@acms-subir/core 0.1.0 → 0.3.0

package/src/lib/webhooks.ts

@@ -0,0 +1,139 @@
+// Signed outgoing webhooks. emitWebhook() queues one delivery row per
+// subscribed endpoint and tries it immediately (in the background where the
+// runtime allows); failures retry with backoff from the cron sweep
+// (processDueDeliveries, run by the Worker's scheduled handler and by the
+// middleware sweep on Node). Every request carries:
+//   X-Acms-Event:      event.published
+//   X-Acms-Delivery:   <delivery id>
+//   X-Acms-Timestamp:  <unix seconds>
+//   X-Acms-Signature:  sha256=<hex HMAC-SHA256 of "<timestamp>.<body>">
+// Receivers verify by recomputing the HMAC with the endpoint secret and
+// rejecting stale timestamps.
+import type { ContentRepository } from './repo/types';
+import type { Webhook, WebhookDelivery, WebhookEventType } from './schema';
+import { isPrivateHost } from './net';
+
+export const MAX_ATTEMPTS = 4;
+// minutes until attempt n+1 (after the first immediate try)
+const BACKOFF_MIN = [1, 10, 60];
+
+const hex = (buf: ArrayBuffer) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, '0')).join('');
+
+export async function signPayload(secret: string, timestamp: number, body: string): Promise<string> {
+  const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  return `sha256=${hex(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${timestamp}.${body}`)))}`;
+}
+
+export function generateWebhookSecret(): string {
+  return `whsec_${hex(crypto.getRandomValues(new Uint8Array(24)).buffer)}`;
+}
+
+// Endpoint URLs must be public http(s): a webhook must never become a way to
+// make the server call its own network. Localhost is allowed only in dev.
+export function validateWebhookUrl(raw: string, allowPrivate = false): string {
+  let url: URL;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    throw new Error('Enter a full URL starting with https://.');
+  }
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') throw new Error('Webhook URLs must use http(s).');
+  if (url.username || url.password) throw new Error('Put credentials in the receiver, not the URL.');
+  if (!allowPrivate && isPrivateHost(url.hostname)) throw new Error('Webhook URLs must point at a public host.');
+  return url.href;
+}
+
+type Fetcher = (url: string, init: RequestInit) => Promise<Response>;
+
+export interface EmitOptions {
+  now?: number;
+  fetcher?: Fetcher;
+  // Workers: ctx.waitUntil, so the response isn't held for delivery
+  waitUntil?: (p: Promise<unknown>) => void;
+}
+
+export async function emitWebhook(
+  repo: ContentRepository,
+  event: WebhookEventType,
+  data: Record<string, unknown>,
+  opts: EmitOptions = {}
+): Promise<WebhookDelivery[]> {
+  const hooks = (await repo.listWebhooks()).filter((h) => h.active && (h.events.includes(event) || h.events.includes('*')));
+  if (!hooks.length) return [];
+  const now = opts.now ?? Date.now();
+  const rows: WebhookDelivery[] = hooks.map((h) => {
+    const id = crypto.randomUUID();
+    return {
+      id, webhookId: h.id, event,
+      payload: JSON.stringify({ id, type: event, createdAt: new Date(now).toISOString(), data }),
+      status: 'pending', attempts: 0, nextAt: now, responseCode: null, createdAt: now, deliveredAt: null,
+    };
+  });
+  await repo.createDeliveries(rows);
+  const work = Promise.all(rows.map((d) => attemptDelivery(repo, d, hooks.find((h) => h.id === d.webhookId)!, opts))).catch(() => {});
+  if (opts.waitUntil) opts.waitUntil(work);
+  else await work;
+  return rows;
+}
+
+export async function attemptDelivery(repo: ContentRepository, d: WebhookDelivery, hook: Webhook, opts: EmitOptions = {}): Promise<void> {
+  const now = opts.now ?? Date.now();
+  const fetcher: Fetcher = opts.fetcher ?? ((url, init) => fetch(url, init));
+  const ts = Math.floor(now / 1000);
+  let code: number | null = null;
+  try {
+    const res = await fetcher(hook.url, {
+      method: 'POST',
+      redirect: 'manual',
+      headers: {
+        'content-type': 'application/json',
+        'user-agent': 'acms-webhooks/1.0',
+        'x-acms-event': d.event,
+        'x-acms-delivery': d.id,
+        'x-acms-timestamp': String(ts),
+        'x-acms-signature': await signPayload(hook.secret, ts, d.payload),
+      },
+      body: d.payload,
+      signal: AbortSignal.timeout(8000),
+    });
+    code = res.status;
+    await res.body?.cancel().catch(() => {});
+  } catch {
+    code = null; // unreachable / timeout
+  }
+  const attempts = d.attempts + 1;
+  const ok = code !== null && code >= 200 && code < 300;
+  const exhausted = attempts >= MAX_ATTEMPTS;
+  await repo.recordDelivery(d.id, {
+    status: ok ? 'delivered' : exhausted ? 'failed' : 'pending',
+    attempts,
+    nextAt: ok || exhausted ? null : now + BACKOFF_MIN[Math.min(attempts - 1, BACKOFF_MIN.length - 1)] * 60_000,
+    responseCode: code,
+    deliveredAt: ok ? now : null,
+  });
+}
+
+// retry sweep: due pending deliveries, oldest first, bounded per run
+export async function processDueDeliveries(repo: ContentRepository, opts: EmitOptions = {}): Promise<number> {
+  const now = opts.now ?? Date.now();
+  const due = await repo.listDueDeliveries(now, 25);
+  if (!due.length) return 0;
+  const hooks = new Map((await repo.listWebhooks()).map((h) => [h.id, h]));
+  let n = 0;
+  for (const d of due) {
+    const hook = hooks.get(d.webhookId);
+    if (!hook || !hook.active) {
+      await repo.recordDelivery(d.id, { status: 'failed', attempts: d.attempts, nextAt: null, responseCode: null, deliveredAt: null });
+      continue;
+    }
+    await attemptDelivery(repo, d, hook, { ...opts, now });
+    n++;
+  }
+  return n;
+}
+
+// the request's background-work hook, when the runtime has one (Workers)
+export function waitUntilFrom(locals: unknown): ((p: Promise<unknown>) => void) | undefined {
+  const ctx = (locals as { runtime?: { ctx?: { waitUntil?: (p: Promise<unknown>) => void } } } | undefined)?.runtime?.ctx;
+  return ctx?.waitUntil ? (p) => ctx.waitUntil!(p) : undefined;
+}

