[Spike] Publishing Queue: consolidated audit — current state, backend API, target UI mapping

[hmoreras]

Goal

Consolidated audit of the current Publishing Queue portlet that produces every input the FE implementation will need: feature parity matrix across the three Dojo tabs, backend API contract, target UI mapping to the new Angular design, and a backend hardening backlog.

Deliverables

Post the artifacts below as a comment on this issue, then back-link a one-line summary on epic #34734.

1. Feature parity matrix

Single table covering every feature currently shipped across all three Dojo tabs, with classification (Keep / Drop / Defer) and a short note explaining why. Group rows by the target Angular surface in the new design, so the FE task can be sized accurately:

• Queue tab — READY TO SEND column (currently Bundles tab): list unsent bundles, edit name/filter, delete bundle, delete asset from bundle, download .tgz, generate / regenerate, remote publish, per-row kebab actions
• Queue tab — IN PROGRESS column (currently Pending tab): list queued bundles, list assets per bundle, delete asset from queue, delete bundle from queue, status / retry chips, pagination
• History tab (currently Status / History tab): debounced search, pagination, bundle detail modal, retry bundles, bulk delete options (selected / all / success only / fail only), Sent / Failed chips
• Cross-tab top bar: single global search ("bundles, content, or environments"), Refresh, Upload Bundle
• Modals (new design): Asset list (Name / Type / State), Bundle details (metadata + endpoints-by-environment table), Configure & send (Push / Remove / Push+Remove + Send now / Schedule + env + filter), Upload bundle, Confirm-remove
• Legacy Dojo bits to drop: dijit.layout.TabContainer, dotcms.dojo.push.PushHandler, dojox.form.Uploader, the inline ng-event custom DOM bridge used to hand off "Generate / Download" to Angular

2. Backend API audit

Table covering every endpoint the portlet touches, with the columns below. Source code references included so reviewers can confirm.

| HTTP | Path | Class#method | Purpose | Auth gates | License | OpenAPI | Request | Response | Known gaps |

Coverage at minimum:

• GET /v1/publishing — list bundles with filter / status (com.dotcms.rest.api.v1.publishing.PublishingResource)
• GET /v1/publishing/{bundleId} — bundle detail
• POST /v1/publishing/retry — retry bundles
• POST /v1/publishing/push/{bundleId} — push to environments
• DELETE /v1/publishing/{bundleId} — delete bundle
• DELETE /v1/publishing/purge — bulk purge by status (async, WebSocket completion notification)
• POST /v1/bundles/assets, DELETE /v1/bundles/{bundleId}/assets — bundle asset management (com.dotcms.rest.api.v1.publishing.BundleManagementResource)
• GET /bundle/{bundleId}/assets — list assets in bundle (legacy)
• GET /bundle/getunsendbundles/{params:.*} — list unsent (legacy, regex path)
• GET /bundle/updatebundle/{params:.*} — update name/filter (legacy)
• GET /bundle/_download/{bundleId} — .tar.gz streaming download (legacy)
• POST /bundle/_generate — generate bundle (legacy)
• POST /bundle/sync, POST /bundle — bundle upload sync / async (legacy, requireLicense(true))
• DELETE /v1/publishqueue — delete queue elements
• GET /environment, POST /environment, PUT /environment/{id}, DELETE /environment/{id} — environments
• GET /v1/environments/endpoints, …
• GET /v1/pushpublish/filters, …

3. Target UI mapping — design walkthrough

For each screen in the new design (link below), produce a short annotated description that lists: route + component name + which store action drives it + which endpoint(s) it calls + edge cases (empty state, error, in-flight). Cover at minimum:

• Queue tab populated (READY TO SEND + IN PROGRESS two-column)
• Queue tab with empty READY TO SEND
• History tab populated
• Asset list modal
• Bundle details modal (metadata + endpoints-by-environment)
• Configure & send modal
• Per-row kebab on READY TO SEND
• Top bar (search + Refresh + Upload Bundle + site selector)

4. Security findings

If the API audit surfaces a license, role, or inter-server-auth gating gap, file a separate [Task] security issue immediately and link it here. Specific resources to validate: AuditPublishingResource (no OpenAPI, custom auth header), BundlePublisherResource (Community license check), legacy BundleResource listing helpers (mixed auth patterns).

5. Backend hardening backlog

For each gap below, file a separate [Task] issue and link it here:

• OpenAPI hardening for legacy resources missing @Operation: BundleResource, AuditPublishingResource, PublishQueueResource
• Consolidation of legacy BundleResource endpoints into the v1 publishing surface: getunsendbundles, updatebundle, _download, _generate, sync, {bundleId}/assets
• Sorting parameter for GET /v1/publishing (currently fixed order)
• Webhook / callback alternative for async purge + upload operations (currently WebSocket-only)

Inputs

• JSPs: dotCMS/src/main/webapp/html/portlet/ext/contentlet/publishing/view_publish_tool.jsp (shell), view_publish_audit_list.jsp, view_publish_queue_list.jsp, view_unpushed_bundles.jsp, view_publish_audit_detail.jsp, edit_publish_bundle.jsp
• Portlet registration: dotCMS/src/main/webapp/WEB-INF/portlet.xml (entry publishing-queue, lines ~212-225)
• PortletID enum: dotCMS/src/main/java/com/dotmarketing/util/PortletID.java (entry PUBLISHING_QUEUE)
• i18n keys: dotCMS/src/main/webapp/WEB-INF/messages/Language.properties (com.dotcms.repackage.javax.portlet.title.publishing-queue, publisher_Queue, publisher_Audit, publisher_Unpushed_Bundles)
• New design: https://claude.ai/design/p/52e62c08-322d-4a8e-9900-95e5668c4d74?file=Publishing+Queue+Redesign.html&via=share (internal — auth required)

Definition of Done

• Feature parity matrix, API audit table, target UI mapping, and backend hardening backlog posted as a comment on this issue
• Any discovered security gap filed as a separate issue and linked here
• Each backend hardening item filed as a separate [Task] issue and linked here
• Summary comment cross-posted on epic Dojo to Angular: Publishing Queue Portlet #34734

[hmoreras]

1 / 3 — Feature parity matrix

Every distinct UI feature in the legacy Dojo Publishing Queue portlet, classified against the new Angular design.

