@actuate-media/cms-core 0.21.0 → 0.23.0

package/dist/__tests__/api/comments-routes.test.js

@@ -0,0 +1,266 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { createSession } from '../../auth/session.js';
+import { initDB } from '../../db.js';
+import { generateToken as generateCsrfToken } from '../../security/csrf.js';
+/**
+ * Integration tests for the comment REST endpoints introduced in slice 4
+ * of Phase 3. The point of these tests is to exercise the *handler* layer
+ * end-to-end (auth, CSRF, JSON envelopes, status code mapping) — the pure
+ * service logic is covered by `realtime/comments.test.ts`.
+ *
+ * We back the mock DB with a tiny in-memory implementation of the subset
+ * of Prisma we use, so the routes execute against real-ish data without a
+ * Postgres instance.
+ */
+const SECRET = 'test-secret-for-comments-routes-1234567890abcd';
+function createMockDB() {
+    const rows = new Map();
+    let counter = 0;
+    return {
+        rows,
+        session: {
+            findUnique: async () => ({ revokedAt: null }),
+        },
+        user: {},
+        media: {},
+        documentComment: {
+            async findUnique({ where }) {
+                return rows.get(where.id) ?? null;
+            },
+            async findMany({ where, orderBy, take, }) {
+                let r = Array.from(rows.values()).filter((row) => {
+                    if (where.documentId !== undefined && row.documentId !== where.documentId)
+                        return false;
+                    if (Object.prototype.hasOwnProperty.call(where, 'resolvedAt') && row.resolvedAt !== null)
+                        return false;
+                    if (Object.prototype.hasOwnProperty.call(where, 'deletedAt') && row.deletedAt !== null)
+                        return false;
+                    return true;
+                });
+                if (orderBy?.createdAt === 'asc') {
+                    r = r.sort((a, b) => {
+                        const ax = a.createdAt instanceof Date ? a.createdAt.getTime() : 0;
+                        const bx = b.createdAt instanceof Date ? b.createdAt.getTime() : 0;
+                        return ax - bx;
+                    });
+                }
+                if (typeof take === 'number')
+                    r = r.slice(0, take);
+                return r;
+            },
+            async create({ data, }) {
+                counter += 1;
+                const now = new Date(Date.UTC(2026, 5, 1, 0, 0, counter));
+                const row = {
+                    id: `c-${counter}`,
+                    documentId: data.documentId,
+                    parentId: data.parentId,
+                    userId: data.userId,
+                    body: data.body,
+                    anchor: data.anchor,
+                    resolvedAt: null,
+                    resolvedById: null,
+                    deletedAt: null,
+                    createdAt: now,
+                    updatedAt: now,
+                };
+                rows.set(row.id, row);
+                return row;
+            },
+            async update({ where, data }) {
+                const existing = rows.get(where.id);
+                if (!existing)
+                    throw new Error(`row ${where.id} not found`);
+                const next = {
+                    ...existing,
+                    ...data,
+                    updatedAt: new Date(),
+                };
+                rows.set(where.id, next);
+                return next;
+            },
+        },
+        auditLog: {
+            // logEvent does fire-and-forget writes; we just accept anything.
+            create: async () => ({}),
+        },
+    };
+}
+async function sessionHeaders(role, userId = 'user-1') {
+    const token = await createSession({ userId, role, sessionId: `session-${userId}` }, { secret: SECRET });
+    const csrf = await generateCsrfToken();
+    return {
+        cookie: `actuate_session=${token}; actuate_csrf=${csrf}`,
+        'x-csrf-token': csrf,
+        'content-type': 'application/json',
+    };
+}
+describe('comments REST endpoints (Phase 3 slice 4)', () => {
+    let db;
+    let handler;
+    beforeEach(() => {
+        process.env.CMS_SECRET = SECRET;
+        db = createMockDB();
+        initDB(db);
+        handler = handleActuateAPI({ prismaClient: db });
+    });
+    it('rejects unauthenticated POST', async () => {
+        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            // No session cookie — auth should reject before CSRF runs.
