Merge remote-tracking branch 'origin/v14/dev' into release/14.0

Author: iOvergaard

Directory.Packages.props

@@ -6,31 +6,31 @@
   <!-- Global packages (private, build-time packages for all projects) -->
   <ItemGroup>
     <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.6.133" />
-    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.507" />
+    <GlobalPackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
     <GlobalPackageReference Include="Umbraco.Code" Version="2.1.0" />
     <GlobalPackageReference Include="Umbraco.GitVersioning.Extensions" Version="0.2.0" />
   </ItemGroup>
   <!-- Microsoft packages -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Razor.RuntimeCompilation" Version="8.0.4" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.8.0" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.1" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.1" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.1" />
-    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="8.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.4" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.4" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Abstractions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Abstractions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.4" />
     <PackageVersion Include="Microsoft.Extensions.FileProviders.Physical" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.1" />
-    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Core" Version="8.0.4" />
+    <PackageVersion Include="Microsoft.Extensions.Identity.Stores" Version="8.0.4" />
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Options" Version="8.0.2" />
     <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Options.DataAnnotations" Version="8.0.0" />
   </ItemGroup>
@@ -41,25 +41,25 @@
   </ItemGroup>
   <!-- Third-party packages -->
   <ItemGroup>
-    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.0.0" />
-    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.0.0" />
+    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.1.0" />
+    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.0" />
     <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
     <PackageVersion Include="Examine" Version="3.2.0" />
     <PackageVersion Include="Examine.Core" Version="3.2.0" />
-    <PackageVersion Include="HtmlAgilityPack" Version="1.11.57" />
-    <PackageVersion Include="JsonPatch.Net" Version="2.1.0" />
-    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.6" />
-    <PackageVersion Include="MailKit" Version="4.3.0" />
+    <PackageVersion Include="HtmlAgilityPack" Version="1.11.60" />
+    <PackageVersion Include="JsonPatch.Net" Version="3.0.0" />
+    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
+    <PackageVersion Include="MailKit" Version="4.4.0" />
     <PackageVersion Include="Markdown" Version="2.2.1" />
     <PackageVersion Include="MessagePack" Version="2.5.140" />
     <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.3.8" />
     <PackageVersion Include="MiniProfiler.Shared" Version="4.3.8" />
     <PackageVersion Include="ncrontab" Version="3.3.3" />
     <PackageVersion Include="NPoco" Version="5.7.1" />
     <PackageVersion Include="NPoco.SqlServer" Version="5.7.1" />
-    <PackageVersion Include="OpenIddict.Abstractions" Version="4.10.1" />
-    <PackageVersion Include="OpenIddict.AspNetCore" Version="4.10.1" />
-    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="4.10.1" />
+    <PackageVersion Include="OpenIddict.Abstractions" Version="5.4.0" />
+    <PackageVersion Include="OpenIddict.AspNetCore" Version="5.4.0" />
+    <PackageVersion Include="OpenIddict.EntityFrameworkCore" Version="5.4.0" />
     <PackageVersion Include="Serilog" Version="3.1.1" />
     <PackageVersion Include="Serilog.AspNetCore" Version="8.0.1" />
     <PackageVersion Include="Serilog.Enrichers.Process" Version="2.0.2" />
@@ -73,13 +73,13 @@
     <PackageVersion Include="Serilog.Sinks.File" Version="5.0.0" />
     <PackageVersion Include="Serilog.Sinks.Map" Version="1.0.2" />
     <PackageVersion Include="SixLabors.ImageSharp" Version="3.1.3" />
-    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.0" />
+    <PackageVersion Include="SixLabors.ImageSharp.Web" Version="3.1.1" />
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="6.5.0" />
   </ItemGroup>
   <!-- Transitive pinned versions (only required because our direct dependencies have vulnerable versions of transitive dependencies) -->
   <ItemGroup>
     <!-- Both Microsoft.EntityFrameworkCore.SqlServer and NPoco.SqlServer bring in a vulnerable version of Azure.Identity -->
-    <PackageVersion Include="Azure.Identity" Version="1.10.4" />
+    <PackageVersion Include="Azure.Identity" Version="1.11.0" />
     <!-- Dazinator.Extensions.FileProviders brings in a vulnerable version of System.Net.Http -->
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
     <!-- Examine brings in a vulnerable version of System.Security.Cryptography.Xml -->

build/azure-pipelines.yml

@@ -85,12 +85,6 @@ stages:
             retryCountOnTaskFailure: 3
             inputs:
               versionSpec: $(nodeVersion)
-          - script: npm ci --no-fund --no-audit --prefer-offline
-            displayName: Run npm ci (Login)
-            workingDirectory: src/Umbraco.Web.UI.Login
-          - script: npm run build
-            displayName: Run npm build (Login)
-            workingDirectory: src/Umbraco.Web.UI.Login
           - script: npm ci --no-fund --no-audit --prefer-offline
             displayName: Run npm ci (Bellissima)
             workingDirectory: src/Umbraco.Web.UI.Client
@@ -101,9 +95,12 @@ stages:
           - script: npm run build:for:cms
             displayName: Run build (Bellissima)
             workingDirectory: src/Umbraco.Web.UI.Client
+          - script: npm ci --no-fund --no-audit --prefer-offline
+            displayName: Run npm ci (Login)
+            workingDirectory: src/Umbraco.Web.UI.Login
           - script: npm run build
-            displayName: Run Login Build (Bellissima)
-            workingDirectory: src/Umbraco.Web.UI.Client/apps/auth
+            displayName: Run npm build (Login)
+            workingDirectory: src/Umbraco.Web.UI.Login
           - task: UseDotNet@2
             displayName: Use .NET SDK from global.json
             inputs:

