@actuate-media/cms-core 0.13.0 → 0.15.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Actuate Media
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Actuate Media
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/__tests__/api/api-key-auth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=api-key-auth.test.d.ts.map

package/dist/__tests__/api/api-key-auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/api-key-auth.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/api-key-auth.test.js

@@ -0,0 +1,254 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { generateApiKey } from '../../security/api-key-enhanced.js';
+// Make sure the API surface that authenticates via API keys actually:
+//   1. accepts an `Authorization: Bearer act_sk_*` token without CSRF,
+//   2. enforces the key's scopes (collection + action),
+//   3. rejects revoked/expired keys.
+//
+// We don't spin up the real database for these — a mock Prisma client that
+// answers `apiKey.findUnique` and a minimal `document` interface is enough
+// to exercise the auth + CSRF skip + scope check paths.
+const VALID_SECRET = 'a'.repeat(48);
+function createMockDB(opts) {
+    const apiKey = opts.apiKey;
+    return {
+        apiKey: {
+            // `hasModel` probes for `findMany` to decide whether the model exists
+            // on the Prisma client. Including a stub here is enough to clear the
+            // check even though our tests only exercise findUnique/update.
+            findMany: async () => (apiKey ? [apiKey] : []),
+            findUnique: async ({ where }) => {
+                if (!apiKey)
+                    return null;
+                if (apiKey.keyHash !== where.keyHash)
+                    return null;
+                return apiKey;
+            },
+            update: async () => apiKey,
+        },
+        document: {
+            findMany: async () => [],
+            count: async () => 0,
+            create: async ({ data }) => ({
+                ...data,
+                id: 'doc-1',
+                createdAt: new Date(),
+                updatedAt: new Date(),
+            }),
+        },
+        user: {},
+        session: {},
+        media: {},
+    };
+}
+async function makeKey(scopes) {
+    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
+    return {
+        key,
+        record: {
+            id: 'apikey-1',
+            keyHash,
+            keyPrefix,
+            userId: 'user-1',
+            scopes,
+            ipRestrictions: null,
+            expiresAt: null,
+            lastUsedAt: null,
+            revokedAt: null,
+        },
+    };
+}
+describe('API key authentication', () => {
+    beforeEach(() => {
+        delete globalThis.__actuateConfig;
+        process.env.CMS_SECRET = VALID_SECRET;
+    });
+    it('allows a request authenticated by a valid API key (no CSRF token)', async () => {
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['read'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                collections: {
+                    posts: { slug: 'posts', labels: { singular: 'Post', plural: 'Posts' }, fields: {} },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(response.status).toBe(200);
+    });
+    it('rejects with 401 when bearer token does not match any API key in the DB', async () => {
+        const { record } = await makeKey({ admin: true });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                collections: {
+                    posts: { slug: 'posts', labels: { singular: 'Post', plural: 'Posts' }, fields: {} },
+                },
+            },
+        });
+        const fakeKey = 'act_sk_' + 'f'.repeat(64);
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts', {
+            headers: { Authorization: `Bearer ${fakeKey}` },
+        }));
+        expect(response.status).toBe(401);
+    });
+    it('rejects revoked API keys', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        record.revokedAt = new Date();
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                collections: {
+                    posts: { slug: 'posts', labels: { singular: 'Post', plural: 'Posts' }, fields: {} },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(response.status).toBe(401);
+    });
+    it('rejects expired API keys', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        record.expiresAt = new Date(Date.now() - 60_000);
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                collections: {
+                    posts: { slug: 'posts', labels: { singular: 'Post', plural: 'Posts' }, fields: {} },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(response.status).toBe(401);
+    });
+    it('rejects with 403 when scope does not include the requested collection', async () => {
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['read'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                collections: {
+                    posts: { slug: 'posts', labels: { singular: 'Post', plural: 'Posts' }, fields: {} },
+                    pages: { slug: 'pages', labels: { singular: 'Page', plural: 'Pages' }, fields: {} },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/pages', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(response.status).toBe(403);
+    });
+    it('rejects with 403 when scope does not include the requested action', async () => {
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['read'] });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                collections: {
+                    posts: { slug: 'posts', labels: { singular: 'Post', plural: 'Posts' }, fields: {} },
+                },
+            },
+        });
+        // POST should be blocked without `create` in actions — and crucially the
+        // request has no CSRF token, so we're confirming that the API-key path
+        // bypassed CSRF and got as far as scope enforcement before failing.
