plone.restapi 10.0.2__tar.gz → 10.0.4__tar.gz

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/CHANGES.md

@@ -9,6 +9,36 @@
 
 <!-- towncrier release notes start -->
 
+## 10.0.4 (2026-08-31)
+
+
+### New features
+
+- Add support for the `RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES` environment variable, a comma-separated list of extra attribute names appended to the summary serializer's `non_metadata_attributes`. 
+
+
+### Bug fixes
+
+- Fix the security check when a wrong permission is specified.
+  @ale-rt #2041
+- Security: in summary serializer only allow access to metadata that is available in the catalog. 
+
+
+### Tests
+
+- Fix expected test output due to more recent `plone.app.discussion` profile.  @mauritsvanrees 
+
+## 10.0.3 (2026-08-21)
+
+
+### Bug fixes
+
+- Fix serialization of RichTextValue objects when an explicit context is not known.
+  [erral] #1583
+- Make calls to time.tzset() in tests conditional on operating system. Windows does not support it. @ewohnlich #2027
+- Fix an `AttributeError` in the `@users` endpoint when the site's default portrait cannot be traversed. `isDefaultPortrait` now reports a mismatch instead of raising. @ericof #2035
+- Fix schema serialization with Dict and List fields that don't specify a value_type/key_type. @erral #2037
+
 ## 10.0.2 (2026-06-26)
 
 

{plone_restapi-10.0.2/src/plone.restapi.egg-info → plone_restapi-10.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plone.restapi
-Version: 10.0.2
+Version: 10.0.4
 Summary: plone.restapi is a RESTful hypermedia API for Plone.
 Home-page: https://github.com/plone/plone.restapi/
 Author: Timo Stollenwerk (kitconcept GmbH)
@@ -222,6 +222,36 @@ this file, one to a line, like so:
 
 <!-- towncrier release notes start -->
 
+## 10.0.4 (2026-08-31)
+
+
+### New features
+
+- Add support for the `RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES` environment variable, a comma-separated list of extra attribute names appended to the summary serializer's `non_metadata_attributes`. 
+
+
+### Bug fixes
+
+- Fix the security check when a wrong permission is specified.
+  @ale-rt #2041
+- Security: in summary serializer only allow access to metadata that is available in the catalog. 
+
+
+### Tests
+
+- Fix expected test output due to more recent `plone.app.discussion` profile.  @mauritsvanrees 
+
+## 10.0.3 (2026-08-21)
+
+
+### Bug fixes
+
+- Fix serialization of RichTextValue objects when an explicit context is not known.
+  [erral] #1583
+- Make calls to time.tzset() in tests conditional on operating system. Windows does not support it. @ewohnlich #2027
+- Fix an `AttributeError` in the `@users` endpoint when the site's default portrait cannot be traversed. `isDefaultPortrait` now reports a mismatch instead of raising. @ericof #2035
+- Fix schema serialization with Dict and List fields that don't specify a value_type/key_type. @erral #2037
+
 ## 10.0.2 (2026-06-26)
 
 

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/setup.py

@@ -3,7 +3,7 @@ from setuptools import setup
 import pathlib
 import sys
 
-version = "10.0.2"
+version = "10.0.4"
 
 if getattr(sys.version_info, "major") == 2:
     raise ValueError(

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/__init__.py

@@ -20,7 +20,6 @@ PROJECT_NAME = "plone.restapi"
 
 allow_module("json")
 
-# BBB: Plone 5.2
 HAS_PLONE_6 = getattr(
     import_module("Products.CMFPlone.factory"), "PLONE60MARKER", False
 )

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/serializer/configure.zcml

@@ -89,6 +89,7 @@
   <adapter factory=".converters.persistent_mapping_converter" />
   <adapter factory=".converters.python_datetime_converter" />
   <adapter factory=".converters.RichtextDXContextConverter" />
+  <adapter factory=".converters.richtextvalue_converter" />
   <adapter factory=".converters.set_converter" />
   <adapter factory=".converters.bytes_converter" />
   <adapter factory=".converters.time_converter" />