package/src/middleware.ts

@@ -1,7 +1,11 @@
 import { defineMiddleware } from 'astro:middleware';
-import { verifySessionToken, SESSION_COOKIE } from './lib/auth';
+import { validateSession, SESSION_COOKIE } from './lib/auth';
 import { getRepo } from './lib/repo';
 import { CONTENT } from './lib/content';
+import { processDueDeliveries, waitUntilFrom } from './lib/webhooks';
+import { dispatchEmail } from './lib/email/service';
+import { sendDueReminders } from './lib/booking/service';
+import { previewParamRedirect, hasPreviewCookie } from './lib/designPreview';
 
 // Legacy content-URL redirects, checked only on would-be 404s (below) so they
 // can never shadow real content. Tags moved from `${base}/tag/` to a
@@ -56,19 +60,38 @@ export const onRequest = defineMiddleware(async (context, next) => {
     return context.redirect(pathname.replace(/\/+$/, '') + context.url.search, 301);
   }
 
+  // design preview links (?designPreview=1, ?designVersion=, ?preview=<token>,
+  // ?preview=off) become a cookie, then the clean URL — so every link clicked
+  // afterwards stays in preview mode
+  const previewTo = await previewParamRedirect(context.url, context.request.method, context.cookies, async () =>
+    Boolean(await validateSession(context.cookies.get(SESSION_COOKIE)?.value, context.locals)));
+  if (previewTo) return context.redirect(previewTo, 302);
+
   if (pathname.startsWith('/admin') && pathname !== '/admin/login') {
     const token = context.cookies.get(SESSION_COOKIE)?.value;
-    if (!verifySessionToken(token)) {
+    if (!(await validateSession(token, context.locals))) {
       return context.redirect('/admin/login');
     }
   }
 
