@actuate-media/cms-admin 0.26.0 → 0.28.0

package/src/views/settings/AccessProtectionCard.tsx

@@ -0,0 +1,143 @@
+'use client'
+
+import { useId, useState } from 'react'
+import { Check, X } from 'lucide-react'
+import {
+  validateIpRange,
+  type IpAllowlistStatus,
+  type SecretsStatus,
+  type SecuritySourceMetadata,
+} from '@actuate-media/cms-core/security-center'
+import { SettingsSourceBadge } from './components.js'
+import { SecurityCard, StatusRow } from './securityPrimitives.js'
+
+export function AccessProtectionCard({
+  ipAllowlist,
+  secrets,
+  csrfEnabled,
+  uploadValidation,
+  sources,
+  onNavigate,
+}: {
+  ipAllowlist: IpAllowlistStatus
+  secrets: SecretsStatus
+  csrfEnabled: boolean
+  uploadValidation: boolean
+  sources: Record<string, SecuritySourceMetadata>
+  onNavigate?: (path: string) => void
+}) {
+  const headingId = useId()
+  const ipTestId = useId()
+  const [ipTest, setIpTest] = useState('')
+  const ipTestValid = ipTest.trim() === '' ? null : validateIpRange(ipTest)
+
+  const distributed = secrets.rateLimitBackend === 'distributed'
+
+  return (
+    <SecurityCard
+      headingId={headingId}
+      title="Access & Request Protection"
+      description="Network-level access restrictions and request-level protections. These are enforced by the platform; edit network rules in config."
+    >
+      {/* ── Access restrictions ─────────────────────────────────────────── */}
+      <div className="space-y-2">
+        <div className="flex items-center justify-between gap-2">
+          <span className="text-foreground text-sm font-medium">Admin IP allowlist</span>
+          <SettingsSourceBadge meta={sources.ipAllowlist} />
+        </div>
+        <StatusRow
+          status={ipAllowlist.enabled ? 'pass' : 'unknown'}
+          label="Status"
+          value={ipAllowlist.enabled ? `${ipAllowlist.ranges.length} range(s)` : 'Not configured'}
+        />
+        {ipAllowlist.currentIp && (
+          <StatusRow
+            status={
+              ipAllowlist.currentIpAllowed === null
+                ? 'unknown'
+                : ipAllowlist.currentIpAllowed
+                  ? 'pass'
+                  : 'fail'
+            }
+            label="Your current IP"
+            value={
+              <span className="font-mono text-xs">
+                {ipAllowlist.currentIp}
+                {ipAllowlist.currentIpAllowed === false && ' (blocked)'}
+              </span>
+            }
+          />
+        )}
+        {ipAllowlist.enabled && (
+          <div className="text-muted-foreground flex flex-wrap gap-1.5 pt-1">
+            {ipAllowlist.ranges.map((r) => (
+              <code key={r} className="bg-muted rounded px-1.5 py-0.5 font-mono text-xs">
+                {r}
+              </code>
+            ))}
+          </div>
+        )}
+        <div className="pt-1">
+          <label htmlFor={ipTestId} className="text-muted-foreground mb-1 block text-sm">
+            Validate an IP or CIDR range
+          </label>
+          <div className="flex items-center gap-2">
+            <input
+              id={ipTestId}
+              type="text"
+              value={ipTest}
+              onChange={(e) => setIpTest(e.target.value)}
+              placeholder="e.g. 203.0.113.0/24"
+              className="border-border bg-input-background text-foreground focus-visible:ring-ring w-full max-w-xs rounded-md border px-3 py-1.5 font-mono text-sm focus-visible:ring-2 focus-visible:outline-none"
+            />
+            {ipTestValid === true && (
+              <span className="text-success flex items-center gap-1 text-sm">
+                <Check size={15} aria-hidden="true" /> Valid
+              </span>
+            )}
+            {ipTestValid === false && (
+              <span className="text-destructive flex items-center gap-1 text-sm">
+                <X size={15} aria-hidden="true" /> Invalid
+              </span>
+            )}
+          </div>
+          <p className="text-muted-foreground mt-1 text-xs">
+            Add validated ranges to <code className="font-mono">admin.ipAllowlist</code> in
+            actuate.config.ts; the middleware enforces them.
+          </p>
+        </div>
+      </div>
+
+      {/* ── Request protection ──────────────────────────────────────────── */}
+      <div className="border-border mt-4 space-y-2 border-t pt-4">
+        <StatusRow
+          status={csrfEnabled ? 'pass' : 'fail'}
+          label="CSRF protection"
+          value={csrfEnabled ? 'Enabled' : 'Disabled'}
+          badge={<SettingsSourceBadge meta={sources.csrf} />}
+        />
+        <StatusRow
+          status={distributed ? 'pass' : 'warning'}
+          label="Rate limiting"
+          value={distributed ? 'Distributed (Upstash)' : 'In-memory'}
+          badge={<SettingsSourceBadge meta={sources.rateLimiting} />}
+        />
+        <StatusRow
+          status={uploadValidation ? 'pass' : 'warning'}
+          label="Upload validation"
+          value="MIME + magic bytes + SVG sanitization"
+          badge={<SettingsSourceBadge meta={sources.uploadValidation} />}
+        />
+        {onNavigate && (
+          <button
+            type="button"
+            onClick={() => onNavigate('/media')}
+            className="text-brand mt-1 text-sm hover:underline"
+          >
+            Manage upload rules in Media →
+          </button>
+        )}
+      </div>
+    </SecurityCard>
+  )
+}

