@acms-subir/core 0.0.1

package/src/actions/index.ts

@@ -0,0 +1,502 @@
+import { defineAction, ActionError } from 'astro:actions';
+import { z } from 'astro:schema';
+import type { ActionAPIContext } from 'astro:actions';
+import { getRepo } from '../lib/repo';
+import { getMediaStore } from '../lib/media/store';
+import { verifySessionToken, SESSION_COOKIE } from '../lib/auth';
+import { parseConfig, slugify, widgetTypes, type WidgetType } from '../lib/schema';
+import { env } from '../lib/env';
+import { CONTENT, collectionUrl } from '../lib/content';
+import { invalidateRedirectCache } from '../middleware';
+import { isPrivateHost } from '../lib/net';
+import { normalizeCalendarSrc } from '../lib/calendar/src';
+import { getCalendarEvents } from '../lib/calendar/ics';
+import { siteLocale } from '../lib/dates';
+import { normalizePageLocale } from '../lib/i18n';
+
+// All admin mutations live here. The middleware only guards /admin pages,
+// so every action re-checks the session itself.
+function requireAdmin(ctx: ActionAPIContext) {
+  if (!verifySessionToken(ctx.cookies.get(SESSION_COOKIE)?.value)) {
+    throw new ActionError({ code: 'UNAUTHORIZED', message: 'Not signed in.' });
+  }
+}
+
+function decodeEntities(s: string): string {
+  return s
+    .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"').replace(/&#0?39;|&apos;/g, "'").replace(/&#x27;/gi, "'");
+}
+
+// Schemas here use astro:schema's zod only — mixing in the project's own zod
+// instance breaks the action client's type inference (it falls back to the
+// FormData overload).
+const nullableTs = z.number().nullable();
+const StatusInput = z.enum(['draft', 'scheduled', 'published', 'archived']);
+const BlockInput = z.object({
+  id: z.string(),
+  type: z.string(),
+  config: z.record(z.any()),
+});
+
+export const server = {
+  posts: {
+    save: defineAction({
+      input: z.object({
+        id: z.string(),
+        title: z.string().optional(),
+        slug: z.string().optional(),
+        collection: z.string().optional(),
+        body: z.string().optional(),
+        bodyJson: z.string().optional(),
+        bodyHtml: z.string().optional(),
+        excerpt: z.string().optional(),
+        tags: z.array(z.string()).optional(),
+        cover: z.string().optional(),
+        coverAlt: z.string().optional(),
+        seoTitle: z.string().optional(),
+        seoDesc: z.string().optional(),
+        status: StatusInput.optional(),
+        featured: z.boolean().optional(),
+        authorId: z.string().nullable().optional(),
+        authorIds: z.array(z.string()).optional(),
+        template: z.string().optional(),
+        publishedAt: nullableTs.optional(),
+        scheduledAt: nullableTs.optional(),
+      }),
+      handler: async ({ id, ...data }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        if (data.slug !== undefined) data.slug = slugify(data.slug);
+        if (data.collection !== undefined && !CONTENT.collections[data.collection]) {
+          throw new ActionError({ code: 'BAD_REQUEST', message: `Unknown collection "${data.collection}".` });
+        }
+        const movesUrl = data.slug !== undefined || data.collection !== undefined;
+        const before = movesUrl ? await repo.getPost(id) : null;
+        await repo.updatePost(id, data);
+        // any new tag names become registry entries with slugs for archives
+        if (data.tags !== undefined) await repo.ensureTags(data.tags);
+        const post = await repo.getPost(id);
+        if (!post) throw new ActionError({ code: 'NOT_FOUND', message: 'Post not found.' });
+        // a published post whose slug or collection changed leaves a 301
+        // behind so old links keep working
+        if (before && before.status === 'published' && (before.slug !== post.slug || before.collection !== post.collection)) {
+          await repo
+            .createRedirect({
+              fromPath: collectionUrl(before.collection, before.slug),
+              toPath: collectionUrl(post.collection, post.slug),
+            })
+            .catch(() => {});
+          invalidateRedirectCache();
+        }
+        return { post };
+      },
+    }),
+    delete: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.deletePost(id);
+        return { ok: true };
+      },
+    }),
+  },
+
+  pages: {
+    save: defineAction({
+      input: z.object({
+        id: z.string(),
+        title: z.string().optional(),
+        slug: z.string().optional(),
+        status: StatusInput.optional(),
+        isHome: z.boolean().optional(),
+        locale: z.string().optional(),
+        seoTitle: z.string().optional(),
+        seoDesc: z.string().optional(),
+        template: z.string().optional(),
