[Conflicts] Merge main into next

.changeset/brevo-api-replace-axios-with-fetch.md

@@ -0,0 +1,7 @@
+---
+"@dextinity/brevo-api": patch
+---
+
+Replace `axios` with the native `fetch` API when requesting the email campaign content from the frontend
+
+This removes the `@nestjs/axios` and `axios` dependencies from the package.

.changeset/content-scope-dimensions.md

@@ -0,0 +1,22 @@
+---
+"@dextinity/cms-api": minor
+---
+
+Allow declaring content scope dimensions at runtime
+
+Add an optional `availableContentScopeDimensions` option to the `UserPermissionsModule` to declare the content scope dimensions (with optional labels). When omitted, the dimensions are derived from the keys of `availableContentScopes`.
+
+A content scope may hold any value (including the `"*"` wildcard) for a dimension that is not part of `availableContentScopes`. Content scopes are no longer validated against `availableContentScopes`; access is enforced per request by `isAllowed`, which compares the requested scope against the user's granted scopes.
+
+**Example**
+
+```ts
+UserPermissionsModule.forRootAsync({
+    useFactory: () => ({
+        availableContentScopes: [ ... ],
+        availableContentScopeDimensions: [{ name: "domain", label: "Domain (Website)" }, { name: "language" }, { name: "product" }],
+        // ...
+    }),
+    // ...
+});
+```

.changeset/outlook-vml-shape-reserved-pixel.md

@@ -0,0 +1,7 @@
+---
+"@dextinity/mail-react": patch
+---
+
+Fix rounded images rendering a pixel too large in classic Outlook
+
+Two images side by side made their section wider than the body width. Affects `MjmlImage`, `HtmlImage`, `MjmlPixelImageBlock` and `HtmlPixelImageBlock`.

.changeset/tiptap-feature-options.md

@@ -0,0 +1,29 @@
+---
+"@dextinity/cms-admin": minor
+"@dextinity/cms-api": minor
+---
+
+Replace the TipTap Rich Text Block's `supports` array with one option per feature
+
+`createTipTapRichTextBlock` now takes a single root options object with one option per editor feature, similar to TipTap's `StarterKit` configuration. Feature-specific options move into a nested options object of the feature they belong to, so `headingLevels` becomes `heading: { levels: [...] }`.
+
+Every feature is enabled by default (except `underline`) and is disabled by passing `false`, so a configuration only has to state what deviates from the defaults instead of repeating every supported feature. Links stay the exception: they are enabled by passing the link block as `link`.
+
+**Example**
+
+```ts
+// Before
+createTipTapRichTextBlock({
+    supports: ["bold", "italic", "strike", "sub", "sup", "heading", "ordered-list", "unordered-list"],
+    headingLevels: [2, 3],
+});
+
+// After
+createTipTapRichTextBlock({
+    nonBreakingSpace: false,
+    softHyphen: false,
+    heading: { levels: [2, 3] },
+});
+```
+
+The features are named after their option: `bold`, `italic`, `underline`, `strike`, `sub`, `sup`, `heading`, `orderedList`, `unorderedList`, `nonBreakingSpace`, `softHyphen` and `link`. Additionally, `undoRedoButtons` (Admin only) shows or hides the undo/redo buttons in the toolbar; the keyboard shortcuts work regardless. The document-level limits `maxTextBlocks` and `listLevelMax` are unchanged.

.changeset/validate-page-tree-node-scope-name.md

@@ -0,0 +1,7 @@
+---
+"@dextinity/cms-api": patch
+---
+
+Validate the GraphQL type names of a custom `PageTreeNode` scope passed to `PageTreeModule.forRoot()`
+
+`PageTreeModule.forRoot()` now throws an error at startup if the provided `Scope` class isn't decorated with `@ObjectType("PageTreeNodeScope")` and `@InputType("PageTreeNodeScopeInput")`, mirroring the existing validation for `DamModule`'s `Scope` option. This prevents runtime GraphQL schema errors caused by an accidentally renamed scope type.