package/src/views/settings/AdminThemeCard.tsx

@@ -0,0 +1,145 @@
+'use client'
+
+import { ACCENT_PRESET_LIST } from '@actuate-media/cms-core/appearance'
+import type { ColorMode, SidebarDensity } from '@actuate-media/cms-core/appearance'
+import { Check, Monitor, Moon, Sun } from 'lucide-react'
+
+import { SettingsSourceBadge } from './components.js'
+import type { UseAppearanceSettings } from './useAppearanceSettings.js'
+
+const COLOR_MODES: { value: ColorMode; label: string; Icon: typeof Sun }[] = [
+  { value: 'light', label: 'Light', Icon: Sun },
+  { value: 'dark', label: 'Dark', Icon: Moon },
+  { value: 'system', label: 'System', Icon: Monitor },
+]
+
+const DENSITIES: { value: SidebarDensity; label: string }[] = [
+  { value: 'default', label: 'Default' },
+  { value: 'compact', label: 'Compact' },
+]
+
+function SegmentedGroup<T extends string>({
+  label,
+  value,
+  options,
+  canEdit,
+  onChange,
+}: {
+  label: string
+  value: T
+  options: { value: T; label: string; Icon?: typeof Sun }[]
+  canEdit: boolean
+  onChange: (v: T) => void
+}) {
+  return (
+    <div
+      role="radiogroup"
+      aria-label={label}
+      className="border-border bg-muted inline-flex flex-wrap rounded-md border p-0.5"
+    >
+      {options.map(({ value: v, label: text, Icon }) => {
+        const active = value === v
+        return (
+          <button
+            key={v}
+            type="button"
+            role="radio"
+            aria-checked={active}
+            disabled={!canEdit}
+            onClick={() => onChange(v)}
+            className={`inline-flex items-center gap-1.5 rounded px-3 py-1.5 text-sm transition-colors disabled:cursor-not-allowed disabled:opacity-50 ${
+              active
+                ? 'bg-card text-foreground shadow-sm'
+                : 'text-muted-foreground hover:text-foreground'
+            }`}
+          >
+            {Icon && <Icon size={14} aria-hidden="true" />}
+            {text}
+          </button>
+        )
+      })}
+    </div>
+  )
+}
+
+export function AdminThemeCard({ s, canEdit }: { s: UseAppearanceSettings; canEdit: boolean }) {
+  return (
+    <section className="border-border bg-card rounded-lg border p-6">
+      <header className="mb-4">
+        <h3 className="text-foreground text-lg font-medium">Admin Theme</h3>
+        <p className="text-muted-foreground mt-0.5 text-sm">
+          Controls the default look of the admin. Individual users can override the color mode.
+        </p>
+      </header>
+
+      <div className="space-y-5">
+        <div>
+          <div className="mb-2 flex items-center gap-2">
+            <span className="text-foreground text-base font-medium">Color mode</span>
+            <SettingsSourceBadge meta={s.sources.colorMode} />
+          </div>
+          <SegmentedGroup
+            label="Color mode"
+            value={s.appearance.colorMode}
+            options={COLOR_MODES}
+            canEdit={canEdit}
+            onChange={s.setColorMode}
+          />
+        </div>
+
+        <div>
+          <div className="mb-2 flex items-center gap-2">
+            <span className="text-foreground text-base font-medium">Accent color</span>
+            <SettingsSourceBadge meta={s.sources.accent} />
+          </div>
+          <div
+            role="radiogroup"
+            aria-label="Accent color"
+            className="flex flex-wrap items-center gap-3"
+          >
+            {ACCENT_PRESET_LIST.map((preset) => {
+              const active = s.appearance.accent === preset.name
+              const editable = s.sources.accent?.editable !== false
+              return (
+                <button
+                  key={preset.name}
+                  type="button"
+                  role="radio"
+                  aria-checked={active}
+                  aria-label={preset.label}
+                  title={preset.label}
+                  disabled={!canEdit || !editable}
+                  onClick={() => s.setAccent(preset.name)}
+                  className={`focus-visible:ring-ring relative flex h-9 w-9 items-center justify-center rounded-full transition-transform focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50 ${
+                    active ? 'ring-foreground ring-2 ring-offset-2' : ''
+                  }`}
+                  style={{ backgroundColor: preset.swatch }}
+                >
+                  {active && <Check size={16} className="text-white" aria-hidden="true" />}
+                </button>
+              )
+            })}
+            {/* Text label so accent is not communicated by color alone. */}
+            <span className="text-muted-foreground text-sm">
+              {ACCENT_PRESET_LIST.find((p) => p.name === s.appearance.accent)?.label ??
+                s.appearance.accent}
+            </span>
+          </div>
+        </div>
+
+        <div>
+          <div className="mb-2 flex items-center gap-2">
+            <span className="text-foreground text-base font-medium">Sidebar density</span>
+          </div>
+          <SegmentedGroup
+            label="Sidebar density"
+            value={s.appearance.density}
+            options={DENSITIES}
+            canEdit={canEdit}
+            onChange={s.setDensity}
+          />
+        </div>
+      </div>
+    </section>
+  )
+}