+        bodyJson: z.string().optional(),
+        bodyHtml: z.string().optional(),
+        blocks: z.array(BlockInput).optional(),
+      }),
+      handler: async ({ id, blocks, ...data }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        if (data.slug !== undefined) data.slug = slugify(data.slug);
+        // default locale stores as '', unknown codes fall back to it
+        if (data.locale !== undefined) data.locale = normalizePageLocale(data.locale);
+        const before = data.slug !== undefined ? await repo.getPage(id) : null;
+        const cleanBlocks =
+          blocks === undefined
+            ? undefined
+            : blocks
+                .filter((b) => widgetTypes.includes(b.type as WidgetType))
+                .map((b) => ({ ...b, type: b.type as WidgetType, config: parseConfig(b.type as WidgetType, b.config) as Record<string, unknown> }));
+        await repo.updatePage(id, { ...data, blocks: cleanBlocks });
+        const page = await repo.getPage(id);
+        if (!page) throw new ActionError({ code: 'NOT_FOUND', message: 'Page not found.' });
+        // renaming a published slug leaves a 301 behind so old links keep working
+        if (before && before.status === 'published' && before.slug !== page.slug && !page.isHome) {
+          await repo.createRedirect({ fromPath: `/${before.slug}`, toPath: `/${page.slug}` }).catch(() => {});
+          invalidateRedirectCache();
+        }
+        return { page };
+      },
+    }),
+    delete: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.deletePage(id);
+        return { ok: true };
+      },
+    }),
+  },
+
+  media: {
+    list: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        return { media: await repo.listMedia() };
+      },
+    }),
+    updateAlt: defineAction({
+      input: z.object({ id: z.string(), alt: z.string() }),
+      handler: async ({ id, alt }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.updateMedia(id, { alt });
+        return { ok: true };
+      },
+    }),
+    delete: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const media = await repo.getMedia(id);
+        if (media) {
+          const store = getMediaStore(ctx.locals);
+          await Promise.all([media.key, ...media.variants.map((v) => v.key)].map((k) => store.delete(k)));
+          await repo.deleteMedia(id);
+        }
+        return { ok: true };
+      },
+    }),
+  },
+
+  links: {
+    create: defineAction({
+      input: z.object({
+        kind: z.enum(['link', 'email', 'phone', 'heading', 'text', 'spacer', 'vcard', 'html']).default('link'),
+        label: z.string().default(''),
+        url: z.string().default(''),
+        icon: z.string().default(''),
+        html: z.string().default(''),
+        meta: z.record(z.any()).default({}),
+      }),
+      handler: async (data, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        return { link: await repo.createLink(data) };
+      },
+    }),
+    update: defineAction({
+      input: z.object({
+        id: z.string(),
+        label: z.string().optional(),
+        url: z.string().optional(),
+        icon: z.string().optional(),
+        html: z.string().optional(),
+        meta: z.record(z.any()).optional(),
+      }),
+      handler: async ({ id, ...data }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.updateLink(id, data);
+        return { ok: true };
+      },
+    }),
+    reorder: defineAction({
+      input: z.object({ ids: z.array(z.string()) }),
+      handler: async ({ ids }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.reorderLinks(ids);
+        return { ok: true };
+      },
+    }),
+    delete: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.deleteLink(id);
+        return { ok: true };
+      },
+    }),
+  },
+
+  nav: {
+    create: defineAction({
+      input: z.object({
+        label: z.string().default('New link'),
+        url: z.string().default('/'),
+        area: z.enum(['header', 'footer', 'social']).default('header'),
+      }),
+      handler: async (data, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        return { item: await repo.createNavItem(data) };
+      },
+    }),
+    update: defineAction({
+      input: z.object({
+        id: z.string(),
+        label: z.string().optional(),
+        url: z.string().optional(),
+        area: z.enum(['header', 'footer', 'social']).optional(),
+      }),
+      handler: async ({ id, ...data }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.updateNavItem(id, data);
+        return { ok: true };
+      },
+    }),
+    reorder: defineAction({
+      input: z.object({ ids: z.array(z.string()) }),
+      handler: async ({ ids }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.reorderNavItems(ids);
