API returns.
+function assertNoLeak(bag, key, message) {
+  assert(!bag || !bag[key] || bag[key].length === 0, message);
+}
+
+// Regression tests for GHSA-xmpp-f9v3-r7qh — the incomplete fix for
+// CVE-2026-39857. The projection guard that stops `?choices=` / `?counts=`
+// from leaking distinct values of fields excluded from `publicApiProjection`
+// resolved the schema field by an EXACT-NAME match. Relationship fields
+// register additional query builders whose names differ from the schema field
+// name — the "slug" alias builders (`author` / `authorAnd` for a relationship
+// field named `_author`) and the `_authorAnd` operation builder. Because none
+// of those names match `_author` exactly, the guard failed open and an
+// unauthenticated caller could still extract the relationship's distinct
+// choices (referenced, publicly-visible related docs by title/slug, plus
+// per-value counts via `?counts=`).
+
+describe('Pieces Public API — relationship choices/counts projection guard (GHSA-xmpp-f9v3-r7qh)', function() {
+
+  let apos;
+
+  this.timeout(t.timeout);
+
+  after(async function () {
+    return t.destroy(apos);
+  });
+
+  it('should initialize with article + author piece types', async function() {
+    apos = await t.create({
+      root: module,
+      modules: {
+        author: {
+          extend: '@apostrophecms/piece-type',
+          options: {
+            alias: 'author',
+            label: 'Author'
+          }
+        },
+        article: {
+          extend: '@apostrophecms/piece-type',
+          options: {
+            alias: 'article',
+            label: 'Article'
+          },
+          fields: {
+            add: {
+              foo: {
+                label: 'Foo',
+                type: 'string'
+              },
+              // Deliberately named with a leading underscore, as recommended.
+              // Its slug-alias builders are `author` / `authorAnd`; its
+              // operation builders are `_author` / `_authorAnd`.
+              _author: {
+                label: 'Author',
+                type: 'relationship',
+                withType: 'author'
+              }
+            }
+          }
+        }
+      }
+    });
+    assert(apos.modules.article);
+    assert(apos.modules.author);
+
+    // Sanity: confirm the relationship registered the extra query builders
+    // whose names differ from the `_author` schema field name. These are the
+    // aliases the guard must also gate.
+    const builders = apos.article.find(apos.task.getReq()).builders;
+    assert(builders._author, 'expected relationship builder "_author"');
+    assert(builders._authorAnd, 'expected relationship builder "_authorAnd"');
+    assert(builders.author, 'expected relationship slug-alias builder "author"');
+    assert(builders.authorAnd, 'expected relationship slug-alias builder "authorAnd"');
+  });
+
+  let jane;
+
+  it('should insert a public author and a public article that references it', async function() {
+    const req = apos.task.getReq();
+    jane = await apos.author.insert(req, {
+      ...apos.author.newInstance(),
+      title: 'Jane Author',
+      visibility: 'public'
+    });
+    await apos.article.insert(req, {
+      ...apos.article.newInstance(),
+      title: 'My Article',
+      foo: 'bar',
+      visibility: 'public',
+      _author: [ jane ]
+    });
+
+    // Confirm the relationship persisted so that, absent the guard, the
+    // distinct-values leak would actually have data to expose. This is what
+    // makes the "must not leak" assertions below meaningful.
+    const article = await apos.article.find(req, { title: 'My Article' }).toObject();
+    assert(article);
+    assert(Array.isArray(article._author) && article._author.length === 1);
+    assert.strictEqual(article._author[0].title, 'Jane Author');
+    assert(Array.isArray(article.authorIds) && article.authorIds.length === 1);
+  });
+
+  it('baseline: an anonymous list with a projection excluding _author does not expose the relationship', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article');
+    assert(response);
+    assert(response.results);
+    assert.strictEqual(response.results.length, 1);
+    assert.strictEqual(response.results[0].title, 'My Article');
+    // The relationship must not be populated, and its idsStorage must not be
+    // exposed, when excluded from the projection. (An excluded relationship
+    // comes back as an empty array, so check length rather than truthiness.)
+    assert(
+      !response.results[0]._author || response.results[0]._author.length === 0,
+      '_author must not be populated when excluded from publicApiProjection'
+    );
+    assert(!response.results[0].authorIds, 'authorIds must not be exposed when excluded from publicApiProjection');
+  });
+
+  // Positive control: this proves the relationship choices machinery works and
+  // that the referenced author is discoverable — so the "must not leak" tests
+  // that follow (with the SAME data, only the projection changed) genuinely
+  // demonstrate the guard is doing the blocking, not an absence of data.
+  it('when _author IS in the publicApiProjection, ?choices=author returns the related choices', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1,
+      _author: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=author');
+    assert(response);
+    assert(response.choices);
+    assert(Array.isArray(response.choices.author));
+    assert(
+      response.choices.author.some(c => c.label === 'Jane Author'),
+      'expected the related author among the choices when the relationship is projected'
+    );
+    // The slug alias exposes the related doc slug as the choice value.
+    assert(response.choices.author.some(c => c.value === jane.slug));
+  });
+
+  it('SECURITY: ?choices=author must not leak choices for a relationship excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=author');
+    assert(response);
+    assertNoLeak(
+      response.choices,
+      'author',
+      'relationship slug-alias choices for excluded field "_author" must not be exposed publicly via ?choices=author'
+    );
+  });
+
+  it('SECURITY: ?choices=authorAnd must not leak choices for a relationship excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=authorAnd');
+    assert(response);
+    assertNoLeak(
+      response.choices,
+      'authorAnd',
+      'relationship slug-alias choices for excluded field "_author" must not be exposed publicly via ?choices=authorAnd'
+    );
+  });
+
+  it('SECURITY: ?choices=_authorAnd must not leak choices for a relationship excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=_authorAnd');
+    assert(response);
+    assertNoLeak(
+      response.choices,
+      '_authorAnd',
+      'relationship operation-builder choices for excluded field "_author" must not be exposed publicly via ?choices=_authorAnd'
+    );
+  });
+
+  it('SECURITY: ?counts=author must not leak counts for a relationship excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?counts=author');
+    assert(response);
+    assertNoLeak(
+      response.counts,
+      'author',
+      'relationship slug-alias counts for excluded field "_author" must not be exposed publicly via ?counts=author'
+    );
+  });
+
+  // Regression guard: the exact-name case was already blocked by the parent
+  // CVE fix and must stay blocked.
+  it('?choices=_author (exact relationship field name) remains blocked when excluded from publicApiProjection', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const response = await apos.http.get('/api/v1/article?choices=_author');
+    assert(response);
+    assertNoLeak(
+      response.choices,
+      '_author',
+      'relationship choices for excluded field "_author" must not be exposed publicly'
+    );
+  });
+
+  // The guard is a public-API protection only; authenticated full-API callers
+  // (no publicApiProjection applied) must still receive relationship choices.
+  it('authenticated full-API callers still receive relationship choices for a non-projected relationship', async function() {
+    apos.article.options.publicApiProjection = {
+      title: 1,
+      slug: 1,
+      _url: 1
+    };
+    const req = apos.task.getReq();
+    const query = apos.article.find(req).choices([ 'author' ]);
+    await query.toArray();
+    const choices = query.get('choicesResults');
+    assert(choices);
+    assert(choices.author);
+    assert(choices.author.some(c => c.label === 'Jane Author'));
+  });
+});

