@a83/orbiter-admin 0.3.7 → 0.3.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a83/orbiter-admin",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "Standalone admin server for Orbiter CMS",
   "type": "module",
   "main": "./src/server.js",

package/public/editor.html

@@ -480,10 +480,11 @@
     document.getElementById('collection-id-display').textContent = COLLECTION;
 
     // Load collection schema + entry
-    const [colData, entryData, versionsData, mediaData] = await Promise.all([
+    const [colData, entryData, versionsData, activityData, mediaData] = await Promise.all([
       fetch(`/api/collections/${COLLECTION}`,{credentials:'include'}).then(r=>r.ok?r.json():null),
       IS_NEW ? null : fetch(`/api/collections/${COLLECTION}/entries/${SLUG}`,{credentials:'include'}).then(r=>r.ok?r.json():null),
       IS_NEW ? [] : fetch(`/api/collections/${COLLECTION}/entries/${SLUG}/versions`,{credentials:'include'}).then(r=>r.ok?r.json():[]).catch(()=>[]),
+      IS_NEW ? [] : fetch(`/api/collections/${COLLECTION}/entries/${SLUG}/activity`,{credentials:'include'}).then(r=>r.ok?r.json():[]).catch(()=>[]),
       fetch('/api/media',{credentials:'include'}).then(r=>r.json()).catch(()=>[]),
     ]);
 
@@ -506,14 +507,20 @@
       }
     }
 
-    // Fetch preview URL for this collection
-    const previewMeta = await fetch(`/api/meta/preview_url~${COLLECTION}`,{credentials:'include'}).then(r=>r.json()).catch(()=>null);
+    // Fetch preview URL + token for this collection
+    const [previewMeta, previewTokenMeta] = await Promise.all([
+      fetch(`/api/meta/preview_url~${COLLECTION}`,{credentials:'include'}).then(r=>r.json()).catch(()=>null),
+      fetch('/api/meta/preview~token',{credentials:'include'}).then(r=>r.json()).catch(()=>null),
+    ]);
     const previewUrlTemplate = previewMeta?.value || '';
+    const previewToken = previewTokenMeta?.value || '';
     function updatePreviewLink() {
       const btn = document.getElementById('btn-preview-link');
       if (!btn || !previewUrlTemplate) return;
       const slug = document.getElementById('slug-input')?.value || currentSlug || SLUG;
-      btn.href = previewUrlTemplate.replace('{slug}', slug);
+      const base = previewUrlTemplate.replace('{slug}', slug);
+      const sep  = base.includes('?') ? '&' : '?';
+      btn.href = previewToken ? base + sep + 'preview_token=' + previewToken : base;
       btn.style.display = '';
     }
 
@@ -625,6 +632,15 @@
         </div>
       `).join('');
 
+      const actionLabel = { create:'Created', update:'Saved', publish:'Published', unpublish:'Unpublished', delete:'Moved to trash', restore:'Restored' };
+      const actHtml = activityData.slice(0,10).map(a=>`
+        <div style="display:flex;align-items:baseline;gap:8px;padding:4px 0;border-bottom:1px solid var(--line2);font-size:10px;">
+          <span style="color:var(--text);font-weight:500;flex-shrink:0">${actionLabel[a.action]??a.action}</span>
+          <span style="color:var(--muted);flex:1;text-align:right">${a.username}</span>
+          <span style="color:var(--muted);font-family:var(--mono);flex-shrink:0">${new Date(a.created_at).toLocaleDateString()}</span>
+        </div>
+      `).join('');
+
       const hasSeo = !!(seoFields.titleKey || seoFields.descKey);
       const serpHtml = hasSeo ? `<div class="serp-preview" id="serp-preview">
         <div class="serp-url" id="serp-url">${location.host}/${COLLECTION}/<span id="serp-slug-part">${escHtml(IS_NEW?'…':SLUG)}</span></div>
@@ -658,6 +674,7 @@
           ${updatedAt ? `<div class="meta-field"><div class="field-label">Modified</div><div class="field-readonly">${new Date(updatedAt).toLocaleDateString()}</div></div>` : ''}
         </div>
         ${versionsData.length ? `<div class="meta-section"><div class="meta-label">History</div>${versHtml}</div>` : ''}
+        ${activityData.length ? `<div class="meta-section"><div class="meta-label">Activity</div>${actHtml}</div>` : ''}
       `;
 
