@actuate-media/cms-core 0.27.0 → 0.27.1

package/dist/__tests__/api/stats-seo-cache.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=stats-seo-cache.test.d.ts.map

package/dist/__tests__/api/stats-seo-cache.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats-seo-cache.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/stats-seo-cache.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/stats-seo-cache.test.js

@@ -0,0 +1,96 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { __resetDashboardSeoCache } from '../../api/handlers.js';
+import { createSession } from '../../auth/session.js';
+import { initDB } from '../../db.js';
+import { generateToken as generateCsrfToken } from '../../security/csrf.js';
+/**
+ * `/stats` caches its average-SEO-score computation (a read + scan over
+ * up to 200 documents) per content-scope for a short TTL. These tests
+ * assert the cache is actually consulted: a second request within the
+ * window must NOT re-issue the 200-document SEO read, and clearing the
+ * cache forces a recompute.
+ */
+const SECRET = 'test-secret-for-stats-seo-cache-aaaaaaaaaaaaaaaa';
+function createMockDB(rows) {
+    let seoReadCount = 0;
+    const allRows = rows.map((r, i) => ({
+        id: `d${i}`,
+        title: `Doc ${i}`,
+        status: 'PUBLISHED',
+        collection: 'posts',
+        updatedAt: new Date(),
+        createdById: 'u1',
+        createdBy: { name: 'Author', email: 'a@example.com' },
+        data: r.data,
+    }));
+    const db = {
+        session: { findUnique: async () => ({ revokedAt: null }) },
+        user: { count: async () => 0 },
+        media: { count: async () => 0 },
+        formSubmission: { count: async () => 0 },
+        webhookEndpoint: { count: async () => 0 },
+        document: {
+            count: async () => allRows.length,
+            // The SEO read is the only `findMany` with `take: 200` + `select.data`.
+            findMany: async ({ take, select }) => {
+                if (take === 200 && select?.data)
+                    seoReadCount++;
+                return allRows;
+            },
+            groupBy: async () => [],
+        },
+    };
+    return { db, getSeoReadCount: () => seoReadCount };
+}
+async function sessionCookie() {
+    const token = await createSession({ userId: 'user-1', role: 'ADMIN', sessionId: 'session-1' }, { secret: SECRET });
+    const csrf = await generateCsrfToken();
+    return `actuate_session=${token}; actuate_csrf=${csrf}`;
+}
+const POSTS_CONFIG = { collections: { posts: { slug: 'posts', fields: {} } } };
+describe('GET /api/cms/stats — SEO score cache', () => {
+    const originalSecret = process.env.CMS_SECRET;
+    beforeEach(() => {
+        process.env.CMS_SECRET = SECRET;
+        __resetDashboardSeoCache();
+    });
+    afterEach(() => {
+        if (originalSecret === undefined)
+            delete process.env.CMS_SECRET;
+        else
+            process.env.CMS_SECRET = originalSecret;
+        delete globalThis.__actuateConfig;
+        __resetDashboardSeoCache();
+    });
+    it('computes the score once and serves repeat requests from cache', async () => {
+        const { db, getSeoReadCount } = createMockDB([
+            { data: { seoTitle: 'a', metaDescription: 'b' } }, // 50
+            { data: { seoTitle: 'a', metaDescription: 'b', canonical: 'c', schemaType: 'Article' } }, // 100
+        ]);
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: POSTS_CONFIG });
+        const cookie = await sessionCookie();
+        const call = () => handler(new Request('https://example.com/api/cms/stats', { headers: { cookie } }));
+        const first = (await (await call()).json());
+        expect(first.data.avgSeoScore).toBe(75);
+        expect(getSeoReadCount()).toBe(1);
+        const second = (await (await call()).json());
+        expect(second.data.avgSeoScore).toBe(75);
+        // Served from cache — no second 200-document read.
+        expect(getSeoReadCount()).toBe(1);
+    });
+    it('recomputes after the cache is cleared', async () => {
+        const { db, getSeoReadCount } = createMockDB([{ data: { seoTitle: 'a' } }]); // 25
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db, config: POSTS_CONFIG });
+        const cookie = await sessionCookie();
+        const call = () => handler(new Request('https://example.com/api/cms/stats', { headers: { cookie } }));
+        await call();
+        expect(getSeoReadCount()).toBe(1);
+        __resetDashboardSeoCache();
+        await call();
+        expect(getSeoReadCount()).toBe(2);
+    });
+});
+//# sourceMappingURL=stats-seo-cache.test.js.map