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ title: 'Hello' }),
+        }));
+        expect(response.status).toBe(403);
+    });
+    it('CSRF middleware does not block API-key POST requests', async () => {
+        // Same shape as the previous test but with create scope — the request
+        // should make it past CSRF, past scope, and at least into the action
+        // handler. A 500/400 from the action layer here would still mean the
+        // CSRF check passed (which is what we're asserting).
+        const { key, record } = await makeKey({
+            collections: ['posts'],
+            actions: ['create'],
+            admin: false,
+        });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                collections: {
+                    posts: { slug: 'posts', labels: { singular: 'Post', plural: 'Posts' }, fields: {} },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ title: 'Hello' }),
+        }));
+        // Should not be a 403 CSRF rejection.
+        expect(response.status).not.toBe(403);
+        if (response.status === 403) {
+            const body = await response.json().catch(() => ({}));
+            expect(body.error).not.toBe('Invalid CSRF token');
+        }
+    });
+    it('non-API-key requests still require CSRF for POST', async () => {
+        const db = createMockDB({});
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                collections: {
+                    posts: { slug: 'posts', labels: { singular: 'Post', plural: 'Posts' }, fields: {} },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/collections/posts', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ title: 'Hello' }),
+        }));
+        expect(response.status).toBe(403);
+        const body = await response.json().catch(() => ({}));
+        expect(body.error).toBe('Invalid CSRF token');
+    });
+    it('admin scope grants access to any collection', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const db = createMockDB({ apiKey: record });
+        initDB(db);
+        const handler = handleActuateAPI({
+            prismaClient: db,
+            config: {
+                collections: {
+                    posts: { slug: 'posts', labels: { singular: 'Post', plural: 'Posts' }, fields: {} },
+                    pages: { slug: 'pages', labels: { singular: 'Page', plural: 'Pages' }, fields: {} },
+                },
+            },
+        });
+        const a = await handler(new Request('https://example.com/api/cms/collections/posts', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        const b = await handler(new Request('https://example.com/api/cms/collections/pages', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(a.status).toBe(200);
+        expect(b.status).toBe(200);
+    });
+});
+//# sourceMappingURL=api-key-auth.test.js.map

package/dist/__tests__/api/api-key-auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/api-key-auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AACxD,qCAAqC;AACrC,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,wDAAwD;AAExD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAcnC,SAAS,YAAY,CAAC,IAAiE;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,OAAO;QACL,MAAM,EAAE;YACN,sEAAsE;YACtE,qEAAqE;YACrE,+DAA+D;YAC/D,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE;gBAC9D,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAA;gBACxB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAI,CAAA;gBACjD,OAAO,MAAM,CAAA;YACf,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACpB,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE,CAAC,CAAC;gBAChC,GAAG,IAAI;gBACP,EAAE,EAAE,OAAO;gBACX,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;SACH;QACD,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACH,CAAA;AACV,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE;SAChD,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;QAC7B,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAA;QAChD,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;oBACnF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACF;SACF,CAAC,CAAA;QAEF,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;SACzC,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,qDAAqD;QACrD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;YACpC,WAAW,EAAE,CAAC,OAAO,CAAC;YACtB,OAAO,EAAE,CAAC,QAAQ,CAAC;YACnB,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;QACF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;SACzC,CAAC,CACH,CAAA;QAED,sCAAsC;QACtC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACpD,MAAM,CAAE,IAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;QAC3B,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;SACzC,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACpD,MAAM,CAAE,IAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC;YAC/B,YAAY,EAAE,EAAE;YAChB,MAAM,EAAE;gBACN,WAAW,EAAE;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;oBACnF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;iBACpF;aACF;SACF,CAAC,CAAA;QAEF,MAAM,CAAC,GAAG,MAAM,OAAO,CACrB,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,MAAM,OAAO,CACrB,IAAI,OAAO,CAAC,+CAA+C,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QAED,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/public-seo.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=public-seo.test.d.ts.map