Legend

• Keep — feature exists in both surfaces (Dojo + new design); reimplement in Angular
• Drop — Dojo-only; intentionally removed by the new design
• Defer — Keep, but parked behind a follow-up because the feature requires a separate backend change or a non-trivial UX revision

Rows are grouped by the target Angular surface so the FE+BE task (#36040) can size the work.

Top bar (global, cross-tab)

Feature	Dojo source	New design surface	Class	Note
Tab container with 3 tabs (Pending / Status / Bundles)	view_publish_tool.jsp:365 (dijit.layout.TabContainer)	2 tabs (Queue / History) — PrimeNG p-tabView	Drop tabs, Keep concept	IA collapses Bundles + Pending into Queue's two columns
Per-tab search input	view_publish_tool.jsp:371 (audit) + queue + bundles	Single global top-bar search input	Keep, consolidated	Filter scope expands (see #36040 comment)
Refresh button (per tab)	view_publish_tool.jsp:385,405, view_unpushed_bundles.jsp:59	Single top-bar Refresh	Keep, consolidated	Refreshes the active tab
Upload Bundle button (per tab)	view_publish_tool.jsp:379,399, view_unpushed_bundles.jsp:56	Single top-bar Upload Bundle	Keep, consolidated	Same modal across tabs
Site selector	n/a (part of admin chrome)	Top bar — existing component	Keep	Reuse existing

Queue → READY TO SEND column (was: Bundles tab)

Feature	Dojo source	Class	Note
List unsent bundles for current user	view_unpushed_bundles.jsp:79-182 (BundleAPI.getUnsendBundles(userId))	Keep	Backend filter scope to confirm (own-bundles vs all-bundles)
Bundle name click → edit dialog	view_unpushed_bundles.jsp:82-96 (goToEditBundle)	Drop	Replaced by inline Configure & send modal (filter selection lives there)
Generated flag + filter display	view_unpushed_bundles.jsp:86-92	Defer	New design surfaces filter inside Configure & send; "already generated" indicator may move into Detail modal
Created-by name	view_unpushed_bundles.jsp:101-102	Drop	Not in new design
Dropdown menu (Delete / Download / Generate-Download / Remote-Publish)	view_unpushed_bundles.jsp:109-135 (dijit/DropDownButton)	Keep	Becomes p-menu kebab; action set is state-driven (see #36040 comment)
Primary Send button on a row	n/a (action was buried in dropdown)	NEW	Inline primary CTA on every ready row
Delete bundle confirm	view_unpushed_bundles.jsp:129 (native confirm())	Keep	Becomes Confirm-remove dialog
Generate / Regenerate / Download via ng-event bridge	view_publish_tool.jsp:190-197 (dispatchEvent('ng-event'))	Drop bridge, Keep behavior	Native Angular flow — no DOM event hand-off
Remote publish via PushHandler	view_publish_tool.jsp:199-204 (dotcms.dojo.push.PushHandler)	Drop widget, Keep behavior	Replaced by Configure & send modal
Asset list (first 20, lazy "view all")	view_unpushed_bundles.jsp:143-180,196-217 (addRow JS + fetch /api/bundle/<id>/assets)	Keep, moved	Now lives in the Asset list modal
Per-asset delete from bundle	view_unpushed_bundles.jsp:202 (deleteAsset)	Keep, moved	Trash icon inside the Asset list modal → DELETE /v1/bundles/{bundleId}/assets
Asset link → edit contentlet / language	view_unpushed_bundles.jsp:204-211	Defer	Nice-to-have; new design shows static name
Empty state ("Bundle is empty")	view_unpushed_bundles.jsp:249	Keep, reworded	"Your bundle's empty / Add content here…"
No Results table when user has no drafts	view_unpushed_bundles.jsp:186-191	Keep	Folder icon + reworded

Queue → IN PROGRESS column (was: Pending tab)

Feature	Dojo source	Class	Note
List queued bundles	view_publish_queue_list.jsp:228-346 (PublisherAPI.getQueueBundleIds)	Keep	Now sourced from GET /v1/publishing?status=… (replaces legacy queue query)
Per-bundle asset list (max 20) inline	view_publish_queue_list.jsp:274-286	Drop inline, Keep behind modal	Asset list moves into the Asset list modal
Force-push flag display	view_publish_queue_list.jsp:260	Defer	New design folds this into the operation icon / Configure & send modal
Bundle publish date display (red if past)	view_publish_queue_list.jsp:243-246	Keep	Surface as Scheduled <date> chip
Bundle ID display	view_publish_queue_list.jsp:258	Defer	Bundle ID is in the Detail modal; row shows the bundle name
Per-asset checkbox + bulk select	view_publish_queue_list.jsp:296-302 (.queue_to_delete)	Drop per-asset; Keep per-bundle	New design selects whole bundles only
Asset link → edit contentlet	view_publish_queue_list.jsp:294-344	Defer	Same as above
Delete asset from queue	view_publish_queue_list.jsp:296-302 + view_publish_tool.jsp:402-403 (deleteQueue → JSP delete=<asset_id>$<op>,…)	Defer	Backend PublisherAPI.deleteElementFromPublishQueueTableAndAuditStatus still callable; surface via the Asset list modal
Delete bundle from queue	view_publish_tool.jsp:402-403 (deleteBundle)	Keep	Now Remove from queue in kebab → DELETE /v1/publishing/{bundleId}
Pagination (prev/next + "N-M of Total")	view_publish_queue_list.jsp:355-363 (JSP offset / limit)	Keep	PrimeNG p-paginator — per-column page state, shared page size 10/20/50
Refresh button	view_publish_tool.jsp:405-406 (doQueueFilter)	Keep, top bar	See top bar
Empty state ("No Results")	view_publish_queue_list.jsp:181-192	Keep, reworded	"Nothing in progress"
Status chip (Scheduled / Sending / Failed)	n/a (status only on audit tab)	NEW	Per-row chip in IN PROGRESS
Per-row Retry action (failed bundles)	n/a (was only on audit tab)	NEW	Inline red Retry text button
Transient "Completed" chip (10s lifecycle)	n/a	NEW	Bundle stays 10s before auto-moving to History with toast

