@aphexcms/cms-core 0.1.11 → 0.1.12

package/dist/routes/assets-by-id.js

@@ -0,0 +1,138 @@
+import { json } from '@sveltejs/kit';
+export const GET = async ({ params, locals }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        const { id } = params;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        if (!id) {
+            return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
+        }
+        const asset = await assetService.findAssetById(auth.organizationId, id);
+        if (!asset) {
+            return json({ success: false, error: 'Asset not found' }, { status: 404 });
+        }
+        // Return JSON metadata for admin UI
+        return json({
+            success: true,
+            data: {
+                _type: asset.assetType === 'image' ? 'sanity.imageAsset' : 'sanity.fileAsset',
+                _id: asset.id,
+                url: asset.url,
+                originalFilename: asset.originalFilename,
+                mimeType: asset.mimeType,
+                size: asset.size,
+                metadata: {
+                    dimensions: asset.width && asset.height
+                        ? {
+                            width: asset.width,
+                            height: asset.height
+                        }
+                        : undefined,
+                    ...asset.metadata
+                },
+                title: asset.title,
+                description: asset.description,
+                alt: asset.alt,
+                creditLine: asset.creditLine,
+                _createdAt: asset.createdAt,
+                _updatedAt: asset.updatedAt
+            }
+        });
+    }
+    catch (error) {
+        console.error('[Asset API] Error fetching asset:', error);
+        return json({ success: false, error: 'Failed to fetch asset' }, { status: 500 });
+    }
+};
+export const DELETE = async ({ params, locals }) => {
+    try {
+        const { id } = params;
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        if (!id) {
+            return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
+        }
+        const result = await assetService.deleteAsset(auth.organizationId, id);
+        if (!result) {
+            return json({ success: false, error: 'Asset not found or could not be deleted' }, { status: 404 });
+        }
+        return json({ success: true });
+    }
+    catch (error) {
+        console.error('Error deleting asset:', error);
+        return json({ success: false, error: 'Failed to delete asset' }, { status: 500 });
+    }
+};
+export const PATCH = async ({ params, locals, request }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        const { id } = params;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        if (!id) {
+            return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
+        }
+        const { title, description, alt, creditLine } = await request.json();
+        let updatedAsset;
+        if (auth.type == 'session') {
+            updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
+                title,
+                description,
+                alt,
+                creditLine,
+                updatedBy: auth.user.id
+            });
+        }
+        else {
+            updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
+                title,
+                description,
+                alt,
+                creditLine,
+                updatedBy: auth.keyId
+            });
+        }
+        if (!updatedAsset) {
+            return json({ success: false, error: 'Asset not found' }, { status: 404 });
+        }
+        // Return API response with success wrapper
+        return json({
+            success: true,
+            data: {
+                _type: updatedAsset.assetType === 'image' ? 'sanity.imageAsset' : 'sanity.fileAsset',
+                _id: updatedAsset.id,
+                url: updatedAsset.url,
+                originalFilename: updatedAsset.originalFilename,
+                mimeType: updatedAsset.mimeType,
+                size: updatedAsset.size,
+                metadata: {
+                    dimensions: updatedAsset.width && updatedAsset.height
+                        ? {
+                            width: updatedAsset.width,
+                            height: updatedAsset.height
+                        }
+                        : undefined,
+                    ...updatedAsset.metadata
+                },
+                title: updatedAsset.title,
+                description: updatedAsset.description,
+                alt: updatedAsset.alt,
+                creditLine: updatedAsset.creditLine,
+                _createdAt: updatedAsset.createdAt,
+                _updatedAt: updatedAsset.updatedAt
+            }
+        });
+    }
+    catch (error) {
+        console.error('Error updating asset:', error);
+        return json({ success: false, error: 'Failed to update asset' }, { status: 500 });
+    }
+};

package/dist/routes/assets-cdn.d.ts

@@ -0,0 +1,3 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const GET: RequestHandler;
+//# sourceMappingURL=assets-cdn.d.ts.map

package/dist/routes/assets-cdn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-cdn.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-cdn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,GAAG,EAAE,cAsLjB,CAAC"}