package/dist/__tests__/api/public-seo.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-seo.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/public-seo.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/public-seo.test.js

@@ -0,0 +1,341 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+function createMockDB(docs) {
+    const findFirst = async (args) => {
+        const where = args?.where ?? {};
+        const matches = docs.filter((d) => {
+            if (where.collection && d.collection !== where.collection)
+                return false;
+            if (where.status && d.status !== where.status)
+                return false;
+            if (where.deletedAt === null) {
+                // mock docs never carry deletedAt
+            }
+            if (where.OR && Array.isArray(where.OR)) {
+                return where.OR.some((clause) => {
+                    if (clause.slug !== undefined)
+                        return d.slug === clause.slug;
+                    if (clause.data?.path && clause.data?.equals) {
+                        const path = clause.data.path[0];
+                        return d.data?.[path] === clause.data.equals;
+                    }
+                    return false;
+                });
+            }
+            return true;
+        });
+        const doc = matches[0];
+        if (!doc)
+            return null;
+        return {
+            ...doc,
+            publishedAt: doc.publishedAt ?? null,
+            updatedAt: doc.updatedAt ?? new Date('2026-03-15T12:00:00Z'),
+            createdAt: doc.createdAt ?? new Date('2026-01-01T00:00:00Z'),
+            structuredData: doc.structuredData ?? null,
+        };
+    };
+    const findMany = async (args) => {
+        const where = args?.where ?? {};
+        return docs.filter((d) => {
+            if (where.collection && d.collection !== where.collection)
+                return false;
+            if (where.status && d.status !== where.status)
+                return false;
+            return true;
+        });
+    };
+    return {
+        document: { findFirst, findMany },
+        user: {},
+        session: {},
+        media: {},
+    };
+}
+describe('public SEO routes', () => {
+    beforeEach(() => {
+        delete globalThis.__actuateConfig;
+    });
+    it('exposes /sitemap.xml as a sitemap index over configured collections', async () => {
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB([]),
+            config: {
+                seo: { siteUrl: 'https://example.com', siteName: 'Example' },
+                collections: {
+                    pages: {
+                        slug: 'pages',
+                        labels: { singular: 'Page', plural: 'Pages' },
+                        urlPrefix: '',
+                        type: 'page',
+                        fields: {},
+                    },
+                    posts: {
+                        slug: 'posts',
+                        labels: { singular: 'Post', plural: 'Posts' },
+                        urlPrefix: 'blog',
+                        type: 'post',
+                        fields: {},
+                    },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/sitemap.xml'));
+        expect(response.status).toBe(200);
+        expect(response.headers.get('Content-Type')).toContain('application/xml');
+        const text = await response.text();
+        expect(text).toContain('<sitemapindex');
+        expect(text).toContain('/api/cms/sitemaps/pages.xml');
+        expect(text).toContain('/api/cms/sitemaps/posts.xml');
+    });
+    it('respects seo.sitemap.excludeCollections', async () => {
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB([]),
+            config: {
+                seo: {
+                    siteUrl: 'https://example.com',
+                    sitemap: { excludeCollections: ['drafts'] },
+                },
+                collections: {
+                    pages: {
+                        slug: 'pages',