       // Wire up weekday toggles

package/public/entries.html

@@ -100,15 +100,18 @@
           <button class="filter-tab active" data-status="">All</button>
           <button class="filter-tab" data-status="published">Published</button>
           <button class="filter-tab" data-status="draft">Drafts</button>
+          <button class="filter-tab" data-status="trash" style="margin-left:auto">🗑 Trash</button>
         </div>
 
         <!-- Bulk action bar -->
         <div class="bulk-bar" id="bulk-bar">
           <span><span class="bulk-bar-count" id="bulk-count">0</span> selected</span>
-          <button class="btn btn-ghost btn-sm" id="bulk-publish">Publish</button>
-          <button class="btn btn-ghost btn-sm" id="bulk-draft">Unpublish</button>
+          <button class="btn btn-ghost btn-sm bulk-normal" id="bulk-publish">Publish</button>
+          <button class="btn btn-ghost btn-sm bulk-normal" id="bulk-draft">Unpublish</button>
+          <button class="btn btn-ghost btn-sm bulk-trash" id="bulk-restore" style="display:none">Restore</button>
           <span class="bulk-bar-spacer"></span>
-          <button class="btn btn-danger btn-sm" id="bulk-delete">Delete selected</button>
+          <button class="btn btn-danger btn-sm bulk-normal" id="bulk-delete">Move to Trash</button>
+          <button class="btn btn-danger btn-sm bulk-trash" id="bulk-permanent" style="display:none">Delete forever</button>
         </div>
 
         <div class="table-wrap" id="entries-wrap">
@@ -140,7 +143,10 @@
     let selected    = new Set();
 
     function updateBulkBar() {
-      const bar = document.getElementById('bulk-bar');
+      const bar   = document.getElementById('bulk-bar');
+      const trash = activeFilter === 'trash';
+      document.querySelectorAll('.bulk-normal').forEach(el => el.style.display = trash ? 'none' : '');
+      document.querySelectorAll('.bulk-trash').forEach(el  => el.style.display = trash ? ''     : 'none');
       if (selected.size > 0) {
         bar.classList.add('visible');
         document.getElementById('bulk-count').textContent = selected.size;
@@ -165,6 +171,7 @@
         wrap.innerHTML = '<div class="empty"><div class="empty-icon">◈</div>No entries yet</div>';
         return;
       }
+      const isTrash = activeFilter === 'trash';
       const canSort = !activeFilter;
       wrap.innerHTML = `
         <table>
@@ -172,13 +179,14 @@
             <tr>
               ${canSort ? '<th class="drag-col"></th>' : ''}
               <th class="cb-col"><input type="checkbox" id="check-all" title="Select all" /></th>
-              <th>Title / Slug</th><th>Status</th><th>Updated</th><th></th>
+              <th>Title / Slug</th><th>${isTrash ? 'Deleted' : 'Status'}</th><th>${isTrash ? '' : 'Updated'}</th><th></th>
             </tr>
           </thead>
           <tbody>
             ${entries.map(e => {
               const title   = e.data?.title || e.slug;
               const updated = e.updated_at ? e.updated_at.split(' ')[0] : '—';
+              const deleted = e.deleted_at ? e.deleted_at.split(' ')[0] : '—';
               const nextStatus = e.status === 'published' ? 'draft' : 'published';
               const toggleLabel = e.status === 'published' ? 'Unpublish' : 'Publish';
               return `<tr data-slug="${e.slug}"${canSort ? ' draggable="true"' : ''}>
@@ -188,14 +196,18 @@
                   <div style="color:var(--heading);font-weight:500">${title}</div>
                   <div style="font-family:var(--mono);font-size:10px;color:var(--muted);margin-top:2px">${e.slug}</div>
                 </td>
-                <td><span class="badge badge-${e.status}">${e.status}</span></td>
-                <td style="font-family:var(--mono);font-size:11px;color:var(--muted)">${updated}</td>
+                <td>${isTrash ? `<span style="font-family:var(--mono);font-size:11px;color:var(--muted)">${deleted}</span>` : `<span class="badge badge-${e.status}">${e.status}</span>`}</td>
+                <td style="font-family:var(--mono);font-size:11px;color:var(--muted)">${isTrash ? '' : updated}</td>
                 <td style="width:1%;white-space:nowrap">
                   <div class="row-actions">
-                    <a class="btn-row" href="/editor.html?collection=${colId}&slug=${e.slug}">Edit</a>
-                    <button class="btn-row btn-row-toggle status-toggle" data-slug="${e.slug}" data-next="${nextStatus}">${toggleLabel}</button>
-                    <button class="btn-row btn-row-icon dup-btn" data-slug="${e.slug}" title="Duplicate">⧉</button>
-                    <button class="btn-row btn-row-danger delete-btn" data-slug="${e.slug}">Delete</button>
+                    ${isTrash
+                      ? `<button class="btn-row restore-btn" data-slug="${e.slug}">Restore</button>
+                         <button class="btn-row btn-row-danger perm-del-btn" data-slug="${e.slug}">Delete forever</button>`
+                      : `<a class="btn-row" href="/editor.html?collection=${colId}&slug=${e.slug}">Edit</a>
+                         <button class="btn-row btn-row-toggle status-toggle" data-slug="${e.slug}" data-next="${nextStatus}">${toggleLabel}</button>
+                         <button class="btn-row btn-row-icon dup-btn" data-slug="${e.slug}" title="Duplicate">⧉</button>
+                         <button class="btn-row btn-row-danger delete-btn" data-slug="${e.slug}">Trash</button>`
+                    }
                   </div>
                 </td>
               </tr>`;
@@ -288,16 +300,36 @@
         });
       });
 
