Skip to content

Bugfix/cmg 1109 1004 fixes - #1150

Merged
umesh-more-cstk merged 4 commits into
devfrom
bugfix/cmg-1109-1004-fixes
Aug 25, 2026
Merged

Bugfix/cmg 1109 1004 fixes#1150
umesh-more-cstk merged 4 commits into
devfrom
bugfix/cmg-1109-1004-fixes

Conversation

@chetan-contentstack

Copy link
Copy Markdown

🔗 Jira Ticket


📋 PR Type

  • ✨ Feature
  • 🐛 Bug Fix
  • 🔥 Hotfix
  • ♻️ Refactor
  • 🧹 Chore / Dependency Update
  • 📝 Documentation

📝 Description

What changed?

  • extractAssets.ts now also picks up images embedded in post content, not just formal wp:post_type=attachment items.
  • LoadFileFormat.tsx no longer overwrites the displayed file format when the selected CMS only has one valid format (e.g. Sitecore = Zip).

Why?

  • CMG-1109: content-embedded assets were migrating but never showed on Map Entry Assets — the screen only ever reflected formal attachment items.
  • CMG-1004: editing the file path after selecting Sitecore flipped the displayed format to match the new extension instead of staying locked to Zip.

🧩 Affected Areas

  • api — Node.js backend
  • ui — React frontend
  • upload-api — Upload API server
  • docker / docker-compose
  • CI / GitHub Actions workflows
  • Environment variables / config
  • Other:

🧪 How to Test

  1. Upload a WordPress export with images embedded in post content but no attachment items — confirm they now appear on Map Entry Assets.
  2. Select CMS = Sitecore, then edit the file path to end in .xml/.sql — File Format stays "Zip"; validation error shows instead.
  3. cd upload-api && npx vitest run — passing.

Expected result: content-embedded assets are visible for review pre-migration; Sitecore's file format label never changes regardless of what path is typed.


📸 Screenshots / Recordings

Before After

🔗 Related PRs / Dependencies

  • Same subsystem as #1143 (CMG-1108, merged) — no code dependency.

✅ Author Checklist

  • Branch follows naming convention: bugfix/cmg-1109-1004-fixes
  • Jira ticket linked above
  • Self-reviewed the diff
  • .env / example.env updated — N/A
  • No sensitive credentials or secrets committed
  • Existing tests pass locally (npx vitest run in upload-api/)
  • New tests written — not added; no existing test harness for LoadFileFormat.tsx, and extractAssets.ts verified manually against real extracted fixtures
  • README.md / docs updated — N/A
  • Talisman pre-push scan passes

👀 Reviewer Notes

  • extractAssets.ts's content-scan logic duplicates (and must stay in sync with) wordpress.service.ts's extractImageUrlsFromContent/saveAssetFromUrl — they live in separate services (upload-api vs api) with no shared package.
  • LoadFileFormat.tsx fix only changes behavior for CMS types with a single allowed format; stack-to-stack Contentstack (2 allowed formats) still follows the actual uploaded extension, unchanged.

chetan-contentstack added 2 commits August 24, 2026 16:09
…sets

extractAssets only read formal wp:post_type=attachment items, so images
embedded in post content (no attachment item backing them) never got a row
on the Map Entry Assets screen, even though the actual migration downloads
and creates them as real Contentstack assets via wordpress.service.ts's
content:encoded scan. Extends extraction to find those images too, matching
the id scheme the real migration uses so uids still resolve, and dedupes
against formal attachment items so an overlapping URL doesn't get two rows.
Editing the file path after selecting a CMS with a single fixed allowed
format (e.g. Sitecore, always Zip) re-derived the displayed "File Format"
from the new path's extension, showing e.g. "XML" instead of staying "Zip".
Only CMS types with more than one allowed format (currently just
stack-to-stack Contentstack) should have the label follow the actual
uploaded extension; everyone else keeps their fixed format, with the
existing validation effect flagging a real mismatch instead.
@snyk-io

snyk-io Bot commented Aug 24, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 15 378 25 ✅ Passed
🟡 Medium Severity 19 11 500 ✅ Passed
🔵 Low Severity 2 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 371 30 / 120 days ⚠️ Warning
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 378
  • Medium without fixes: 11
  • Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

@umesh-more-cstk umesh-more-cstk left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed at head 651d00f (both files, full diff). Traced the upload-api extractor against api/src/services/wordpress.service.ts (extractImageUrlsFromContent, saveAssetFromUrl, getAllAssets) and the mapper read/write path in api/src/services/contentMapper.service.ts, and the UI change against LoadSelectCms, LoadUploadFile, LegacyCms/index.tsx and ui/src/cmsData/legacyCms.json.