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ body: 'hi' }),
+        }));
+        // CSRF runs *before* auth, so an unauthenticated POST without a CSRF
+        // token returns 403 instead of 401. Either status is fine for this
+        // test — we just want to confirm anonymous writes are blocked.
+        expect([401, 403]).toContain(res.status);
+    });
+    it('requires write role for POST', async () => {
+        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            headers: await sessionHeaders('VIEWER'),
+            body: JSON.stringify({ body: 'hi' }),
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('creates a top-level comment for an editor', async () => {
+        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            headers: await sessionHeaders('EDITOR'),
+            body: JSON.stringify({ body: 'Looks great!', anchor: { from: 'AQ==', to: 'Ag==' } }),
+        }));
+        expect(res.status).toBe(201);
+        const json = (await res.json());
+        expect(json.data.body).toBe('Looks great!');
+        expect(json.data.anchor).toEqual({ from: 'AQ==', to: 'Ag==' });
+    });
+    it('returns 400 on empty body', async () => {
+        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            headers: await sessionHeaders('EDITOR'),
+            body: JSON.stringify({ body: '   ' }),
+        }));
+        expect(res.status).toBe(400);
+    });
+    it('lists active comments only by default', async () => {
+        const headers = await sessionHeaders('EDITOR');
+        await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ body: 'open one' }),
+        }));
+        const createRes = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ body: 'will resolve' }),
+        }));
+        const created = (await createRes.json());
+        await handler(new Request(`https://example.com/api/cms/comments/${created.data.id}/resolve`, {
+            method: 'POST',
+            headers,
+        }));
+        const listRes = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            headers: { cookie: headers.cookie },
+        }));
+        expect(listRes.status).toBe(200);
+        const list = (await listRes.json());
+        expect(list.data.map((c) => c.body)).toEqual(['open one']);
+        const listAll = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments?includeResolved=true', {
+            headers: { cookie: headers.cookie },
+        }));
+        const allBodies = (await listAll.json()).data.map((c) => c.body);
+        expect(allBodies).toContain('will resolve');
+    });
+    it('blocks includeDeleted for non-admins', async () => {
+        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments?includeDeleted=true', {
+            headers: { cookie: (await sessionHeaders('EDITOR')).cookie },
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('lets admins request includeDeleted', async () => {
+        const res = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments?includeDeleted=true', {
+            headers: { cookie: (await sessionHeaders('ADMIN')).cookie },
+        }));
+        expect(res.status).toBe(200);
+    });
+    it('allows the author to edit but blocks other editors', async () => {
+        const authorHeaders = await sessionHeaders('EDITOR', 'user-1');
+        const otherHeaders = await sessionHeaders('EDITOR', 'user-2');
+        const create = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            headers: authorHeaders,
+            body: JSON.stringify({ body: 'mine' }),
+        }));
+        const created = (await create.json());
+        const evil = await handler(new Request(`https://example.com/api/cms/comments/${created.data.id}`, {
+            method: 'PATCH',
+            headers: otherHeaders,
+            body: JSON.stringify({ body: 'tampered' }),
+        }));
+        expect(evil.status).toBe(403);
+        const good = await handler(new Request(`https://example.com/api/cms/comments/${created.data.id}`, {
+            method: 'PATCH',
+            headers: authorHeaders,
+            body: JSON.stringify({ body: 'fixed' }),
+        }));
+        expect(good.status).toBe(200);
+        const dto = (await good.json());
+        expect(dto.data.body).toBe('fixed');
+    });
+    it('resolves and re-opens a thread, then soft-deletes it', async () => {
+        const headers = await sessionHeaders('EDITOR');
+        const create = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ body: 'thread' }),
+        }));
+        const { data } = (await create.json());
+        const resolved = await handler(new Request(`https://example.com/api/cms/comments/${data.id}/resolve`, {
+            method: 'POST',