package/src/views/settings/AppearanceTab.tsx

@@ -0,0 +1,81 @@
+'use client'
+
+import { AlertTriangle, Loader2 } from 'lucide-react'
+
+import { AdminThemeCard } from './AdminThemeCard.js'
+import { BrandPreviewCard } from './BrandPreviewCard.js'
+import { BrandingCard } from './BrandingCard.js'
+import { SettingsSaveBar, SettingsValidationSummary } from './components.js'
+import { TypographyMotionCard } from './TypographyMotionCard.js'
+import { useAppearanceSettings } from './useAppearanceSettings.js'
+
+export interface AppearanceTabProps {
+  /** Current user's role. Only ADMIN can persist changes. */
+  role?: string
+  config?: Record<string, unknown>
+}
+
+function CardSkeleton() {
+  return <div className="border-border bg-card h-48 animate-pulse rounded-lg border" />
+}
+
+export function AppearanceTab({ role, config }: AppearanceTabProps) {
+  const canEdit = role === 'ADMIN'
+  const s = useAppearanceSettings(canEdit, config)
+
+  if (s.loading) {
+    return (
+      <div className="space-y-4" aria-busy="true">
+        <CardSkeleton />
+        <CardSkeleton />
+        <CardSkeleton />
+      </div>
+    )
+  }
+
+  if (s.loadError) {
+    return (
+      <div
+        role="alert"
+        className="border-destructive/30 bg-destructive/10 text-destructive flex items-center justify-between gap-4 rounded-lg border p-4 text-sm"
+      >
+        <span className="flex items-center gap-2">
+          <AlertTriangle size={16} aria-hidden="true" /> {s.loadError}
+        </span>
+        <button
+          type="button"
+          onClick={s.reload}
+          className="border-destructive/40 text-destructive hover:bg-destructive/10 inline-flex items-center gap-1.5 rounded-md border px-3 py-1.5"
+        >
+          <Loader2 size={14} aria-hidden="true" /> Retry
+        </button>
+      </div>
+    )
+  }
+
+  return (
+    <div className="space-y-4">
+      {!canEdit && (
+        <p className="text-muted-foreground border-border bg-muted rounded-lg border p-3 text-sm">
+          You have read-only access to appearance settings.
+        </p>
+      )}
+
+      <SettingsValidationSummary issues={s.issues} />
+
+      <BrandingCard s={s} canEdit={canEdit} />
+      <AdminThemeCard s={s} canEdit={canEdit} />
+      <TypographyMotionCard s={s} canEdit={canEdit} />
+      <BrandPreviewCard s={s} />
+
+      <SettingsSaveBar
+        dirty={s.dirty}
+        canEdit={canEdit}
+        hasErrors={s.issues.some((i) => i.severity === 'error')}
+        saveState={s.saveState}
+        onSave={s.save}
+        onReset={s.reset}
+      />
+    </div>
+  )
+}

