@aphexcms/cms-core 0.1.11 → 0.1.12

package/src/lib/hooks.ts

@@ -1,142 +0,0 @@
-import type { Handle } from '@sveltejs/kit';
-import type { CMSConfig } from './types/index';
-import type { DatabaseAdapter } from './db/index';
-import type { AssetService } from './services/asset-service';
-import type { StorageAdapter } from './storage/interfaces/storage';
-import type { EmailAdapter } from './email/index';
-import type { AuthProvider } from './auth/provider';
-import { handleAuthHook } from './auth/auth-hooks';
-import { createStorageAdapter as createStorageAdapterProvider } from './storage/providers/storage';
-import { AssetService as AssetServiceClass } from './services/asset-service';
-import { createCMS, CMSEngine } from './engine';
-
-// Singleton instances - created once per application lifecycle
-export interface CMSInstances {
-	config: CMSConfig;
-	assetService: AssetService;
-	storageAdapter: StorageAdapter;
-	databaseAdapter: DatabaseAdapter;
-	emailAdapter?: EmailAdapter | null;
-	cmsEngine: CMSEngine;
-	auth?: AuthProvider;
-	pluginRoutes?: Map<
-		string,
-		{ handler: (event: any) => Promise<Response> | Response; pluginName: string }
-	>;
-}
-
-let cmsInstances: CMSInstances | null = null;
-let lastConfigHash: string | null = null;
-
-// Helper to generate a simple hash of schema types for change detection
-function getConfigHash(config: CMSConfig): string {
-	const schemaNames = config.schemaTypes
-		.map((s) => `${s.name}:${s.fields.length}:${JSON.stringify(s.fields)}`)
-		.join(',');
-	return schemaNames;
-}
-
-// Factory function to create the default local storage adapter
-function createDefaultStorageAdapter(): StorageAdapter {
-	return createStorageAdapterProvider('local', {
-		basePath: './storage/assets', // Private storage - not in static/, not served in production
-		baseUrl: '' // No direct URL - all access through /assets/{id}/{filename}
-	});
-}
-
-export function createCMSHook(config: CMSConfig): Handle {
-	return async ({ event, resolve }) => {
-		// Note: In dev mode, /storage/ might be accessible via Vite dev server
-		// In production, only /static/ folder is served - /storage/ is private
-
-		const currentConfigHash = getConfigHash(config);
-		const configChanged = lastConfigHash !== null && currentConfigHash !== lastConfigHash;
-
-		// Initialize CMS instances once at application startup
-		if (!cmsInstances) {
-			console.log('🚀 Initializing CMS...');
-			const databaseAdapter = config.database;
-			// Use the storage adapter from config, or create the default local one.
-			const storageAdapter = config.storage ?? createDefaultStorageAdapter();
-			const emailAdapter = config.email ?? null;
-			const assetService = new AssetServiceClass(storageAdapter, databaseAdapter);
-			const cmsEngine = createCMS(config, databaseAdapter);
-
-			await cmsEngine.initialize();
-
-			// Build plugin route map (do this ONCE at startup)
-			const pluginRoutes = new Map<
-				string,
-				{ handler: (event: any) => Promise<Response> | Response; pluginName: string }
-			>();
-			if (config.plugins && config.plugins.length > 0) {
-				for (const plugin of config.plugins) {
-					if (plugin.routes) {
-						for (const [path, handler] of Object.entries(plugin.routes)) {
-							pluginRoutes.set(path, { handler, pluginName: plugin.name });
-						}
-					}
-				}
-			}
-
-			cmsInstances = {
-				config,
-				databaseAdapter: databaseAdapter,
-				assetService: assetService,
-				storageAdapter: storageAdapter,
-				emailAdapter: emailAdapter,
-				cmsEngine: cmsEngine,
-				auth: config.auth?.provider,
-				pluginRoutes
-			};
-
-			// Install plugins
-			if (config.plugins && config.plugins.length > 0) {
-				for (const plugin of config.plugins) {
-					console.log(`🔌 Installing plugin: ${plugin.name}`);
-					await plugin.install(cmsInstances);
-				}
-			}
-