+            headers,
+        }));
+        expect(resolved.status).toBe(200);
+        const resolvedDto = (await resolved.json());
+        expect(resolvedDto.data.isResolved).toBe(true);
+        const reopened = await handler(new Request(`https://example.com/api/cms/comments/${data.id}/reopen`, {
+            method: 'POST',
+            headers,
+        }));
+        expect(reopened.status).toBe(200);
+        const deleted = await handler(new Request(`https://example.com/api/cms/comments/${data.id}`, {
+            method: 'DELETE',
+            headers,
+        }));
+        expect(deleted.status).toBe(200);
+        const deletedDto = (await deleted.json());
+        expect(deletedDto.data.deletedAt).not.toBeNull();
+    });
+    it('returns 404 when patching a missing comment', async () => {
+        const res = await handler(new Request('https://example.com/api/cms/comments/does-not-exist', {
+            method: 'PATCH',
+            headers: await sessionHeaders('EDITOR'),
+            body: JSON.stringify({ body: 'ghost' }),
+        }));
+        expect(res.status).toBe(404);
+    });
+    it('threads a reply through the create endpoint', async () => {
+        const headers = await sessionHeaders('EDITOR');
+        const create = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ body: 'root' }),
+        }));
+        const root = (await create.json()).data;
+        const reply = await handler(new Request('https://example.com/api/cms/documents/doc-1/comments', {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ body: 'reply', parentId: root.id }),
+        }));
+        expect(reply.status).toBe(201);
+        const replyDto = (await reply.json());
+        expect(replyDto.data.parentId).toBe(root.id);
+    });
+});
+//# sourceMappingURL=comments-routes.test.js.map

package/dist/__tests__/api/comments-routes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments-routes.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/comments-routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG3E;;;;;;;;;GASG;AAEH,MAAM,MAAM,GAAG,gDAAgD,CAAA;AAE/D,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAA;IAClD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,OAAO;QACL,IAAI;QACJ,OAAO,EAAE;YACP,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SAC9C;QACD,IAAI,EAAE,EAAE;QACR,KAAK,EAAE,EAAE;QACT,eAAe,EAAE;YACf,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAA6B;gBACnD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;YACnC,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,EACb,KAAK,EACL,OAAO,EACP,IAAI,GASL;gBACC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC/C,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;wBAAE,OAAO,KAAK,CAAA;oBACvF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;wBACtF,OAAO,KAAK,CAAA;oBACd,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;wBACpF,OAAO,KAAK,CAAA;oBACd,OAAO,IAAI,CAAA;gBACb,CAAC,CAAC,CAAA;gBACF,IAAI,OAAO,EAAE,SAAS,KAAK,KAAK,EAAE,CAAC;oBACjC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;wBAClB,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;wBAClE,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;wBAClE,OAAO,EAAE,GAAG,EAAE,CAAA;oBAChB,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAClD,OAAO,CAAC,CAAA;YACV,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EACX,IAAI,GASL;gBACC,OAAO,IAAI,CAAC,CAAA;gBACZ,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;gBACzD,MAAM,GAAG,GAAuB;oBAC9B,EAAE,EAAE,KAAK,OAAO,EAAE;oBAClB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,IAAI,CAAC,MAAsC;oBACnD,UAAU,EAAE,IAAI;oBAChB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,GAAG;oBACd,SAAS,EAAE,GAAG;iBACf,CAAA;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBACrB,OAAO,GAAG,CAAA;YACZ,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAgE;gBACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBACnC,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,YAAY,CAAC,CAAA;gBAC3D,MAAM,IAAI,GAAuB;oBAC/B,GAAG,QAAQ;oBACX,GAAG,IAAI;oBACP,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB,CAAA;gBACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;gBACxB,OAAO,IAAI,CAAA;YACb,CAAC;SACF;QACD,QAAQ,EAAE;YACR,iEAAiE;YACjE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SACzB;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAmC,EAAE,MAAM,GAAG,QAAQ;IAClF,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE,EAAE,EAChD,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,OAAO;QACL,MAAM,EAAE,mBAAmB,KAAK,kBAAkB,IAAI,EAAE;QACxD,cAAc,EAAE,IAAI;QACpB,cAAc,EAAE,kBAAkB;KACnC,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACzD,IAAI,EAAmC,CAAA;IACvC,IAAI,OAA4C,CAAA;IAEhD,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