@acms-subir/core 0.3.29 → 0.3.31

package/src/lib/live/store.ts

@@ -40,9 +40,19 @@ export class LiveStore {
   async state(hash: string, sessionHash: string, revision: number, encrypted: string, expiresAt: number) {
     await (await this.driver()).batch([{sql:'DELETE FROM live_oauth_states WHERE expires_at<? OR session_hash=?',args:[Date.now(),sessionHash]}, {sql:'INSERT INTO live_oauth_states (hash,session_hash,revision,encrypted,expires_at) VALUES (?,?,?,?,?)',args:[hash,sessionHash,revision,encrypted,expiresAt]}]);
   }
-  async consumeState(hash: string, sessionHash: string, now: number) {
-    const rows = await (await this.driver()).all('DELETE FROM live_oauth_states WHERE hash=? AND session_hash=? AND expires_at>? RETURNING revision,encrypted', [hash,sessionHash,now]);
-    return rows[0] ? {revision:Number(rows[0].revision),encrypted:String(rows[0].encrypted)} : null;
+  // Google's redirect finds its pending state by the state value alone (it often arrives without a
+  // usable sign-in); only the signed-in admin who began it can finish it (consumeSessionStates).
+  async pendingState(hash: string, now: number) {
+    const rows = await (await this.driver()).all('SELECT encrypted,expires_at FROM live_oauth_states WHERE hash=? AND expires_at>?', [hash,now]);
+    return rows[0] ? {encrypted:String(rows[0].encrypted),expiresAt:Number(rows[0].expires_at)} : null;
+  }
+  /** Swaps in the payload with Google's code. Compare-and-swap on the old ciphertext: only the first callback counts. */
+  async attachCode(hash: string, before: string, after: string, expiresAt: number, now: number) {
+    return (await (await this.driver()).all('UPDATE live_oauth_states SET encrypted=?,expires_at=? WHERE hash=? AND encrypted=? AND expires_at>? RETURNING hash', [after,expiresAt,hash,before,now])).length > 0;
+  }
+  async consumeSessionStates(sessionHash: string, now: number) {
+    const rows = await (await this.driver()).all('DELETE FROM live_oauth_states WHERE session_hash=? AND expires_at>? RETURNING revision,encrypted', [sessionHash,now]);
+    return rows.map(r => ({revision:Number(r.revision),encrypted:String(r.encrypted)}));
   }
   async heartbeat(now: number) { await (await this.driver()).run('UPDATE live_health SET last_at=? WHERE id=1',[now]); }
   async lastHeartbeat() { return Number((await (await this.driver()).all('SELECT last_at FROM live_health WHERE id=1'))[0]?.last_at ?? 0); }

package/src/lib/mobile/schemas.ts

@@ -8,7 +8,8 @@ const Palette = z.object({ bg: str, ink: str, muted: str, line: str, accent: str
 export const Site = z.object({
   name: str, description: str, logo: str, logoDark: str, icon: str, menu: z.array(z.object({ label: str, href: str })),
   languages: z.object({ default: locale, locales: z.array(z.object({ code: str, name: str })) }),
-  features: z.object({ blog: z.array(z.object({ key: str, name: str, url: str, redirectFrom: strings })), calendar: bool, bookings: bool, search: bool, bookingChanges: bool, guestSignIn: bool, forms: bool, links: bool, live: bool }), apiVersion: z.literal(1),
+  features: z.object({ blog: z.array(z.object({ key: str, name: str, url: str, redirectFrom: strings })), calendar: bool, bookings: bool, search: bool, bookingChanges: bool, guestSignIn: bool, forms: bool, links: bool, live: bool }),
+  legal: z.object({ privacy: str.nullable(), terms: str.nullable() }), apiVersion: z.literal(1),
 });
 export const Theme = z.object({
   id: str, name: str, scheme: z.enum(['auto', 'light', 'dark']), colors: z.object({ light: Palette, dark: Palette }),