package/src/views/settings/AuthMfaCard.tsx

@@ -0,0 +1,118 @@
+'use client'
+
+import { useId, useState } from 'react'
+import { MFA_GRACE_PERIOD_OPTIONS } from '@actuate-media/cms-core/security-center'
+import { ConfirmDangerousSettingDialog, SettingsToggleRow } from './components.js'
+import { SecurityCard, StatusRow } from './securityPrimitives.js'
+import type { SecurityForm } from './useSecuritySettings.js'
+
+function graceLabel(days: number): string {
+  if (days === 0) return 'Immediately'
+  if (days === 1) return '1 day'
+  return `${days} days`
+}
+
+export function AuthMfaCard({
+  form,
+  setField,
+  canEdit,
+  viewerHasMfa,
+  withMfa,
+  totalAdmins,
+}: {
+  form: SecurityForm
+  setField: <K extends keyof SecurityForm>(key: K, value: SecurityForm[K]) => void
+  canEdit: boolean
+  viewerHasMfa: boolean
+  withMfa: number
+  totalAdmins: number
+}) {
+  const headingId = useId()
+  const graceId = useId()
+  const [confirmEnable, setConfirmEnable] = useState(false)
+
+  function requestMfaToggle(value: boolean) {
+    if (value && !form.mfaRequired) {
+      setConfirmEnable(true)
+      return
+    }
+    setField('mfaRequired', value)
+  }
+
+  // Lockout-safe: the toggle can't be turned on until the acting admin has
+  // their own MFA configured (the server enforces this too).
+  const mfaToggleDisabled = !canEdit || (!form.mfaRequired && !viewerHasMfa)
+
+  return (
+    <SecurityCard
+      headingId={headingId}
+      title="Authentication & MFA"
+      description="Require multi-factor authentication for admin accounts and control the enrollment window."
+    >
+      <div className="space-y-4">
+        <SettingsToggleRow
+          label="Require MFA for admin users"
+          description="Admins must set up a TOTP authenticator app. Existing admins are prompted to enroll within the grace period."
+          checked={form.mfaRequired}
+          disabled={mfaToggleDisabled}
+          onChange={requestMfaToggle}
+        />
+
+        <div className="flex items-center justify-between gap-4">
+          <label htmlFor={graceId} className="flex-1">
+            <span className="text-foreground text-base font-medium">Enrollment grace period</span>
+            <p className="text-muted-foreground mt-0.5 text-sm">
+              How long existing admins have to set up MFA before it is enforced.
+            </p>
+          </label>
+          <select
+            id={graceId}
+            value={form.mfaGracePeriodDays}
+            disabled={!canEdit || !form.mfaRequired}
+            onChange={(e) => setField('mfaGracePeriodDays', Number(e.target.value))}
+            className="border-border bg-input-background text-foreground focus-visible:ring-ring rounded-md border px-3 py-2 text-sm focus-visible:ring-2 focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50"
+          >
+            {MFA_GRACE_PERIOD_OPTIONS.map((d) => (
+              <option key={d} value={d}>
+                {graceLabel(d)}
+              </option>
+            ))}
+          </select>
+        </div>
+      </div>
+
+      <div className="border-border mt-4 space-y-2 border-t pt-4">
+        <StatusRow
+          status={viewerHasMfa ? 'pass' : 'warning'}
+          label="Your account"
+          value={viewerHasMfa ? 'MFA enabled' : 'MFA not set up'}
+        />
+        {!viewerHasMfa && (
+          <p className="text-muted-foreground text-sm">
+            Set up MFA on your own account before requiring it for everyone, or you may lock
+            yourself out.
+          </p>
+        )}
+        <StatusRow
+          status={totalAdmins === 0 ? 'unknown' : withMfa === totalAdmins ? 'pass' : 'warning'}
+          label="Admin MFA coverage"
+          value={totalAdmins === 0 ? 'No admins' : `${withMfa} of ${totalAdmins} admins`}
+        />
+      </div>
+
+      <ConfirmDangerousSettingDialog
+        open={confirmEnable}
+        title="Require MFA for all admin users?"
+        description={`Admins without MFA will be prompted to enroll and must complete setup within the grace period (${graceLabel(
+          form.mfaGracePeriodDays,
+        )}). Make sure your own account has MFA configured first.`}
+        confirmLabel="Require MFA"
+        onConfirm={() => {
+          setField('mfaRequired', true)
+          setConfirmEnable(false)
+        }}
+        onCancel={() => setConfirmEnable(false)}
+      />
+    </SecurityCard>
+  )
+}

