@actuate-media/cms-admin 0.66.0 → 0.68.0

package/src/hooks/useIdleLogout.ts

@@ -0,0 +1,77 @@
+'use client'
+
+import { useEffect, useRef } from 'react'
+
+/** How often the idle checker wakes up to compare against the deadline. */
+const CHECK_INTERVAL_MS = 30_000
+
+/**
+ * Signs the user out after `timeoutMs` of no user activity, when enabled by
+ * the Settings → Security "Idle auto-logout" policy.
+ *
+ * Deliberately lightweight: activity events only stamp a ref (no state, no
+ * re-renders), and a single coarse interval compares the last-activity stamp
+ * against the deadline. Returning to a hidden tab re-checks immediately via
+ * `visibilitychange`, so a tab left overnight logs out as soon as it's seen
+ * (or at the next interval tick) rather than staying signed in.
+ *
+ * All listeners and the interval are torn down on unmount or when disabled.
+ */
+export function useIdleLogout(options: {
+  enabled: boolean
+  timeoutMs: number
+  onIdle: () => void
+}): void {
+  const { enabled, timeoutMs } = options
+  // Keep the latest callback without re-subscribing listeners on every render.
+  const onIdleRef = useRef(options.onIdle)
+  onIdleRef.current = options.onIdle
+
+  useEffect(() => {
+    if (!enabled || timeoutMs <= 0 || typeof window === 'undefined') return
+
+    let lastActivity = Date.now()
+    let fired = false
+
+    const markActivity = () => {
+      lastActivity = Date.now()
+    }
+
+    const checkIdle = () => {
+      if (fired) return
+      if (Date.now() - lastActivity >= timeoutMs) {
+        fired = true
+        onIdleRef.current()
+      }
+    }
+
+    // Passive listeners — activity stamping must never block scrolling/typing.
+    const activityEvents = [
+      'pointermove',
+      'pointerdown',
+      'keydown',
+      'scroll',
+      'touchstart',
+    ] as const
+    for (const event of activityEvents) {
+      window.addEventListener(event, markActivity, { passive: true })
+    }
+
+    // A tab becoming visible again is NOT user activity — check whether the
+    // deadline passed while it was hidden and log out immediately if so.
+    const onVisibility = () => {
+      if (document.visibilityState === 'visible') checkIdle()
+    }
+    document.addEventListener('visibilitychange', onVisibility)
+
+    const interval = window.setInterval(checkIdle, Math.min(CHECK_INTERVAL_MS, timeoutMs))
+
+    return () => {
+      for (const event of activityEvents) {
+        window.removeEventListener(event, markActivity)
+      }
+      document.removeEventListener('visibilitychange', onVisibility)
+      window.clearInterval(interval)
+    }
+  }, [enabled, timeoutMs])
+}

package/src/lib/api.ts

@@ -65,7 +65,7 @@ function appendLocaleParam(endpoint: string): string {
 export async function cmsApi<T = unknown>(
   endpoint: string,
   options: RequestInit = {},
-): Promise<{ data?: T; error?: string; status: number }> {
+): Promise<{ data?: T; error?: string; code?: string; status: number }> {
   const url = `${basePath}${appendLocaleParam(endpoint)}`
   const isFormData = typeof FormData !== 'undefined' && options.body instanceof FormData
 
@@ -96,7 +96,13 @@ export async function cmsApi<T = unknown>(
     const json = await res.json().catch(() => ({}))
 
     if (!res.ok) {
-      return { error: json.error || `Request failed (${res.status})`, status: res.status }
+      return {
+        error: json.error || `Request failed (${res.status})`,
+        // Machine-readable error discriminator (e.g. IP_LOCKOUT_RISK) set by
+        // guard responses so callers can branch without parsing the message.
+        code: typeof json.code === 'string' ? json.code : undefined,
+        status: res.status,
+      }
     }
 