package/src/lib/mobile/site.ts

@@ -10,10 +10,13 @@ import { darkPalette, liveColor } from '../themeTokens';
 import { safeUrl } from './content';
 import { queryParams } from './http';
 import { guestSignInReady } from './guest';
+import { LEGAL } from '../legal/config';
 
 export async function getSite(repo: ContentRepository, url: URL, _id = '', locals?: unknown) {
   z.object({}).strict().parse(queryParams(url));
   const [settings, nav, pages] = await Promise.all([repo.getSettings(), repo.listNavItems(), repo.listPages()]);
+  // the privacy notice and terms: the standard pages, or published pages at those slugs
+  const legalUrl = (slug: 'privacy' | 'terms') => (LEGAL.enabled || pages.some(p => p.status === 'published' && p.slug === slug) ? `${siteOrigin(settings, url)}/${slug}` : null);
   const origin = siteOrigin(settings, url);
   const bases = new Set(Object.values(CONTENT.collections).map(c => c.base));
   const header = nav.filter(n => n.area === 'header').sort((a, b) => a.order - b.order);
@@ -38,6 +41,8 @@ export async function getSite(repo: ContentRepository, url: URL, _id = '', local
       // Integrations → Live video; GET /api/v1/live answers 404 while it's off
       live: settings.live.mode !== 'off',
     },
+    // in another site language, add /<code> after the origin, like every other page
+    legal: { privacy: legalUrl('privacy'), terms: legalUrl('terms') },
     apiVersion: 1,
   };
 }

package/src/lib/push/service.ts

@@ -252,7 +252,8 @@ export async function sendStartingSoon(repo: ContentRepository, opts: PushRunOpt
   if (!chosen.length) return 0;
   const lead = rule.minutes * MINUTE;
   const occurrences = expandEvents(chosen, settings, { displayTz: settings.timezone || 'UTC', now, windowStartMs: now, windowEndMs: now + lead + 1 })
-    .filter((o) => !o.allDay && o.start > now && o.start - lead <= now);
+    // a single cancelled date of a repeating event gets no reminder
+    .filter((o) => !o.allDay && !o.cancelled && o.start > now && o.start - lead <= now);
   const run = { ...opts, now, origin: opts.origin ?? siteOriginOf(settings, opts.fallbackOrigin) };
   let sent = 0;
   for (const o of occurrences) {

package/src/lib/repo/migrations.ts

@@ -668,12 +668,20 @@ export const MIGRATIONS: Migration[] = [
     `ALTER TABLE events ADD COLUMN host_ids TEXT NOT NULL DEFAULT '[]'`,
     `ALTER TABLE events ADD COLUMN request TEXT`,
   ] },
+  // Settings → Legal (Settings.legal): shown on /privacy and /terms, so it
+  // bumps the content version; the automatic "last updated" stamps don't
+  { version: 57, statements: [
+    `ALTER TABLE settings ADD COLUMN legal TEXT NOT NULL DEFAULT '{}'`,
+    `ALTER TABLE settings ADD COLUMN legal_stamps TEXT NOT NULL DEFAULT '{}'`,
+    `DROP TRIGGER content_version_settings_update`,
+    ...contentVersionTriggers('settings', [...CONTENT_VERSION_COLUMNS.settings, 'links_verified', 'links_avatar_shape', 'links_avatar_fit', 'links_avatar_scale', 'legal']),
+  ] },
 ];
 
 // Current cache coverage; keep earlier migration inputs frozen for upgrade compatibility.
 export const CURRENT_CONTENT_VERSION_COLUMNS = {
   ...CONTENT_VERSION_COLUMNS,
-  settings: [...CONTENT_VERSION_COLUMNS.settings, 'links_verified', 'links_avatar_shape', 'links_avatar_fit', 'links_avatar_scale'],
+  settings: [...CONTENT_VERSION_COLUMNS.settings, 'links_verified', 'links_avatar_shape', 'links_avatar_fit', 'links_avatar_scale', 'legal'],
   events: [...CONTENT_VERSION_COLUMNS.events, 'cancelled_dates'],
 };
 