   const now = Date.now();
-  if (now - lastPublishCheck > 60_000 && !pathname.startsWith('/media/')) {
+  if (now - lastPublishCheck > 60_000 && !pathname.startsWith('/media/') && !pathname.startsWith('/account/') && !pathname.startsWith('/api/email/')) {
     lastPublishCheck = now;
     try {
       const repo = await getRepo(context.locals);
       await repo.publishDuePosts(now);
+      // webhook retries ride the same once-a-minute sweep (Node has no
+      // cron) — in the background, never holding up this request
+      const emails = dispatchEmail(repo, context.locals, 2).catch(() => 0);
+      const wait = waitUntilFrom(context.locals);
+      if (wait) wait(emails); else await emails;
+      const retries = processDueDeliveries(repo, { now }).catch(() => {});
+      if (wait) wait(retries); else await retries;
+      // booking reminders (Node has no cron): site URL, else this request's origin
+      const reminders = repo.getSettings()
+        .then((s) => sendDueReminders(repo, { origin: s.siteUrl.replace(/\/+$/, '') || context.url.origin, locals: context.locals, now }))
+        .catch(() => {});
+      if (wait) wait(reminders); else await reminders;
     } catch {
       // never let the publish sweep break a request
     }
@@ -76,6 +99,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
   const response = await next();
 
+  // a preview render must never be cached where a visitor could get it
+  if (hasPreviewCookie(context.cookies)) {
+    try {
+      response.headers.set('Cache-Control', 'private, no-store');
+      response.headers.append('Vary', 'Cookie');
+    } catch {
+      // immutable headers (e.g. a proxied response): nothing to cache-bust
+    }
+  }
+
   // Redirects fire only when the request would otherwise 404, so a rule can
   // never shadow real content. The table is cached per isolate for a minute.
   if (response.status === 404 && !pathname.startsWith('/admin') && !pathname.startsWith('/api')) {

package/src/pages/404.astro

@@ -0,0 +1,23 @@
+---
+import Site from '../layouts/Site.astro';
+import { SEARCH } from '../lib/search-config';
+// Rendered for every unmatched URL and for routes that return an empty 404.
+Astro.response.status = 404;
+---
+
+<Site title="Page not found" noindex>
+  <div class="not-found">
+    <div class="empty-state">
+      <span class="empty-icon" aria-hidden="true"><svg viewBox="0 0 24 24" width="22" height="22" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="7" /><path d="m20 20-3.6-3.6M8.5 11h5" /></svg></span>
+      <h1>Page not found</h1>
+      <span>It moved, or it never existed.</span>
+      {SEARCH.enabled && (
+        <form action="/search" method="get" role="search">
+          <input type="search" name="q" placeholder="Search the site" aria-label="Search the site" />
+          <button class="btn primary sm" type="submit">Search</button>
+        </form>
+      )}
+      <a class="btn secondary sm" href="/">Go home</a>
+    </div>
+  </div>
+</Site>

package/src/pages/[...slug].astro

@@ -1,25 +1,28 @@
 ---
+import ThemeSections from '../components/ThemeSections.astro';
 import Site from '../layouts/Site.astro';
 import WidgetRenderer from '../components/WidgetRenderer.astro';
 import { getRepo } from '../lib/repo';
-import { verifySessionToken, SESSION_COOKIE } from '../lib/auth';
+import { validateSession, SESSION_COOKIE } from '../lib/auth';
 import { expandDynamicBlocks } from '../lib/dynamicBlocks';
 import { highlightCodeHtml } from '../lib/highlightCode';
 import { resolveDesign } from '../lib/theme';
+import { effectiveSettings } from '../lib/designPreview';
 
 const { slug } = Astro.params;
 const repo = await getRepo(Astro.locals);
 const page = slug ? await repo.getPageBySlug(slug) : null;
 
 // Drafts are visible only to a logged-in admin (doubles as draft preview).
-const isAdmin = verifySessionToken(Astro.cookies.get(SESSION_COOKIE)?.value);
+const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
 if (!page || (page.status !== 'published' && !isAdmin)) {
   return new Response(null, { status: 404, statusText: 'Not found' });
 }
 const bodyHtml = page.bodyHtml ? highlightCodeHtml(await expandDynamicBlocks(page.bodyHtml, repo)) : '';
-const settings = await repo.getSettings();
+// ?designPreview=1 (admin-only) renders the staged Design-screen changes
+const settings = await effectiveSettings(await repo.getSettings(), Astro.url, Astro.cookies, Astro.locals);
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-const PageTemplate = (page.template ? resolveDesign(settings).theme.pageTemplates[page.template] : null) as any;
+const PageTemplate = (page.template && settings.sectionPages?.[page.id]?.mode !== 'content' ? resolveDesign(settings).theme.pageTemplates[page.template] : null) as any;
 ---
 