     return { data: json.data ?? json, status: res.status }

package/src/lib/page-editor-service.ts

@@ -64,6 +64,12 @@ export interface EditorPage {
   slug: string
   path: string
   status: PageStatus
+  /**
+   * Parent page for the tree hierarchy (`data.parentPageId`), or null for
+   * a top-level page. Preselected when arriving via "Add sub-page"
+   * (`/pages/new?parent=<id>`); editable in Page settings.
+   */
+  parentPageId: string | null
   sections: PageSection[]
   seoTitle: string
   seoDescription: string
@@ -192,6 +198,8 @@ function rowToEditorPage(doc: DocumentApiRow): EditorPage {
     slug,
     path: typeof data.path === 'string' && data.path ? data.path : slug ? `/${slug}` : '/',
     status: doc.status ?? 'DRAFT',
+    parentPageId:
+      typeof data.parentPageId === 'string' && data.parentPageId ? data.parentPageId : null,
     // Preserve unknown (externally-managed) sections so the editor can show
     // them read-only and round-trip them on save instead of dropping them.
     sections: coerceSectionsCore(data.sections, { onUnknown: 'preserve' }),
@@ -215,6 +223,7 @@ interface PageWritePayload {
   title: string
   slug: string
   path: string
+  parentPageId: string | null
   sections: PageSection[]
   metaTitle: string
   metaDescription: string
@@ -230,6 +239,7 @@ function toWriteBody(page: EditorPage, extra?: Record<string, unknown>): string
     title: page.title,
     slug: page.slug,
     path: page.path,
+    parentPageId: page.parentPageId,
     // Unmanaged sections are part of `page.sections`, so they round-trip on
     // every save (no data loss). Strip the derived `unmanaged` marker — it is
     // recomputed from the registry on read, so persisting it would only stale.
@@ -275,14 +285,18 @@ export async function publishPage(page: EditorPage): Promise<EditorPage> {
   return rowToEditorPage(res.data)
 }
 
-/** A blank page scaffold for `/pages/new`. */
-export function emptyPage(): EditorPage {
+/**
+ * A blank page scaffold for `/pages/new`. `parentPageId` is preset when
+ * the flow was entered via "Add sub-page" in the Pages tree view.
+ */
+export function emptyPage(parentPageId: string | null = null): EditorPage {
   return {
     id: null,
     title: '',
     slug: '',
     path: '',
     status: 'DRAFT',
+    parentPageId,
     sections: [],
     seoTitle: '',
     seoDescription: '',

