diff --git a/README.md b/README.md index 2c9e21a..cdb67f2 100644 --- a/README.md +++ b/README.md @@ -146,6 +146,11 @@ with an `Origin` header. Native CORS middleware handles `[DisableCors]` endpoint metadata; it does not authorize browser CMS access. Do not add browser CMS calls, a permissive CORS policy or a frontend-origin allowlist as a workaround. +Legacy account surface actions are disabled. The old `/api/profile/image-process` +and `/api/newsletter/signup` routes are removed. All member and newsletter writes +now use the private bridge. The legacy account controller type remains only so +historical Razor views compile. + A bounded native-CMS journey passed real login, session, logout, SMTP delivery and password reset. It used a synthetic member created through the native member manager in a builtin-member-only database. That runtime lacks the legacy SGF diff --git a/SgfDevs.Tests/DirectoryApiContractTests.cs b/SgfDevs.Tests/DirectoryApiContractTests.cs index fd63cd2..68c6c79 100644 --- a/SgfDevs.Tests/DirectoryApiContractTests.cs +++ b/SgfDevs.Tests/DirectoryApiContractTests.cs @@ -152,12 +152,4 @@ private static string[] GetContentTypes(ProducesResponseTypeAttribute attribute) return contentTypes.ToArray(); } - [Fact] - public void ProfileImageEndpoint_RemainsMemberProtected() - { - var method = typeof(DevsApiController).GetMethod(nameof(DevsApiController.UploadProfileImage))!; - - Assert.Contains(method.GetCustomAttributes(), attribute => - attribute.GetType().Name == "UmbracoMemberAuthorizeAttribute"); - } } diff --git a/SgfDevs/Controllers/AccountController.cs b/SgfDevs/Controllers/AccountController.cs index 525a507..189dc14 100644 --- a/SgfDevs/Controllers/AccountController.cs +++ b/SgfDevs/Controllers/AccountController.cs @@ -29,6 +29,8 @@ namespace SGFDevs.Controllers; +// Legacy Razor views still reference this type. Only the private bridge handles member mutations. +[NonController] [AutoValidateAntiforgeryToken] public class AccountController : SurfaceController { diff --git a/SgfDevs/Controllers/DevsApiController.cs b/SgfDevs/Controllers/DevsApiController.cs index a544879..ec247ba 100644 --- a/SgfDevs/Controllers/DevsApiController.cs +++ b/SgfDevs/Controllers/DevsApiController.cs @@ -1,6 +1,5 @@ using System.Collections.Generic; using System.Linq; -using System.Threading.Tasks; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using SGFDevs.Dev; @@ -8,14 +7,8 @@ using SgfDevs.Dev; using SGFDevs.ViewModels; using Umbraco.Cms.Core; -using Umbraco.Cms.Core.IO; using Umbraco.Cms.Core.Models; -using Umbraco.Cms.Core.PropertyEditors; -using Umbraco.Cms.Core.Security; using Umbraco.Cms.Core.Services; -using Umbraco.Cms.Core.Strings; -using Umbraco.Cms.Web.Common; -using Umbraco.Cms.Web.Common.Filters; using Tag = Umbraco.Cms.Web.Common.PublishedModels.Tag; using Umbraco.Extensions; @@ -24,48 +17,22 @@ namespace SGFDevs.Controllers; [ApiController] public class DevsApiController : Controller { - private DirectoryHelper _directoryHelper; - private IMemberService _memberService; - private IExamineManager _examineManager; - private UmbracoHelper _helper; - private IMemberManager _memberManager; - private IMediaService _mediaService; - private MediaFileManager _mediaFileManager; - private IShortStringHelper _shortStringHelper; - private IContentTypeBaseServiceProvider _contentTypeBaseServiceProvider; - private MediaUrlGeneratorCollection _mediaUrlGeneratorCollection; - private NewsletterHelper _newsletterHelper; + private readonly DirectoryHelper _directoryHelper; + private readonly IMemberService _memberService; + private readonly IExamineManager _examineManager; private readonly MemberConverter _memberConverter; private readonly MemberTagDisplayService _memberTagDisplayService; - public DevsApiController( DirectoryHelper directoryHelper, IMemberService memberService, IExamineManager examineManager, - UmbracoHelper helper, - IMemberManager memberManager, - IMediaService mediaService, - MediaFileManager mediaFileManager, - IShortStringHelper shortStringHelper, - IContentTypeBaseServiceProvider contentTypeBaseServiceProvider, - MediaUrlGeneratorCollection mediaUrlGeneratorCollection, - NewsletterHelper newsletterHelper, MemberConverter memberConverter, - MemberTagDisplayService memberTagDisplayService - ) + MemberTagDisplayService memberTagDisplayService) { _directoryHelper = directoryHelper; _memberService = memberService; _examineManager = examineManager; - _helper = helper; - _memberManager = memberManager; - _mediaService = mediaService; - _mediaFileManager = mediaFileManager; - _shortStringHelper = shortStringHelper; - _contentTypeBaseServiceProvider = contentTypeBaseServiceProvider; - _mediaUrlGeneratorCollection = mediaUrlGeneratorCollection; - _newsletterHelper = newsletterHelper; _memberConverter = memberConverter; _memberTagDisplayService = memberTagDisplayService; } @@ -148,69 +115,6 @@ public ActionResult> GetSearch( return Ok(filteredMembers); } - [Route("api/profile/image-process")] - [UmbracoMemberAuthorize] - public async Task UploadProfileImage() - { - var currentMember = await _memberManager.GetCurrentMemberAsync(); - if (currentMember == null) - { - return Forbid(); - } - var member = _memberConverter.FromContent(_memberManager.AsPublishedMember(currentMember)); - - //var request = HttpContext.Current.Request; - //var request = HttpContext.Request; - var request = Request; - - if (request.Form.Files.Count > 0) - { - var file = request.Form.Files[0]; - - if(file.Length > 0) - { - var filesExtension = System.IO.Path.GetExtension(file.FileName); - var newFileName = member.Username + filesExtension; - var membersMediaFolder = _mediaService.GetRootMedia().FirstOrDefault(x => x.Name.InvariantEquals("Members")); - - // Need to explore and see if mediaService.SetMediaFileContent will work to - // update an item if it already exists instead of always creating a new one. - // For now, just create dupes! - // - Myke - var media = _mediaService.CreateMedia(member.Username, membersMediaFolder, Constants.Conventions.MediaTypes.Image); - - media.SetValue( - _mediaFileManager, - _mediaUrlGeneratorCollection, - _shortStringHelper, - _contentTypeBaseServiceProvider, - Constants.Conventions.Media.File, - newFileName, - file.OpenReadStream() - ); - _mediaService.Save(media); - - var imageUdi = new GuidUdi("media", media.Key).ToString(); - - return Ok(imageUdi); - } - } - - return BadRequest(); - } - - [HttpPost] - [Route("api/newsletter/signup")] - public async Task NewsletterSignUp([FromForm] string email, [FromForm(Name = "name")] string honeypot) - { - if (string.IsNullOrEmpty(honeypot)) - { - await _newsletterHelper.Subscribe(email); - } - - return Ok(); - } - private PublicDirectoryMemberDto BuildDirectoryResult(IMember umbracoMember) { var member = _memberConverter.FromMember(umbracoMember);