-			lastConfigHash = currentConfigHash;
-		} else if (configChanged) {
-			// HMR: Config changed, re-sync schemas
-			console.log('🔄 Schema types changed, re-syncing...');
-			console.log('Old hash:', lastConfigHash?.substring(0, 100) + '...');
-			console.log('New hash:', currentConfigHash.substring(0, 100) + '...');
-			console.log(
-				'Schema types being updated:',
-				config.schemaTypes.map((s) => s.name)
-			);
-			cmsInstances.cmsEngine.updateConfig(config);
-			await cmsInstances.cmsEngine.initialize();
-			lastConfigHash = currentConfigHash;
-			console.log('✅ Schema sync complete');
-		}
-
-		// Inject shared CMS services into locals (reuse singleton instances)
-		event.locals.aphexCMS = cmsInstances;
-
-		// Auth protection if configured
-		if (cmsInstances.auth) {
-			const authResponse = await handleAuthHook(
-				event,
-				config,
-				cmsInstances.auth,
-				cmsInstances.databaseAdapter
-			);
-			if (authResponse) return authResponse;
-		}
-
-		// Check if a plugin handles this route (O(1) lookup)
-		if (cmsInstances.pluginRoutes && cmsInstances.pluginRoutes.size > 0) {
-			const pluginRoute = cmsInstances.pluginRoutes.get(event.url.pathname);
-			if (pluginRoute) {
-				console.log(`🔌 Plugin ${pluginRoute.pluginName} handling route: ${event.url.pathname}`);
-				return pluginRoute.handler(event);
-			}
-		}
-
-		return resolve(event);
-	};
-}

package/src/lib/routes/assets-by-id.ts

@@ -1,161 +0,0 @@
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from '@sveltejs/kit';
-import { Asset } from '../types/asset';
-
-export const GET: RequestHandler = async ({ params, locals }) => {
-	try {
-		const { assetService } = locals.aphexCMS;
-		const auth = locals.auth;
-		const { id } = params;
-
-		if (!auth) {
-			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-		}
-
-		if (!id) {
-			return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
-		}
-
-		const asset = await assetService.findAssetById(auth.organizationId, id);
-
-		if (!asset) {
-			return json({ success: false, error: 'Asset not found' }, { status: 404 });
-		}
-
-		// Return JSON metadata for admin UI
-		return json({
-			success: true,
-			data: {
-				_type: asset.assetType === 'image' ? 'sanity.imageAsset' : 'sanity.fileAsset',
-				_id: asset.id,
-				url: asset.url,
-				originalFilename: asset.originalFilename,
-				mimeType: asset.mimeType,
-				size: asset.size,
-				metadata: {
-					dimensions:
-						asset.width && asset.height
-							? {
-									width: asset.width,
-									height: asset.height
-								}
-							: undefined,
-					...asset.metadata
-				},
-				title: asset.title,
-				description: asset.description,
-				alt: asset.alt,
-				creditLine: asset.creditLine,
-				_createdAt: asset.createdAt,
-				_updatedAt: asset.updatedAt
-			}
-		});
-	} catch (error) {
-		console.error('[Asset API] Error fetching asset:', error);
-		return json({ success: false, error: 'Failed to fetch asset' }, { status: 500 });
-	}
-};
-
-export const DELETE: RequestHandler = async ({ params, locals }) => {
-	try {
-		const { id } = params;
-		const { assetService } = locals.aphexCMS;
-		const auth = locals.auth;
-
-		if (!auth) {
-			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-		}
-
-		if (!id) {
-			return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
-		}
-
-		const result = await assetService.deleteAsset(auth.organizationId, id);
-
-		if (!result) {
-			return json(
-				{ success: false, error: 'Asset not found or could not be deleted' },
-				{ status: 404 }
-			);
-		}
-
-		return json({ success: true });
-	} catch (error) {
-		console.error('Error deleting asset:', error);
-		return json({ success: false, error: 'Failed to delete asset' }, { status: 500 });
-	}
-};
-
-export const PATCH: RequestHandler = async ({ params, locals, request }) => {
-	try {
-		const { assetService } = locals.aphexCMS;