package/src/lib/pages-tree.ts

@@ -0,0 +1,145 @@
+/**
+ * Page hierarchy resolution for the Pages tree view.
+ *
+ * Parent resolution strategy (in priority order):
+ *   1. `parentPageId` — explicit link, used when it points at a page that
+ *      exists in the set (and isn't the page itself).
+ *   2. Path-prefix derivation — for rows without a usable `parentPageId`,
+ *      the longest existing path prefix wins: "/about/team" becomes a child
+ *      of the page whose path is "/about". Missing intermediate levels are
+ *      skipped ("/a/b/c" with no "/a/b" attaches to "/a"). The root path
+ *      "/" is never treated as a prefix parent, so top-level pages stay
+ *      siblings of the homepage.
+ *
+ * Safety guarantees:
+ *   - Orphans (parent id not in the set) become roots.
+ *   - Cycles (a → b → a) are broken deterministically: walking up from each
+ *     page in input order, the edge that closes a cycle is severed and that
+ *     page becomes a root. Every page appears in the tree exactly once.
+ *   - Sibling ordering is stable: title (locale-aware), then path.
+ *
+ * Pure functions — no network, no React — so the view and the unit tests
+ * share one implementation.
+ */
+import type { Page } from './pages-service.js'
+
+export interface PageTreeNode {
+  page: Page
+  children: PageTreeNode[]
+}
+
+/** One visible row of the flattened tree table. */
+export interface PageTreeRow {
+  page: Page
+  depth: number
+  hasChildren: boolean
+}
+
+function normalizePath(path: string): string {
+  let p = path.trim()
+  if (!p.startsWith('/')) p = `/${p}`
+  p = p.replace(/\/{2,}/g, '/')
+  if (p.length > 1) p = p.replace(/\/+$/, '')
+  return p
+}
+
+/**
+ * Longest existing path-prefix parent, or null. Only prefixes with at
+ * least one segment count — "/" (the homepage) is never a derived parent.
+ */
+function derivePathParent(page: Page, idByPath: Map<string, string>): string | null {
+  const segments = normalizePath(page.path).split('/').filter(Boolean)
+  for (let i = segments.length - 1; i >= 1; i--) {
+    const prefix = `/${segments.slice(0, i).join('/')}`
+    const candidate = idByPath.get(prefix)
+    if (candidate !== undefined && candidate !== page.id) return candidate
+  }
+  return null
+}
+
+function compareSiblings(a: PageTreeNode, b: PageTreeNode): number {
+  return (
+    a.page.title.localeCompare(b.page.title) ||
+    a.page.path.localeCompare(b.page.path) ||
+    a.page.id.localeCompare(b.page.id)
+  )
+}
+
+/** Build the parent/child hierarchy for the tree view. Returns root nodes. */
+export function buildPageTree(pages: Page[]): PageTreeNode[] {
+  const byId = new Map<string, Page>()
+  for (const p of pages) byId.set(p.id, p)
+
+  // First occurrence wins on duplicate paths, keeping resolution stable
+  // with respect to input order.
+  const idByPath = new Map<string, string>()
+  for (const p of pages) {
+    const norm = normalizePath(p.path)
+    if (!idByPath.has(norm)) idByPath.set(norm, p.id)
+  }
+
+  const parentOf = new Map<string, string | null>()
+  for (const p of pages) {
+    const explicit =
+      p.parentPageId && p.parentPageId !== p.id && byId.has(p.parentPageId) ? p.parentPageId : null
+    parentOf.set(p.id, explicit ?? derivePathParent(p, idByPath))
+  }
+
+  // Cycle guard: walk each page's ancestor chain; the edge that revisits a
+  // seen node is severed, rooting that page. Deterministic in input order.
+  for (const p of pages) {
+    const seen = new Set<string>([p.id])
+    let cur = p.id
+    for (;;) {
+      const parent = parentOf.get(cur) ?? null
+      if (parent === null) break
+      if (seen.has(parent)) {
+        parentOf.set(cur, null)
+        break
+      }
+      seen.add(parent)
+      cur = parent
+    }
+  }
+
+  const nodeById = new Map<string, PageTreeNode>()
+  for (const p of pages) nodeById.set(p.id, { page: p, children: [] })
+
+  const roots: PageTreeNode[] = []
+  for (const p of pages) {
+    const node = nodeById.get(p.id)!
+    const parentId = parentOf.get(p.id) ?? null
+    const parentNode = parentId !== null ? nodeById.get(parentId) : undefined
+    if (parentNode) parentNode.children.push(node)
+    else roots.push(node)
+  }
+
+  const sortRecursive = (nodes: PageTreeNode[]) => {
+    nodes.sort(compareSiblings)
+    for (const n of nodes) sortRecursive(n.children)
+  }
+  sortRecursive(roots)
+  return roots
+}
+
+/**
+ * Flatten the tree into visible rows: children render only when their
+ * parent's id is in `expanded`.
+ */
+export function flattenPageTree(nodes: PageTreeNode[], expanded: Set<string>): PageTreeRow[] {
+  const rows: PageTreeRow[] = []
+  const walk = (list: PageTreeNode[], depth: number) => {
+    for (const node of list) {
+      const hasChildren = node.children.length > 0
+      rows.push({ page: node.page, depth, hasChildren })
+      if (hasChildren && expanded.has(node.page.id)) walk(node.children, depth + 1)
+    }
+  }
+  walk(nodes, 0)
+  return rows
+}
+
+/** Default expand state: every root node that has children starts open. */
+export function defaultExpandedIds(roots: PageTreeNode[]): Set<string> {
+  return new Set(roots.filter((n) => n.children.length > 0).map((n) => n.page.id))
+}