package/dist/routes/assets-cdn.js

@@ -0,0 +1,155 @@
+export const GET = async ({ params, locals, setHeaders, request }) => {
+    console.log('[Asset CDN] ========== ROUTE HIT ==========');
+    console.log('[Asset CDN] Params:', params);
+    try {
+        const { assetService, databaseAdapter, storageAdapter, cmsEngine, config } = locals.aphexCMS;
+        let auth = locals.auth;
+        const { id, filename } = params;
+        console.log('[Asset CDN] Request for asset:', id, filename);
+        console.log('[Asset CDN] Has auth?', !!auth);
+        // If no session auth, check for API key in headers
+        if (!auth) {
+            const apiKey = request.headers.get('x-api-key');
+            console.log('[Asset CDN] API key present?', !!apiKey);
+            if (apiKey && config.auth?.provider) {
+                try {
+                    const apiKeyAuth = await config.auth.provider.validateApiKey(request, databaseAdapter);
+                    if (apiKeyAuth) {
+                        auth = apiKeyAuth;
+                        console.log('[Asset CDN] Authenticated via API key, org:', apiKeyAuth.organizationId);
+                    }
+                }
+                catch (err) {
+                    console.warn('[Asset CDN] API key validation failed:', err);
+                }
+            }
+        }
+        console.log('[Asset CDN] Auth type:', auth?.type);
+        if (!id) {
+            return new Response('Asset ID is required', { status: 400 });
+        }
+        // Try to fetch asset globally first (bypasses RLS for public assets)
+        const asset = await assetService.findAssetByIdGlobal(id);
+        console.log('[Asset CDN] Asset found globally?', !!asset);
+        if (!asset) {
+            console.warn('[Asset CDN] Asset not found:', id);
+            return new Response('Asset not found', { status: 404 });
+        }
+        const organizationId = auth?.organizationId;
+        console.log('[Asset CDN] Auth object:', JSON.stringify(auth, null, 2));
+        console.log('[Asset CDN] Auth organizationId:', organizationId);
+        console.log('[Asset CDN] Asset organizationId:', asset.organizationId);
+        // Check if this asset is used in a private field
+        // The field metadata (schemaType and fieldPath) is stored when the asset is uploaded
+        let isPrivate = false;
+        const schemaType = asset.metadata?.schemaType;
+        const fieldPath = asset.metadata?.fieldPath;
+        if (schemaType && fieldPath) {
+            // Get the schema definition from IN-MEMORY config (always up-to-date with code changes)
+            const schema = cmsEngine.getSchemaTypeByName(schemaType);
+            console.log(`[Asset CDN] Schema lookup for ${schemaType}:`, {
+                found: !!schema,
+                fieldCount: schema?.fields?.length
+            });
+            if (schema && schema.fields) {
+                // Navigate the field path to find the field definition
+                const findField = (fields, path) => {
+                    const parts = path.split('.');
+                    let current = null;
+                    for (let i = 0; i < parts.length; i++) {
+                        const part = parts[i];
+                        current = fields.find((f) => f.name === part);
+                        if (!current)
+                            return null;
+                        // If not the last part, navigate into nested fields
+                        if (i < parts.length - 1) {
+                            if (current.type === 'object' && current.fields) {
+                                fields = current.fields;
+                            }
+                            else {
+                                return null;
+                            }
+                        }
+                    }
+                    return current;
+                };
+                const field = findField(schema.fields, fieldPath);
+                console.log(`[Asset CDN] Field lookup for ${fieldPath}:`, {
+                    found: !!field,
+                    type: field?.type,
+                    private: field?.private
+                });
+                if (field && field.type === 'image') {
+                    isPrivate = field.private === true;
+                    console.log(`[Asset CDN] Field check: ${schemaType}.${fieldPath} - private: ${isPrivate}`);
+                }
+                else {
+                    console.warn(`[Asset CDN] Could not find field: ${schemaType}.${fieldPath}`);
+                }
+            }
+        }
+        else {
+            console.log('[Asset CDN] No field metadata - treating as public');
+        }
+        console.log('[Asset CDN] Asset privacy result:', { isPrivate, schemaType, fieldPath });
+        // If asset is private, require auth
+        if (isPrivate && !organizationId) {
+            console.warn('[Asset CDN] Private asset accessed without auth - DENIED');
+            return new Response('Unauthorized - This asset is private', { status: 401 });
+        }
+        // If asset is private, verify org matches
+        if (isPrivate && organizationId && organizationId !== asset.organizationId) {
+            console.warn('[Asset CDN] Org mismatch for private asset - FORBIDDEN');
+            return new Response('Forbidden', { status: 403 });
+        }
+        // Log the decision
+        if (isPrivate && organizationId) {
+            console.log('[Asset CDN] Private asset access ALLOWED - user has auth and org matches');
+        }
+        else if (!isPrivate) {
+            console.log('[Asset CDN] Public asset access ALLOWED');
+        }
+        console.log('[Asset CDN] Asset found:', {
+            id: asset.id,
+            path: asset.path,
+            mimeType: asset.mimeType,
+            storageAdapter: asset.storageAdapter
+        });
+        // If asset has a direct URL (S3/R2), redirect to it
+        if (asset.url && asset.url.startsWith('http')) {
+            console.log('[Asset CDN] Redirecting to external URL:', asset.url);
+            return new Response(null, {
+                status: 302,
+                headers: { Location: asset.url }
+            });
+        }
+        // Otherwise, serve from local storage
+        if (!storageAdapter?.getObject) {
+            console.error('[Asset CDN] Storage adapter does not support getObject');
+            return new Response('Storage adapter does not support file serving', { status: 500 });
+        }
+        console.log('[Asset CDN] Reading file from storage:', asset.path);
+        const fileBuffer = await storageAdapter.getObject(asset.path);
+        console.log('[Asset CDN] Serving file:', {
+            size: fileBuffer.length,
+            mimeType: asset.mimeType
+        });
+        // Set appropriate headers for the asset
+        setHeaders({
+            'Content-Type': asset.mimeType || 'application/octet-stream',
+            'Content-Length': fileBuffer.length.toString(),
+            'Cache-Control': 'public, max-age=31536000, immutable', // Cache for 1 year
+            'Content-Disposition': `inline; filename="${encodeURIComponent(asset.originalFilename || asset.filename)}"`,
+            ...(asset.mimeType?.startsWith('image/') && {
+                'Accept-Ranges': 'bytes'
+            })
+        });
+        // Convert Buffer to ArrayBuffer for Response
+        const arrayBuffer = fileBuffer.buffer.slice(fileBuffer.byteOffset, fileBuffer.byteOffset + fileBuffer.byteLength);
+        return new Response(arrayBuffer);
+    }
+    catch (error) {
+        console.error('[Asset CDN] Error serving asset:', error);
+        return new Response('Failed to serve asset', { status: 500 });
+    }
+};