.coderabbit.yml

@@ -0,0 +1,33 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+    auto_review:
+        enabled: false
+    high_level_summary_in_walkthrough: true
+    request_changes_workflow: true
+    # We don't use GitHub issues and CodeRabbit has no access to Jira, so there is never a linked issue to assess or relate.
+    assess_linked_issues: false
+    related_issues: false
+    pre_merge_checks:
+        override_requested_reviewers_only: true # author can't dismiss failing checks
+        issue_assessment:
+            mode: "off"
+        custom_checks:
+            - name: "Requires human review"
+              mode: "error"
+              instructions: |
+                  FAIL if the PR touches one of the following:
+                      - authentication
+                      - authorization
+                      - DB migrations
+                      - CI workflow files
+                      - secret or credential handling
+                      - changes public API
+                      - deletes tests
+                      - coderabbit config
+
+                  FAIL if the PR adds or modifies more than 300 lines of hand-written source.
+                  When counting those lines, ignore deleted lines, and ignore changes to
+                  tests (*.spec.*, *.test.*, __snapshots__/), docs (docs/, *.md,
+                  .changeset/) and generated output (**/generated/, schema.gql,
+                  block-meta.json, pnpm-lock.yaml).
+                  Otherwise PASS.

.gitignore

@@ -19,6 +19,7 @@ junit-storybook.xml
 .context
 .playwright
 .playwright-mcp
+.playwright-cli/
 
 # Agent files
 .agents/skills/

SECURITY.md

@@ -5,11 +5,15 @@
 The versions of the project that are currently supported with security updates.
 
 | Version | Supported                             |
-|--------:|:--------------------------------------|
-|     9.x | :white_check_mark:                    |
+| ------: | :------------------------------------ |
+|  ≥ 10.x | :white_check_mark:                    |
+|     9.x | :x: (use 10.x instead, see note)      |
 |     8.x | :white_check_mark: (until 2027-07-07) |
 |   < 8.x | :x:                                   |
 
+> [!NOTE]
+> Version 9.x is not supported. Use 10.x instead, which is largely compatible with 9.x: every breaking change in 10.x is part of the COMET -> Dextinity rename. See the [migration guide from v9 to v10](https://cms-docs.dextinity.com/docs/migration-guide/migration-from-v9-to-v10).
+
 ## Reporting a vulnerability
 
 You can report a vulnerability by contacting us via email at [security@vivid-planet.com](mailto:security@vivid-planet.com).

demo/admin/src/common/blocks/TipTapRichTextBlock.tsx

@@ -1,3 +1,4 @@
+import { RteHighlight, Tag } from "@dextinity/admin-icons";
 import { createTipTapRichTextBlock } from "@dextinity/cms-admin";
 import { ProductPriceBlock } from "@src/products/blocks/ProductPriceBlock";
 import { ProductTeaserBlock } from "@src/products/blocks/ProductTeaserBlock";
@@ -66,12 +67,14 @@ export const TipTapRichTextBlock = createTipTapRichTextBlock({
         {
             name: "highlight",
             label: <FormattedMessage id="tipTapRichTextBlock.inlineStyle.highlight" defaultMessage="Highlight" />,
+            icon: RteHighlight,
             element: (props: HTMLAttributes<HTMLElement>) => <span style={{ backgroundColor: "#fff3cd", padding: "0 2px" }} {...props} />,
         },
         {
             name: "tag",
             label: <FormattedMessage id="tipTapRichTextBlock.inlineStyle.tag" defaultMessage="Tag" />,
             appliesTo: ["paragraph"],
+            icon: Tag,
             element: (props: HTMLAttributes<HTMLElement>) => (
                 <span style={{ backgroundColor: "#e0f0ff", color: "#0066cc", padding: "0 4px", borderRadius: 4 }} {...props} />
             ),

demo/api/schema.gql

@@ -2310,12 +2310,12 @@ enum UserPermissionSource {
 }
 
 type UserPermissionsUser {
-  contentScopesCount: Int!
+  contentScopesCount: Int! @deprecated(reason: "The Scopes column was removed from the users list. Will be removed in the next version.")
   email: String!
   id: String!
   impersonationAllowed: Boolean!
   name: String!
-  permissionsCount: Int!
+  permissionsCount: Int! @deprecated(reason: "The Permissions column was removed from the users list. Will be removed in the next version.")
 }
 
 input UserPermissionsUserFilter {

demo/api/src/app.module.ts

@@ -126,6 +126,12 @@ export class AppModule {
                                 label: { domain: siteConfig.name },
                             })),
                         ),
+                        availableContentScopeDimensions: [
+                            { name: "domain", label: "Domain (Website)" },
+                            { name: "language", label: "Language" },
+                            // "product" is declared here so it shows up in the admin panel although it is not part of availableContentScopes
+                            { name: "product", label: "Product Category" },
+                        ],
                         userService,
                         accessControlService,
                         systemUsers: [SYSTEM_USER_NAME],

demo/api/src/auth/access-control.service.spec.ts

@@ -61,7 +61,7 @@ describe("AccessControlService", () => {
 
             const contentScopes = service.getContentScopesForUser(nonAdminUser);
 