package/src/lib/repo/sql.ts

@@ -939,6 +939,17 @@ export class SqlRepository implements ContentRepository {
     await this.ready;
     await this.driver.run('UPDATE events SET cancelled_dates = ?, updated_at = ? WHERE id = ?', [JSON.stringify(dates), Date.now(), id]);
   }
+  async cancelOccurrenceRsvps(id: string, start: number) {
+    await this.ready;
+    // the mutation id limits the "cancelled" emails to exactly these RSVPs (as deleteEvent does)
+    const mutation = crypto.randomUUID();
+    const notifications = bookingJobs(id,'cancelled',undefined,false,mutation).map(s=>({...s,sql:s.sql.replace('b.id = ?',"b.event_id = ? AND b.kind='rsvp'")}));
+    await this.driver.batch([
+      {sql:"UPDATE bookings SET status='cancelled',notification_version=notification_version+1,email_mutation=?,reminder_sent_at=NULL,updated_at=? WHERE event_id=? AND kind='rsvp' AND start_at=? AND status IN ('pending','confirmed')",args:[mutation,Date.now(),id,start]},
+      ...notifications,
+    ]);
+    return Number((await this.first("SELECT COUNT(*) AS n FROM bookings WHERE event_id=? AND kind='rsvp' AND email_mutation=?", [id, mutation]))?.n ?? 0);
+  }
   async discardEventDraft(id: string) {
     await this.ready;
     await this.driver.run('UPDATE events SET draft = NULL WHERE id = ?', [id]);
@@ -2032,6 +2043,8 @@ export class SqlRepository implements ContentRepository {
       push: JSON.parse(String(r?.push ?? '{}')),
       calendar: JSON.parse(String(r?.calendar ?? '{}')),
       mobileAccess: JSON.parse(String(r?.mobile_access ?? '{}')),
+      legal: JSON.parse(String(r?.legal ?? '{}')),
+      legalStamps: JSON.parse(String(r?.legal_stamps ?? '{}')),
       monitoring: JSON.parse(String(r?.monitoring ?? '{}')),
       agent: JSON.parse(String(r?.agent ?? '{}')),
       draftsApiKey: r?.drafts_api_key ?? '',
@@ -2063,9 +2076,9 @@ export class SqlRepository implements ContentRepository {
       linksAvatarShape:'links_avatar_shape', linksAvatarFit:'links_avatar_fit', linksAvatarScale:'links_avatar_scale',
       activeTheme:'active_theme', designOverrides:'design_overrides', sectionPages:'section_pages', siteLogo:'site_logo', siteLogoDark:'site_logo_dark', siteUrl:'site_url', siteFavicon:'site_favicon', siteCover:'site_cover',
       announcement:'announcement', analytics:'analytics', headCode:'head_code', footerCode:'footer_code', timezone:'timezone', locale:'locale',
-      draftsApiKey:'drafts_api_key', draftsAllowedOrigins:'drafts_allowed_origins', draftDesign:'draft_design', ai:'ai', agent:'agent', live:'live', push:'push', calendar:'calendar', mobileAccess:'mobile_access', monitoring:'monitoring',
+      draftsApiKey:'drafts_api_key', draftsAllowedOrigins:'drafts_allowed_origins', draftDesign:'draft_design', ai:'ai', agent:'agent', live:'live', push:'push', calendar:'calendar', mobileAccess:'mobile_access', monitoring:'monitoring', legal:'legal', legalStamps:'legal_stamps',
     };
-    const jsonKeys = new Set(['designOverrides','sectionPages','announcement','analytics','draftsAllowedOrigins','draftDesign','ai','agent','live','push','calendar','mobileAccess','monitoring']);
+    const jsonKeys = new Set(['designOverrides','sectionPages','announcement','analytics','draftsAllowedOrigins','draftDesign','ai','agent','live','push','calendar','mobileAccess','monitoring','legal','legalStamps']);
     const entries = Object.entries(data).filter(([k,v]) => columns[k] && v !== undefined);
     if (!entries.length) return;
     const design = entries.some(([k]) => ['activeTheme','designOverrides','sectionPages','siteLogo','siteLogoDark','siteFavicon','siteCover','draftDesign'].includes(k));