History tab (was: Status / History tab)

Feature	Dojo source	Class	Note
Audit list (sent + failed bundles)	view_publish_audit_list.jsp:283-388 (PublishAuditAPI.getPublishAuditStatus)	Keep	Sourced from GET /v1/publishing?status=…
Search filter (debounced 250ms)	view_publish_tool.jsp:371 + debouncedAuditFilter	Keep, moved	Global top-bar search
Clear-filter button	view_publish_tool.jsp:372	Keep	Clear icon inside the search input
Master checkbox + per-row checkbox	view_publish_audit_list.jsp:286-291,346-351	Keep	Becomes bulk select for History bulk actions
Bundle ID (truncated 24 chars)	view_publish_audit_list.jsp:354-355	Drop inline	Bundle ID lives in the Detail modal; row uses bundle name
Bundle filter name display	view_publish_audit_list.jsp:358-359	Defer	Filter is in the Detail modal
Asset preview (first 3 + "view all")	view_publish_audit_list.jsp:364-371,485-498 (requestAssets)	Drop inline, Keep behind Asset list modal	Row click → Asset list modal
Status display (PENDING / SUCCESS / FAILED_*)	view_publish_audit_list.jsp:380	Keep	Becomes Sent / Failed chip; one entry per row
Bundle entered timestamp	view_publish_audit_list.jsp:382	Defer	Surfaced in Detail modal as Bundle start
Bundle last-updated (relative time)	view_publish_audit_list.jsp:384 (prettyDateSince)	Keep	Row meta — "Yesterday", "2 days ago"
Row click → Detail modal	view_publish_audit_list.jsp:354,358,364,369,374 (showDetail → dijit.Dialog)	Keep	Row click → Asset list modal; kebab View Details → Bundle details modal
Retry selected bundles	view_publish_tool.jsp:376-377 (DotAjaxDirector /retry)	Keep	Bulk Retry Send (selection bar) + per-row Retry (failed) → POST /v1/publishing/retry
Retry options (force-push + delivery strategy)	view_publish_audit_detail.jsp:109-121	Defer	Configure & send modal carries these settings; retry uses last-known op
Bulk delete selected	view_publish_tool.jsp:382-384 → DELETE /api/bundle/ids	Keep	Bulk Remove (selection bar)
Delete-all dialog with 4 options (selected / all / success / fail)	view_publish_tool.jsp:446-472	Drop dialog, Defer purge	Bulk select + remove replaces the dialog; mass purge by status still exists as DELETE /v1/publishing/purge but isn't surfaced in UI
Pagination (prev/next + "N-M of Total")	view_publish_audit_list.jsp:394-402	Keep	Same paginator as Queue tab
"Deleted N" toast	view_publish_audit_list.jsp:263-265 (showDotCMSSystemMessage)	Keep, restyled	DotMessageDisplayService — "Removed N bundles"
Empty state ("No Results")	view_publish_audit_list.jsp:409-421	Keep, reworded	"No bundles have been sent yet."
Sortable Bundle / Status columns	n/a (no sort in Dojo)	NEW	Three-state sort (asc → desc → off) per column

Modals

Modal	Dojo source	Class	Note
Asset list	view_publish_audit_list.jsp:364-371 (inline preview), view_unpushed_bundles.jsp:143-180 (inline table), view_publish_audit_detail.jsp:120-131 (asset titles)	Keep, unified	Single Asset list modal (Name / Type / State + per-row delete + failed-env banner) for both Queue and History rows
Bundle details	view_publish_audit_detail.jsp:1-241 (dijit.Dialog + ContentPane)	Keep, redesigned	9-field definition list + endpoints-by-environment table + split-button Download
Edit bundle (name)	edit_publish_bundle.jsp:92-134 (dijit.form.ValidationTextBox)	Drop	Bundle name editing folded into Configure & send modal (filter selector includes the bundle's filter)
Upload bundle	view_publish_tool.jsp:420-443 (dojox.form.Uploader)	Keep, redesigned	PrimeNG p-fileUpload (.tar.gz); same endpoint POST /bundle/sync
Delete bundles options (4-way)	view_publish_tool.jsp:446-472	Drop	Replaced by per-row + bulk selection + confirm-remove
Confirm-remove	n/a (was inline confirm() + custom 4-way dialog)	NEW	PrimeNG p-dialog 500px, title Remove bundle? / Remove N bundles?
Push publish (env / endpoint selector)	PushHandler (Dojo widget)	Drop widget, Keep redesigned	Configure & send modal (action cards + Send-now/Schedule + searchable env dropdown + filter dropdown + auto-retry hint)
Retry options (force-push + delivery strategy)	view_publish_audit_detail.jsp:109-121	Defer	Folded into Configure & send modal; auto-retry mention added

