[DEFECT] TagResource v2 API: siteId ignored on create, tag disappears after site edit, site filter broken

[fmontes]

Problem Statement

The TagResource v2 API (/api/v2/tags) has three related bugs around the siteId field that break site-specific tag management:

1. Create ignores siteId: POST /api/v2/tags with a non-SYSTEM_HOST siteId silently saves the tag under SYSTEM_HOST instead.
2. Edit site makes tag disappear from list: PUT /api/v2/tags/{id} to change a tag's site returns 200 with correct data, but the tag no longer appears in GET /api/v2/tags results.
3. Filter by siteId doesn't work: GET /api/v2/tags?siteId={id} does not return tags that were assigned to that site via PUT.

These bugs make it impossible to manage tags per-site, which is a core multi-site feature.

Steps to Reproduce

Bug 1 — Create ignores siteId:

1. Get a non-SYSTEM_HOST site ID (e.g., demo.dotcms.com with id 48190c8c-42c4-46af-8d1a-0cd5db894797)
2. POST /api/v2/tags with body: [{"name": "test-tag", "siteId": "48190c8c-42c4-46af-8d1a-0cd5db894797"}]
3. Response returns siteId: "SYSTEM_HOST" — the requested siteId is ignored

Bug 2 — Edit site makes tag disappear:

1. Create a tag (it will be on SYSTEM_HOST due to Bug 1)
2. PUT /api/v2/tags/{tagId} with body: {"tagName": "test-tag", "siteId": "48190c8c-42c4-46af-8d1a-0cd5db894797"}
3. Response returns 200 with correct siteId
4. GET /api/v2/tags?filter=test-tag — returns 0 results, the tag disappeared

Bug 3 — Filter by siteId broken:

1. After Bug 2's PUT, the tag should be on demo.dotcms.com
2. GET /api/v2/tags?siteId=48190c8c-42c4-46af-8d1a-0cd5db894797 — our tag is not in the results
3. GET /api/v2/tags?filter=test-tag&siteId=48190c8c-42c4-46af-8d1a-0cd5db894797 — returns 0 results

Automated test script output (6 of 12 tests fail):

Test 1: POST with siteId=demo.dotcms.com → FAIL (saved as SYSTEM_HOST)
Test 2: GET after create → FAIL (siteId is SYSTEM_HOST, not requested site)
Test 3: PUT to SYSTEM_HOST → PASS
Test 4: PUT to demo.dotcms.com → FAIL (tag disappears from list)
Test 5: GET with siteId filter → FAIL (our tag not found)

Acceptance Criteria

• POST /api/v2/tags with a valid siteId creates the tag on that site (not SYSTEM_HOST)
• PUT /api/v2/tags/{id} changing siteId keeps the tag visible in GET /api/v2/tags results
• GET /api/v2/tags?siteId={id} returns tags that belong to that site
• GET /api/v2/tags?filter={name}&siteId={id} returns matching tags on that site
• Existing tags on SYSTEM_HOST continue to work as before

dotCMS Version

Latest from main branch (local dev environment, localhost:8080)

Severity

High - Major functionality broken

Links

• NA

[hassandotcms]

Tag v2 PUT bug: tags become invisible after updating siteId

When a site has tagStorage=SYSTEM_HOST, CREATE looks up that property and stores tags with host_id=SYSTEM_HOST instead of the site's own ID. LIST does the same when querying. This has always worked.

Before v2, tag update could not change a tag's site; v1 and TagAjax only update the tag name, never the host_id.

The v2 API added the ability to change a tag's site via PUT, but it writes the raw siteId as host_id without resolving tagStorage. LIST then queries by the resolved value and doesn't find the tag. The tag becomes
invisible.

Fix: Resolve tagStorage in PUT, same as CREATE and LIST already do. This means that for sites with tagStorage=SYSTEM_HOST, updating a tag's siteId to that site will still show SYSTEM_HOST as the stored site; same as
what happens when creating a tag for that site. siteId has consistent semantics across all operations.

Does this approach make sense, or should PUT bypass tagStorage and write the literal siteId (which is problematic)?

@fmontes @fabrizzio-dotCMS @nollymar

[github-actions]

PRs linked to this issue

• fix: resolve tagStorage in v2 tag PUT to prevent tags becoming invisible #34547 by @hassandotcms