feat(image-editor): wire Save and focal-point persistence for the new image editor

[oidacra]

Summary

Wires the new Angular image editor's Save to the temp-file flow and completes
focal-point persistence for the new Edit Content.

On Save, the editor GETs the contentAsset filter URL it already builds for preview, with
binaryFieldId=<fieldVar>&_imageToolSaveFile=true appended; the servlet stages the filtered
render as a DotCMSTempFile, the dialog closes returning it, and the field stages it (preview
refreshes; the temp id is sent as the field value on check-in — the source binary is never
overwritten). A focal point is folded into the same request (/filter/FocalPoint/fp/x,y +
overwrite=true) and committed via copyMetadata; the editor seeds the marker from the asset's
stored focal on open and treats a focal-only change as dirty.

Closes #36067.

What changed

Image editor (libs/image-editor) — new withSave feature + saveRequested/saveSucceeded/saveFailed
events + saveEditedImage GET; buildSaveUrl reuses the preview filter chain, appends the save
flags, and folds in the focal point (epsilon-compared against the seeded baseline — recenter-to-clear
and untouched-seed both handled); the dialog closes with the temp on success and stays open + surfaces
the error on failure; focal seeded on open from ImageEditorOpenParams.focalPoint; isDirty widened to
detect a focal move (epsilon-tolerant); footer Save button (+ i18n) shows a loading spinner while the
editor is busy applying a filter or saving.

Binary field (libs/edit-content) — onEditImage reads the asset's stored focal
({field}MetaData.focalPoint, via parseFocalPoint) and passes it to the launcher so the marker
re-seeds on reopen; null-metadata guards (handleTempFile, getFileMetadata) so the image-tool temp
(metadata: null) renders instead of crashing.

Backend — BinaryExporterServlet re-wraps the temp after copying the rendered bytes so it carries
real metadata (image/mimeType/dimensions) — it was returning metadata:null/image:false/mimeType:unknown,
which left the field showing a file icon — mirroring TempFileAPI.createTempFile;
DefaultTransformStrategy.addBinaries exposes focalPoint on the content REST read path (mirrors
BinaryViewStrategy) so the editor can re-seed.

Acceptance criteria

• Save builds the contentAsset filter URL + binaryFieldId + _imageToolSaveFile=true and GETs it
• Returned temp id used; dialog closes with the temp file; field preview refreshes (on check-in)
• Error → dialog stays open, error surfaced, field value unchanged
• binaryFieldId is the dynamic field variable
• Focal point folded into the save chain + committed; seeded on open; focal-only change marks dirty
• focalPoint exposed on the content read path
• Download / Cancel — verified, implemented in part 1 (feat(image-editor): add Angular image editor #36236)
• Enterprise availability gate — [IMAGE EDITOR] Add gated 'Edit image' action backed by IMAGE_EDITOR_LAUNCHER #36058

Test plan

Unit: buildSaveUrl (filters, focal seed-vs-centre, recenter-to-clear, epsilon), withSave (status
transitions + the built Save URL), footer Save (click, loading spinner on busy/saving), dialog
close-on-success / no-close-on-failure, focal seeding, isDirty (epsilon), parseFocalPoint,
null-metadata guards, DefaultTransformStrategy focalPoint — 334 (image-editor) + 1980 (edit-content)
passing, lint clean, backend compiles.

Manual (local, FEATURE_FLAG_NEW_IMAGE_EDITOR=true): open the editor on a Binary field → apply a filter /
move the focal point → Save → the dialog closes; after Publish the field shows the edited image;
reopen the editor → the focal marker is restored.

Notes

• Branched off the in-flight part-1 branch ([IMAGE EDITOR] Build DotImageEditorComponent modal shell and image-editor signalStore #36063, currently in the merge queue), so until that merges the
  diff includes its commits — rebase onto main once [IMAGE EDITOR] Build DotImageEditorComponent modal shell and image-editor signalStore #36063 lands.
• Out of scope ([IMAGE EDITOR] Add gated 'Edit image' action backed by IMAGE_EDITOR_LAUNCHER #36058): the new unified File field's Edit action + setPreviewFile consumption and the
  Enterprise availability gate. The committed-thumbnail "shows the old image until Publish" behaviour is the
  expected publish lifecycle (the field renders the committed binary), not a bug.

[claude]

Claude finished @oidacra's task in 2m 20s —— View job

---

Rollback Safety Analysis

• Read rollback-unsafe categories reference
• Get full PR diff
• Analyze diff against every unsafe category
• Apply AI: Safe To Rollback label

---

Result: ✅ Safe To Rollback

After analyzing the PR diff against all rollback-unsafe categories, no unsafe patterns were found.