Dojo plumbing to drop

Piece	Location	Replacement
dijit.layout.TabContainer	view_publish_tool.jsp:365	PrimeNG p-tabView
dijit.layout.ContentPane	view_publish_tool.jsp:367,393,413 (lazy JSP loading)	Angular lazy-loaded library + signals
dojox.layout.ContentPane	view_publish_tool.jsp:77,96,119,137,155,169 (refresh logic)	Store-driven re-fetch on event
dojox.form.Uploader	view_publish_tool.jsp:428	PrimeNG p-fileUpload
dotcms.dojo.push.PushHandler	view_publish_tool.jsp:199-204	Configure & send dialog (new component)
dijit/DropDownButton + dijit/Menu + dijit/MenuItem	view_unpushed_bundles.jsp:109-135	PrimeNG p-menu (kebab)
dijit.Dialog (audit detail, upload, delete options, edit bundle)	view_publish_tool.jsp:165,420,446, edit_publish_bundle.jsp:1	PrimeNG p-dialog
dijit.form.CheckBox	view_publish_queue_list.jsp:232-238,296-302, view_publish_audit_list.jsp:286-291,346-351	PrimeNG p-checkbox inside p-table
dijit.form.ValidationTextBox	edit_publish_bundle.jsp:118	Native + Angular Validators (only if edit-bundle modal returns)
dijit.form.Select (delivery strategy)	view_publish_audit_detail.jsp:112	PrimeNG p-select inside the All-endpoints filter
dijit.Tooltip	view_publish_queue_list.jsp:119, view_publish_audit_list.jsp:100	PrimeNG p-tooltip (directive)
dotcms.dojo.data.RoleReadStore	edit_publish_bundle.jsp:19	n/a (edit dialog dropped)
dojo.xhr* (xhrGet, xhrPost, xhrDelete)	view_publish_audit_list.jsp:157,253, edit_publish_bundle.jsp:52	Angular HttpClient via data-access service
DotAjaxDirector /retry and /uploadBundle legacy actions	view_publish_tool.jsp:376, view_publish_audit_list.jsp:253	POST /v1/publishing/retry + POST /bundle/sync
ng-event custom DOM bridge	view_publish_tool.jsp:190-197	Native Angular call (no DOM event)
Inline <script> blocks (13+ in view_publish_tool.jsp + sibling JSPs)	every JSP	Migrated to TypeScript modules in dot-publishing-queue lib

[hmoreras]

2 / 3 — Backend API audit

Every REST endpoint the Publishing Queue portlet touches today, with the contract details the FE needs.

Conventions

• Auth — RB = requiredBackendUser(true) + rejectWhenNoUser(true) (the baseline applied to every endpoint below unless noted)
• Portlet gate — requiredPortlet("publishing-queue") denies access when the calling user can't see the portlet
• Admin/config — endpoint also runs an isAdmin || hasPortletAccess("configuration") check inside the method body
• OpenAPI ✅ — @Operation annotation present + class appears in dotCMS/src/main/webapp/WEB-INF/openapi/openapi.yaml
• OpenAPI ⚠️ — present in spec but missing schema / response annotations
• OpenAPI ❌ — not in spec

com.dotcms.rest.api.v1.publishing.PublishingResource — /v1/publishing (modern)

HTTP	Path	Method (line)	Purpose	Auth	License	OpenAPI	Request	Response	Known gaps
GET	/v1/publishing	listPublishingJobs (PublishingResource:187)	Unified list (audit + queue) with paging & filter	RB	none	✅	Query: page (default 1), per_page (1–500, default 50), filter (case-insensitive partial — bundle_id + bundle_name ONLY), status (comma-sep enum)	ResponseEntityPublishingJobsView → { entity: PublishingJobView[], pagination: { currentPage, perPage, totalEntries } }	No sort param. Filter doesn't reach item / env / endpoint names. No publishing-queue portlet gate.
GET	/v1/publishing/{bundleId}	getPublishingJobDetails (PublishingResource:331)	Bundle detail + per-endpoint breakdown	RB	none	✅	Path validated alphanumeric+-+_	ResponseEntityPublishingJobDetailView → { bundleId, status, created, modified, environments[], endpoints[]{ status, error } }	publish_start / publish_end not exposed (Bundle has publishDate / expireDate). No bundle_start / bundle_end either.
POST	/v1/publishing/retry	retryBundles (PublishingResource:551)	Retry one or many bundles	RB	none	✅	Body RetryBundlesForm → { bundleIds: string[], forcePush?: boolean=false, deliveryStrategy?: "ALL_ENDPOINTS"|"FAILED_ENDPOINTS"=ALL_ENDPOINTS }	ResponseEntityRetryBundlesView → RetryBundleResultView[] { bundleId, success, message, forcePush?, operation?, deliveryStrategy, assetCount? }	Bulk ✅. Per-bundle result rows ✅.
POST	/v1/publishing/push/{bundleId}	pushBundle (PublishingResource:703)	Push to envs with optional schedule	RB	none	✅	Body PushBundleForm → { operation: "publish"|"expire"|"publishexpire" (case-insens.), publishDate?: ISO8601 +offset, expireDate?: ISO8601 +offset, environments: string[], filterKey: string }	ResponseEntityPushBundleResultView → { bundleId, operation, publishDate, expireDate, environments[], filterKey }	Operation naming mismatch with the design — design says push / remove / pushremove, BE says publish / expire / publishexpire. FE must map. forcePush derived from filter — not in the form.
DELETE	/v1/publishing/{bundleId}	deletePublishingJob (PublishingResource:437)	Delete a single bundle	RB	none	✅	Path: bundleId	{ message: "Bundle deleted successfully" }	409 on in-progress states (BUNDLING / SENDING_TO_ENDPOINTS / PUBLISHING_BUNDLE). No bulk variant. No publishing-queue portlet gate.
DELETE	/v1/publishing/purge	purgePublishingJobs (PublishingResource:894)	Bulk purge by status (async, WebSocket completion)	RB	none	✅	Query: status (comma-sep). Default safe set when omitted	ResponseEntityPurgeView → { message, statusesRequested[] }	Async via thread pool + WebSocket — non-browser clients have no callback. Cannot purge in-progress statuses.