package/src/views/settings/BrandPreviewCard.tsx

@@ -0,0 +1,125 @@
+'use client'
+
+import type { ResolvedAdminBrand } from '@actuate-media/cms-core/appearance'
+
+import type { UseAppearanceSettings } from './useAppearanceSettings.js'
+
+function Initials({ initials, size = 'h-8 w-8 text-sm' }: { initials: string; size?: string }) {
+  return (
+    <span
+      className={`bg-brand text-brand-foreground inline-flex shrink-0 items-center justify-center rounded-md font-medium ${size}`}
+      aria-hidden="true"
+    >
+      {initials}
+    </span>
+  )
+}
+
+/** Expanded sidebar lockup preview (primary → mark+title → initials). */
+function SidebarPreview({ admin, dark }: { admin: ResolvedAdminBrand; dark?: boolean }) {
+  const logo = dark && admin.dark ? admin.dark : admin.primary
+  return (
+    <div
+      className={`flex h-14 items-center gap-2.5 rounded-md border px-3 ${
+        dark ? 'border-border bg-foreground' : 'bg-sidebar border-sidebar-border'
+      }`}
+    >
+      {logo ? (
+        <img src={logo.url} alt={logo.alt} className="h-8 w-auto object-contain" />
+      ) : admin.mark ? (
+        <>
+          <img src={admin.mark.url} alt={admin.mark.alt} className="h-8 w-8 object-contain" />
+          <span className={dark ? 'text-background text-sm' : 'text-sidebar-foreground text-sm'}>
+            {admin.initials}
+          </span>
+        </>
+      ) : (
+        <>
+          <Initials initials={admin.initials} />
+          <span className={dark ? 'text-background text-sm' : 'text-sidebar-foreground text-sm'}>
+            Admin
+          </span>
+        </>
+      )}
+    </div>
+  )
+}
+
+function PreviewTile({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <div className="space-y-1.5">
+      <span className="text-muted-foreground text-xs font-medium">{label}</span>
+      {children}
+    </div>
+  )
+}
+
+export function BrandPreviewCard({ s }: { s: UseAppearanceSettings }) {
+  const { admin, public: pub, faviconUrl } = s.preview
+  return (
+    <section className="border-border bg-card rounded-lg border p-6">
+      <header className="mb-4 flex items-center justify-between gap-2">
+        <div>
+          <h3 className="text-foreground text-lg font-medium">Brand Preview</h3>
+          <p className="text-muted-foreground mt-0.5 text-sm">
+            How your brand renders across the admin and public site.
+          </p>
+        </div>
+        {s.dirty && (
+          <span className="text-warning bg-warning/10 border-warning/30 rounded-md border px-2 py-0.5 text-xs">
+            Unsaved
+          </span>
+        )}
+      </header>
+
+      <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3">
+        <PreviewTile label="Admin sidebar">
+          <SidebarPreview admin={admin} />
+        </PreviewTile>
+
+        <PreviewTile label="Collapsed sidebar">
+          <div className="bg-sidebar border-sidebar-border flex h-14 w-14 items-center justify-center rounded-md border">
+            {admin.mark ? (
+              <img src={admin.mark.url} alt={admin.mark.alt} className="h-8 w-8 object-contain" />
+            ) : (
+              <Initials initials={admin.initials} />
+            )}
+          </div>
+        </PreviewTile>
+
+        <PreviewTile label="Dark mode">
+          <SidebarPreview admin={admin} dark />
+        </PreviewTile>
+
+        <PreviewTile label="Public header">
+          <div className="border-border bg-background flex h-14 items-center gap-2.5 rounded-md border px-3">
+            {pub.primary ? (
+              <img
+                src={pub.primary.url}
+                alt={pub.primary.alt}
+                className="h-8 w-auto object-contain"
+              />
+            ) : pub.mark ? (
+              <>
+                <img src={pub.mark.url} alt={pub.mark.alt} className="h-8 w-8 object-contain" />
+                <span className="text-foreground text-sm">{pub.initials}</span>
+              </>
+            ) : (
+              <span className="text-foreground text-sm font-medium">{pub.initials}</span>
+            )}
+          </div>
+        </PreviewTile>
+
+        <PreviewTile label="Favicon">
+          <div className="border-border bg-muted flex h-14 w-14 items-center justify-center rounded-md border p-2">
+            {faviconUrl ? (
+              <img src={faviconUrl} alt="Favicon preview" className="h-8 w-8 object-contain" />
+            ) : (
+              <span className="text-muted-foreground text-xs">None</span>
+            )}
+          </div>
+        </PreviewTile>
+      </div>
+    </section>
+  )
+}