package/src/lib/post-types-service.ts

@@ -0,0 +1,129 @@
+import { cmsApi } from './api.js'
+
+/**
+ * Detail metadata for one post type (collection), sourced from the public
+ * `GET /collections` introspection endpoint. Read-only by design: collection
+ * schemas are file-defined in `actuate.config.ts`, so the Post Type editor
+ * inspects the live schema and generates config snippets for changes.
+ */
+export interface PostTypeFieldSummary {
+  name: string
+  type: string
+  required: boolean
+  relationTo?: string | string[]
+  options?: unknown[]
+}
+
+export interface PostTypeDetail {
+  slug: string
+  singular: string
+  plural: string
+  description: string | null
+  urlPrefix: string
+  icon: string | null
+  color: string | null
+  fields: PostTypeFieldSummary[]
+}
+
+interface CollectionDetailRow {
+  slug: string
+  labels: { singular: string; plural: string }
+  type: string
+  urlPrefix: string
+  description: string | null
+  icon: string | null
+  color: string | null
+  hidden: boolean
+  fields: PostTypeFieldSummary[]
+}
+
+export async function fetchPostTypeDetail(slug: string): Promise<PostTypeDetail | null> {
+  const res = await cmsApi<CollectionDetailRow[]>('/collections')
+  if (res.error || !res.data) {
+    throw new Error(res.error ?? 'Failed to load collections')
+  }
+  const row = res.data.find((c) => c.slug === slug)
+  if (!row) return null
+  return {
+    slug: row.slug,
+    singular: row.labels?.singular ?? slug,
+    plural: row.labels?.plural ?? slug,
+    description: row.description ?? null,
+    urlPrefix: row.urlPrefix || slug,
+    icon: row.icon ?? null,
+    color: row.color ?? null,
+    fields: Array.isArray(row.fields) ? row.fields : [],
+  }
+}
+
+/** Friendly display names for cms-core field types (design's type badges). */
+export const FIELD_TYPE_LABELS: Record<string, string> = {
+  text: 'Short Text',
+  richText: 'Rich Text',
+  number: 'Number',
+  boolean: 'Boolean',
+  date: 'Date',
+  slug: 'Slug',
+  select: 'Select',
+  relationship: 'Relation',
+  media: 'Media',
+  json: 'JSON',
+  color: 'Color',
+  url: 'URL',
+  email: 'Email',
+  array: 'List',
+  blocks: 'Blocks',
+}
+
+export function fieldTypeLabel(type: string): string {
+  return FIELD_TYPE_LABELS[type] ?? type
+}
+
+/** "clientName" / "client_name" → "Client Name" for display. */
+export function humanizeFieldName(name: string): string {
+  return name
+    .replace(/[_-]+/g, ' ')
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .replace(/\b\w/g, (c) => c.toUpperCase())
+}
+
+/** "Client Name" → "clientName" for generated field keys. */
+export function fieldKeyFromName(name: string): string {
+  const words = name
+    .replace(/[^a-zA-Z0-9]+/g, ' ')
+    .trim()
+    .split(/\s+/)
+    .filter(Boolean)
+  if (words.length === 0) return ''
+  return words
+    .map((w, i) => (i === 0 ? w.toLowerCase() : w[0]!.toUpperCase() + w.slice(1).toLowerCase()))
+    .join('')
+}
+
+export interface FieldSnippetInput {
+  key: string
+  label: string
+  type: string
+  required: boolean
+  helpText?: string
+}
+
+/**
+ * Paste-ready field entry for the collection's `fields` map in
+ * `actuate.config.ts` — same escape rules as the New Post Type snippet.
+ */
+export function renderFieldSnippet(input: FieldSnippetInput): string {
+  const esc = (s: string) => s.replace(/\\/g, '\\\\').replace(/'/g, "\\'")
+  const parts = [`type: '${input.type}'`, `label: '${esc(input.label)}'`]
+  if (input.required) parts.push('required: true')
+  if (input.helpText?.trim()) parts.push(`admin: { description: '${esc(input.helpText.trim())}' }`)
+  if (input.type === 'select') {
+    parts.push(`options: [{ label: 'Option A', value: 'option-a' }]`)
+  }
+  if (input.type === 'relationship') {
+    parts.push(`relationTo: 'posts'`)
+  }
+  return `${input.key}: { ${parts.join(', ')} },`
+}