com.dotcms.rest.api.v1.publishing.BundleManagementResource — /v1/bundles

HTTP	Path	Method (line)	Purpose	Auth	License	OpenAPI	Request	Response	Known gaps
POST	/v1/bundles/assets	addAssetsToBundle (BundleManagementResource:177)	Add assets to bundle (auto-create / lookup)	RB	none	✅	Body AddAssetsToBundleForm → { bundleId?, bundleName? (required for create), assetIds: string[] }	ResponseEntityAddAssetsToBundleView → { bundleId, bundleName, created: boolean, total: int, errors: string[] }	Fallthrough: bundleId → unsent bundleName lookup → auto-create. Duplicates silently skipped. Per-asset errors returned in errors[] with 200 OK.
DELETE	/v1/bundles/{bundleId}/assets	removeAssetsFromBundle (BundleManagementResource:379)	Remove assets from unpushed bundle	RB	none	✅	Path bundleId; Body RemoveAssetsFromBundleForm → { assetIds: string[] }	ResponseEntityRemoveAssetsFromBundleView → RemoveAssetResultView[] { assetId, success, message }	409 if bundle is in-progress. Per-asset result (not atomic).

com.dotcms.rest.PublishQueueResource — /v1/publishqueue

HTTP	Path	Method (line)	Purpose	Auth	License	OpenAPI	Request	Response	Known gaps
DELETE	/v1/publishqueue	deleteAssetsByIdentifiers (PublishQueueResource:40)	Delete elements from publishing queue by identifier	RB + requiredPortlet("publishing-queue")	none	⚠️	Body DeletePPQueueElementsByIdentifierForm → { identifiers: string[] }	ResponseEntityView<String> → "Requested elements were removed from the Push-Publish Queue"	Form has no Swagger @Schema annotation; missing @Operation content.

com.dotcms.rest.BundleResource — /bundle (legacy)

HTTP	Path	Method (line)	Purpose	Auth	License	OpenAPI	Request	Response	Known gaps
GET	/bundle/{bundleId}/assets	getPublishQueueElements (BundleResource:120)	List assets in a queue or audit bundle	RB	none	✅	Path bundleId; Query limit (default unlimited)	List<Map<String,Object>> ad-hoc	Dual lookup (queue first, then audit). Ad-hoc map response.
GET	/bundle/getunsendbundles/{params:.*}	getUnsendBundles (BundleResource:184)	List unsent bundles by user/name (legacy regex path)	RB	none	✅	Path matrix params: userid; Query name (wildcard * ⇒ null), start, count	JSONArray → { identifier, label, items[], numRows }	Legacy matrix params + JSONObject envelope.
GET	/bundle/updatebundle/{params:.*}	updateBundle (BundleResource:257)	Update bundle name	RB	none	❌	Path matrix params: bundleid; Query bundleName	{ response: "true"|"false" }	GET with side effect. Not RESTful. Missing OpenAPI.
DELETE	/bundle/ids	deleteBundlesByIdentifiers (BundleResource:369)	Bulk delete bundles by IDs (async via socket)	RB + requiredPortlet("publishing-queue")	none	✅	Body DeleteBundlesByIdentifierForm → { identifiers: string[] }	"Removing bundles in separated process..."	Async via thread pool + WebSocket; no client polling.
DELETE	/bundle/olderthan/{olderThan}	deleteBundlesOlderThan (BundleResource:550)	Delete bundles older than date (async)	RB	none	✅	Path olderThan (ISODateParam, must be in the past)	"Removing bundles in separated process..."	Same async pattern.
DELETE	/bundle/all	deleteAll (BundleResource:604)	Delete all bundles (config-driven statuses, async)	RB	none	✅	none	"Removing bundles in separated process..."	Statuses driven by config bundle.delete.all.statuses.
DELETE	/bundle/all/fail	deleteAllFail (BundleResource:651)	Delete all failed bundles	RB	none	✅	none	"Removing bundles in separated process..."	Statuses: FAILED_TO_* family.
DELETE	/bundle/all/success	deleteAllSuccess (BundleResource:711)	Delete all successful bundles	RB	none	✅	none	"Removing bundles in separated process..."	Statuses: SUCCESS, SUCCESS_WITH_WARNINGS.
GET	/bundle/_download/{bundleId}	downloadBundle (BundleResource:754)	Download .tar.gz archive	RB + requiredPortlet("publishing-queue")	none	✅	Path bundleId	Streaming application/x-tgz + Content-Disposition: attachment	File must already exist on disk. No bulk variant.
POST	/bundle/_generate	generateBundle (BundleResource:795)	Generate archive (async, streaming)	RB + requiredPortlet("publishing-queue")	none	✅	Body GenerateBundleForm → { bundleId, filterKey, operation }	Async tar.gz stream + system message	Async via thread pool.
POST	/bundle/sync	uploadBundleSync (BundleResource:892)	Upload bundle synchronously	RB	requireLicense(true)	✅	Multipart .tar.gz	{ bundleName, status: PublishAuditStatus.Status.name() }	Licensed. Blocks request until processed.
POST	/bundle	uploadBundleAsync (BundleResource:951)	Upload bundle asynchronously	RB	requireLicense(true)	✅	Multipart .tar.gz	{ bundleName, status } + system message	Licensed. Async via thread pool.
GET	/bundle/{bundleId}/manifest	downloadManifest (BundleResource:1024)	Download bundle manifest (CSV)	RB	none	✅	Path bundleId	application/octet-stream (CSV)	Extracted from the on-disk tar.gz.