-      // Delete
+      // Delete → Trash
       wrap.querySelectorAll('.delete-btn').forEach(btn => {
         btn.addEventListener('click', async () => {
-          if (!confirm(`Delete "${btn.dataset.slug}"?`)) return;
           await fetch(`/api/collections/${colId}/entries/${btn.dataset.slug}`, {
             method: 'DELETE', credentials: 'include',
           });
           loadEntries();
         });
       });
+
+      // Restore from Trash
+      wrap.querySelectorAll('.restore-btn').forEach(btn => {
+        btn.addEventListener('click', async () => {
+          await fetch(`/api/collections/${colId}/entries/${btn.dataset.slug}/restore`, {
+            method: 'POST', credentials: 'include',
+          });
+          loadEntries();
+        });
+      });
+
+      // Permanent delete
+      wrap.querySelectorAll('.perm-del-btn').forEach(btn => {
+        btn.addEventListener('click', async () => {
+          if (!confirm(`Permanently delete "${btn.dataset.slug}"? This cannot be undone.`)) return;
+          await fetch(`/api/collections/${colId}/entries/${btn.dataset.slug}/permanent`, {
+            method: 'DELETE', credentials: 'include',
+          });
+          loadEntries();
+        });
+      });
     }
 
     // Filter buttons
@@ -322,9 +354,15 @@
       });
       loadEntries();
     }
-    document.getElementById('bulk-publish').addEventListener('click', () => bulkAction('publish'));
-    document.getElementById('bulk-draft').addEventListener('click',   () => bulkAction('draft'));
-    document.getElementById('bulk-delete').addEventListener('click',  () => bulkAction('delete'));
+    document.getElementById('bulk-publish').addEventListener('click',   () => bulkAction('publish'));
+    document.getElementById('bulk-draft').addEventListener('click',     () => bulkAction('draft'));
+    document.getElementById('bulk-delete').addEventListener('click',    () => bulkAction('delete'));
+    document.getElementById('bulk-restore').addEventListener('click',   () => bulkAction('restore'));
+    document.getElementById('bulk-permanent').addEventListener('click', async () => {
+      const n = selected.size;
+      if (!confirm(`Permanently delete ${n} entr${n !== 1 ? 'ies' : 'y'}? This cannot be undone.`)) return;
+      await bulkAction('permanent');
+    });
 