-		const auth = locals.auth;
-		const { id } = params;
-
-		if (!auth) {
-			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-		}
-
-		if (!id) {
-			return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
-		}
-
-		const { title, description, alt, creditLine } = await request.json();
-
-		let updatedAsset: Asset | null;
-
-		if (auth.type == 'session') {
-			updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
-				title,
-				description,
-				alt,
-				creditLine,
-				updatedBy: auth.user.id
-			});
-		} else {
-			updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
-				title,
-				description,
-				alt,
-				creditLine,
-				updatedBy: auth.keyId
-			});
-		}
-
-		if (!updatedAsset) {
-			return json({ success: false, error: 'Asset not found' }, { status: 404 });
-		}
-
-		// Return API response with success wrapper
-		return json({
-			success: true,
-			data: {
-				_type: updatedAsset.assetType === 'image' ? 'sanity.imageAsset' : 'sanity.fileAsset',
-				_id: updatedAsset.id,
-				url: updatedAsset.url,
-				originalFilename: updatedAsset.originalFilename,
-				mimeType: updatedAsset.mimeType,
-				size: updatedAsset.size,
-				metadata: {
-					dimensions:
-						updatedAsset.width && updatedAsset.height
-							? {
-									width: updatedAsset.width,
-									height: updatedAsset.height
-								}
-							: undefined,
-					...updatedAsset.metadata
-				},
-				title: updatedAsset.title,
-				description: updatedAsset.description,
-				alt: updatedAsset.alt,
-				creditLine: updatedAsset.creditLine,
-				_createdAt: updatedAsset.createdAt,
-				_updatedAt: updatedAsset.updatedAt
-			}
-		});
-	} catch (error) {
-		console.error('Error updating asset:', error);
-		return json({ success: false, error: 'Failed to update asset' }, { status: 500 });
-	}
-};

package/src/lib/routes/assets-cdn.ts

@@ -1,185 +0,0 @@
-import type { RequestHandler } from '@sveltejs/kit';
-
-export const GET: RequestHandler = async ({ params, locals, setHeaders, request }) => {
-	console.log('[Asset CDN] ========== ROUTE HIT ==========');
-	console.log('[Asset CDN] Params:', params);
-	try {
-		const { assetService, databaseAdapter, storageAdapter, cmsEngine, config } = locals.aphexCMS;
-		let auth = locals.auth;
-		const { id, filename } = params;
-
-		console.log('[Asset CDN] Request for asset:', id, filename);
-		console.log('[Asset CDN] Has auth?', !!auth);
-
-		// If no session auth, check for API key in headers
-		if (!auth) {
-			const apiKey = request.headers.get('x-api-key');
-			console.log('[Asset CDN] API key present?', !!apiKey);
-			if (apiKey && config.auth?.provider) {
-				try {
-					const apiKeyAuth = await config.auth.provider.validateApiKey(request, databaseAdapter);
-					if (apiKeyAuth) {
-						auth = apiKeyAuth;
-						console.log('[Asset CDN] Authenticated via API key, org:', apiKeyAuth.organizationId);
-					}
-				} catch (err) {
-					console.warn('[Asset CDN] API key validation failed:', err);
-				}
-			}
-		}
-
-		console.log('[Asset CDN] Auth type:', auth?.type);
-
-		if (!id) {
-			return new Response('Asset ID is required', { status: 400 });
-		}
-
-		// Try to fetch asset globally first (bypasses RLS for public assets)
-		const asset = await assetService.findAssetByIdGlobal(id);
-
-		console.log('[Asset CDN] Asset found globally?', !!asset);
-
-		if (!asset) {
-			console.warn('[Asset CDN] Asset not found:', id);
-			return new Response('Asset not found', { status: 404 });
-		}
-
-		const organizationId = auth?.organizationId;
-		console.log('[Asset CDN] Auth object:', JSON.stringify(auth, null, 2));
-		console.log('[Asset CDN] Auth organizationId:', organizationId);
-		console.log('[Asset CDN] Asset organizationId:', asset.organizationId);
-
-		// Check if this asset is used in a private field
