@actuate-media/cms-core 0.22.0 → 0.23.0

package/dist/__tests__/api/collections-discovery.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=collections-discovery.test.d.ts.map

package/dist/__tests__/api/collections-discovery.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections-discovery.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/collections-discovery.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/collections-discovery.test.js

@@ -0,0 +1,129 @@
+/**
+ * Regression tests for the `/api/cms/collections` discovery endpoint
+ * shipped in PR F (Phase 7 — MCP-parity stylistic cleanup).
+ *
+ * Purpose: enumerate the configured collections without relying on the
+ * OpenAPI generator, which has historically drifted out of sync with
+ * the admin-visible surface. The endpoint is unauthenticated by design
+ * — the response contains schema-shape metadata that is already public
+ * via `/openapi.json` — but we test that contract here so a future
+ * change can't silently widen it.
+ */
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { setActuateConfig } from '../../config/runtime.js';
+const SECRET = 'test-secret-collections-discovery-pr-f-12345';
+describe('GET /api/cms/collections (PR F discovery endpoint)', () => {
+    // Snapshot every env var any test in this file touches so we can
+    // restore them in `afterEach`. Mirrors the pattern in health.test.ts —
+    // PR #155 review (Bugbot) caught that the prior implementation set
+    // CMS_SECRET in beforeEach but never restored it, leaking state into
+    // any other test that runs after this file.
+    const original = {
+        CMS_SECRET: process.env.CMS_SECRET,
+        CMS_SESSION_SECRET: process.env.CMS_SESSION_SECRET,
+    };
+    beforeEach(() => {
+        process.env.CMS_SECRET = SECRET;
+        delete process.env.CMS_SESSION_SECRET;
+    });
+    afterEach(() => {
+        for (const [k, v] of Object.entries(original)) {
+            if (v === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = v;
+        }
+        delete globalThis.__actuateConfig;
+    });
+    function makeHandler() {
+        setActuateConfig({
+            secret: SECRET,
+            collections: {
+                posts: {
+                    slug: 'posts',
+                    labels: { singular: 'Post', plural: 'Posts' },
+                    type: 'post',
+                    urlPrefix: 'blog',
+                    fields: {
+                        title: { type: 'text', required: true },
+                        body: { type: 'richText' },
+                        author: { type: 'relationship', relationTo: 'users' },
+                    },
+                },
+                pages: {
+                    slug: 'pages',
+                    labels: { singular: 'Page', plural: 'Pages' },
+                    type: 'page',
+                    fields: {
+                        title: { type: 'text', required: true },
+                        slug: { type: 'slug', required: true },
+                    },
+                },
+                hidden_internal: {
+                    slug: 'hidden_internal',
+                    labels: { singular: 'Internal', plural: 'Internal' },
+                    fields: { name: { type: 'text' } },
+                    admin: { hidden: true },
+                },
+            },
+        });
+        return handleActuateAPI({ prismaClient: {} });
+    }
+    it('returns one entry per configured collection with field summaries', async () => {
+        const handler = makeHandler();
+        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
+        expect(response.status).toBe(200);
+        const payload = (await response.json());
+        expect(payload.data).toHaveLength(3);
+        const bySlug = new Map(payload.data.map((c) => [c.slug, c]));
+        const posts = bySlug.get('posts');
+        expect(posts.labels).toEqual({ singular: 'Post', plural: 'Posts' });
+        expect(posts.type).toBe('post');
+        expect(posts.fieldCount).toBe(3);
+        expect(posts.fields).toEqual(expect.arrayContaining([
+            { name: 'title', type: 'text', required: true },
+            { name: 'body', type: 'richText', required: false },
+            { name: 'author', type: 'relationship', required: false },
+        ]));
+        const pages = bySlug.get('pages');
+        expect(pages.type).toBe('page');
+        expect(pages.fieldCount).toBe(2);
+        expect(pages.fields.find((f) => f.name === 'title')?.required).toBe(true);
+    });
+    it('surfaces admin.hidden as `hidden: true` so agents can choose to skip them', async () => {
+        // Internal collections should still be discoverable — the agent
+        // might legitimately want to read from them — but the flag lets
+        // the agent down-rank them in its planning.
+        const handler = makeHandler();
+        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
+        const payload = (await response.json());
+        const hiddenEntry = payload.data.find((c) => c.slug === 'hidden_internal');
+        expect(hiddenEntry?.hidden).toBe(true);
+        const postsEntry = payload.data.find((c) => c.slug === 'posts');
+        expect(postsEntry?.hidden).toBe(false);
+    });
+    it('returns 500 when no CMS config is registered (deploy misconfig)', async () => {
+        // Defensive: route must error loudly when getActuateConfig() is
+        // missing instead of returning `{ data: [] }`, which would lie to
+        // the MCP fallback chain about the server's actual state.
+        const handler = handleActuateAPI({ prismaClient: {} });
+        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
+        expect(response.status).toBe(500);
+    });
+    it('does not leak deeper schema (validators, hooks, access functions)', async () => {
+        // The response is unauthenticated — field-level validators or
+        // access functions could include source pointers / closure state
+        // that mustn't ship in the public surface. Keep the contract
+        // tight: only `name`, `type`, `required` per field.
+        const handler = makeHandler();
+        const response = await handler(new Request('https://example.com/api/cms/collections', { method: 'GET' }));
+        const payload = (await response.json());
+        for (const collection of payload.data) {
+            for (const field of collection.fields) {
+                expect(Object.keys(field).sort()).toEqual(['name', 'required', 'type']);
+            }
+        }
+    });
+});
+//# sourceMappingURL=collections-discovery.test.js.map