     // New entry modal
     const overlay = document.getElementById('modal-overlay');

package/public/settings.html

@@ -362,6 +362,13 @@
             <div><div class="setting-label">API token</div><div class="setting-desc">Optional bearer token to restrict access</div></div>
             <input class="input" type="password" name="api.token" value="${get('api.token')}" autocomplete="off" placeholder="Leave blank for open access" />
           </div>
+          <div class="setting-row">
+            <div><div class="setting-label">Preview token</div><div class="setting-desc">Appended to Preview URLs — allows viewing draft entries on your site</div></div>
+            <div style="display:flex;gap:8px;align-items:center">
+              <input class="input" type="text" id="preview-token-display" value="${get('preview.token')??''}" readonly style="flex:1;font-family:var(--mono);font-size:11px;" placeholder="No token generated" />
+              <button type="button" class="btn btn-ghost btn-sm" id="btn-gen-preview-token">Generate</button>
+            </div>
+          </div>
         </div>
 
         <div class="settings-group">
@@ -651,10 +658,22 @@
         ['media.s3_public_url', fd.get('media.s3_public_url')],
         ['api.enabled',         fd.get('api.enabled') ? '1' : '0'],
         ['api.token',           fd.get('api.token')],
+        ['preview.token',       document.getElementById('preview-token-display').value || null],
       ]);
       showBanner('site-banner','banner-ok','Settings saved');
     });
 
+    // Preview token generator
+    document.getElementById('btn-gen-preview-token')?.addEventListener('click', async () => {
+      const token = Array.from(crypto.getRandomValues(new Uint8Array(24))).map(b=>b.toString(16).padStart(2,'0')).join('');
+      document.getElementById('preview-token-display').value = token;
+      await fetch('/api/meta/preview.token', {
+        method: 'PUT', credentials: 'include',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ value: token }),
+      });
+    });
+
     // GitHub push (conditional: only wired if section rendered)
     const ghPushBtn = document.getElementById('github-push-btn');
     if (ghPushBtn) ghPushBtn.addEventListener('click', async () => {

package/src/routes/entries.js

@@ -16,11 +16,12 @@ entryRoutes.post('/:collectionId/entries/bulk', async (c) => {
   const { collectionId } = c.req.param();
   const { action, slugs } = await c.req.json();
   if (!Array.isArray(slugs) || !slugs.length) return c.json({ error: 'slugs required' }, 400);
-  if (!['publish', 'draft', 'delete'].includes(action))  return c.json({ error: 'Invalid action' }, 400);
+  if (!['publish', 'draft', 'delete', 'restore', 'permanent'].includes(action)) return c.json({ error: 'Invalid action' }, 400);
   const db = openPod(c.get('podPath'));
-  if (action === 'delete') {
-    slugs.forEach(slug => db.deleteEntry(collectionId, slug));
-  } else {
+  if (action === 'delete')    { slugs.forEach(slug => db.deleteEntry(collectionId, slug)); }
+  else if (action === 'restore')   { slugs.forEach(slug => db.restoreEntry(collectionId, slug)); }
+  else if (action === 'permanent') { slugs.forEach(slug => db.permanentDeleteEntry(collectionId, slug)); }
+  else {
     const status = action === 'publish' ? 'published' : 'draft';
     slugs.forEach(slug => {
       const entry = db.getEntry(collectionId, slug);
@@ -78,6 +79,7 @@ entryRoutes.post('/:collectionId/entries', async (c) => {
 