-		// The field metadata (schemaType and fieldPath) is stored when the asset is uploaded
-		let isPrivate = false;
-
-		const schemaType = asset.metadata?.schemaType;
-		const fieldPath = asset.metadata?.fieldPath;
-
-		if (schemaType && fieldPath) {
-			// Get the schema definition from IN-MEMORY config (always up-to-date with code changes)
-			const schema = cmsEngine.getSchemaTypeByName(schemaType);
-			console.log(`[Asset CDN] Schema lookup for ${schemaType}:`, {
-				found: !!schema,
-				fieldCount: schema?.fields?.length
-			});
-
-			if (schema && schema.fields) {
-				// Navigate the field path to find the field definition
-				const findField = (fields: any[], path: string): any => {
-					const parts = path.split('.');
-					let current: any = null;
-
-					for (let i = 0; i < parts.length; i++) {
-						const part = parts[i];
-						current = fields.find((f) => f.name === part);
-
-						if (!current) return null;
-
-						// If not the last part, navigate into nested fields
-						if (i < parts.length - 1) {
-							if (current.type === 'object' && current.fields) {
-								fields = current.fields;
-							} else {
-								return null;
-							}
-						}
-					}
-
-					return current;
-				};
-
-				const field = findField(schema.fields, fieldPath);
-				console.log(`[Asset CDN] Field lookup for ${fieldPath}:`, {
-					found: !!field,
-					type: field?.type,
-					private: field?.private
-				});
-
-				if (field && field.type === 'image') {
-					isPrivate = field.private === true;
-					console.log(
-						`[Asset CDN] Field check: ${schemaType}.${fieldPath} - private: ${isPrivate}`
-					);
-				} else {
-					console.warn(`[Asset CDN] Could not find field: ${schemaType}.${fieldPath}`);
-				}
-			}
-		} else {
-			console.log('[Asset CDN] No field metadata - treating as public');
-		}
-
-		console.log('[Asset CDN] Asset privacy result:', { isPrivate, schemaType, fieldPath });
-
-		// If asset is private, require auth
-		if (isPrivate && !organizationId) {
-			console.warn('[Asset CDN] Private asset accessed without auth - DENIED');
-			return new Response('Unauthorized - This asset is private', { status: 401 });
-		}
-
-		// If asset is private, verify org matches
-		if (isPrivate && organizationId && organizationId !== asset.organizationId) {
-			console.warn('[Asset CDN] Org mismatch for private asset - FORBIDDEN');
-			return new Response('Forbidden', { status: 403 });
-		}
-
-		// Log the decision
-		if (isPrivate && organizationId) {
-			console.log('[Asset CDN] Private asset access ALLOWED - user has auth and org matches');
-		} else if (!isPrivate) {
-			console.log('[Asset CDN] Public asset access ALLOWED');
-		}
-
-		console.log('[Asset CDN] Asset found:', {
-			id: asset.id,
-			path: asset.path,
-			mimeType: asset.mimeType,
-			storageAdapter: asset.storageAdapter
-		});
-
-		// If asset has a direct URL (S3/R2), redirect to it
-		if (asset.url && asset.url.startsWith('http')) {
-			console.log('[Asset CDN] Redirecting to external URL:', asset.url);
-			return new Response(null, {
-				status: 302,
-				headers: { Location: asset.url }
-			});
-		}
-
-		// Otherwise, serve from local storage
-		if (!storageAdapter?.getObject) {
-			console.error('[Asset CDN] Storage adapter does not support getObject');
-			return new Response('Storage adapter does not support file serving', { status: 500 });
-		}
-
-		console.log('[Asset CDN] Reading file from storage:', asset.path);
-		const fileBuffer = await storageAdapter.getObject(asset.path);
-
-		console.log('[Asset CDN] Serving file:', {
-			size: fileBuffer.length,
-			mimeType: asset.mimeType
-		});
-
-		// Set appropriate headers for the asset
-		setHeaders({
-			'Content-Type': asset.mimeType || 'application/octet-stream',
-			'Content-Length': fileBuffer.length.toString(),
-			'Cache-Control': 'public, max-age=31536000, immutable', // Cache for 1 year