-            expect(contentScopes).toEqual([{ domain: "main", language: "en" }]);
+            expect(contentScopes).toEqual([{ domain: "main", language: "*", product: "*" }]);
         });
 
         it("should return limited content scopes for unknown non-admin user", () => {
@@ -74,7 +74,7 @@ describe("AccessControlService", () => {
 
             const contentScopes = service.getContentScopesForUser(unknownUser);
 
-            expect(contentScopes).toEqual([{ domain: "main", language: "en" }]);
+            expect(contentScopes).toEqual([{ domain: "main", language: "*", product: "*" }]);
         });
     });
 });

demo/api/src/auth/access-control.service.ts

@@ -15,7 +15,8 @@ export class AccessControlService extends AbstractAccessControlService {
         if (user.isAdmin) {
             return UserPermissions.allContentScopes;
         } else {
-            return [{ domain: "main", language: "en" }];
+            // Grant access to every language and product within the "main" domain using wildcard dimensions
+            return [{ domain: "main", language: "*", product: "*" }];
         }
     }
 }

demo/api/src/content-scope/content-scope.interface.ts

@@ -3,6 +3,8 @@ import { ContentScope } from "@dextinity/cms-api";
 import type { ContentScope as BaseContentScope } from "@src/site-configs";
 
 declare module "@dextinity/cms-api" {
-    // eslint-disable-next-line @typescript-eslint/no-empty-object-type
-    interface ContentScope extends BaseContentScope {}
+    interface ContentScope extends BaseContentScope {
+        // Optional dimension used only by certain resolvers. Not part of `availableContentScopes` as there can be thousands of product ids.
+        product?: string;
+    }
 }

demo/api/src/page-tree/dto/page-tree-node-scope.ts

@@ -3,9 +3,8 @@ import { Field, InputType, ObjectType } from "@nestjs/graphql";
 import { IsString } from "class-validator";
 
 @Embeddable()
-@ObjectType("PageTreeNodeScope") // name must not be changed in the app
-@InputType("PageTreeNodeScopeInput") // name must not be changed in the app
-// @TODO: disguise @ObjectType("PageTreeContentScope") and @InputType("PageTreeContentScopeInput") decorators under a custom decorator: f.i. @PageTreeNodeScope
+@ObjectType("PageTreeNodeScope")
+@InputType("PageTreeNodeScopeInput")
 export class PageTreeNodeScope {
     @Property({ columnType: "text" })
     @Field()

dev-pm.config.ts

@@ -137,7 +137,7 @@ export default defineConfig({
         {
             name: "mail-react-storybook",
             script: "pnpm --filter @dextinity/mail-react run storybook",
-            group: ["mail-react"],
+            group: ["mail-react", "storybook", "docs"],
         },
 
         //group brevo
@@ -270,7 +270,7 @@ export default defineConfig({
             name: "storybook",
             script: "pnpm --filter dextinity-storybook run storybook",
             group: ["storybook", "docs"],
-            waitOn: ["tcp:26646", "tcp:26647"], // storybook-dextinity-admin, storybook-dextinity-cms-admin
+            waitOn: ["tcp:26646", "tcp:26647", "tcp:6066"], // storybook-dextinity-admin, storybook-dextinity-cms-admin, mail-react-storybook
         },
         {
             name: "docs",

docs/docs/2-core-concepts/2-blocks/4-factories.mdx

@@ -227,6 +227,31 @@ export const FullWidthImageBlock = createCompositeBlock({
 });
 ```
 
+## DamVideoBlock (Admin only)
+
+The DamVideoBlock factory creates a block for a video from the DAM.
+Use `supports` to restrict what editors can set besides the video file itself:
+
+- `"controls"`: The playback options autoplay, loop and show controls.
+- `"previewImage"`: The poster image shown before playback.
+
+Both are supported by default.
+`@dextinity/cms-admin` exports a ready-made `DamVideoBlock` created with those defaults, use the `createDamVideoBlock` factory to change them:
+
+```tsx title="DamVideoBlock.tsx"
+import { createDamVideoBlock } from "@dextinity/cms-admin";
+
+// For a site that renders no poster image
+export const DamVideoBlock = createDamVideoBlock({ supports: ["controls"] });
+```
+
+:::note
+
+Leaving out an option only hides it from the editor.
+Values that are already stored are kept as they are.
+The preview image in particular stays part of the block's data either way, since the API's child block is non-nullable.
+:::
+
 ## FinalFormBlock (Admin only)
 
 The FinalFormBlock factory can be used to convert a block's `AdminComponent` API to the Final Form `Field` API.