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/serializer/converters.py

@@ -7,12 +7,13 @@ from decimal import Decimal
 from persistent.list import PersistentList
 from persistent.mapping import PersistentMapping
 from plone.app.textfield.interfaces import IRichTextValue
-from plone.dexterity.interfaces import IDexterityContent
 from plone.restapi.bbb import safe_text
 from plone.restapi.interfaces import IContextawareJsonCompatible
 from plone.restapi.interfaces import IJsonCompatible
 from zope.component import adapter
+from zope.component import getMultiAdapter
 from zope.component import queryMultiAdapter
+from zope.component.hooks import getSite
 from zope.globalrequest import getRequest
 from zope.i18n import translate
 from zope.i18nmessageid.message import Message
@@ -66,8 +67,8 @@ def json_compatible(value, context=None):
         adapter = queryMultiAdapter((value, context), IContextawareJsonCompatible)
         if adapter:
             return adapter()
-    else:
-        return IJsonCompatible(value, None)
+
+    return IJsonCompatible(value, None)
 
 
 @adapter(Interface)
@@ -80,8 +81,7 @@ def default_converter(value):
         return value
 
     raise TypeError(
-        "No converter for making"
-        " {!r} ({}) JSON compatible.".format(value, type(value))
+        f"No converter for making {value!r} ({type(value)}) JSON compatible."
     )
 
 
@@ -175,7 +175,16 @@ def timedelta_converter(value):
     return json_compatible(value.total_seconds())
 
 
-@adapter(IRichTextValue, IDexterityContent)
+@adapter(IRichTextValue)
+@implementer(IJsonCompatible)
+def richtextvalue_converter(value):
+    # Use the context-aware converter with the site as the context
+    context = getSite()
+    adapter = getMultiAdapter((value, context), IContextawareJsonCompatible)
+    return adapter()
+
+
+@adapter(IRichTextValue, Interface)
 @implementer(IContextawareJsonCompatible)
 class RichtextDXContextConverter:
     def __init__(self, value, context):

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/serializer/schema.py

@@ -1,4 +1,5 @@
 from AccessControl import getSecurityManager
+from logging import getLogger
 from plone.autoform.interfaces import READ_PERMISSIONS_KEY
 from plone.restapi.interfaces import IFieldSerializer
 from plone.restapi.interfaces import ISchemaSerializer
@@ -13,6 +14,8 @@ from zope.interface.interfaces import IInterface
 from zope.schema import getFields
 from zope.security.interfaces import IPermission
 
+logger = getLogger(__name__)
+
 
 @adapter(IInterface, Interface, Interface)
 @implementer(ISchemaSerializer)
@@ -53,7 +56,15 @@ def _check_permission(permission_name, instance, obj=None) -> bool:
     if permission_name not in permission_cache:
         permission = queryUtility(IPermission, name=permission_name)
         if permission is None:
-            permission_cache[permission_name] = True
+            logger.warning(
+                (
+                    "The permission %r was not found, forbidding access. "
+                    "Be sure to specify a properly registered permission id, "
+                    "e.g. zope2.View"
+                ),
+                permission_name,
+            )
+            permission_cache[permission_name] = False
         else:
             sm = getSecurityManager()
             permission_cache[permission_name] = bool(

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/serializer/summary.py

@@ -12,6 +12,19 @@ from zope.component import getAllUtilitiesRegisteredFor
 from zope.interface import implementer
 from zope.interface import Interface
 
+import logging
+import os
+
+logger = logging.getLogger(__name__)
+
+ADDITIONAL_NON_METADATA_ATTRIBUTES = {
+    attr.strip()
+    for attr in os.environ.get("RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES", "").split(
+        ","
+    )
+    if attr.strip()
+}
+
 
 @implementer(IJSONSummarySerializerMetadata)
 class JSONSummarySerializerMetadata:
@@ -30,7 +43,7 @@ class JSONSummarySerializerMetadata:
         return {
             "getPath",
             "getURL",
-        }
+        } | ADDITIONAL_NON_METADATA_ATTRIBUTES
 