package/dist/__tests__/api/collections-discovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections-discovery.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/collections-discovery.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D,MAAM,MAAM,GAAG,8CAA8C,CAAA;AAE7D,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,iEAAiE;IACjE,uEAAuE;IACvE,mEAAmE;IACnE,qEAAqE;IACrE,4CAA4C;IAC5C,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;QAClC,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;KACnD,CAAA;IAED,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAA0B,CAAC,CAAA;;gBAC9D,OAAO,CAAC,GAAG,CAAC,CAA0B,CAAC,GAAG,CAAC,CAAA;QAClD,CAAC;QACD,OAAQ,UAA4C,CAAC,eAAe,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,SAAS,WAAW;QAClB,gBAAgB,CAAC;YACf,MAAM,EAAE,MAAM;YACd,WAAW,EAAE;gBACX,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;oBAC7C,IAAI,EAAE,MAAM;oBACZ,SAAS,EAAE,MAAM;oBACjB,MAAM,EAAE;wBACN,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;wBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE;qBACtD;iBACF;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;oBAC7C,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;qBACvC;iBACF;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;oBACpD,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;oBAClC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB;aACF;SACO,CAAC,CAAA;QACX,OAAO,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,OAAO,GAAG,WAAW,EAAE,CAAA;QAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CASrC,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAE5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAE,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAC1B,MAAM,CAAC,eAAe,CAAC;YACrB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC/C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE;YACnD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE;SAC1D,CAAC,CACH,CAAA;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAE,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,gEAAgE;QAChE,gEAAgE;QAChE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAA;QAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAErC,CAAA;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAA;QAC1E,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;QAC/D,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,gEAAgE;QAChE,kEAAkE;QAClE,0DAA0D;QAC1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,8DAA8D;QAC9D,iEAAiE;QACjE,6DAA6D;QAC7D,oDAAoD;QACpD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAA;QAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAErC,CAAA;QACD,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAqnB5C,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AA2ND,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA8rNzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAqnB5C,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AA2ND,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAquNzD"}

package/dist/api/handlers.js

@@ -776,6 +776,44 @@ export function registerCMSRoutes(router) {
             headers: { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' },
         });
     });
+    // ---------------------------------------------------------------------------
+    // Collection discovery (Phase 7 PR F)
+    //
+    // Lightweight enumeration sourced directly from `getActuateConfig()` so
+    // agents and the MCP server's `list_collections` tool don't depend on
+    // OpenAPI spec generation succeeding. OpenAPI is still the source of
+    // truth for full per-field JSON Schemas; this endpoint trades depth
+    // for reliability and surfaces just enough metadata for the agent to
+    // plan a follow-up call (create_document, list_documents, etc.).
+    //
+    // Auth: unauthenticated, like /openapi.json — the response contains
+    // only schema-shape metadata that is already public via OpenAPI.
+    // ---------------------------------------------------------------------------
+    router.get('/collections', async () => {
+        const config = getActuateConfig();
+        if (!config)
+            return errorResponse('CMS not configured', 500);
+        const collections = Object.entries(config.collections ?? {}).map(([slug, def]) => {
+            const fields = (def?.fields ?? {});
+            // Reduce each field to `{ name, type, required }` — enough for the
+            // agent to plan a create/update without sending the full validator.
+            const fieldSummary = Object.entries(fields).map(([name, fieldDef]) => ({
+                name,
+                type: typeof fieldDef?.type === 'string' ? fieldDef.type : 'unknown',
+                required: fieldDef?.required === true,
+            }));
+            return {
+                slug,
+                labels: def?.labels ?? { singular: slug, plural: slug },
+                type: def?.type ?? 'page',
+                urlPrefix: def?.urlPrefix ?? slug,
+                hidden: def?.admin?.hidden === true,
+                fieldCount: fieldSummary.length,
+                fields: fieldSummary,
+            };
+        });
+        return json({ data: collections });
+    });
     router.get('/docs', async () => {
         const html = `<!DOCTYPE html>
 <html>