+        return { ok: true };
+      },
+    }),
+    delete: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.deleteNavItem(id);
+        return { ok: true };
+      },
+    }),
+  },
+
+  settings: {
+    update: defineAction({
+      input: z.object({
+        siteTitle: z.string().optional(),
+        tagline: z.string().optional(),
+        footerText: z.string().optional(),
+        linksName: z.string().optional(),
+        linksBio: z.string().optional(),
+        linksAvatar: z.string().optional(),
+        activeTheme: z.string().optional(),
+        designOverrides: z.record(z.any()).optional(),
+        siteLogo: z.string().optional(),
+        siteFavicon: z.string().optional(),
+        siteCover: z.string().optional(),
+      }),
+      handler: async (data, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.updateSettings(data);
+        return { ok: true };
+      },
+    }),
+  },
+
+  tags: {
+    list: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        return { tags: await repo.listTags() };
+      },
+    }),
+  },
+
+  users: {
+    list: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        return { users: await repo.listUsers() };
+      },
+    }),
+  },
+
+  bookmark: {
+    // Server-side link-metadata fetch for the bookmark card (no CORS in the
+    // browser). Fetches the page, scrapes OG/meta tags, returns a compact
+    // shape. Guards: https/http only, no private hosts, 1.5 MB / 8 s caps.
+    fetch: defineAction({
+      input: z.object({ url: z.string().url() }),
+      handler: async ({ url }, ctx) => {
+        requireAdmin(ctx);
+        // redirects are followed manually so EVERY hop is re-checked against
+        // the private-host guard (a public URL 302ing to 127.0.0.1 or a cloud
+        // metadata IP must not slip through)
+        let current = url;
+        let res: Response | null = null;
+        for (let hop = 0; hop < 5; hop++) {
+          const u = new URL(current);
+          if (!/^https?:$/.test(u.protocol) || isPrivateHost(u.hostname)) {
+            throw new ActionError({ code: 'BAD_REQUEST', message: 'That URL can’t be bookmarked.' });
+          }
+          res = await fetch(u.href, {
+            redirect: 'manual',
+            signal: AbortSignal.timeout(8000),
+            headers: { 'User-Agent': 'Mozilla/5.0 (compatible; acms-bookmark/1.0)', Accept: 'text/html' },
+          }).catch(() => null);
+          if (res && res.status >= 300 && res.status < 400) {
+            const loc = res.headers.get('location');
+            if (!loc) break;
+            current = new URL(loc, u.href).href;
+            continue;
+          }
+          break;
+        }
+        if (!res || !res.ok) throw new ActionError({ code: 'BAD_GATEWAY', message: 'Couldn’t reach that page.' });
+        const finalUrl = current;
+        const html = (await res.text()).slice(0, 1_500_000);
+
+        const tag = (patterns: RegExp[]) => {
+          for (const p of patterns) {
+            const m = html.match(p);
+            if (m?.[1]) return decodeEntities(m[1].trim());
+          }
+          return '';
+        };
+        const metaContent = (name: string) => [
+          new RegExp(`<meta[^>]+(?:property|name)=["']${name}["'][^>]+content=["']([^"']+)["']`, 'i'),
+          new RegExp(`<meta[^>]+content=["']([^"']+)["'][^>]+(?:property|name)=["']${name}["']`, 'i'),
+        ];
+        const abs = (u: string) => {
+          if (!u) return '';
+          try { return new URL(u, finalUrl).href; } catch { return ''; }
+        };
+
+        const title = tag(metaContent('og:title')) || tag(metaContent('twitter:title')) || tag([/<title[^>]*>([^<]+)<\/title>/i]);
+        const description = tag(metaContent('og:description')) || tag(metaContent('twitter:description')) || tag(metaContent('description'));
+        const image = abs(tag(metaContent('og:image')) || tag(metaContent('twitter:image')));
+        const siteName = tag(metaContent('og:site_name')) || new URL(finalUrl).hostname;
+        const favicon = abs(
+          tag([
+            /<link[^>]+rel=["'](?:shortcut )?icon["'][^>]+href=["']([^"']+)["']/i,
+            /<link[^>]+href=["']([^"']+)["'][^>]+rel=["'](?:shortcut )?icon["']/i,
+          ]) || '/favicon.ico'
+        );
+
+        return { meta: { title, description, image, favicon, siteName } };
+      },
+    }),
+  },
+
+  calendar: {
+    // Editor-side check for the calendar card: normalize whatever the author
+    // pasted, fetch the feed(s), and return the next few events so the card
+    // can show a live preview (and reject dead URLs at paste time). The
+    // public site never calls this — it renders via expandDynamicBlocks.