com.dotcms.rest.EnvironmentResource — /environment

HTTP	Path	Method (line)	Purpose	Auth	License	OpenAPI	Request	Response	Known gaps
GET	/environment	loadAllEnvironments (EnvironmentResource:82)	List environments (admin sees all; others filtered by role)	RB	none	✅	none	ResponseEntityEnvironmentsView → Set<Environment>	Role-based filtering.
GET	/environment/loadenvironments/{roleid}	loadEnvironments (EnvironmentResource:128)	List environments by role (legacy regex path)	RB	none	✅	Path matrix params: roleid	JSONArray → [{}, { id, name }, …] (first item is empty placeholder)	Legacy JSONObject envelope.
POST	/environment	create (EnvironmentResource:226)	Create environment	RB + admin/configuration	none	✅	Body EnvironmentForm → { name, whoCanSend[], pushMode }	ResponseEntityEnvironmentView → Environment	Permission mapping from roles.
PUT	/environment/{id}	update (EnvironmentResource:311)	Update environment	RB + admin/configuration	none	✅	Path id; Body EnvironmentForm	ResponseEntityEnvironmentView	Name uniqueness check. Session env updated if user had it selected.
DELETE	/environment/{id}	delete (EnvironmentResource:439)	Delete environment	RB + admin/configuration	none	✅	Path id	ResponseEntityBooleanView → true	—

com.dotcms.rest.EndpointResource — /v1/environments/endpoints

HTTP	Path	Method (line)	Purpose	Auth	License	OpenAPI	Request	Response	Known gaps
GET	/v1/environments/endpoints	getEndpoints (EndpointResource:81)	List all endpoints	RB	none	✅	none	ResponseEntityEndpointsView → List<PublishingEndPoint>	No filtering.
GET	/v1/environments/endpoints/environment/{environmentId}	getEndpointsByEnvironmentId (EndpointResource:119)	Endpoints in an environment	RB	none	✅	Path environmentId	ResponseEntityEndpointsView	—
GET	/v1/environments/endpoints/{endpointId}	getEndpoint (EndpointResource:155)	Single endpoint	RB	none	✅	Path endpointId	ResponseEntityEndpointView	404 if not found.
POST	/v1/environments/endpoints	create (EndpointResource:208)	Create endpoint	RB + admin/configuration	none	✅	Body EndpointForm → { name, protocol, address, port, authorizationToken (encrypted), enabled, sending, environmentId }	ResponseEntityEndpointView	Token encrypted via PublicEncryptionFactory.encryptString. Verify response omits plain token.
PUT	/v1/environments/endpoints/{id}	update (EndpointResource:295)	Update endpoint	RB + admin/configuration	none	✅	Path id; Body EndpointForm	ResponseEntityEndpointView	Name uniqueness (except self).
DELETE	/v1/environments/endpoints/{id}	delete (EndpointResource:413)	Delete endpoint	RB + admin/configuration	none	✅	Path id	ResponseEntityBooleanView → true	404 if not found.

com.dotcms.rest.api.v1.pushpublish.PushPublishFilterResource — /v1/pushpublish/filters

HTTP	Path	Method (line)	Purpose	Auth	License	OpenAPI	Request	Response	Known gaps
GET	/v1/pushpublish/filters	getFilters (PushPublishFilterResource:84)	List push publish filters (role-filtered)	RB	none	⚠️	none	ResponseEntityView<List<FilterDescriptor>>	Role-based filter visible to non-admins. Missing @Operation.
GET	/v1/pushpublish/filters/{filterKey}	getFilter (PushPublishFilterResource:120)	Single filter (role check)	RB	none	⚠️	Path filterKey	ResponseEntityView<FilterDescriptor>	404 if not visible to caller.
POST	/v1/pushpublish/filters (JSON)	saveFromForm (PushPublishFilterResource:193)	Create filter from bean	RB + Role.CMS_ADMINISTRATOR_ROLE	none	⚠️	Body FilterDescriptorForm → { key, title, defaultFilter, roles, filters: { excludeQuery, excludeClasses[], dependencies, excludeDependencyQuery, excludeDependencyClasses[], forcePush, relationships } }	ResponseEntityView<List<String>> (filter names)	Duplicate key check.
POST	/v1/pushpublish/filters (multipart)	saveFromFile (PushPublishFilterResource:246)	Create filter from YML	RB + admin	none	⚠️	Multipart YML	ResponseEntityView<List<String>>	—
PUT	/v1/pushpublish/filters (JSON)	updateFromForm	Update filter from bean	RB + admin	none	⚠️	Body FilterDescriptorForm	ResponseEntityView<List<String>>	—
PUT	/v1/pushpublish/filters (multipart)	updateFromFile	Update filter from YML	RB + admin	none	⚠️	Multipart YML	ResponseEntityView<List<String>>	—
DELETE	/v1/pushpublish/filters/{filterKey}	deleteFilter	Delete filter	RB + admin	none	⚠️	Path filterKey	ResponseEntityView	—

Cross-resource issues

• Duplicate / overlapping paths — /v1/publishing/purge (modern) duplicates legacy /bundle/all, /bundle/all/fail, /bundle/all/success. /v1/bundles/assets adds; legacy /bundle/{bundleId}/assets lists. Spike recommends migrating the FE to the v1 surface and deprecating the legacy ones (see Hardening Backlog below).
• Inconsistent error envelopes — v1 endpoints use ResponseEntityView<T> + structured @ApiResponse. Legacy BundleResource returns plain strings or ad-hoc JSON. PublishQueueResource returns bare ResponseEntityView<String> with no schema.
• Async ops have no non-browser callback — /v1/publishing/purge, /bundle/ids, /bundle/olderthan/*, /bundle/all*, /bundle (async upload), /bundle/_generate all return immediately and notify only via WebSocket. The Angular store can listen, but BFF/API clients can't.
• Portlet-gate inconsistency — BundleResource destructive ops (/bundle/_download, /bundle/_generate, /bundle/ids) and PublishQueueResource require requiredPortlet("publishing-queue"). The new PublishingResource destructive ops (DELETE /v1/publishing/{bundleId}, DELETE /v1/publishing/purge) do not. A non-portlet backend user can delete bundles via v1 but not via legacy. Filed as security task (see Security Findings).
• Naming mismatch — design uses push / remove / pushremove; backend PushBundleForm.operation is publish / expire / publishexpire. FE has to maintain a mapping; backend could rename or expose both for clarity (low urgency).

