Merge branch 'main' into pro-7798-fix-ordering

Author: boutell

CHANGELOG.md

@@ -4,8 +4,10 @@
 
 ### Adds
 
+* Implemented GET /api/v1/@apostrophecms/login/whoami route such that it returns the details of the currently logged in user; added the route to the login module.
 * Adds keyboard shortcuts for manipulating widgets in areas. Includes Cut, Copy, Paste, Delete, and Duplicate.
 * Adds dynamic choices working with piece manager filters.
+* Allow `import.imageTags` (array of image tag IDs) to be passed to the rich text widget when importing (see https://docs.apostrophecms.org/reference/api/rich-text.html#importing-inline-images).
 
 ### Changes
 
@@ -14,6 +16,7 @@
 * Add missing Pages manager shortcuts list helper.
 * Improve the `isEmpty` method of the rich text widget to take into account the HTML blocks (`<figure>` and `<table>`) that are not empty but do not contain any plain text.
 * Fixed admin bar item ordering to correctly respect the precedence hierarchy: groups (when leader is positioned) > explicit order array > groups (when leader has positioning options) > individual `last`/`after` options.
+* (Backward compatibility break) Conditional field that depends on already hidden field is also hidden, again.
 
 ## 4.18.0 (2025-06-11)
 

modules/@apostrophecms/area/index.js

@@ -604,7 +604,7 @@ module.exports = {
           return {};
         }
         const schema = manager.schema;
-        const field = _.find(schema, 'name', name);
+        const field = schema?.find(field => field.name === name);
         if (!(field && field.options)) {
           return {};
         }

modules/@apostrophecms/login/index.js

@@ -69,7 +69,9 @@ module.exports = {
       allowedAttempts: 3,
       perMinutes: 1,
       lockoutMinutes: 1
-    }
+    },
+    minimumWhoamiFields: [ '_id', 'username', 'title', 'email' ],
+    whoamiFields: []
   },
   async init(self) {
     self.passport = new Passport();
@@ -351,6 +353,22 @@ module.exports = {
         // it should be accessed via POST because the result
         // may differ by individual user session and should not
         // be cached
+        async whoami (req) {
+          if (!req.user) {
+            throw self.apos.error('notfound');
+          }
+
+          const fields = new Set([ ...self.options.minimumWhoamiFields, ...self.options.whoamiFields ]);
+          const user = {};
+
+          for (const field of fields) {
+            if (req.user[field] !== undefined) {
+              user[field] = req.user[field];
+            }
+          }
+
+          return user;
+        },
         async context(req) {
           return self.getContext(req);
         },

modules/@apostrophecms/rich-text-widget/index.js

@@ -1070,7 +1070,8 @@ module.exports = {
                 });
                 const image = await self.apos.image.insert(req, {
                   title: name,
-                  attachment
+                  attachment,
+                  tagsIds: input.import.imageTags || []
                 });
                 const newSrc = `${self.apos.image.action}/${image.aposDocId}/src`;
                 $image.replaceWith(

modules/@apostrophecms/schema/ui/apos/lib/conditionalFields.js

@@ -124,7 +124,7 @@ export function getConditionalFields(
           values,
           field[conditionType],
           (propName, condition, docValue) =>
-            evaluateExternal(propName, condition, conditionType)
+            evaluateExternalAndHidden(propName, condition, conditionType)
         );
       }
     }
@@ -134,10 +134,14 @@ export function getConditionalFields(
 
   // Handle external conditions as a voter function.
   // Non-boolean returns are ignored by the `checkIfConditions` function.
-  function evaluateExternal(propName, conditionValue, conditionType) {
+  function evaluateExternalAndHidden(propName, conditionValue, conditionType) {
     if (isExternalCondition(propName, conditionType)) {
       return externalConditionsResults[conditionType]?.[propName] === conditionValue;
     }
+
+    if (result[conditionType]?.[propName] === false) {
+      return false;
+    }
   }
 }
 

package.json

@@ -36,7 +36,7 @@
     "@apostrophecms/vue-material-design-icons": "^1.0.0",
     "@ctrl/tinycolor": "^4.1.0",
     "@floating-ui/dom": "^1.5.3",
-    "@opentelemetry/api": "^1.0.4",
+    "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/semantic-conventions": "^1.0.1",
     "@paralleldrive/cuid2": "^2.2.2",
     "@tiptap/extension-color": "^2.4.0",

test/login.js

@@ -867,4 +867,84 @@ describe('Login', function() {
       }
     );
   });
+
+  it('should return an error with code 404 at GET login/whoami when user is not logged in', async function() {
+    try {
+      await apos.http.get('/api/v1/@apostrophecms/login/whoami');
+      assert.fail('Expected error but got success');
+    } catch (err) {
+      assert.strictEqual(err.status, 404);
+    }
+  });
+
+  it('should return user data at GET login/whoami when user is logged in', async function() {
+
+    const jar = apos.http.jar();
+
+    await apos.http.post(
+      '/api/v1/@apostrophecms/login/login',
+      {
+        method: 'POST',
+        body: {
+          username: 'HarryPutter',
+          password: 'AnotherLovelyPassword',
+          session: true
+        },
+        jar
+      }
+    );
+
+    const whoamiResponse = await apos.http.get('/api/v1/@apostrophecms/login/whoami', { jar });
+    assert.ok(whoamiResponse._id);
+    assert.strictEqual(whoamiResponse.username, 'HarryPutter');
+    assert.strictEqual(whoamiResponse.title, 'Extra Cool Putter');
+    assert.strictEqual(whoamiResponse.email, 'hputter@aol.com');
+  });
+
+  it('should return user data with additional whoamiFields if explicitly added at GET login/whoami when user is logged in', async function() {
+
+    const jar = apos.http.jar();
+
+    apos.modules['@apostrophecms/login'].options.whoamiFields = [ 'role' ];
+
+    await apos.http.post(
+      '/api/v1/@apostrophecms/login/login',
+      {
+        method: 'POST',
+        body: {
+          username: 'HarryPutter',
+          password: 'AnotherLovelyPassword',
+          session: true
+        },
+        jar
+      }
+    );
+
+    const whoamiResponse = await apos.http.get('/api/v1/@apostrophecms/login/whoami', { jar });
+    assert.strictEqual(whoamiResponse.role, 'admin');
+  });
+
+  it('should not return user data with additional whoamiFields if not explicitly added at GET login/whoami when user is logged in', async function() {
+
+    const jar = apos.http.jar();
+
+    // Reset the whoamiFields to default (empty)
+    apos.modules['@apostrophecms/login'].options.whoamiFields = [];
+
+    await apos.http.post(
+      '/api/v1/@apostrophecms/login/login',
+      {
+        method: 'POST',
+        body: {
+          username: 'HarryPutter',
+          password: 'AnotherLovelyPassword',
+          session: true
+        },
+        jar
+      }
+    );
+
+    const whoamiResponse = await apos.http.get('/api/v1/@apostrophecms/login/whoami', { jar });
+    assert.ok(!('role' in whoamiResponse));
+  });
 });