;QAC/B,EAAE,GAAG,YAAY,EAAE,CAAA;QACnB,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,2DAA2D;YAC3D,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACrC,CAAC,CACH,CAAA;QACD,qEAAqE;QACrE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACrC,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;SACrF,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4D,CAAA;QAC1F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SACtC,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,OAAO,CACX,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SAC3C,CAAC,CACH,CAAA;QACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAC7B,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SAC/C,CAAC,CACH,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA6B,CAAA;QACpE,MAAM,OAAO,CACX,IAAI,OAAO,CAAC,wCAAwC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE;YAC7E,MAAM,EAAE,MAAM;YACd,OAAO;SACR,CAAC,CACH,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SACpC,CAAC,CACH,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAsC,CAAA;QACxE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;QAE1D,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,OAAO,CAAC,2EAA2E,EAAE;YACvF,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SACpC,CAAC,CACH,CAAA;QACD,MAAM,SAAS,GAAI,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuC,CAAC,IAAI,CAAC,GAAG,CACtF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAA;QACD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0EAA0E,EAAE;YACtF,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE;SAC7D,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,0EAA0E,EAAE;YACtF,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE;SAC5D,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC9D,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAE7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACvC,CAAC,CACH,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAA6B,CAAA;QAEjE,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,IAAI,OAAO,CAAC,wCAAwC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE;YACrE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SAC3C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7B,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,IAAI,OAAO,CAAC,wCAAwC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE;YACrE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SACxC,CAAC,CACH,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA+B,CAAA;QAC7D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;SACzC,CAAC,CACH,CAAA;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAA6B,CAAA;QAElE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,wCAAwC,IAAI,CAAC,EAAE,UAAU,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO;SACR,CAAC,CACH,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAEzC,CAAA;QACD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,wCAAwC,IAAI,CAAC,EAAE,SAAS,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO;SACR,CAAC,CACH,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAC3B,IAAI,OAAO,CAAC,wCAAwC,IAAI,CAAC,EAAE,EAAE,EAAE;YAC7D,MAAM,EAAE,QAAQ;YAChB,OAAO;SACR,CAAC,CACH,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2C,CAAA;QACnF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,qDAAqD,EAAE;YACjE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SACxC,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACvC,CAAC,CACH,CAAA;QACD,MAAM,IAAI,GAAI,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAA8B,CAAC,IAAI,CAAA;QAErE,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,IAAI,OAAO,CAAC,sDAAsD,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;SAC3D,CAAC,CACH,CAAA;QACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAA0C,CAAA;QAC9E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/notifications-routes.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=notifications-routes.test.d.ts.map

package/dist/__tests__/api/notifications-routes.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications-routes.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/notifications-routes.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/notifications-routes.test.js

@@ -0,0 +1,225 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { createSession } from '../../auth/session.js';
+import { initDB } from '../../db.js';
+import { generateToken as generateCsrfToken } from '../../security/csrf.js';
+/**
+ * Integration tests for the notifications REST endpoints introduced in
+ * slice 6 of Phase 3. The pure service is covered by
+ * `realtime/notifications.test.ts`; these tests exercise the handler
+ * layer end-to-end (auth, JSON envelopes, status codes) and verify
+ * that the bell only sees its own user's rows.