Endpoint capability map (for the FE store)

Capability	Endpoint(s) used
List Ready-to-Send	GET /v1/publishing?status=WAITING_FOR_PUBLISHING,BUNDLE_REQUESTED (or) GET /bundle/getunsendbundles/{params:.*} for owner-filtered legacy
List In Progress	GET /v1/publishing?status=BUNDLING,SENDING_TO_ENDPOINTS,PUBLISHING_BUNDLE,RECEIVED_BUNDLE,SUCCESS_WITH_WARNINGS&…
List History	GET /v1/publishing?status=SUCCESS,FAILED_TO_*&…
Bundle details	GET /v1/publishing/{bundleId}
Asset list per bundle	GET /bundle/{bundleId}/assets (legacy — replace candidate)
Push bundle (Configure & send)	POST /v1/publishing/push/{bundleId}
Retry (per-row + bulk)	POST /v1/publishing/retry
Remove from queue / history (single)	DELETE /v1/publishing/{bundleId}
Remove from queue / history (bulk)	Per-id loop (or) file new bulk endpoint
Delete asset from bundle	DELETE /v1/bundles/{bundleId}/assets
Upload bundle	POST /bundle/sync (licensed)
Download single bundle	GET /bundle/_download/{bundleId}
Download manifest	GET /bundle/{bundleId}/manifest
Generate bundle (Generate / download kebab)	POST /bundle/_generate
List environments	GET /environment
Endpoints by environment	GET /v1/environments/endpoints/environment/{environmentId}
Push publish filters	GET /v1/pushpublish/filters

[hmoreras]

3 / 3 — Target UI mapping + Security findings + Hardening backlog

Target UI mapping

Each design surface annotated with: route, component, store action, endpoint(s) hit, and edge cases. All components live in the new Nx library core-web/libs/portlets/dot-publishing-queue/. Implementation must follow core-web/libs/portlets/CLAUDE.md and the frontend standards docs (see #36040 comment for the full link list).

1. Top bar (always visible)

• Route: apps/dotcms-ui/.../publishing-queue (lazy-loads dotPublishingQueueRoutes)
• Component: DotPublishingQueueShellComponent
• Store action: store.setSearch(query) (debounced 250ms), store.refresh()
• Endpoints: triggers the active tab's list call (GET /v1/publishing?...)
• Edge cases:
  • Empty search input — keep Refresh + Upload Bundle actions visible
  • In selection mode (store.selection().length > 0) — swap right side to the bulk-actions strip (Remove / Download / Configure & send (N) / Retry Send)
  • License-gated user opening the portlet — surface a static "Publishing Queue requires a Standard+ license" view (see Security findings below)

2. Queue tab — populated

• Route: publishing-queue (default) or publishing-queue/queue if we deep-link tabs
• Component: DotPublishingQueueQueuePageComponent → renders two DotPublishingQueueListComponent instances inside a p-splitter
• Store action: store.loadQueue() on init; auto-refresh on the polling tick (interval TBD by spike output test rwqrwqrwqr wq #6 — see open questions)
• Endpoints:
  • Left column (READY TO SEND): GET /v1/publishing?status=WAITING_FOR_PUBLISHING,BUNDLE_REQUESTED&per_page=10&page=N (or a thin facade if we keep owner-filtering on legacy /bundle/getunsendbundles)
  • Right column (IN PROGRESS): GET /v1/publishing?status=BUNDLING,SENDING_TO_ENDPOINTS,PUBLISHING_BUNDLE,RECEIVED_BUNDLE,SUCCESS_WITH_WARNINGS,FAILED_TO_*&per_page=10&page=N
  • Asset count per row may need a follow-up GET /bundle/{bundleId}/assets if the v1 list response doesn't include item counts (verify in the spike's implementation pass)
• Edge cases:
  • Splitter persists pref to localStorage key dot-publishing-queue/split-pct
  • Loading — PrimeNG p-table loading flag
  • Error — DotHttpErrorManagerService.handle(error) + revert state to loaded
  • Three-state sort cycle on Bundle / Status columns (active column highlighted; second click flips dir; third clears)

3. Queue tab — empty READY TO SEND

• Component: DotPublishingQueueListComponent with empty-state slot
• Store derivation: readyEmpty = computed(() => readyRows().length === 0 && !searchActive())
• Endpoints: same as populated (no extra calls)
• Edge cases:
  • Microcopy: "Your bundle's empty / Add content here and it'll be ready to send to your environments." with folder icon
  • When search active and zero matches, render the search-no-results variant (folder icon only) — distinct from genuine empty

4. History tab — populated

• Route: publishing-queue/history (if routed) or driven by store.activeTab()
• Component: DotPublishingQueueHistoryPageComponent with a single p-table
• Store action: store.loadHistory() on tab activate; pagination via store.setHistoryPage(n)
• Endpoints: GET /v1/publishing?status=SUCCESS,SUCCESS_WITH_WARNINGS,FAILED_TO_*&per_page=N&page=M&filter=<search>
• Edge cases:
  • Sent (green) / Failed (red) chip per row
  • Empty: "No bundles have been sent yet." (no icon)
  • Selection-mode chrome adds Retry Send (bulk → POST /v1/publishing/retry with the selected ids)
  • Three-state sort cycle on Bundle / Status

5. Asset list modal

• Component: DotPublishingQueueAssetListDialogComponent (PrimeNG p-dialog, ~700px, closable: true, closeOnEscape: true)
• Store action: store.openAssetList(bundleId) (loads on demand)
• Endpoints: GET /bundle/{bundleId}/assets?limit=-1 (legacy — spike's hardening backlog covers v1 replacement); DELETE /v1/bundles/{bundleId}/assets for per-row trash
• Edge cases:
  • Failed-env banner (p-message severity="error") when any env on the bundle has status = failed — shows env names, first error, auto-retried N/3, and a Retry send CTA that closes this dialog and opens Configure & send pre-populated
  • Empty: "No items left in this bundle."
  • Trash-icon delete on an in-progress bundle is blocked (server returns 409); store surfaces a toast

6. Bundle details modal

• Component: DotPublishingQueueDetailsDialogComponent (PrimeNG p-dialog, ~700px, closable: true, closeOnEscape: true)
• Store action: store.openBundleDetails(bundleId)
• Endpoints: GET /v1/publishing/{bundleId}; download split-button → GET /bundle/_download/{bundleId} and GET /bundle/{bundleId}/manifest
• Edge cases:
  • "All Endpoints" filter at the top narrows the endpoint table to a single env
  • 9-field definition list — surface "—" for missing dates (publish_start / publish_end may not be returned today; see hardening backlog)
  • Endpoint table groups by env with Push-To-All: true|false header row
  • Download split-button: p-splitButton with primary Download + dropdown item Manifest
  • Footer Accept closes the dialog
  • For bundles that never shipped: render This bundle has not been sent to any environment yet.