+    preview: defineAction({
+      input: z.object({ sources: z.array(z.string()).min(1).max(6) }),
+      handler: async ({ sources }, ctx) => {
+        requireAdmin(ctx);
+        const normalized: string[] = [];
+        for (const raw of sources) {
+          const url = normalizeCalendarSrc(raw);
+          if (!url) {
+            throw new ActionError({
+              code: 'BAD_REQUEST',
+              message: 'Paste a Google Calendar link, a calendar ID, or an .ics feed URL.',
+            });
+          }
+          normalized.push(url);
+        }
+        const repo = await getRepo(ctx.locals);
+        const settings = await repo.getSettings();
+        const tz = settings.timezone || 'UTC';
+        const now = Date.now();
+        const { events, errors } = await getCalendarEvents(normalized, {
+          displayTz: tz, now,
+          windowStartMs: now - 86_400_000,
+          windowEndMs: now + 120 * 86_400_000,
+        });
+        if (!events.length && errors.length) throw new ActionError({ code: 'BAD_GATEWAY', message: errors[0] });
+        const locale = siteLocale(settings);
+        const dayFmt = new Intl.DateTimeFormat(locale, { weekday: 'short', month: 'short', day: 'numeric', timeZone: tz });
+        const timeFmt = new Intl.DateTimeFormat(locale, { hour: 'numeric', minute: '2-digit', timeZone: tz });
+        const upcoming = events
+          .filter((e) => e.end > now)
+          .slice(0, 5)
+          .map((e) => ({
+            when: dayFmt.format(e.start) + (e.allDay ? '' : ` · ${timeFmt.format(e.start)}`),
+            title: e.title,
+            cal: e.cal,
+          }));
+        return { sources: normalized, upcoming, total: events.length };
+      },
+    }),
+  },
+
+  unsplash: {
+    search: defineAction({
+      input: z.object({ query: z.string().min(1), page: z.number().int().min(1).default(1) }),
+      handler: async ({ query, page }, ctx) => {
+        requireAdmin(ctx);
+        const key = env('UNSPLASH_ACCESS_KEY');
+        if (!key) throw new ActionError({ code: 'PRECONDITION_FAILED', message: 'Unsplash is not configured.' });
+        const res = await fetch(
+          `https://api.unsplash.com/search/photos?query=${encodeURIComponent(query)}&page=${page}&per_page=24`,
+          { headers: { Authorization: `Client-ID ${key}` } }
+        );
+        if (!res.ok) throw new ActionError({ code: 'BAD_GATEWAY', message: `Unsplash error ${res.status}` });
+        const data = (await res.json()) as {
+          total_pages: number;
+          results: {
+            id: string;
+            description: string | null;
+            alt_description: string | null;
+            width: number;
+            height: number;
+            urls: { regular: string; small: string; full: string };
+            links: { download_location: string };
+            user: { name: string; links: { html: string } };
+          }[];
+        };
+        return {
+          totalPages: data.total_pages,
+          photos: data.results.map((p) => ({
+            id: p.id,
+            alt: p.alt_description ?? p.description ?? '',
+            width: p.width,
+            height: p.height,
+            thumb: p.urls.small,
+            regular: p.urls.regular,
+            downloadLocation: p.links.download_location,
+            authorName: p.user.name,
+            authorUrl: p.user.links.html,
+          })),
+        };
+      },
+    }),
+    // Unsplash API guideline: trigger the download endpoint when a photo is used.
+    track: defineAction({
+      input: z.object({ downloadLocation: z.string().url() }),
+      handler: async ({ downloadLocation }, ctx) => {
+        requireAdmin(ctx);
+        const key = env('UNSPLASH_ACCESS_KEY');
+        if (!key || !downloadLocation.startsWith('https://api.unsplash.com/')) return { ok: false };
+        await fetch(downloadLocation, { headers: { Authorization: `Client-ID ${key}` } }).catch(() => {});
+        return { ok: true };
+      },
+    }),
+  },
+};