package/src/lib/repo/types.ts

@@ -149,6 +149,8 @@ export interface ContentRepository {
   discardEventDraft(id: string): Promise<void>;
   /** replace an event's cancelled occurrence keys at once, keeping any staged draft */
   setEventCancelledDates(id: string, dates: string[]): Promise<void>;
+  /** Cancels the RSVPs for one date of an event (they get the "cancelled" email). Returns how many. */
+  cancelOccurrenceRsvps(id: string, start: number): Promise<number>;
   deleteEvent(id: string): Promise<void>;
   // saved-place sync (lib/maps/places.ts): rewrite just the location of the
   // live row and/or the staged draft, leaving every other field — and the

package/src/lib/schema.ts

@@ -1,6 +1,7 @@
 import { safeEventImageUrl } from './calendar/images';
 import { LiveConfig } from './live/types';
 import { PushSettings } from './push/types';
+import { LegalSettings, LegalStamps } from './legal/types';
 import { SectionPages } from '../theme-sdk/contract.mjs';
 import { AiConfig, AgentConfig } from './ai-schema';
 import { z } from 'zod';
@@ -762,6 +763,9 @@ export const Settings = z.object({
   monitoring: Monitoring.default({}),
   // push notification automation (lib/push); the feature itself is acms({ mobile: { push } })
   push: PushSettings.default({}),
+  // Settings → Legal (lib/legal): operator details and their own sections
+  legal: LegalSettings.default({}),
+  legalStamps: LegalStamps,
   siteTitle: z.string().default('My Site'),
   tagline: z.string().default(''),
   // site-wide footer, markdown allowed; empty falls back to "title — tagline"

package/src/pages/admin/settings.astro

@@ -2,6 +2,8 @@
 import Admin from '../../layouts/Admin.astro';
 import AiSettings from '../../components/AiSettings';
 import MonitoringSettings from '../../components/MonitoringSettings';
+import LegalSettings from '../../components/LegalSettings';
+import { LEGAL } from '../../lib/legal/config';
 import { getRepo } from '../../lib/repo';
 import { accessFor } from '../../lib/permissions/access';
 import type { Permission } from '../../lib/permissions/catalog';
@@ -233,6 +235,7 @@ const groups = [
     { id: 'site', label: 'Title & description', terms: 'site title tagline url footer seo' },
     { id: 'localization', label: 'Timezone & language', terms: 'timezone locale language date' },
     { id: 'announcement', label: 'Announcement bar', terms: 'announcement banner bar' },
+    ...(can('site.settings') ? [{ id: 'legal', label: 'Legal', terms: 'legal privacy notice policy terms of service aviso de privacidad arco gdpr app store privacy data safety address' }] : []),
   ] },
   { label: 'Publishing', items: [
     ...(can('integrations.manage') ? [{ id: 'drafts-api', label: 'External drafts API', terms: 'api key drafts cors origins' }] : []),
@@ -381,6 +384,16 @@ const groups = [
         </form>
       </section>
 
+      {can('site.settings') && (
+        <section class="scard" id="legal">
+          <header class="scard-head">
+            <a class="scard-back" href="#" aria-label="All settings"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 6l-6 6 6 6" /></svg></a>
+            <div class="grow"><h2>Legal</h2><p>{LEGAL.enabled ? 'Your privacy notice and terms (/privacy, /terms): who you are, your own sections, and the answers for the app stores.' : 'The standard privacy and terms pages are off for this site.'}</p></div>
+          </header>
+          <LegalSettings client:visible />
+        </section>
+      )}
+
       <div class="set-group-title">Publishing</div>
 