 <Site
@@ -33,7 +36,9 @@ const PageTemplate = (page.template ? resolveDesign(settings).theme.pageTemplate
       Draft preview — only you can see this page.
     </p>
   )}
-  {PageTemplate ? (
+  {settings.sectionPages?.[page.id]?.mode === 'sections' ? (
+    <ThemeSections page={page} settings={settings} />
+  ) : PageTemplate ? (
     <PageTemplate page={page} html={bodyHtml} settings={settings} />
   ) : page.bodyHtml ? (
     <article class="page-body" set:html={bodyHtml} />

package/src/pages/account/[action].astro

@@ -0,0 +1,53 @@
+---
+import { getRepo } from '../../lib/repo';
+import { accountForm, issueAccountToken, redeemAccountToken } from '../../lib/email/accounts';
+import { sha256 } from '../../lib/email/config';
+import { dispatchEmail, kickEmail } from '../../lib/email/service';
+import { waitUntilFrom } from '../../lib/webhooks';
+import { SESSION_COOKIE } from '../../lib/auth';
+import '../../styles/admin.css';
+const action=Astro.params.action||'';
+if(!['invite','reset','forgot'].includes(action))return new Response('Not found',{status:404});
+Astro.response.headers.set('Cache-Control','no-store');
+Astro.response.headers.set('Referrer-Policy','no-referrer');
+Astro.response.headers.set('X-Robots-Tag','noindex');
+const repo=await getRepo(Astro.locals);
+const token=Astro.url.searchParams.get('token')||'';
+let error='',success='';
+if(Astro.request.method==='POST'){
+  try{
+    if(Astro.request.headers.get('origin')!==Astro.url.origin)throw new Error('Please submit this form from this site.');
+    if(Number(Astro.request.headers.get('content-length'))>10000)throw new Error('Form too large.');
+    const form=await accountForm(Astro.request);
+    const address=String(form.get('email')||'').trim().toLowerCase();
+    const ip=Astro.clientAddress||'unknown';
+    const allowed=await repo.email.rateLimit(`account-ip:${sha256(ip)}`,20,15*60000);
+    if(action==='forgot'){
+      const accountAllowed=await repo.email.rateLimit(`reset:${sha256(address)}`,3,15*60000);
+      if(allowed&&accountAllowed){
+        try { await issueAccountToken(repo,{purpose:'reset',email:address},Astro.locals); const wait=waitUntilFrom(Astro.locals); if(wait)wait(dispatchEmail(repo,Astro.locals,1).catch(()=>0)); }
+        catch { /* Generic response also covers unavailable email configuration. */ }
+      }
+      success='If an account exists for that address, a password reset email will be sent. Check your inbox.';
+    }else{
+      if(!allowed)throw new Error('Too many attempts. Please try again later.');
+      const password=String(form.get('password')||'');
+      if(password!==String(form.get('confirm')||''))throw new Error('The passwords do not match.');
+      if(!await redeemAccountToken(repo,token,password,action as 'invite'|'reset'))throw new Error('This link has expired, was used, or was revoked. Request a new link.');
+      Astro.cookies.delete(SESSION_COOKIE,{path:'/'});
+      success=action==='invite'?'Your account is ready. Sign in with your email and new password.':'Your password has changed. Sign in again with your new password.';
+      await kickEmail(repo,Astro.locals,waitUntilFrom(Astro.locals));
+    }
+  }catch(e){error=e instanceof Error?e.message:'Unable to process this request.';}
+}
+const liveToken=action==='forgot'?true:/^[a-zA-Z0-9_-]{43}$/.test(token)&&await repo.email.tokenByHash(sha256(token));
+const heading=action==='forgot'?'Forgot your password?':action==='invite'?'Accept your invitation':'Choose a new password';
+---
+<!doctype html><html lang="en"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="robots" content="noindex"/><meta name="referrer" content="no-referrer"/><title>{heading}</title></head>
+<body><main class="login-wrap"><div class="card card-pad login-card"><h1>{heading}</h1>
+{error&&<p class="flash error" role="alert">{error}</p>}
+{success?<p class="flash" role="status">{success}</p>:!liveToken?<p>This link has expired or is no longer available. Ask the owner for a new invitation or request a password reset.</p>:<form method="post">
+{action==='forgot'?<label class="field"><span>Email address</span><input name="email" type="email" autocomplete="email" required maxlength="254"/></label>:<><label class="field"><span>New password</span><input name="password" type="password" autocomplete="new-password" minlength="12" maxlength="128" required/></label><label class="field"><span>Confirm password</span><input name="confirm" type="password" autocomplete="new-password" minlength="12" maxlength="128" required/></label><p class="hint">Use at least 12 characters. This link can only be used once.</p></>}
+<button class="btn primary block" type="submit">{action==='forgot'?'Request password reset':action==='invite'?'Accept invitation':'Change password'}</button>
+</form>}
+<p><a href="/admin/login">Back to sign in</a></p></div></main></body></html>