+ */
+const SECRET = 'test-secret-for-notifications-routes-1234567890ab';
+function createMockDB() {
+    const rows = new Map();
+    let counter = 0;
+    let clock = Date.UTC(2026, 5, 1, 0, 0, 0);
+    return {
+        rows,
+        session: { findUnique: async () => ({ revokedAt: null }) },
+        user: {},
+        media: {},
+        documentComment: {},
+        auditLog: { create: async () => ({}) },
+        documentNotification: {
+            async create({ data, }) {
+                counter += 1;
+                clock += 1000;
+                const row = {
+                    id: `n-${counter}`,
+                    userId: data.userId,
+                    kind: data.kind,
+                    documentId: data.documentId ?? null,
+                    commentId: data.commentId ?? null,
+                    payload: data.payload,
+                    readAt: data.readAt ?? null,
+                    createdAt: new Date(clock),
+                };
+                rows.set(row.id, row);
+                return row;
+            },
+            async findUnique({ where }) {
+                return rows.get(where.id) ?? null;
+            },
+            async findMany({ where, orderBy, take, }) {
+                let r = Array.from(rows.values()).filter((row) => {
+                    if (row.userId !== where.userId)
+                        return false;
+                    if (Object.prototype.hasOwnProperty.call(where, 'readAt')) {
+                        if (where.readAt === null && row.readAt !== null)
+                            return false;
+                    }
+                    return true;
+                });
+                r.sort((a, b) => orderBy?.createdAt === 'asc'
+                    ? a.createdAt.getTime() - b.createdAt.getTime()
+                    : b.createdAt.getTime() - a.createdAt.getTime());
+                if (typeof take === 'number')
+                    r = r.slice(0, take);
+                return r;
+            },
+            async update({ where, data }) {
+                const row = rows.get(where.id);
+                if (!row)
+                    throw new Error(`row ${where.id} not found`);
+                if (data.readAt !== undefined)
+                    row.readAt = data.readAt;
+                return row;
+            },
+            async updateMany({ where, data, }) {
+                let count = 0;
+                for (const row of rows.values()) {
+                    if (row.userId !== where.userId)
+                        continue;
+                    if (where.readAt === null && row.readAt !== null)
+                        continue;
+                    row.readAt = data.readAt;
+                    count += 1;
+                }
+                return { count };
+            },
+            async count({ where }) {
+                let n = 0;
+                for (const row of rows.values()) {
+                    if (row.userId === where.userId && row.readAt === null)
+                        n += 1;
+                }
+                return n;
+            },
+        },
+    };
+}
+async function sessionHeaders(role, userId = 'user-1') {
+    const token = await createSession({ userId, role, sessionId: `session-${userId}` }, { secret: SECRET });
+    const csrf = await generateCsrfToken();
+    return {
+        cookie: `actuate_session=${token}; actuate_csrf=${csrf}`,
+        'x-csrf-token': csrf,
+        'content-type': 'application/json',
+    };
+}
+async function seedNotification(db, userId, override = {}) {
+    return db.documentNotification.create({
+        data: {
+            userId,
+            kind: 'comment_reply',
+            documentId: 'doc-1',
+            commentId: 'c-1',
+            payload: { actorId: 'someone', actorName: 'Someone', excerpt: 'hi' },
+            readAt: null,
+            ...override,
+        },
+    });
+}
+describe('notifications REST endpoints (Phase 3 slice 6)', () => {
+    let db;
+    let handler;
+    beforeEach(() => {
+        process.env.CMS_SECRET = SECRET;
+        db = createMockDB();
+        initDB(db);
+        handler = handleActuateAPI({ prismaClient: db });
+    });
+    it('rejects unauthenticated GET', async () => {
+        const res = await handler(new Request('https://example.com/api/cms/notifications'));
+        expect(res.status).toBe(401);
+    });
+    it('lists only the current user notifications', async () => {
+        await seedNotification(db, 'user-1', {
+            payload: { actorId: 'a', actorName: 'A', excerpt: 'mine' },