     def blocklisted_attributes(self):
         return {
@@ -112,14 +125,26 @@ class DefaultJSONSummarySerializer:
         if not isinstance(additional_metadata_fields, list):
             additional_metadata_fields = [additional_metadata_fields]
         additional_metadata_fields = set(additional_metadata_fields)
-
+        if not additional_metadata_fields:
+            return self.default_metadata_fields
+
+        fields_cache = self.request.get("_summary_fields_cache", None)
+        if fields_cache is None:
+            catalog = getToolByName(self.context, "portal_catalog")
+            fields_cache = set(catalog.schema()) | self.non_metadata_attributes
+            self.request.set("_summary_fields_cache", fields_cache)
         if "_all" in additional_metadata_fields:
-            fields_cache = self.request.get("_summary_fields_cache", None)
-            if fields_cache is None:
-                catalog = getToolByName(self.context, "portal_catalog")
-                fields_cache = set(catalog.schema()) | self.non_metadata_attributes
-                self.request.set("_summary_fields_cache", fields_cache)
             additional_metadata_fields = fields_cache
+        else:
+            rejected_metadata_fields = additional_metadata_fields - fields_cache
+            if rejected_metadata_fields:
+                logger.debug(
+                    "Rejected metadata_fields %s requested for %s: not available "
+                    "in the catalog schema or non_metadata_attributes.",
+                    sorted(rejected_metadata_fields),
+                    self.context,
+                )
+            additional_metadata_fields = additional_metadata_fields & fields_cache
 
         return self.default_metadata_fields | additional_metadata_fields
 

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/services/inherit/get.py

@@ -37,7 +37,7 @@ class InheritedBehaviorExpander:
                         obj
                         for obj in self.context.aq_chain
                         if registration.marker.providedBy(obj)
-                        and _check_permission("View", self, obj)
+                        and _check_permission("zope2.View", self, obj)
                     ),
                     None,
                 )

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/services/users/get.py

@@ -75,6 +75,8 @@ def getPortraitUrl(user):
 def isDefaultPortrait(value):
     portal = getSite()
     default_portrait_value = portal.restrictedTraverse(default_portrait, None)
+    if default_portrait_value is None:
+        return False
     return (
         aq_inner(value).getPhysicalPath()
         == aq_inner(default_portrait_value).getPhysicalPath()

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/testing.py

@@ -77,7 +77,8 @@ class DateTimeFixture(Layer):
     def setUp(self):
         tz = "UTC"
         os.environ["TZ"] = tz
-        time.tzset()
+        if os.name != "nt":
+            time.tzset()
 
         # Patch DateTime's timezone for deterministic behavior.
         from DateTime import DateTime
@@ -95,7 +96,8 @@ class DateTimeFixture(Layer):
     def tearDown(self):
         if "TZ" in os.environ:
             del os.environ["TZ"]
-        time.tzset()
+        if os.name != "nt":
+            time.tzset()
 
         from DateTime import DateTime
 

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/tests/http-examples/translated_messages_addons.resp

@@ -57,8 +57,8 @@ Content-Type: application/json
             "upgrade_info": {
                 "available": false,
                 "hasProfile": true,
-                "installedVersion": "3000",
-                "newVersion": "3000",
+                "installedVersion": "3001",
+                "newVersion": "3001",
                 "required": false
             },
             "version": "1.2.3"

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/tests/http-examples/translated_messages_types_folder.resp

@@ -138,6 +138,7 @@ Content-Type: application/json+schema
             "behavior": "plone.dublincore",
             "description": "Usado en listados de elementos y resultados de b\u00fasquedas.",
             "factory": "Text",
+            "maxLength": 10000,
             "title": "Descripci\u00f3n",
             "type": "string",
             "widget": "textarea"
@@ -251,6 +252,7 @@ Content-Type: application/json+schema
             "behavior": "plone.dublincore",
             "description": "",
             "factory": "Text line (String)",
+            "maxLength": 1024,
             "title": "T\u00edtulo",
             "type": "string"
         }

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/tests/http-examples/types_document.resp

@@ -159,6 +159,7 @@ Content-Type: application/json+schema
             "behavior": "plone.dublincore",
             "description": "Used in item listings and search results.",
             "factory": "Text",
+            "maxLength": 10000,
             "title": "Summary",
             "type": "string",
             "widget": "textarea"
@@ -279,6 +280,7 @@ Content-Type: application/json+schema
             "behavior": "plone.dublincore",
             "description": "",
             "factory": "Text line (String)",
+            "maxLength": 1024,
             "title": "Title",
             "type": "string"
         },

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/tests/http-examples/types_document_put.req