7. Configure & send modal

• Component: DotPublishingQueueConfigureSendDialogComponent (PrimeNG p-dialog, ~700px, closable: true, closeOnEscape: true)
• Store action: store.openConfigureSend(bundle) then store.submitConfigureSend(form)
• Endpoints: POST /v1/publishing/push/{bundleId}; env list from cached GET /environment; filter list from GET /v1/pushpublish/filters
• Edge cases:
  • Three action cards (Push / Remove / Push+Remove). FE must map to backend operation field: push → publish, remove → expire, pushremove → publishexpire
  • Send now / Schedule segmented control — schedule picker uses PrimeNG p-calendar with date+time
  • Timezone hint line: <TZ name> · Change (Change deep-links to user prefs)
  • Set expire date toggle for op = push (extra date input)
  • op = pushremove always shows the Expire / remove date input
  • Env dropdown is searchable; each option shows N endpoints · <first endpoint>; footer has Edit environments deep link
  • Inline validation: Select at least one environment. (red hint)
  • Filter dropdown hidden entirely when op = remove
  • CTA Accept (single neutral label across all ops); button disabled when no env selected
  • Microcopy: When to publish ↔ When to remove, Send now ↔ Remove now, Publish date ↔ Remove date

8. Per-row kebab on READY TO SEND

• Component: DotPublishingQueueRowKebabComponent (PrimeNG p-menu triggered by more_v icon)
• Store action: emits an action event the page resolves via store.dispatchRowAction(action, bundle)
• Endpoints:
  • Configure & send → opens dialog (above)
  • Generate / download → POST /bundle/_generate followed by GET /bundle/_download/{bundleId} once the system message confirms
  • Remove from queue → confirm dialog → DELETE /v1/publishing/{bundleId}
• Edge cases:
  • Kebab items are state-driven (see [Task] Publishing Queue: Angular implementation + backend wiring #36040 comment for the full state × action matrix). For ready, items are: Configure & send · Generate / download · — · Remove from queue (danger)
  • Kebab dropdown closes on outside click / Escape
  • Danger item has red text

Security findings

The API audit surfaced one inconsistency to file as a separate [Task] issue:

Portlet-gate inconsistency between v1 and legacy destructive ops. PublishingResource.deletePublishingJob (DELETE /v1/publishing/{bundleId} at PublishingResource:437) and PublishingResource.purgePublishingJobs (DELETE /v1/publishing/purge at PublishingResource:894) require requiredBackendUser(true) but do not require requiredPortlet("publishing-queue"). Equivalent legacy ops (DELETE /bundle/ids at BundleResource:369; DELETE /v1/publishqueue at PublishQueueResource:40) and download/generate ops (/bundle/_download/{bundleId}, /bundle/_generate) do require the portlet. A back-end user without portlet access can therefore delete bundles via the v1 endpoints even though the UI is hidden from them.

No other gating, license, or inter-server-auth gaps surfaced. AuditPublishingResource and BundlePublisherResource use the inter-server AuthCredentialPushPublishUtil correctly. Bundle uploads (/bundle/sync and /bundle) correctly enforce requireLicense(true). EnvironmentResource and EndpointResource destructive ops correctly check isAdmin || hasPortletAccess("configuration").

This security finding is filed as a separate [Task] issue (see Hardening backlog below).

Backend hardening backlog

Each gap is filed as its own [Task] issue, back-linked to this spike and to epic #34734. The FE+BE implementation task (#36040) consumes the v1 endpoints as-is and ships behind the assumption that these tasks are sequenced in parallel.

#	Title (filed below)	Why it matters
1	Add sort parameter to GET /v1/publishing	History tab + Queue columns expose three-state sort on Bundle and Status; currently FE has to sort client-side after fetch, breaking pagination correctness.
2	Expand filter scope on GET /v1/publishing to item / env / endpoint names	Top-bar search promises "bundles, content, or environments". Today the filter only matches bundle_id + bundle_name.
3	Expose publish_start / publish_end (and confirm bundle_start / bundle_end) on GET /v1/publishing/{bundleId}	Bundle details modal renders these four fields in its 9-field definition list.
4	Add requiredPortlet("publishing-queue") to v1 destructive ops	Closes the portlet-gate inconsistency (security finding above). Affects DELETE /v1/publishing/{bundleId} and DELETE /v1/publishing/purge.
5	Bulk DELETE by ID array on /v1/publishing	History bulk-remove and Queue bulk-remove need this; today FE has to loop per-bundle.
6	Bulk download endpoint or documented client pattern	Selection bar shows Download for N bundles. No backend support today.
7	OpenAPI hardening for legacy resources missing @Operation / schemas	Targets BundleResource (some methods incomplete), AuditPublishingResource (none), PublishQueueResource (form lacks @Schema), PushPublishFilterResource (post/put/delete implicit).
8	Webhook / polling callback for async purge + upload + generate + bulk delete	Currently completion lives only on the browser WebSocket — non-browser clients can't observe.
9	Consolidate legacy /bundle/* listing + mutation endpoints into the v1 publishing surface	getunsendbundles, updatebundle, {bundleId}/assets, _download, _generate, sync should move to v1 with consistent envelopes and authn.
10	Operation naming alignment between FE design and BE form	Design uses push / remove / pushremove; BE uses publish / expire / publishexpire. Either rename the BE form or formally document the mapping.

Tasks are filed in a separate batch comment below with cross-links.