Categories checked

Category	Verdict	Notes
C-1 Structural Data Model Change	✅ Safe	No runonce tasks, no schema changes to contentlet, identifier, multi_tree, etc.
C-2 Elasticsearch Mapping Change	✅ Safe	No changes to ESMappingAPIImpl, ESMappingUtilHelper, or mapping constants
C-3 Content JSON Model Version Bump	✅ Safe	No changes to CURRENT_MODEL_VERSION or ImmutableContentlet
C-4 DROP TABLE / DROP COLUMN	✅ Safe	No DDL drop statements found
H-1 One-Way Data Migration / Destructive Backfill	✅ Safe	No data transformation tasks
H-2 RENAME TABLE / RENAME COLUMN	✅ Safe	No rename operations
H-3 Primary Key Restructuring	✅ Safe	No PK changes
H-4 New ContentType Field Type	✅ Safe	No new field types registered
H-5 Binary Storage Provider Change	✅ Safe	No storage provider config changes; BinaryExporterServlet changes are behavioral only (temp file re-wrap + focal-point write)
H-6 DROP PROCEDURE / FUNCTION	✅ Safe	No stored procedure drops
H-7 NOT NULL Column Without Default	✅ Safe	No schema changes at all
H-8 VTL Viewtool Contract Change	✅ Safe	No viewtool classes modified; DefaultTransformStrategy adds a focalPoint key to the {field}MetaData map, but this is an additive change — N-1 would simply return a map without focalPoint, which is the prior behavior (gracefully absent, not broken)
M-1 Non-Broadening Column Type Change	✅ Safe	No column type changes
M-2 Push Publishing Bundle Format Change	✅ Safe	No bundler or handler changes
M-3 REST/GraphQL API Contract Change	✅ Safe	The focalPoint key added to binary metadata responses is purely additive — existing consumers receive it as an optional extra field and N-1 simply omits it
M-4 OSGi Plugin API Breakage	✅ Safe	No OSGi interface changes

Summary of backend changes

• DefaultTransformStrategy.java — additive: exposes focalPoint in the {field}MetaData map on the content REST read path (new key, no old key removed)
• BinaryExporterServlet.java — behavioral: re-wraps temp file after copy to populate metadata, and writes focal point onto the temp — no schema changes
• FeatureFlagName.java / ConfigurationResource.java / dotmarketing-config.properties — FEATURE_FLAG_NEW_IMAGE_EDITOR constant removed entirely (backend + frontend both updated); N-1 rollback would simply re-add the constant from the previous binary — no data or state affected
• Language.properties — two new i18n keys added (additive, safe)

[github-actions]

🤖 dotBot Review (Bedrock)

Reviewed 39 file(s); 12 candidate(s) → 6 confirmed, 0 uncertain (unverified, kept for review).

⚠️ Coverage capped: 0 file(s) + 6 lower-severity candidate(s) skipped (limits: 40 files, 12 candidates).

Confirmed findings

• 🔴 Critical core-web/libs/dotcms-models/src/lib/shared-models.ts:39 — Removed feature flag breaks image editor availability
  The removal of FEATURE_FLAG_NEW_IMAGE_EDITOR from FeaturedFlags enum breaks feature flag checks required for new image editor functionality. The PR's test plan explicitly requires FEATURE_FLAG_NEW_IMAGE_EDITOR=true for manual validation, indicating backend/frontend code still relies on this flag for gating. This would cause runtime errors in feature checks and disable the editor even when configured.
• 🟠 High core-web/libs/image-editor/src/lib/services/dot-image-editor.service.ts:140 — State-changing operation using GET method
  The code uses HttpClient.get() to trigger a save operation via '/contentAsset/image/filter' with _imageToolSaveFile=true parameter. This performs a state-changing file write via GET request, violating REST idempotency expectations and CSRF protection patterns. While dotCMS backend may have CSRF protections, using GET for writes is an anti-pattern that exposes unnecessary risk.
• 🟠 High dotCMS/src/main/java/com/dotcms/rest/api/v1/system/ConfigurationResource.java:234 — Potential NullPointerException when copying metadata
  In BinaryExporterServlet, if contentlet.getBinaryMetadata(fieldVar) returns null, the subsequent call to metadata.copyMetadata(tempFile) will throw a NullPointerException. The code lacks a null check before accessing the metadata, leading to a crash when handling requests for content without binary metadata.
• 🟠 High core-web/libs/image-editor/src/lib/store/features/with-save.feature.ts:73 — Focal point not added when metadata is null
  When tempFile.metadata is null, the code sets metadata to null and does not include the focalPoint, violating persistence requirements. The ternary operator returns null in the else clause, skipping focalPoint assignment. This breaks focal point saving for assets without existing metadata, directly contradicting the PR's stated goal of focal-point persistence.
• 🟡 Medium core-web/libs/edit-content/src/lib/fields/dot-edit-content-file-field/utils/focal-point.util.ts:23 — Missing range validation for focal point coordinates
  The parseFocalPoint function in focal-point.util.ts does not validate that the parsed x and y values are within the 0-1 range required for normalized focal points. This allows invalid values (e.g., 1.5 or -0.3) to be returned, which could cause rendering issues in the image editor or persist invalid data to the backend. The current code checks for valid numbers but not their range, leaving the system vulnerable to out-of-bounds input.
• 🟡 Medium core-web/libs/image-editor/src/lib/components/dot-image-editor/dot-image-editor.component.ts:94 — Potential memory leak from unmanaged subscription
  The subscription in DotImageEditorComponent uses takeUntilDestroyed() without providing DestroyRef, which may not properly unsubscribe when the component is destroyed. The component is not marked as standalone, requiring explicit DestroyRef injection. The current implementation lacks DestroyRef injection and argument in takeUntilDestroyed(), risking uncleaned subscriptions.

---

_{us.deepseek.r1-v1:0 · Run: #28475231277 · tokens: in: 219357 · out: 66747 · total: 286104 · calls: 66 · est. ~$0.657}

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request