@@ -124,6 +124,7 @@ Content-Type: application/json
             "behavior": "plone.dublincore",
             "description": "Used in item listings and search results.",
             "factory": "Text",
+            "maxLength": 10000,
             "title": "Summary",
             "type": "string",
             "widget": "textarea"
@@ -244,6 +245,7 @@ Content-Type: application/json
             "behavior": "plone.dublincore",
             "description": "",
             "factory": "Text line (String)",
+            "maxLength": 1024,
             "title": "Title",
             "type": "string"
         },

plone_restapi-10.0.4/src/plone/restapi/tests/test_converters.py

@@ -0,0 +1,24 @@
+from plone.app.textfield import RichTextValue
+from plone.restapi.serializer.converters import json_compatible
+from plone.restapi.testing import PLONE_RESTAPI_DX_INTEGRATION_TESTING
+
+import unittest
+
+
+class TestConverters(unittest.TestCase):
+
+    layer = PLONE_RESTAPI_DX_INTEGRATION_TESTING
+
+    def test_richtextvalue_converter(self):
+        """test that a RichTextValue is converted to a proper JSON structure"""
+        html = "<p>This is a demo HTML</p>"
+        value = RichTextValue(html, "text/html", "text/html")
+        json_compatible_value = json_compatible(value)
+        self.assertEqual(
+            json_compatible_value,
+            {
+                "data": html,
+                "content-type": "text/html",
+                "encoding": "utf-8",
+            },
+        )

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/tests/test_dxfield_publication.py

@@ -12,7 +12,6 @@ import unittest
 
 
 class TestPublicationFields(unittest.TestCase):
-
     layer = PLONE_RESTAPI_DX_INTEGRATION_TESTING
 
     def setUp(self):
@@ -22,7 +21,8 @@ class TestPublicationFields(unittest.TestCase):
 
         tz = "Europe/Rome"
         os.environ["TZ"] = tz
-        time.tzset()
+        if os.name != "nt":
+            time.tzset()
 
         # Patch DateTime's timezone for deterministic behavior.
         self.DT_orig_localZone = DateTime.localZone
@@ -46,7 +46,8 @@ class TestPublicationFields(unittest.TestCase):
 
     def tearDown(self):
         os.environ["TZ"] = "UTC"
-        time.tzset()
+        if os.name != "nt":
+            time.tzset()
 
         from DateTime import DateTime
 

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/tests/test_serializer_converters.py

@@ -4,6 +4,7 @@ from datetime import timedelta
 from DateTime import DateTime
 from persistent.list import PersistentList
 from persistent.mapping import PersistentMapping
+from plone.app.textfield.value import RichTextValue
 from plone.restapi.serializer.converters import json_compatible
 from plone.restapi.testing import PLONE_RESTAPI_DX_INTEGRATION_TESTING
 from unittest import TestCase
@@ -218,3 +219,33 @@ class TestJsonCompatibleConverters(TestCase):
 
     def test_missing_value(self):
         self.assertEqual(None, json_compatible(Missing.Value))
+
+    def test_richtext_value_nested(self):
+        value = RichTextValue(
+            raw="<p>foo</p>", mimeType="text/html", outputMimeType="text/x-html-safe"
+        )
+        expected = {
+            "data": "<p>foo</p>",
+            "content-type": "text/html",
+            "encoding": "utf-8",
+        }
+        self.assertEqual(expected, json_compatible(value))
+        self.assertEqual(
+            expected,
+            json_compatible({"foo": value})["foo"],
+        )
+
+    def test_richtext_value_link_resolution_with_fallback(self):
+        # Verify that relative links are resolved against the site root
+        # when using the fallback context
+        html = '<p><a href="resolveuid/12345">link</a></p>'
+        value = RichTextValue(
+            raw=html, mimeType="text/html", outputMimeType="text/x-html-safe"
+        )
+        # Note: Since the UID isn't real, it won't be resolved to a URL,
+        # but output_relative_to will still be called.
+        # If we had a real object, we could test it further.
+        # The main thing is that it doesn't crash and returns valid JSON.
+        result = json_compatible(value)
+        self.assertIn("data", result)
+        self.assertEqual(result["content-type"], "text/html")

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/tests/test_serializer_summary.py

@@ -9,6 +9,7 @@ from plone.dexterity.utils import createContentInContainer
 from plone.event.interfaces import IEvent
 from plone.event.interfaces import IEventRecurrence
 from plone.restapi.interfaces import ISerializeToJsonSummary
+from plone.restapi.serializer.summary import JSONSummarySerializerMetadata
 from plone.restapi.testing import PLONE_RESTAPI_DX_INTEGRATION_TESTING
 from plone.restapi.testing import register_static_uuid_utility
 from Products.CMFCore.utils import getToolByName
@@ -19,6 +20,7 @@ from zope.interface import alsoProvides
 import Missing
 import pytz
 import unittest
+import unittest.mock as mock
 
 try:
     from plone.app.event.adapters import OccurrenceContentListingObject
@@ -201,6 +203,19 @@ class TestSummarySerializers(unittest.TestCase):
             summary.items(),
         )
 