   const id    = db.createEntry(collectionId, slug, data, status);
   const entry = db.getEntry(collectionId, slug);
+  db.logAudit(id, c.get('user')?.username ?? 'unknown', 'create');
   db.close();
   return c.json({ ...entry, id }, 201);
 });
@@ -91,7 +93,15 @@ entryRoutes.put('/:collectionId/entries/:slug', async (c) => {
   const before = db.getEntry(collectionId, slug);
   const ok     = db.updateEntry(collectionId, slug, body);
   if (!ok) { db.close(); return c.json({ error: 'Not found' }, 404); }
-  const updated = db.getEntry(collectionId, body.slug ?? slug);
+  const updated  = db.getEntry(collectionId, body.slug ?? slug);
+  const username = c.get('user')?.username ?? 'unknown';
+  if (body.status === 'published' && before?.status !== 'published') {
+    db.logAudit(updated.id, username, 'publish');
+  } else if (body.status === 'draft' && before?.status === 'published') {
+    db.logAudit(updated.id, username, 'unpublish');
+  } else {
+    db.logAudit(updated.id, username, 'update');
+  }
   db.close();
 
   if (body.status === 'published' && before?.status !== 'published') {
@@ -100,16 +110,51 @@ entryRoutes.put('/:collectionId/entries/:slug', async (c) => {
   return c.json(updated);
 });
 
-// DELETE /api/collections/:id/entries/:slug
+// DELETE /api/collections/:id/entries/:slug → soft delete (trash)
 entryRoutes.delete('/:collectionId/entries/:slug', (c) => {
+  const { collectionId, slug } = c.req.param();
+  const db    = openPod(c.get('podPath'));
+  const entry = db.getEntry(collectionId, slug);
+  if (!entry) { db.close(); return c.json({ error: 'Not found' }, 404); }
+  db.deleteEntry(collectionId, slug);
+  db.logAudit(entry.id, c.get('user')?.username ?? 'unknown', 'delete');
+  db.close();
+  return c.json({ ok: true });
+});
+
+// POST /api/collections/:id/entries/:slug/restore — move from trash back to draft
+entryRoutes.post('/:collectionId/entries/:slug/restore', (c) => {
+  const { collectionId, slug } = c.req.param();
+  const db    = openPod(c.get('podPath'));
+  const row   = db.db.prepare('SELECT * FROM _entries WHERE collection_id = ? AND slug = ? AND deleted_at IS NOT NULL').get(collectionId, slug);
+  const ok    = db.restoreEntry(collectionId, slug);
+  if (row) db.logAudit(row.id, c.get('user')?.username ?? 'unknown', 'restore');
+  db.close();
+  if (!ok) return c.json({ error: 'Not found in trash' }, 404);
+  return c.json({ ok: true });
+});
+
+// DELETE /api/collections/:id/entries/:slug/permanent — hard delete from trash
+entryRoutes.delete('/:collectionId/entries/:slug/permanent', (c) => {
   const { collectionId, slug } = c.req.param();
   const db = openPod(c.get('podPath'));
-  const ok = db.deleteEntry(collectionId, slug);
+  const ok = db.permanentDeleteEntry(collectionId, slug);
   db.close();
   if (!ok) return c.json({ error: 'Not found' }, 404);
   return c.json({ ok: true });
 });
 
+// GET /api/collections/:id/entries/:slug/activity
+entryRoutes.get('/:collectionId/entries/:slug/activity', (c) => {
+  const { collectionId, slug } = c.req.param();
+  const db    = openPod(c.get('podPath'));
+  const entry = db.db.prepare('SELECT * FROM _entries WHERE collection_id = ? AND slug = ?').get(collectionId, slug);
+  if (!entry) { db.close(); return c.json({ error: 'Not found' }, 404); }
+  const log = db.getAuditLog(entry.id);
+  db.close();
+  return c.json(log);
+});
+
 // GET /api/collections/:id/entries/:slug/versions
 entryRoutes.get('/:collectionId/entries/:slug/versions', (c) => {
   const { collectionId, slug } = c.req.param();

package/src/routes/meta.js

@@ -10,7 +10,7 @@ const ALLOWED_KEYS = [
   'media.backend', 'media.local_path',
   'media.github_token', 'media.github_repo', 'media.github_branch', 'media.github_dir',
   'media.s3_bucket', 'media.s3_region', 'media.s3_endpoint', 'media.s3_access_key', 'media.s3_secret_key', 'media.s3_public_url',
-  'api.enabled', 'api.token',
+  'api.enabled', 'api.token', 'preview.token',
   'dashboard.notes', 'dashboard.todos',
   'ui.theme',
   'format_version',