       {can('integrations.manage') && (

package/src/pages/api/legal.ts

@@ -0,0 +1,23 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../lib/repo';
+import { ApiError, apiError, json, readJson } from '../../lib/api';
+import { legalAdminState, saveLegal } from '../../lib/legal/admin';
+import { requirePermission } from '../../lib/permissions/access';
+
+// Settings → Legal (General settings permission, this site's admin only).
+export const GET: APIRoute = async ({ request, cookies, locals, url }) => {
+  try {
+    const repo = await getRepo(locals);
+    await requirePermission(request, cookies, repo, 'site.settings');
+    return json(await legalAdminState(repo, url, locals));
+  } catch (e) { return apiError(e); }
+};
+export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
+  try {
+    const repo = await getRepo(locals);
+    await requirePermission(request, cookies, repo, 'site.settings');
+    if (request.headers.get('origin') !== url.origin) throw new ApiError(403, 'Change this from this site’s admin.');
+    await saveLegal(repo, await readJson(request, 200_000));
+    return json(await legalAdminState(repo, url, locals));
+  } catch (e) { return apiError(e); }
+};

package/src/pages/api/live/oauth/youtube/callback.ts

@@ -1,18 +1,15 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../../../lib/repo';
-import { ApiError } from '../../../../../lib/api';
-import { requestSessionBinding } from '../../../../../lib/auth/request';
-import { accessFor } from '../../../../../lib/permissions/access';
-import { finishOAuth } from '../../../../../lib/live/service';
-export const GET:APIRoute=async({request,cookies,locals,url})=>{
+import { receiveOAuthCallback } from '../../../../../lib/live/service';
+// Google's redirect back is a cross-site GET that may carry no usable sign-in (Clerk development
+// instances, a session token that expired on Google's screens), so it doesn't check one: it parks
+// the code on its one-use pending state, and the signed-in admin page finishes with a same-origin
+// POST (finishAuthorize) bound to the session that began it. The code never enters a URL again.
+export const GET:APIRoute=async({locals,url})=>{
   const headers={'Cache-Control':'no-store','Referrer-Policy':'no-referrer'};
   try{
-    const repo=await getRepo(locals),session=await requestSessionBinding(request,cookies,locals);
-    // OAuth is intentionally a cross-site GET. Session-bound, one-use state provides CSRF protection.
-    const access=await accessFor(request,cookies,repo);
-    if(!session||!access?.can('services.manage'))throw new ApiError(403,'Sign in as someone who manages connected services and start authorization again.');
-    await finishOAuth(repo,session,url,locals);
-    return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=connected'}});
+    await receiveOAuthCallback(await getRepo(locals),url,locals);
+    return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=finish'}});
   }catch{
     // Never reflect callback codes, tokens or provider error bodies into an HTML page or URL.
     return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=error'}});

package/src/pages/api/live/settings.ts

@@ -4,7 +4,7 @@ import { getRepo } from '../../../lib/repo';
 import { ApiError, apiError, json, readJson } from '../../../lib/api';
 import { requestSessionBinding } from '../../../lib/auth/request';
 import { Provider } from '../../../lib/live/types';
-import { adminState, beginOAuth, disconnect, saveConnection, syncConnection, validateConfig } from '../../../lib/live/service';
+import { adminState, beginOAuth, disconnect, finishOAuth, saveConnection, syncConnection, validateConfig } from '../../../lib/live/service';
 import { requirePermission } from '../../../lib/permissions/access';
 import { sendManualLiveNotice } from '../../../lib/push/service';
 const Input=z.discriminatedUnion('action',[
@@ -13,6 +13,8 @@ const Input=z.discriminatedUnion('action',[
   z.object({action:z.literal('selectChannel'),provider:z.literal('youtube'),channelId:z.string().min(1).max(200)}).strict(),
   z.object({action:z.literal('enable'),provider:Provider,enabled:z.boolean()}).strict(),
   z.object({action:z.literal('authorize'),provider:z.literal('youtube')}).strict(),
+  // after Google's redirect (?live=finish): exchange the parked code for this signed-in session
+  z.object({action:z.literal('finishAuthorize'),provider:z.literal('youtube')}).strict(),
   z.object({action:z.literal('disconnect'),provider:Provider}).strict(),
   // notify: "Notify app users" on a manual link (sends once per link; needs push)
   z.object({action:z.literal('saveConfig'),config:z.unknown(),notify:z.boolean().default(false)}).strict(),
@@ -30,6 +32,7 @@ export const POST:APIRoute=async({request,cookies,locals,url})=>{
       case 'saveConnection':await saveConnection(repo,input,locals);break;
       case 'test':await syncConnection(repo,input.provider,locals,true);break;
       case 'authorize':return json({authorizationUrl:await beginOAuth(repo,await requestSessionBinding(request,cookies,locals),url,locals)});
+      case 'finishAuthorize':await finishOAuth(repo,await requestSessionBinding(request,cookies,locals),url,locals);break;
       case 'disconnect':await disconnect(repo,input.provider,locals);break;
       case 'saveConfig':{
         await repo.updateSettings({live:validateConfig(input.config)});