-			'Content-Disposition': `inline; filename="${encodeURIComponent(asset.originalFilename || asset.filename)}"`,
-			...(asset.mimeType?.startsWith('image/') && {
-				'Accept-Ranges': 'bytes'
-			})
-		});
-
-		// Convert Buffer to ArrayBuffer for Response
-		const arrayBuffer = fileBuffer.buffer.slice(
-			fileBuffer.byteOffset,
-			fileBuffer.byteOffset + fileBuffer.byteLength
-		) as ArrayBuffer;
-
-		return new Response(arrayBuffer);
-	} catch (error) {
-		console.error('[Asset CDN] Error serving asset:', error);
-		return new Response('Failed to serve asset', { status: 500 });
-	}
-};

package/src/lib/routes/assets.ts

@@ -1,116 +0,0 @@
-// Aphex CMS Asset API Handlers
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from '@sveltejs/kit';
-
-export const POST: RequestHandler = async ({ request, locals }) => {
-	try {
-		const { assetService } = locals.aphexCMS;
-		const auth = locals.auth;
-
-		if (!auth) {
-			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-		}
-
-		const formData = await request.formData();
-		const file = formData.get('file') as File;
-
-		if (!file) {
-			return json({ success: false, error: 'No file provided' }, { status: 400 });
-		}
-
-		// Convert file to buffer
-		const arrayBuffer = await file.arrayBuffer();
-		const buffer = Buffer.from(arrayBuffer);
-
-		// Get optional metadata from form data
-		const title = (formData.get('title') as string) || undefined;
-		const description = (formData.get('description') as string) || undefined;
-		const alt = (formData.get('alt') as string) || undefined;
-		const creditLine = (formData.get('creditLine') as string) || undefined;
-
-		// Get field metadata for privacy checking
-		const schemaType = (formData.get('schemaType') as string) || undefined;
-		const fieldPath = (formData.get('fieldPath') as string) || undefined;
-
-		// Create asset upload data
-		const uploadData = {
-			buffer,
-			originalFilename: file.name,
-			mimeType: file.type,
-			size: file.size,
-			title,
-			description,
-			alt,
-			creditLine,
-			createdBy: auth.type === 'session' ? auth.user.id : undefined,
-			metadata: {
-				schemaType,
-				fieldPath
-			}
-		};
-
-		// Upload asset using the service
-		const asset = await assetService.uploadAsset(auth.organizationId, uploadData);
-
-		return json({
-			success: true,
-			data: asset
-		});
-	} catch (error) {
-		console.error('Asset upload failed:', error);
-		return json(
-			{
-				success: false,
-				error: 'Asset upload failed',
-				message: error instanceof Error ? error.message : 'Unknown error'
-			},
-			{ status: 500 }
-		);
-	}
-};
-
-export const GET: RequestHandler = async ({ url, locals }) => {
-	try {
-		const { assetService } = locals.aphexCMS;
-		const auth = locals.auth;
-
-		if (!auth) {
-			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-		}
-
-		// Parse query parameters
-		const assetType = url.searchParams.get('assetType') as 'image' | 'file' | undefined;
-		const mimeType = url.searchParams.get('mimeType') || undefined;
-		const search = url.searchParams.get('search') || undefined;
-		const limitParam = url.searchParams.get('limit');
-		const offsetParam = url.searchParams.get('offset');
-
-		const limit = limitParam ? parseInt(limitParam) : 20;
-		const offset = offsetParam ? parseInt(offsetParam) : 0;
-
-		const filters = {
-			assetType,
-			mimeType,
-			search,
-			limit: isNaN(limit) ? 20 : limit,
-			offset: isNaN(offset) ? 0 : offset
-		};
-
-		const assets = await assetService.findAssets(auth.organizationId, filters);
-
-		return json({
-			success: true,
-			data: assets
-		});
-	} catch (error) {
-		console.error('Failed to fetch assets:', error);
-		return json(
-			{
-				success: false,
-				error: 'Failed to fetch assets',
-				message: error instanceof Error ? error.message : 'Unknown error'
-			},
-			{ status: 500 }
-		);
-	}
-};