package/test/pieces.js

@@ -6,6 +6,12 @@ const _ = require('lodash');
 const FormData = require('form-data');
 const t = require('../test-lib/test.js');
 
+// The etag tests below issue their conditional request via rawGet (raw
+// node:http): the built-in fetch used by apos.http adds Cache-Control: no-cache
+// to any request carrying a conditional header (Fetch standard), which would
+// suppress the asserted 304s.
+const { rawGet } = t;
+
 describe('Pieces', function() {
 
   let apos;
@@ -1807,11 +1813,8 @@ describe('Pieces', function() {
     };
 
     const response1 = await apos.http.get('/api/v1/thing/testThing:en:published', { fullResponse: true });
-    const response2 = await apos.http.get('/api/v1/thing/testThing:en:published', {
-      fullResponse: true,
-      headers: {
-        'if-none-match': response1.headers.etag
-      }
+    const response2 = await rawGet(apos, '/api/v1/thing/testThing:en:published', {
+      'if-none-match': response1.headers.etag
     });
 
     assert(response1.status === 200);
@@ -1845,11 +1848,8 @@ describe('Pieces', function() {
     // so requesting it again should not return a 304 status code
     const pieceUpdateResponse = await apos.doc.update(apos.task.getReq(), pieceDoc);
 
-    const response2 = await apos.http.get('/api/v1/thing/testThing:en:published', {
-      fullResponse: true,
-      headers: {
-        'if-none-match': response1.headers.etag
-      }
+    const response2 = await rawGet(apos, '/api/v1/thing/testThing:en:published', {
+      'if-none-match': response1.headers.etag
     });
 
     const eTag1Parts = response1.headers.etag.split(':');
@@ -1885,11 +1885,8 @@ describe('Pieces', function() {
     outOfDateETagParts[2] = Number(outOfDateETagParts[2]) -
       (4444 + 1) * 1000; // 1s outdated
 
-    const response2 = await apos.http.get('/api/v1/thing/testThing:en:published', {
-      fullResponse: true,
-      headers: {
-        'if-none-match': outOfDateETagParts.join(':')
-      }
+    const response2 = await rawGet(apos, '/api/v1/thing/testThing:en:published', {
+      'if-none-match': outOfDateETagParts.join(':')
     });
 
     const eTag1Parts = response1.headers.etag.split(':');