Add new methods.

backend/src/Squidex/Areas/Api/Controllers/Contents/Generator/Builder.cs

@@ -24,6 +24,12 @@ namespace Squidex.Areas.Api.Controllers.Contents.Generator
 
         public JsonSchema ChangeStatusSchema { get; }
 
+        public JsonSchema BulkResponseSchema { get; }
+
+        public JsonSchema BulkRequestSchema { get; }
+
+        public JsonSchema QuerySchema { get; }
+
         public OpenApiDocument OpenApiDocument { get; }
 
         public OpenApiSchemaResolver OpenApiSchemaResolver { get; }
@@ -38,9 +44,17 @@ namespace Squidex.Areas.Api.Controllers.Contents.Generator
             OpenApiDocument = document;
             OpenApiSchemaResolver = schemaResolver;
 
-            var changeStatusType = typeof(ChangeStatusDto).ToContextualType();
+            ChangeStatusSchema = CreateSchema<ChangeStatusDto>(schemaResolver, schemaGenerator);
+            BulkRequestSchema = CreateSchema<BulkUpdateContentsDto>(schemaResolver, schemaGenerator);
+            BulkResponseSchema = CreateSchema<BulkResultDto>(schemaResolver, schemaGenerator);
+            QuerySchema = CreateSchema<QueryDto>(schemaResolver, schemaGenerator);
+        }
+
+        private static JsonSchema CreateSchema<T>(OpenApiSchemaResolver schemaResolver, OpenApiSchemaGenerator schemaGenerator)
+        {
+            var contextualType = typeof(T).ToContextualType();
 
-            ChangeStatusSchema = schemaGenerator.GenerateWithReference<JsonSchema>(changeStatusType, schemaResolver);
+            return schemaGenerator.GenerateWithReference<JsonSchema>(contextualType, schemaResolver);
         }
 
         public OperationsBuilder Shared()

backend/src/Squidex/Areas/Api/Controllers/Contents/Generator/OperationBuilder.cs

@@ -62,16 +62,25 @@ namespace Squidex.Areas.Api.Controllers.Contents.Generator
             return this;
         }
 
-        private OperationBuilder AddParameter(string name, JsonSchema schema, OpenApiParameterKind kind, string description)
+        private OperationBuilder AddParameter(string name, JsonSchema schema, OpenApiParameterKind kind, string? description)
         {
-            var parameter = new OpenApiParameter { Schema = schema, Name = name, Kind = kind };
+            var parameter = new OpenApiParameter
+            {
+                Kind = kind,
+                Schema = schema,
+                Name = name,
+            };
 
             if (!string.IsNullOrWhiteSpace(description))
             {
                 parameter.Description = operations.FormatText(description);
             }
 
-            parameter.IsRequired = kind != OpenApiParameterKind.Query;
+            if (kind != OpenApiParameterKind.Query)
+            {
+                parameter.IsRequired = true;
+                parameter.IsNullableRaw = false;
+            }
 
             operation.Parameters.Add(parameter);
 
@@ -85,7 +94,7 @@ namespace Squidex.Areas.Api.Controllers.Contents.Generator
             return this;
         }
 
-        public OperationBuilder HasQuery(string name, JsonObjectType type, string description)
+        public OperationBuilder HasQuery(string name, JsonObjectType type, string? description = null)
         {
             var jsonSchema = new JsonSchema { Type = type };
 
@@ -99,7 +108,7 @@ namespace Squidex.Areas.Api.Controllers.Contents.Generator
             return AddParameter(name, jsonSchema, OpenApiParameterKind.Path, description);
         }
 
-        public OperationBuilder HasBody(string name, JsonSchema jsonSchema, string description)
+        public OperationBuilder HasBody(string name, JsonSchema jsonSchema, string? description = null)
         {
             return AddParameter(name, jsonSchema, OpenApiParameterKind.Body, description);
         }
@@ -115,14 +124,13 @@ namespace Squidex.Areas.Api.Controllers.Contents.Generator
 
         public OperationBuilder RequirePermission(string permissionId)
         {
+            var fullId = PermissionIds.ForApp(permissionId, operations.Parent.AppName, operations.SchemaName).Id;
+
             operation.Security = new List<OpenApiSecurityRequirement>
             {
                 new OpenApiSecurityRequirement
                 {
-                    [Constants.SecurityDefinition] = new[]
+                    [Constants.SecurityDefinition] = new[] { fullId }
-                    {
-                        PermissionIds.ForApp(permissionId, operations.Parent.AppName, operations.SchemaName).Id
-                    }
                 }
             };
 

backend/src/Squidex/Areas/Api/Controllers/Contents/Generator/SchemasOpenApiGenerator.cs

@@ -113,6 +113,14 @@ namespace Squidex.Areas.Api.Controllers.Contents.Generator
                 .Responds(200, "Content items retrieved.", builder.ContentsSchema)
                 .Responds(400, "Content query not valid.");
 
+            builder.AddOperation(OpenApiOperationMethod.Post, "/query")
+                .RequirePermission(PermissionIds.AppContentsReadOwn)
+                .Operation("QueryPost")
+                .OperationSummary("Query [schema] contents items using Post.")
+                .HasBody("query", builder.Parent.QuerySchema, null)
+                .Responds(200, "Content items retrieved.", builder.ContentsSchema)
+                .Responds(400, "Content query not valid.");
+
             builder.AddOperation(OpenApiOperationMethod.Get, "/{id}")
                 .RequirePermission(PermissionIds.AppContentsReadOwn)
                 .Operation("Get")
@@ -146,6 +154,14 @@ namespace Squidex.Areas.Api.Controllers.Contents.Generator
                 .Responds(201, "Content item created", builder.ContentSchema)
                 .Responds(400, "Content data not valid.");
 
+            builder.AddOperation(OpenApiOperationMethod.Post, "/bulk")
+                .RequirePermission(PermissionIds.AppContentsReadOwn)
+                .Operation("Bulk")
+                .OperationSummary("Bulk update content items.")
+                .HasBody("request", builder.Parent.BulkRequestSchema, null)
+                .Responds(200, "Contents created, update or delete.", builder.Parent.BulkResponseSchema)
+                .Responds(400, "Contents request not valid.");
+
             builder.AddOperation(OpenApiOperationMethod.Post, "/{id}")
                 .RequirePermission(PermissionIds.AppContentsUpsert)
                 .Operation("Upsert")
@@ -188,6 +204,7 @@ namespace Squidex.Areas.Api.Controllers.Contents.Generator
                 .RequirePermission(PermissionIds.AppContentsDeleteOwn)
                 .Operation("Delete")
                 .OperationSummary("Delete a [schema] content item.")
+                .HasQuery("permanent", JsonObjectType.Boolean, FieldDescriptions.EntityRequestDeletePermanent)
                 .HasId()
                 .Responds(204, "Content item deleted");
         }