+    def test_extra_non_metadata_attributes_env_var(self):
+        with mock.patch(
+            "plone.restapi.serializer.summary.ADDITIONAL_NON_METADATA_ATTRIBUTES",
+            {"customAttribute", "anotherCustomAttribute"},
+        ):
+            non_metadata_attributes = (
+                JSONSummarySerializerMetadata().non_metadata_attributes()
+            )
+        self.assertIn("customAttribute", non_metadata_attributes)
+        self.assertIn("anotherCustomAttribute", non_metadata_attributes)
+        self.assertIn("getPath", non_metadata_attributes)
+        self.assertIn("getURL", non_metadata_attributes)
+
     def test_dx_type_summary(self):
         summary = getMultiAdapter((self.doc1, self.request), ISerializeToJsonSummary)()
 

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/tests/test_services_inherit.py

@@ -180,15 +180,27 @@ class TestServiceInherit(unittest.TestCase):
             title="Restricted Child",
         )
         alsoProvides(restricted_parent, ITestBehaviorMarker)
+        api.content.transition(restricted_child, to_state="published")
         transaction.commit()
 
         logout()
         anon_session = RelativeSession(self.portal.absolute_url())
         anon_session.headers.update({"Accept": "application/json"})
 
+        # Anonymous is allowed to view the child, as it is published.
+        url = f"{restricted_child.absolute_url()}"
+        response = anon_session.get(url)
+        self.assertEqual(response.status_code, 200)
+
+        # Anonymous is also allowed to request an inherited behavior on the
+        # published child.
         url = f"{restricted_child.absolute_url()}/@inherit?expand.inherit.behaviors=plone.testbehavior.ITestBehavior"
         response = anon_session.get(url)
-        self.assertEqual(response.status_code, 401)
+        self.assertEqual(response.status_code, 200)
+
+        # But no data of the parent is exposed, as the parent is private.
+        data = response.json()
+        self.assertEqual(sorted(data.keys()), ["@id"])
 
     def test_inherit_expansion(self):
         response = self.api_session.get(

{plone_restapi-10.0.2 → plone_restapi-10.0.4}/src/plone/restapi/tests/test_services_users.py

@@ -13,6 +13,8 @@ from plone.restapi.testing import RelativeSession
 from Products.CMFCore.permissions import SetOwnPassword
 from Products.CMFCore.utils import getToolByName
 from Products.MailHost.interfaces import IMailHost
+from unittest.mock import MagicMock
+from unittest.mock import patch
 from zope.component import getUtility
 
 import base64
@@ -32,6 +34,15 @@ class TestUnit(unittest.TestCase):
         self.assertEqual(extract("text / plain"), "text/plain")
         self.assertEqual(extract(" text/plain ; charset=utf-8"), "text/plain")
 
+    def test_is_default_portrait_without_default_portrait(self):
+        """A missing default portrait must not raise, but report a mismatch."""
+        from plone.restapi.services.users import get as users_get
+
+        portal = MagicMock()
+        portal.restrictedTraverse.return_value = None
+        with patch.object(users_get, "getSite", return_value=portal):
+            self.assertFalse(users_get.isDefaultPortrait(MagicMock()))
+
 
 class TestUsersEndpoint(unittest.TestCase):
     layer = PLONE_RESTAPI_DX_FUNCTIONAL_TESTING
@@ -442,6 +453,20 @@ class TestUsersEndpoint(unittest.TestCase):
         self.assertEqual(response.status_code, 200)
         self.assertTrue(response.json()["portrait"].endswith("/@portrait/noam"))
 
+    def test_get_user_with_portrait_set_and_no_default_portrait(self):
+        from plone.restapi.services.users import get as users_get
+
+        with self.makeRealImage() as image:
+            pm = api.portal.get_tool("portal_membership")
+            pm.changeMemberPortrait(image, "noam")
+            transaction.commit()
+
+        with patch.object(users_get, "default_portrait", "no-such-default-portrait"):
+            response = self.api_session.get("/@users/noam")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(response.json()["portrait"].endswith("/@portrait/noam"))
+
     def test_get_search_user_with_filter(self):
         response = self.api_session.post(
             "/@users",