package/src/pages/admin/ai.astro

@@ -0,0 +1,12 @@
+---
+import Admin from '../../layouts/Admin.astro';
+import AiCleaner from '../../components/AiCleaner';
+import { CONTENT } from '../../lib/content';
+const initialKind = Astro.url.searchParams.get('kind') === 'pages' ? 'pages' : 'posts';
+const requestedCollection = Astro.url.searchParams.get('collection') ?? 'posts';
+const initialCollection = CONTENT.collections[requestedCollection] ? requestedCollection : 'posts';
+const collections = Object.entries(CONTENT.collections).map(([key, value]) => ({ key, label: value.plural }));
+---
+<Admin title="Create from document" section="ai" wide>
+  <AiCleaner client:load initialKind={initialKind} initialCollection={initialCollection} collections={collections} />
+</Admin>

package/src/pages/admin/c/[collection]/[id].astro

@@ -5,7 +5,9 @@ import { createPreviewToken } from '../../../../lib/preview';
 import { resolveDesign } from '../../../../lib/theme';
 import { env } from '../../../../lib/env';
 import { BRAND } from '../../../../lib/brand';
-import { CONTENT } from '../../../../lib/content';
+import { CONTENT, collectionUrl } from '../../../../lib/content';
+import { mergePostDraft } from '../../../../lib/drafts';
+import ThemeScript from '../../../../components/ThemeScript.astro';
 import PostEditor from '../../../../components/editor/PostEditor';
 import '../../../../styles/admin.css';
 import '../../../../styles/editor.css';
@@ -22,9 +24,14 @@ const post = await repo.getPost(id);
 if (!post) return new Response(null, { status: 404 });
 if (post.collection !== key) return Astro.redirect(`/admin/c/${post.collection}/${post.id}`);
 
+// The editor hydrates from the pending draft when one exists (live posts
+// stage their edits until Update); the live URL stays on the live slug.
+const editable = mergePostDraft(post);
+const livePath = collectionUrl(post.collection, post.slug);
+
 // Canonical content is the TipTap doc (as HTML). Legacy markdown posts are
 // converted on first open and become rich content on next save.
-const initialHTML = post.bodyHtml || (post.body ? renderMarkdown(post.body) : '');
+const initialHTML = editable.bodyHtml || (editable.body ? renderMarkdown(editable.body) : '');
 const previewPath = `/preview/post/${post.id}`;
 const sharePath = `${previewPath}?token=${createPreviewToken('post', post.id)}`;
 const unsplashEnabled = Boolean(env('UNSPLASH_ACCESS_KEY'));
@@ -36,7 +43,8 @@ const templates = Object.keys(resolveDesign(settings).theme.postTemplates);
 <html lang="en">
   <head>
     <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-visual" />
+    <ThemeScript />
     <meta name="robots" content="noindex" />
     <title>{post.title || 'Untitled'} · {BRAND.name} editor</title>
     <link rel="preconnect" href="https://fonts.googleapis.com" />
@@ -45,12 +53,14 @@ const templates = Object.keys(resolveDesign(settings).theme.postTemplates);
   <body>
     <PostEditor
       client:only="react"
-      post={post}
+      post={editable}
       initialHTML={initialHTML}
       unsplashEnabled={unsplashEnabled}
       previewPath={previewPath}
       sharePath={sharePath}
+      livePath={livePath}
       templates={templates}
+      site={{ title: settings.siteTitle, url: settings.siteUrl }}
     />
   </body>
 </html>