+        });
+        await seedNotification(db, 'user-2', {
+            payload: { actorId: 'a', actorName: 'A', excerpt: 'theirs' },
+        });
+        const headers = await sessionHeaders('EDITOR', 'user-1');
+        const res = await handler(new Request('https://example.com/api/cms/notifications', {
+            headers: { cookie: headers.cookie },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data).toHaveLength(1);
+        expect(body.data[0].payload.excerpt).toBe('mine');
+    });
+    it('returns the unread badge count', async () => {
+        await seedNotification(db, 'user-1', {
+            payload: { actorId: 'a', actorName: 'A', excerpt: 'a' },
+        });
+        await seedNotification(db, 'user-1', {
+            payload: { actorId: 'a', actorName: 'A', excerpt: 'b' },
+            readAt: new Date(),
+        });
+        const headers = await sessionHeaders('EDITOR', 'user-1');
+        const res = await handler(new Request('https://example.com/api/cms/notifications/unread-count', {
+            headers: { cookie: headers.cookie },
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.count).toBe(1);
+    });
+    it('marks a single notification read (idempotent)', async () => {
+        const n = await seedNotification(db, 'user-1');
+        const headers = await sessionHeaders('EDITOR', 'user-1');
+        const first = await handler(new Request(`https://example.com/api/cms/notifications/${n.id}/read`, {
+            method: 'POST',
+            headers,
+        }));
+        expect(first.status).toBe(200);
+        const firstBody = (await first.json());
+        expect(firstBody.data.readAt).not.toBeNull();
+        // Second mark — still 200 with the same readAt.
+        const second = await handler(new Request(`https://example.com/api/cms/notifications/${n.id}/read`, {
+            method: 'POST',
+            headers,
+        }));
+        expect(second.status).toBe(200);
+    });
+    it("forbids marking another user's notification", async () => {
+        const n = await seedNotification(db, 'user-1');
+        const headers = await sessionHeaders('EDITOR', 'user-2');
+        const res = await handler(new Request(`https://example.com/api/cms/notifications/${n.id}/read`, {
+            method: 'POST',
+            headers,
+        }));
+        expect(res.status).toBe(403);
+    });
+    it('marks all unread notifications read in one shot', async () => {
+        for (let i = 0; i < 3; i++) {
+            await seedNotification(db, 'user-1', {
+                payload: { actorId: 'a', actorName: 'A', excerpt: String(i) },
+            });
+        }
+        const headers = await sessionHeaders('EDITOR', 'user-1');
+        const res = await handler(new Request('https://example.com/api/cms/notifications/read-all', {
+            method: 'POST',
+            headers,
+        }));
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.data.count).toBe(3);
+        const after = await handler(new Request('https://example.com/api/cms/notifications/unread-count', {
+            headers: { cookie: headers.cookie },
+        }));
+        expect((await after.json()).data.count).toBe(0);
+    });
+    it('honours includeRead=true', async () => {
+        await seedNotification(db, 'user-1', {
+            payload: { actorId: 'a', actorName: 'A', excerpt: 'unread' },
+        });
+        await seedNotification(db, 'user-1', {
+            payload: { actorId: 'a', actorName: 'A', excerpt: 'read' },
+            readAt: new Date(),
+        });
+        const headers = await sessionHeaders('EDITOR', 'user-1');
+        const onlyUnread = await handler(new Request('https://example.com/api/cms/notifications', {
+            headers: { cookie: headers.cookie },
+        }));
+        expect((await onlyUnread.json()).data.map((n) => n.payload.excerpt)).toEqual(['unread']);
+        const all = await handler(new Request('https://example.com/api/cms/notifications?includeRead=true', {
+            headers: { cookie: headers.cookie },
+        }));
+        const allExcerpts = (await all.json()).data.map((n) => n.payload.excerpt);
+        expect(allExcerpts).toEqual(expect.arrayContaining(['unread', 'read']));
+    });
+});
+//# sourceMappingURL=notifications-routes.test.js.map