+                        labels: { singular: 'P', plural: 'Pp' },
+                        urlPrefix: '',
+                        fields: {},
+                    },
+                    drafts: {
+                        slug: 'drafts',
+                        labels: { singular: 'D', plural: 'Dd' },
+                        urlPrefix: 'd',
+                        fields: {},
+                    },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/sitemap.xml'));
+        const text = await response.text();
+        expect(text).toContain('/sitemaps/pages.xml');
+        expect(text).not.toContain('/sitemaps/drafts.xml');
+    });
+    it('returns 404 when seo.sitemap.disabled is true', async () => {
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB([]),
+            config: {
+                seo: { siteUrl: 'https://example.com', sitemap: { disabled: true } },
+                collections: {
+                    pages: { slug: 'pages', labels: { singular: 'P', plural: 'P' }, fields: {} },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/sitemap.xml'));
+        expect(response.status).toBe(404);
+    });
+    it('renders per-collection sitemap with absolute URLs and lastmod', async () => {
+        const docs = [
+            {
+                id: '1',
+                slug: 'about',
+                collection: 'pages',
+                status: 'PUBLISHED',
+                data: { title: 'About', slug: 'about' },
+                updatedAt: new Date('2026-03-10T09:00:00Z'),
+            },
+            {
+                id: '2',
+                slug: 'contact',
+                collection: 'pages',
+                status: 'PUBLISHED',
+                data: { title: 'Contact', slug: 'contact' },
+                updatedAt: new Date('2026-03-11T09:00:00Z'),
+            },
+        ];
+        initDB(createMockDB(docs));
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB(docs),
+            config: {
+                seo: { siteUrl: 'https://example.com' },
+                collections: {
+                    pages: {
+                        slug: 'pages',
+                        labels: { singular: 'P', plural: 'Pp' },
+                        urlPrefix: '',
+                        type: 'page',
+                        fields: {},
+                    },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/sitemaps/pages.xml'));
+        expect(response.status).toBe(200);
+        const text = await response.text();
+        expect(text).toContain('<urlset');
+        expect(text).toContain('<loc>https://example.com/about</loc>');
+        expect(text).toContain('<loc>https://example.com/contact</loc>');
+        expect(text).toContain('<priority>0.8</priority>');
+        expect(text).toContain('2026-03-10T09:00:00.000Z');
+    });
+    it('returns 404 for sitemap of an unknown collection', async () => {
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB([]),
+            config: {
+                seo: { siteUrl: 'https://example.com' },
+                collections: {
+                    pages: { slug: 'pages', labels: { singular: 'P', plural: 'P' }, fields: {} },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/sitemaps/unknown.xml'));
+        expect(response.status).toBe(404);
+    });
+    it('includes archivePath in a post-type sitemap', async () => {
+        const docs = [
+            {
+                id: '1',
+                slug: 'first',
+                collection: 'posts',
+                status: 'PUBLISHED',
+                data: { title: 'First', slug: 'first' },
+            },
+        ];
+        initDB(createMockDB(docs));
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB(docs),
+            config: {
+                seo: { siteUrl: 'https://example.com' },
+                collections: {
+                    posts: {
+                        slug: 'posts',
+                        labels: { singular: 'Post', plural: 'Posts' },
+                        urlPrefix: 'blog',
+                        type: 'post',
+                        seo: { archivePath: '/blog' },
+                        fields: {},
+                    },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/sitemaps/posts.xml'));
+        const text = await response.text();
+        expect(text).toContain('<loc>https://example.com/blog</loc>');
+        expect(text).toContain('<loc>https://example.com/blog/first</loc>');
+    });
+    it('serves /robots.txt with a Sitemap reference', async () => {
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB([]),
+            config: {
+                seo: { siteUrl: 'https://example.com' },
+                collections: {},