2 blockers, 2 questions, 2 nits.

Blockers (inline):

  • upload-api/migration-wordpress/libs/extractAssets.ts:88 — the content scan only covers <img> src/data-src/srcset, while the migration run also collects <a href> image links, <audio>/<source>, and inline + <style> background images. Those assets migrate but still get no Map Entry row, so the CMG-1108/1109 symptom remains reproducible for that markup.
  • ui/src/components/LegacyCms/Actions/LoadFileFormat.tsx:64 — "no allowed formats known yet" shares the lock-and-return branch with "exactly one format", so DEFAULT_CMS_TYPE (allowed_file_formats: [], the first-visit state for multi-version Sitecore before a version card is clicked) now shows File extension not found on a valid .zip instead of the extension-derived Zip.

Questions:

  • Inline on extractAssets.ts:206file_size: '' plus the un-normalized filename make every content-embedded asset compare as changed on iteration ≥2, pre-selecting isUpdate for untouched assets. Same shape as the existing attachment rows, so possibly a known gap — worth confirming.
  • question: how does this diff address the second half of CMG-1004 ("even after validation fails, the user can still proceed to the next step")? isError/errorMessage in LoadFileFormat.tsx are local state rendered into one div and read nowhere else, and the step-completion gate at ui/src/components/LegacyCms/index.tsx:214-217 keys off selectedFileFormat.title/fileformat_id, selectedCms.title, affix and uploadedFile.isValidated — never the format-vs-CMS mismatch. The blocking path today is LoadUploadFile.tsx:405-420 setting isValidated: false, which this diff doesn't touch. If the intent is that the forced selectedFileFormat keeps that path reachable, please spell it out in the description; if progression is still possible, that half of the ticket looks unfixed.

Nits:

  • Inline on extractAssets.ts:142?? '' vs the service's ||/undefined for baseSiteUrl produces rows the real run can't create when wp:base_site_url is absent.
  • nit: no tests added. extractAssets is pure and upload-api already runs vitest (tests/unit/migration-wordpress/); one fixture with an embedded <img> + srcset, plus an image that is also a formal attachment, would lock in the otherCmsAssetUid contract that the doc comments say must stay byte-identical to saveAssetFromUrl's customId — currently only guarded by comments.

Scope: diff matches the stated Affected Areas (ui, upload-api); no lockfile or generated churn. Verified as correct: the content-asset uid derivation (nameWithoutExt.replace(/-/g,'_').toLowerCase(), query string stripped) matches saveAssetFromUrl's customId and the uid-mapping.json key exactly; the cheerio import matches the sibling extractItems.ts in the same package; and the srcset-variant rows are legitimate, since the run downloads each variant URL separately.


Generated by Claude Code

Comment thread ui/src/components/LegacyCms/Actions/LoadFileFormat.tsx Outdated
Comment thread upload-api/migration-wordpress/libs/extractAssets.ts
Comment thread upload-api/migration-wordpress/libs/extractAssets.ts
Comment thread upload-api/migration-wordpress/libs/extractAssets.ts Outdated
- extractAssets.ts: cover a[href] image links, audio/source, and CSS
  background-image (inline + <style>), not just img src/data-src/srcset, so
  the same set of embedded assets the real migration finds also get a row.
  Also: skip relative URLs when wp:base_site_url is missing instead of
  emitting a row for an asset the run can't actually resolve.
- LoadFileFormat.tsx: lock the displayed format only when the CMS has
  exactly one allowed format. An empty allowed_file_formats (CMS not yet
  resolved, e.g. Sitecore before a version is picked) now correctly falls
  through to the extension-derived display instead of blanking the field.
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 15 378 25 ✅ Passed
🟡 Medium Severity 19 11 500 ✅ Passed
🔵 Low Severity 2 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 371 30 / 120 days ⚠️ Warning
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 378
  • Medium without fixes: 11
  • Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 15 378 25 ✅ Passed
🟡 Medium Severity 19 11 500 ✅ Passed
🔵 Low Severity 2 0 1000 ✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 371 30 / 120 days ⚠️ Warning
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 378
  • Medium without fixes: 11
  • Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

@umesh-more-cstk
umesh-more-cstk merged commit dc542c6 into dev Aug 25, 2026
10 checks passed
@umesh-more-cstk
umesh-more-cstk deleted the bugfix/cmg-1109-1004-fixes branch August 25, 2026 05:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants