V15 RC: Unpublished content can be reached through the cache service (and thus, through the Delivery API)

[kjac]

Which Umbraco version are you using? (Please write the exact version, example: 10.1.0)

V15 RC (latest)

Bug summary

If content has been published and is subsequently unpublished, it can still be retrieved in a somewhat published state using IDocumentCacheService.GetByKeyAsync().

For language variant content, only invariant properties seem to be loaded - hence "somewhat published" 😄

Ultimately this means we can expose unpublished content through the Delivery API, when requesting content by key.

Specifics

No response

Steps to reproduce

1. Create and save some content - do not publish it.
2. Request the content through the Delivery API by its key. This yields a 404, as it is unpublished.
3. Publish the content and request it once more. This yields the content as expected.
4. Unpublish the content and request it again. This yields (parts of) the content, where a 404 was expected.

You can also reproduce the issue by invoking this API controller:

using Microsoft.AspNetCore.Mvc;
using Umbraco.Cms.Core.Models.PublishedContent;
using Umbraco.Cms.Core.PublishedCache;

namespace Umbraco.Cms.Web.UI.Custom;

[ApiController]
public class CacheTesterController : Controller
{
    private readonly IDocumentCacheService _documentCacheService;

    public CacheTesterController(IDocumentCacheService documentCacheService)
        => _documentCacheService = documentCacheService;

    // GET /cache/test?key=[GUID]
    [Route("/cache/test")]
    public async Task<IActionResult> Test(Guid key)
    {
        IPublishedContent? content = await _documentCacheService.GetByKeyAsync(key, false);
        return Ok(content != null ? $"Got content # {content.Id}" : "Got no content");
    }
}

Expected result / actual result

No response

[nikolajlauridsen]

Fixed in #17413