package/dist/__tests__/api/stats-seo-cache.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats-seo-cache.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/stats-seo-cache.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE3E;;;;;;GAMG;AAEH,MAAM,MAAM,GAAG,kDAAkD,CAAA;AAEjE,SAAS,YAAY,CAAC,IAA8C;IAClE,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,OAAO,CAAC,EAAE;QACjB,MAAM,EAAE,WAAW;QACnB,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE;QACrD,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC,CAAC,CAAA;IACH,MAAM,EAAE,GAAG;QACT,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE;QAC1D,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE;QAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE;QAC/B,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE;QACxC,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE;QACzC,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM;YACjC,wEAAwE;YACxE,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAO,EAAE,EAAE;gBACxC,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,EAAE,IAAI;oBAAE,YAAY,EAAE,CAAA;gBAChD,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;SACxB;KACF,CAAA;IACD,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,CAAA;AACpD,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,EAC3D,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,OAAO,mBAAmB,KAAK,kBAAkB,IAAI,EAAE,CAAA;AACzD,CAAC;AAED,MAAM,YAAY,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAW,CAAA;AAEvF,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAA;IAE7C,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;QAC/B,wBAAwB,EAAE,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAA;;YAC1D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,cAAc,CAAA;QAC5C,OAAQ,UAA4C,CAAC,eAAe,CAAA;QACpE,wBAAwB,EAAE,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC;YAC3C,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK;YACxD,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM;SACjG,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;QAC5E,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,OAAO,CAAC,IAAI,OAAO,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAEpF,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAsC,CAAA;QAChF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAEjC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAsC,CAAA;QACjF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxC,mDAAmD;QACnD,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA,CAAC,KAAK;QACjF,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;QAC5E,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,OAAO,CAAC,IAAI,OAAO,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAEpF,MAAM,IAAI,EAAE,CAAA;QACZ,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAEjC,wBAAwB,EAAE,CAAA;QAC1B,MAAM,IAAI,EAAE,CAAA;QACZ,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/handlers.d.ts

@@ -1,4 +1,6 @@
 import type { ApiRouter } from './router.js';
+/** Test-only: reset the SEO score cache so cases don't bleed into each other. */
+export declare function __resetDashboardSeoCache(): void;
 export declare function parseCookieHeader(cookieHeader: string): Record<string, string>;
 export declare function registerCMSRoutes(router: ApiRouter): void;
 //# sourceMappingURL=handlers.d.ts.map

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAgpB5C,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiQD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAyjPzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAogB5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiQD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA8kPzD"}