package/dist/__tests__/api/notifications-routes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications-routes.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/notifications-routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG3E;;;;;;GAMG;AAEH,MAAM,MAAM,GAAG,mDAAmD,CAAA;AAElE,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAA;IACvD,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAEzC,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE;QAC1D,IAAI,EAAE,EAAE;QACR,KAAK,EAAE,EAAE;QACT,eAAe,EAAE,EAAE;QACnB,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE;QACtC,oBAAoB,EAAE;YACpB,KAAK,CAAC,MAAM,CAAC,EACX,IAAI,GAKL;gBACC,OAAO,IAAI,CAAC,CAAA;gBACZ,KAAK,IAAI,IAAI,CAAA;gBACb,MAAM,GAAG,GAA4B;oBACnC,EAAE,EAAE,KAAK,OAAO,EAAE;oBAClB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;oBACnC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;oBACjC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;oBAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC;iBAC3B,CAAA;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBACrB,OAAO,GAAG,CAAA;YACZ,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAA6B;gBACnD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;YACnC,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,EACb,KAAK,EACL,OAAO,EACP,IAAI,GAKL;gBACC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;oBAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;wBAAE,OAAO,KAAK,CAAA;oBAC7C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;wBAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;4BAAE,OAAO,KAAK,CAAA;oBAChE,CAAC;oBACD,OAAO,IAAI,CAAA;gBACb,CAAC,CAAC,CAAA;gBACF,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACd,OAAO,EAAE,SAAS,KAAK,KAAK;oBAC1B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE;oBAC/C,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAClD,CAAA;gBACD,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAClD,OAAO,CAAC,CAAA;YACV,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAA6D;gBACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC9B,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,YAAY,CAAC,CAAA;gBACtD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;oBAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;gBACvD,OAAO,GAAG,CAAA;YACZ,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,EACf,KAAK,EACL,IAAI,GAIL;gBACC,IAAI,KAAK,GAAG,CAAC,CAAA;gBACb,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBAChC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;wBAAE,SAAQ;oBACzC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;wBAAE,SAAQ;oBAC1D,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;oBACxB,KAAK,IAAI,CAAC,CAAA;gBACZ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,CAAA;YAClB,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAA+C;gBAChE,IAAI,CAAC,GAAG,CAAC,CAAA;gBACT,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBAChC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;wBAAE,CAAC,IAAI,CAAC,CAAA;gBAChE,CAAC;gBACD,OAAO,CAAC,CAAA;YACV,CAAC;SACF;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAmC,EAAE,MAAM,GAAG,QAAQ;IAClF,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE,EAAE,EAChD,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,OAAO;QACL,MAAM,EAAE,mBAAmB,KAAK,kBAAkB,IAAI,EAAE;QACxD,cAAc,EAAE,IAAI;QACpB,cAAc,EAAE,kBAAkB;KACnC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,EAAmC,EACnC,MAAc,EACd,WAA6C,EAAE;IAE/C,OAAO,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;QACpC,IAAI,EAAE;YACJ,MAAM;YACN,IAAI,EAAE,eAAe;YACrB,UAAU,EAAE,OAAO;YACnB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;YACpE,MAAM,EAAE,IAAI;YACZ,GAAG,QAAQ;SACZ;KACF,CAAC,CAAA;AACJ,CAAC;AAED,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,IAAI,EAAmC,CAAA;IACvC,IAAI,OAA4C,CAAA;IAEhD,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;QAC/B,EAAE,GAAG,YAAY,EAAE,CAAA;QACnB,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;SAC3D,CAAC,CAAA;QACF,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE;SAC7D,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,2CAA2C,EAAE;YACvD,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SACpC,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuD,CAAA;QACrF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;SACxD,CAAC,CAAA;QACF,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACvD,MAAM,EAAE,IAAI,IAAI,EAAE;SACnB,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,wDAAwD,EAAE;YACpE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SACpC,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgC,CAAA;QAC9D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAExD,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,IAAI,OAAO,CAAC,6CAA6C,CAAC,CAAC,EAAE,OAAO,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO;SACR,CAAC,CACH,CAAA;QACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,SAAS,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAwC,CAAA;QAC7E,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;QAE5C,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,OAAO,CAAC,6CAA6C,CAAC,CAAC,EAAE,OAAO,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO;SACR,CAAC,CACH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,6CAA6C,CAAC,CAAC,EAAE,OAAO,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO;SACR,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE;gBACnC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE;aAC9D,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAExD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,oDAAoD,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,OAAO;SACR,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgC,CAAA;QAC9D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,IAAI,OAAO,CAAC,wDAAwD,EAAE;YACpE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SACpC,CAAC,CACH,CAAA;QACD,MAAM,CAAE,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE;SAC7D,CAAC,CAAA;QACF,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE;YACnC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE;YAC1D,MAAM,EAAE,IAAI,IAAI,EAAE;SACnB,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,MAAM,OAAO,CAC9B,IAAI,OAAO,CAAC,2CAA2C,EAAE;YACvD,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SACpC,CAAC,CACH,CAAA;QACD,MAAM,CACH,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAwD,CAAC,IAAI,CAAC,GAAG,CACxF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACzB,CACF,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;QAErB,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,4DAA4D,EAAE;YACxE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;SACpC,CAAC,CACH,CAAA;QACD,MAAM,WAAW,GACf,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/api/preview-and-scheduling.test.js

@@ -254,6 +254,59 @@ describe('GET /resolve?preview=<token>', () => {
         expect(response.status).toBe(404);
     });
 });
+describe('GET /preview/stream', () => {
+    it('rejects when no token is supplied', async () => {
+        const db = createMockDB({ docs: [] });
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: cmsConfig });
+        const response = await handler(new Request('https://example.com/api/cms/preview/stream', {
+            headers: { Accept: 'text/event-stream' },
+        }));
+        expect(response.status).toBe(401);
+    });
+    it('rejects an invalid token', async () => {
+        const db = createMockDB({ docs: [] });
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: cmsConfig });
+        const response = await handler(new Request('https://example.com/api/cms/preview/stream?token=garbage', {
+            headers: { Accept: 'text/event-stream' },
+        }));
+        expect(response.status).toBe(401);
+    });
+    it('opens an SSE stream and emits a ready event for a valid token', async () => {
+        const { key, record } = await makeKey({ admin: true });
+        const docs = [
+            {
+                id: 'doc-1',
+                collection: 'posts',
+                slug: 'live',
+                status: 'DRAFT',
+                data: { title: 'Live' },
+                publishedAt: null,
+            },
+        ];
+        const db = createMockDB({ apiKey: record, docs });
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: cmsConfig });
+        const tokenRes = await handler(new Request('https://example.com/api/cms/preview/token', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ collection: 'posts', documentId: 'doc-1' }),
+        }));
+        const token = (await tokenRes.json()).data.token;
+        const streamRes = await handler(new Request(`https://example.com/api/cms/preview/stream?token=${encodeURIComponent(token)}`, {
+            headers: { Accept: 'text/event-stream' },
+        }));
+        expect(streamRes.status).toBe(200);
+        expect(streamRes.headers.get('Content-Type')).toMatch(/text\/event-stream/);
+        const reader = streamRes.body?.getReader();
+        expect(reader).toBeDefined();
+        const { value } = await reader.read();
+        expect(value).toBeDefined();
+        expect(new TextDecoder().decode(value)).toContain('event: ready');
+        await reader.cancel().catch(() => undefined);
+    });
+});
 describe('POST /collections/:slug/:id/schedule', () => {
     it('sets scheduledAt and flips status to SCHEDULED', async () => {
         const { key, record } = await makeKey({ admin: true });