src/Umbraco.Cms.Api.Common/Attributes/ShortGenericSchemaNameAttribute.cs

@@ -30,7 +30,6 @@ private static void ConfigureOpenIddict(IUmbracoBuilder builder)
             {
                 // Enable the authorization and token endpoints.
                 // - important: member endpoints MUST be added before backoffice endpoints to ensure that auto-discovery works for members
-                // FIXME: swap paths here so member API is first (see comment above)
                 options
                     .SetAuthorizationEndpointUris(
                         Paths.MemberApi.AuthorizationEndpoint.TrimStart(Constants.CharArrays.ForwardSlash),

src/Umbraco.Cms.Api.Common/DependencyInjection/UmbracoBuilderAuthExtensions.cs

@@ -39,44 +39,7 @@ private string HandleGenerics(string name, Type type)
             return name;
         }
 
-        // find all types that implement this type and have an matching attribute
-        var assignableTypesWithAttributeInfo = AppDomain.CurrentDomain.GetAssemblies()
-            .Where(assembly => assembly.FullName?.StartsWith("Umbraco") == true)
-            .SelectMany(assembly => assembly.GetTypes())
-            .Where(t => t.IsAssignableTo(type))
-            .Select(t =>
-            {
-                var attribute = System.Attribute.GetCustomAttributes(t)
-                        .FirstOrDefault(attribute => attribute is ShortGenericSchemaNameAttribute) as
-                    ShortGenericSchemaNameAttribute;
-                return attribute == null
-                    ? new ShortSchemaNameAttributeInfo(t)
-                    : new ShortSchemaNameAttributeInfo(t, attribute.GenericTypes, attribute.SchemaName);
-            })
-            .Where(info => info.GenericTypes != null);
-
-        var matchingType = assignableTypesWithAttributeInfo
-            .SingleOrDefault(t => t.GenericTypes!.Length == type.GenericTypeArguments.Length
-                                  && t.GenericTypes.Intersect(type.GenericTypeArguments).Count() ==
-                                  type.GenericTypeArguments.Length && t.SchemaName.IsNullOrWhiteSpace() == false);
-
         // use attribute custom name or append the generic type names, ultimately turning i.e. "PagedViewModel<RelationItemViewModel>" into "PagedRelationItem"
-        return matchingType != null
-            ? matchingType.SchemaName!
-            : $"{name}{string.Join(string.Empty, type.GenericTypeArguments.Select(SanitizedTypeName))}";
-    }
-
-    private class ShortSchemaNameAttributeInfo
-    {
-        public Type Type { get; set; }
-        public Type[]? GenericTypes { get; set; }
-        public string? SchemaName { get; set; }
-
-        public ShortSchemaNameAttributeInfo(Type type, Type[]? genericTypes = null, string? schemaName = null)
-        {
-            Type = type;
-            GenericTypes = genericTypes;
-            SchemaName = schemaName;
-        }
+        return $"{name}{string.Join(string.Empty, type.GenericTypeArguments.Select(SanitizedTypeName))}";
     }
 }

src/Umbraco.Cms.Api.Common/OpenApi/SchemaIdSelector.cs

@@ -1,3 +1,5 @@
+using Umbraco.Cms.Core;
+
 namespace Umbraco.Cms.Api.Common.Security;
 
 public static class Paths
@@ -14,7 +16,7 @@ public static class BackOfficeApi
 
         public static readonly string RevokeEndpoint = EndpointPath($"{EndpointTemplate}/revoke");
 
-        private static string EndpointPath(string relativePath) => $"/umbraco/management/api/v1/{relativePath}";
+        private static string EndpointPath(string relativePath) => $"/umbraco{Constants.Web.ManagementApiPath}v1/{relativePath}";
     }
 
     public static class MemberApi

src/Umbraco.Cms.Api.Common/Security/Paths.cs

@@ -11,12 +11,18 @@ public sealed class UmbracoJsonTypeInfoResolver : DefaultJsonTypeInfoResolver, I
     private readonly ConcurrentDictionary<Type, ISet<Type>> _subTypesCache = new ConcurrentDictionary<Type, ISet<Type>>();
 
     public UmbracoJsonTypeInfoResolver(ITypeFinder typeFinder)
-    {
-        _typeFinder = typeFinder;
-    }
+        => _typeFinder = typeFinder;
 
     public IEnumerable<Type> FindSubTypes(Type type)
     {
+        if (type.IsInterface is false)
+        {
+            // IMPORTANT: do NOT return an empty enumerable here. it will cause nullability to fail on reference
+            //            properties, because "$ref" does not mix and match well with "nullable" in OpenAPI.
+            //            see also https://github.com/OAI/OpenAPI-Specification/issues/1368
+            return new[] { type };
+        }
+
         if (_subTypesCache.TryGetValue(type, out ISet<Type>? cachedResult))
         {
             return cachedResult;
@@ -30,32 +36,9 @@ public IEnumerable<Type> FindSubTypes(Type type)
     public override JsonTypeInfo GetTypeInfo(Type type, JsonSerializerOptions options)
     {
         JsonTypeInfo result = base.GetTypeInfo(type, options);
-
-        if (type.IsInterface)
-        {
-            return GetTypeInfoForInterface(result, type, options);
-        }
-        else
-        {
-            return GetTypeInfoForClass(result, type, options);
-        }
-
-    }
-
-    private JsonTypeInfo GetTypeInfoForClass(JsonTypeInfo result, Type type, JsonSerializerOptions options)
-    {
-        if (result.Kind != JsonTypeInfoKind.Object || !type.GetInterfaces().Any())
-        {
-            return result;
-        }
-
-        JsonPolymorphismOptions jsonPolymorphismOptions = result.PolymorphismOptions ?? new JsonPolymorphismOptions();
-
-        jsonPolymorphismOptions.DerivedTypes.Add(new JsonDerivedType(type, type.Name));
-
-        result.PolymorphismOptions = jsonPolymorphismOptions;
-
-        return result;
+        return type.IsInterface
+            ? GetTypeInfoForInterface(result, type, options)
+            : result;
     }
 
     private JsonTypeInfo GetTypeInfoForInterface(JsonTypeInfo result, Type type, JsonSerializerOptions options)

src/Umbraco.Cms.Api.Common/Serialization/UmbracoJsonTypeInfoResolver.cs

@@ -1,12 +1,9 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.Services;
 
 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
 
@@ -16,32 +13,6 @@ public class ByIdContentApiController : ContentApiItemControllerBase
 {
     private readonly IRequestMemberAccessService _requestMemberAccessService;
 
-    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
-    public ByIdContentApiController(
-        IApiPublishedContentCache apiPublishedContentCache,
-        IApiContentResponseBuilder apiContentResponseBuilder,
-        IPublicAccessService publicAccessService)
-        : this(
-            apiPublishedContentCache,
-            apiContentResponseBuilder,
-            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
-    {
-    }
-
-    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
-    public ByIdContentApiController(
-        IApiPublishedContentCache apiPublishedContentCache,
-        IApiContentResponseBuilder apiContentResponseBuilder,
-        IPublicAccessService publicAccessService,
-        IRequestMemberAccessService requestMemberAccessService)
-        : this(
-            apiPublishedContentCache,
-            apiContentResponseBuilder,
-            requestMemberAccessService)
-    {
-    }
-
-    [ActivatorUtilitiesConstructor]
     public ByIdContentApiController(
         IApiPublishedContentCache apiPublishedContentCache,
         IApiContentResponseBuilder apiContentResponseBuilder,

src/Umbraco.Cms.Api.Delivery/Controllers/Content/ByIdContentApiController.cs

@@ -1,12 +1,9 @@
 using Asp.Versioning;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
-using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Core.DeliveryApi;
-using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models.DeliveryApi;
 using Umbraco.Cms.Core.Models.PublishedContent;
-using Umbraco.Cms.Core.Services;
 using Umbraco.Extensions;
 
 namespace Umbraco.Cms.Api.Delivery.Controllers.Content;
@@ -17,32 +14,6 @@ public class ByIdsContentApiController : ContentApiItemControllerBase
 {
     private readonly IRequestMemberAccessService _requestMemberAccessService;
 
-    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
-    public ByIdsContentApiController(
-        IApiPublishedContentCache apiPublishedContentCache,
-        IApiContentResponseBuilder apiContentResponseBuilder,
-        IPublicAccessService publicAccessService)
-        : this(
-            apiPublishedContentCache,
-            apiContentResponseBuilder,
-            StaticServiceProvider.Instance.GetRequiredService<IRequestMemberAccessService>())
-    {
-    }
-
-    [Obsolete($"Please use the constructor that does not accept {nameof(IPublicAccessService)}. Will be removed in V14.")]
-    public ByIdsContentApiController(
-        IApiPublishedContentCache apiPublishedContentCache,
-        IApiContentResponseBuilder apiContentResponseBuilder,
-        IPublicAccessService publicAccessService,
-        IRequestMemberAccessService requestMemberAccessService)
-        : this(
-            apiPublishedContentCache,
-            apiContentResponseBuilder,
-            requestMemberAccessService)
-    {
-    }
-
-    [ActivatorUtilitiesConstructor]
     public ByIdsContentApiController(
         IApiPublishedContentCache apiPublishedContentCache,
         IApiContentResponseBuilder apiContentResponseBuilder,