package/src/styles/legal-settings.css

@@ -0,0 +1,23 @@
+/* Settings → Legal */
+.lg { display: grid; gap: 20px; }
+.lg-block { display: grid; gap: 10px; }
+.lg-block h3 { margin: 0; font-size: 14px; }
+.lg-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(240px, 1fr)); gap: 10px 16px; }
+.lg-wide { grid-column: 1 / -1; }
+.lg-warn { margin: 0; padding: 10px 12px 10px 28px; border: 1px solid var(--line); border-radius: 8px; background: var(--soft); font-size: 13px; display: grid; gap: 4px; }
+.lg-links { display: flex; flex-wrap: wrap; gap: 6px 16px; align-items: baseline; margin: 0; }
+.lg-section { display: grid; gap: 8px; margin: 0; padding: 12px; border: 1px solid var(--line); border-radius: 8px; }
+.lg-row { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; }
+.lg-title { flex: 1 1 220px; }
+.lg-section textarea, .lg-tr input, .lg-tr textarea { width: 100%; }
+.lg-tr { display: grid; gap: 6px; }
+.lg-tr summary { cursor: pointer; font-size: 13px; color: var(--muted); }
+.lg-tr[open] { gap: 6px; }
+.lg-tr[open] > * + * { margin-top: 6px; }
+.lg-table { display: grid; border: 1px solid var(--line); border-radius: 8px; overflow: hidden; font-size: 13px; }
+.lg-table > div { display: grid; grid-template-columns: minmax(140px, 1fr) 2fr 2fr; gap: 12px; padding: 10px 12px; border-top: 1px solid var(--line); }
+.lg-table > div:first-child { border-top: 0; }
+.lg-table small { display: block; margin-top: 2px; }
+.lg-th { background: var(--soft); font-weight: 600; }
+.lg-notes { margin: 0; padding-left: 18px; display: grid; gap: 4px; font-size: 13px; }
+@media (max-width: 720px) { .lg-table > div { grid-template-columns: 1fr; gap: 4px; } }

package/src/virtual.d.ts

@@ -18,7 +18,7 @@ declare module 'virtual:acms-config' {
     search?: { enabled: boolean };
     // resolved by integration.mjs; '' = pick from the environment (lib/maps/config.ts)
     maps?: { provider: '' | 'geoapify' | 'google' | 'mapbox' | 'locationiq' | 'stadia' | 'photon' | 'nominatim' | 'pelias' };
-    legal?: { enabled: boolean; operatorName: string; contactEmail: string; updatedAt: string };
+    legal?: { enabled: boolean; operatorName: string; contactEmail: string; address: string; country: string; updatedAt: string };
     // resolved by integration.mjs (lib/roles.ts and lib/permissions/catalog.ts read them)
     roles?: { key: string; label: string; summary: string; admin: boolean; home: string }[];
     permissions?: { key: string; label: string; description: string; defaults: string[]; sensitive: boolean }[];