package/dist/api/handlers.js

@@ -386,6 +386,25 @@ async function safeFindMany(model, args) {
         return [];
     }
 }
+/**
+ * Short-TTL cache for the dashboard's average SEO score.
+ *
+ * `/stats` otherwise reads the `data` JSON of up to 200 published
+ * documents and scores each one on every load — the single heaviest
+ * part of the endpoint. The score barely moves minute-to-minute, so we
+ * cache it per content-scope (the JSON-stringified Prisma `where`, which
+ * encodes the registered collection allowlist) for a short window.
+ *
+ * Module-level so it survives across requests within a warm isolate;
+ * a cold start simply recomputes once. Keyed by scope so multi-config
+ * isolates never read each other's score.
+ */
+let dashboardSeoCache = null;
+const DASHBOARD_SEO_CACHE_TTL_MS = 60_000;
+/** Test-only: reset the SEO score cache so cases don't bleed into each other. */
+export function __resetDashboardSeoCache() {
+    dashboardSeoCache = null;
+}
 function isAllowedStorageUrl(url) {
     try {
         const parsed = new URL(url);
@@ -2953,6 +2972,33 @@ export function registerCMSRoutes(router) {
             score += 25;
         return score;
     }
+    /**
+     * Average SEO score across published content, cached per content-scope
+     * for `DASHBOARD_SEO_CACHE_TTL_MS`. On a cache hit this returns without
+     * touching the database — avoiding the 200-document `data` read + scan
+     * that dominates `/stats`. Failures from `safeFindMany` surface as an
+     * empty list (score 0) and are not cached, so a transient DB blip
+     * doesn't pin a stale 0.
+     */
+    async function getCachedAvgSeoScore(model, where) {
+        const key = JSON.stringify(where);
+        const now = Date.now();
+        if (dashboardSeoCache && dashboardSeoCache.key === key && dashboardSeoCache.expires > now) {
+            return dashboardSeoCache.value;
+        }
+        const docs = await safeFindMany(model, {
+            where,
+            select: { data: true },
+            take: 200,
+        });
+        let value = 0;
+        if (docs.length > 0) {
+            const total = docs.reduce((sum, doc) => sum + computeLightSeoScore(doc.data ?? {}), 0);
+            value = Math.round(total / docs.length);
+        }
+        dashboardSeoCache = { key, value, expires: now + DASHBOARD_SEO_CACHE_TTL_MS };
+        return value;
+    }
     /**
      * Collection slugs that are written by the benchmark suite and a few
      * other internal/test fixtures. Documents in these collections are
@@ -3002,7 +3048,7 @@ export function registerCMSRoutes(router) {
             // the helper above for the allowlist-vs-denylist behaviour.
             const contentWhere = userContentWhere();
             const publishedContentWhere = userContentWhere({ status: 'PUBLISHED' });
-            const [docResult, mediaResult, userResult, recentResult, collGroupResult, statusGroupResult, formResult, seoDocsResult, webhookTotalResult, webhookActiveResult,] = await Promise.allSettled([
+            const [docResult, mediaResult, userResult, recentResult, collGroupResult, statusGroupResult, formResult, seoScoreResult, webhookTotalResult, webhookActiveResult,] = await Promise.allSettled([
                 safeCount(d.document, contentWhere),
                 safeCount(d.media),
                 safeCount(d.user),
@@ -3029,11 +3075,9 @@ export function registerCMSRoutes(router) {
                 safeGroupBy(d.document, ['collection'], contentWhere),
                 safeGroupBy(d.document, ['status'], contentWhere),
                 safeCount(d.formSubmission),
-                safeFindMany(d.document, {
-                    where: publishedContentWhere,
-                    select: { data: true },
-                    take: 200,
-                }),
+                // Cached per content-scope so the 200-doc SEO read+scan runs at
+                // most once per TTL window across warm requests.
+                getCachedAvgSeoScore(d.document, publishedContentWhere),
                 // Cheap counts so the dashboard's "Content Delivery" tile doesn't need
                 // a second round-trip. `webhookEndpoint` may not exist on every host,
                 // so `safeCount` swallows missing-model errors and returns 0.
@@ -3050,12 +3094,7 @@ export function registerCMSRoutes(router) {
                 for (const g of statusGroupResult.value)
                     statusCounts[g.status] = g._count._all;
             }
-            let avgSeoScore = 0;
-            if (seoDocsResult.status === 'fulfilled' && seoDocsResult.value.length > 0) {
-                const docs = seoDocsResult.value;
-                const total = docs.reduce((sum, doc) => sum + computeLightSeoScore(doc.data ?? {}), 0);
-                avgSeoScore = Math.round(total / docs.length);
-            }
+            const avgSeoScore = seoScoreResult.status === 'fulfilled' ? seoScoreResult.value : 0;
             const recentDocs = recentResult.status === 'fulfilled'
                 ? recentResult.value.map((doc) => ({
                     id: doc.id,