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/robots.txt'));
+        expect(response.status).toBe(200);
+        expect(response.headers.get('Content-Type')).toContain('text/plain');
+        const text = await response.text();
+        expect(text).toMatch(/^User-agent: \*/m);
+        expect(text).toContain('Disallow: /admin');
+        expect(text).toContain('Sitemap: https://example.com/api/cms/sitemap.xml');
+    });
+    it('appends AI bot blocks when seo.robots.blockAIBots is true', async () => {
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB([]),
+            config: {
+                seo: { siteUrl: 'https://example.com', robots: { blockAIBots: true } },
+                collections: {},
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/robots.txt'));
+        const text = await response.text();
+        expect(text).toContain('User-agent: GPTBot');
+        expect(text).toContain('User-agent: ClaudeBot');
+        expect(text).toContain('Disallow: /');
+    });
+    it('returns 404 for /robots.txt when seo.robots.disabled is true', async () => {
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB([]),
+            config: {
+                seo: { siteUrl: 'https://example.com', robots: { disabled: true } },
+                collections: {},
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/robots.txt'));
+        expect(response.status).toBe(404);
+    });
+    it('renders /og.png as an SVG OG card', async () => {
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB([]),
+            config: {
+                seo: { siteUrl: 'https://example.com', siteName: 'Example' },
+                collections: {},
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/og.png?title=Hello%20World&description=Welcome'));
+        expect(response.status).toBe(200);
+        expect(response.headers.get('Content-Type')).toContain('image/svg+xml');
+        const text = await response.text();
+        expect(text).toContain('<svg');
+        expect(text).toContain('Hello');
+        expect(text).toContain('Example');
+    });
+    it('returns 404 for /og.png when seo.ogImage.disabled is true', async () => {
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB([]),
+            config: {
+                seo: { siteUrl: 'https://example.com', ogImage: { disabled: true } },
+                collections: {},
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/og.png?title=X'));
+        expect(response.status).toBe(404);
+    });
+    it('enriches /resolve with composed jsonLd and meta', async () => {
+        const docs = [
+            {
+                id: 'post-1',
+                slug: 'hello',
+                collection: 'posts',
+                status: 'PUBLISHED',
+                data: {
+                    title: 'Hello World',
+                    slug: 'hello',
+                    metaDescription: 'A first post',
+                    authorName: 'Jane',
+                },
+                publishedAt: new Date('2026-02-01T00:00:00Z'),
+                updatedAt: new Date('2026-02-10T00:00:00Z'),
+            },
+        ];
+        initDB(createMockDB(docs));
+        const handler = handleActuateAPI({
+            prismaClient: createMockDB(docs),
+            config: {
+                seo: {
+                    siteUrl: 'https://example.com',
+                    siteName: 'Example',
+                    organization: { name: 'Example Inc' },
+                },
+                collections: {
+                    posts: {
+                        slug: 'posts',
+                        labels: { singular: 'Post', plural: 'Posts' },
+                        urlPrefix: 'blog',
+                        type: 'post',
+                        fields: {},
+                    },
+                },
+            },
+        });
+        const response = await handler(new Request('https://example.com/api/cms/resolve?path=/blog/hello'));
+        expect(response.status).toBe(200);
+        const body = (await response.json());
+        expect(body.meta).toBeDefined();
+        expect(body.meta.title).toBe('Hello World');
+        expect(body.meta.canonical).toBe('https://example.com/blog/hello');
+        expect(body.meta.tags['og:title']).toBe('Hello World');
+        expect(body.jsonLd['@type']).toBe('BlogPosting');
+        expect(body.jsonLd.author).toMatchObject({ '@type': 'Person', name: 'Jane' });
+        expect(body.jsonLd.publisher).toMatchObject({ '@type': 'Organization', name: 'Example Inc' });
+        expect(typeof body.jsonLdHtml).toBe('string');
+        expect(body.jsonLdHtml).toContain('<script type="application/ld+json">');
+    });
+});
+//# sourceMappingURL=public-seo.test.js.map