@actuate-media/cms-core 0.35.0 → 0.36.0

package/dist/api/handlers.js

@@ -8897,6 +8897,58 @@ export function registerCMSRoutes(router) {
             return internalError(err);
         }
     });
+    // Public brand: resolved logos + favicon for the public frontend. No auth —
+    // brand assets are public site data. Only the PUBLIC brand view + favicon are
+    // exposed here (never the admin-only brand) so a white-labeled admin doesn't
+    // leak through the public API.
+    router.get('/public/brand', async (request) => {
+        try {
+            const { resolveBrand } = await import('../appearance/index.js');
+            const resolved = await resolveBrand(db(), null);
+            return cachedRead(request, {
+                cache: getActuateConfig()?.cache,
+                tags: [ACTUATE_TAG_ROOT, actuateTag('global', 'settings')],
+                wrap: jsonWithCache,
+                build: async () => ({
+                    data: { public: resolved.public, favicon: resolved.favicon },
+                }),
+            });
+        }
+        catch (err) {
+            return internalError(err, 'public/brand GET');
+        }
+    });
+    // Authenticated appearance read: stored appearance + brand settings plus the
+    // fully resolved admin/public/favicon views (with asset URLs) so the admin
+    // Appearance tab can render live previews. View-only auth — writes go through
+    // PUT /globals/settings (ADMIN_ROLES), so editors can view but not save.
+    router.get('/appearance', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const { getAppearanceSettings, getBrandSettings, resolveBrand } = await import('../appearance/index.js');
+            const [appearance, brand, resolved] = await Promise.all([
+                getAppearanceSettings(db()),
+                getBrandSettings(db()),
+                resolveBrand(db(), null),
+            ]);
+            return json({
+                data: {
+                    appearance,
+                    brand,
+                    resolved: { admin: resolved.admin, public: resolved.public, favicon: resolved.favicon },
+                    // Direct per-asset URLs so the editor shows each field's actual
+                    // asset (not the resolved fallback chain).
+                    assets: resolved.assets,
+                    siteTitle: resolved.siteTitle,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'appearance GET');
+        }
+    });
     router.get('/globals/:slug', async (request, params) => {
         try {
             const auth = await requireAuth(request);
@@ -8912,10 +8964,13 @@ export function registerCMSRoutes(router) {
                 build: async () => {
                     const ctx = buildActionContext(auth.session, db());
                     const global = await getGlobal(params.slug, ctx);
-                    if (!global) {
-                        return errorResponse('Global not found', 404);
-                    }
-                    return { data: global };
+                    // Globals are upsert-on-write: a slug with no row yet (fresh install,
+                    // never-saved settings) is a valid EMPTY state, not an error. Return
+                    // {} so the admin editor (e.g. the Settings page) loads cleanly before
+                    // the first save, and the next PUT creates the document. The public
+                    // `/public/globals/:slug` route keeps its config-gated 404 for
+                    // genuinely undeclared globals.
+                    return { data: global ?? {} };
                 },
             });
         }
@@ -8943,8 +8998,17 @@ export function registerCMSRoutes(router) {
             // Audit settings changes (title/tagline/URL/locale/timezone/etc.) with a
             // per-key before/after diff so the audit trail records what changed and
             // who changed it. Scalar values only — we never log nested secret blobs.
+            // Nested config blobs (`appearance`, `brand`) are logged as a changed
+            // key (not their contents) so appearance/branding edits are auditable
+            // without dumping asset IDs or theme objects into the log.
             try {
                 const changes = diffScalarKeys(previous ?? {}, body);
+                const prev = (previous ?? {});
+                for (const key of ['appearance', 'brand']) {
+                    if (key in body && JSON.stringify(prev[key]) !== JSON.stringify(body[key])) {
+                        changes.push({ key, from: '[changed]', to: '[changed]' });
+                    }
+                }
                 if (changes.length > 0) {
                     void logEvent({
                         event: 'settings_changed',