@actuate-media/cms-core 0.35.0 → 0.35.1

package/dist/__tests__/api/globals-routes.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=globals-routes.test.d.ts.map

package/dist/__tests__/api/globals-routes.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globals-routes.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/globals-routes.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/globals-routes.test.js

@@ -0,0 +1,100 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+import { generateApiKey } from '../../security/api-key-enhanced.js';
+/**
+ * Authenticated `GET /globals/:slug` behaviour.
+ *
+ * Globals are upsert-on-write (the first PUT creates the row). A slug that has
+ * no document yet is therefore a valid EMPTY state, not a 404 — the shipped
+ * admin Settings page reads `/globals/settings` and must load cleanly on a
+ * fresh install before anything has been saved. This regression test pins
+ * that contract so we don't reintroduce the "Global not found" banner.
+ */
+const VALID_SECRET = 'a'.repeat(48);
+function createMockDB(opts) {
+    const apiKey = opts.apiKey;
+    return {
+        apiKey: {
+            findMany: async () => (apiKey ? [apiKey] : []),
+            findUnique: async ({ where }) => {
+                if (!apiKey)
+                    return null;
+                if (apiKey.keyHash !== where.keyHash)
+                    return null;
+                return apiKey;
+            },
+            update: async () => apiKey,
+        },
+        document: {
+            findFirst: async () => opts.global ?? null,
+            findMany: async () => [],
+            count: async () => 0,
+        },
+        user: {},
+        session: {},
+        media: {},
+    };
+}
+async function makeKey(scopes) {
+    const { key, keyHash, keyPrefix } = await generateApiKey({ prefix: 'act_sk', scopes });
+    return {
+        key,
+        record: {
+            id: 'apikey-1',
+            keyHash,
+            keyPrefix,
+            userId: 'user-1',
+            scopes,
+            ipRestrictions: null,
+            expiresAt: null,
+            lastUsedAt: null,
+            revokedAt: null,
+        },
+    };
+}
+function makeHandler(db) {
+    return handleActuateAPI({ prismaClient: db, config: { collections: {} } });
+}
+describe('GET /globals/:slug (authenticated)', () => {
+    beforeEach(() => {
+        delete globalThis.__actuateConfig;
+        process.env.CMS_SECRET = VALID_SECRET;
+    });
+    it('returns 200 with empty data when the global has never been saved', async () => {
+        const { key, record } = await makeKey({ globals: ['settings'] });
+        const db = createMockDB({ apiKey: record, global: null });
+        initDB(db);
+        const handler = makeHandler(db);
+        const response = await handler(new Request('https://example.com/api/cms/globals/settings', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(response.status).toBe(200);
+        await expect(response.json()).resolves.toEqual({ data: {} });
+    });
+    it('returns the stored data when the global document exists', async () => {
+        const { key, record } = await makeKey({ globals: ['settings'] });
+        const db = createMockDB({
+            apiKey: record,
+            global: { id: 'doc-1', collection: 'settings', data: { siteTitle: 'Actuate Media' } },
+        });
+        initDB(db);
+        const handler = makeHandler(db);
+        const response = await handler(new Request('https://example.com/api/cms/globals/settings', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(response.status).toBe(200);
+        await expect(response.json()).resolves.toEqual({ data: { siteTitle: 'Actuate Media' } });
+    });
+    it('rejects with 403 when the API key is not scoped to the global', async () => {
+        const { key, record } = await makeKey({ collections: ['posts'], actions: ['read'] });
+        const db = createMockDB({ apiKey: record, global: null });
+        initDB(db);
+        const handler = makeHandler(db);
+        const response = await handler(new Request('https://example.com/api/cms/globals/settings', {
+            headers: { Authorization: `Bearer ${key}` },
+        }));
+        expect(response.status).toBe(403);
+    });
+});
+//# sourceMappingURL=globals-routes.test.js.map

package/dist/__tests__/api/globals-routes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globals-routes.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/globals-routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAGnE;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAcnC,SAAS,YAAY,CAAC,IAAqD;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAkC,EAAE,EAAE;gBAC9D,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAA;gBACxB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAI,CAAA;gBACjD,OAAO,MAAM,CAAA;YACf,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;SAC3B;QACD,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;YAC1C,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACxB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;QACD,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;KACH,CAAA;AACV,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAmB;IACxC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtF,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,EAAE,EAAE,UAAU;YACd,OAAO;YACP,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;SAChB;KACF,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,EAAW;IAC9B,OAAO,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAW,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AACrF,CAAC;AAED,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,UAAU,CAAC,GAAG,EAAE;QACd,OAAQ,UAAkB,CAAC,eAAe,CAAA;QAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAChE,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAE/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,8CAA8C,EAAE;YAC1D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAChE,MAAM,EAAE,GAAG,YAAY,CAAC;YACtB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE;SACtF,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAE/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,8CAA8C,EAAE;YAC1D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAE/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,IAAI,OAAO,CAAC,8CAA8C,EAAE;YAC1D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;SAC5C,CAAC,CACH,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA+/B5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAyRD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwtUzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA+/B5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAyRD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA0tUzD"}

package/dist/api/handlers.js

@@ -8912,10 +8912,13 @@ export function registerCMSRoutes(router) {
                 build: async () => {
                     const ctx = buildActionContext(auth.session, db());
                     const global = await getGlobal(params.slug, ctx);
-                    if (!global) {
-                        return errorResponse('Global not found', 404);
-                    }
-                    return { data: global };
+                    // Globals are upsert-on-write: a slug with no row yet (fresh install,
+                    // never-saved settings) is a valid EMPTY state, not an error. Return
+                    // {} so the admin editor (e.g. the Settings page) loads cleanly before
+                    // the first save, and the next PUT creates the document. The public
+                    // `/public/globals/:slug` route keeps its config-gated 404 for
+                    // genuinely undeclared globals.
+                    return { data: global ?? {} };
                 },
             });
         }