package/dist/routes/assets.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const POST: RequestHandler;
+export declare const GET: RequestHandler;
+//# sourceMappingURL=assets.d.ts.map

package/dist/routes/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,IAAI,EAAE,cAiElB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cA4CjB,CAAC"}

package/dist/routes/assets.js

@@ -0,0 +1,94 @@
+// Aphex CMS Asset API Handlers
+import { json } from '@sveltejs/kit';
+export const POST = async ({ request, locals }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        const formData = await request.formData();
+        const file = formData.get('file');
+        if (!file) {
+            return json({ success: false, error: 'No file provided' }, { status: 400 });
+        }
+        // Convert file to buffer
+        const arrayBuffer = await file.arrayBuffer();
+        const buffer = Buffer.from(arrayBuffer);
+        // Get optional metadata from form data
+        const title = formData.get('title') || undefined;
+        const description = formData.get('description') || undefined;
+        const alt = formData.get('alt') || undefined;
+        const creditLine = formData.get('creditLine') || undefined;
+        // Get field metadata for privacy checking
+        const schemaType = formData.get('schemaType') || undefined;
+        const fieldPath = formData.get('fieldPath') || undefined;
+        // Create asset upload data
+        const uploadData = {
+            buffer,
+            originalFilename: file.name,
+            mimeType: file.type,
+            size: file.size,
+            title,
+            description,
+            alt,
+            creditLine,
+            createdBy: auth.type === 'session' ? auth.user.id : undefined,
+            metadata: {
+                schemaType,
+                fieldPath
+            }
+        };
+        // Upload asset using the service
+        const asset = await assetService.uploadAsset(auth.organizationId, uploadData);
+        return json({
+            success: true,
+            data: asset
+        });
+    }
+    catch (error) {
+        console.error('Asset upload failed:', error);
+        return json({
+            success: false,
+            error: 'Asset upload failed',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+export const GET = async ({ url, locals }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        // Parse query parameters
+        const assetType = url.searchParams.get('assetType');
+        const mimeType = url.searchParams.get('mimeType') || undefined;
+        const search = url.searchParams.get('search') || undefined;
+        const limitParam = url.searchParams.get('limit');
+        const offsetParam = url.searchParams.get('offset');
+        const limit = limitParam ? parseInt(limitParam) : 20;
+        const offset = offsetParam ? parseInt(offsetParam) : 0;
+        const filters = {
+            assetType,
+            mimeType,
+            search,
+            limit: isNaN(limit) ? 20 : limit,
+            offset: isNaN(offset) ? 0 : offset
+        };
+        const assets = await assetService.findAssets(auth.organizationId, filters);
+        return json({
+            success: true,
+            data: assets
+        });
+    }
+    catch (error) {
+        console.error('Failed to fetch assets:', error);
+        return json({
+            success: false,
+            error: 'Failed to fetch assets',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes/documents-by-id.d.ts

@@ -0,0 +1,5 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const GET: RequestHandler;
+export declare const PUT: RequestHandler;
+export declare const DELETE: RequestHandler;
+//# sourceMappingURL=documents-by-id.d.ts.map

package/dist/routes/documents-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cA2DjB,CAAC;AAGF,eAAO,MAAM,GAAG,EAAE,cAoEjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cA+CpB,CAAC"}

package/dist/routes/documents-by-id.js

@@ -0,0 +1,142 @@
+// Aphex CMS Document by ID API Handlers
+import { json } from '@sveltejs/kit';
+import { canWrite } from '../types/auth.js';
+// GET /api/documents/[id] - Get document by ID
+export const GET = async ({ params, url, locals }) => {
+    try {
+        const { databaseAdapter, auth: authProvider } = locals.aphexCMS;
+        const auth = locals.auth;
+        const { id } = params;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        if (!id) {
+            return json({ success: false, error: 'Document ID is required' }, { status: 400 });
+        }
+        // Parse depth parameter
+        const depthParam = url.searchParams.get('depth');
+        const depth = depthParam ? parseInt(depthParam) : 0;
+        const clampedDepth = isNaN(depth) ? 0 : Math.max(0, Math.min(depth, 5)); // Clamp between 0-5
+        const document = await databaseAdapter.findByDocId(auth.organizationId, id, clampedDepth);
+        if (!document) {
+            return json({ success: false, error: 'Document not found' }, { status: 404 });
+        }
+        // Populate createdBy user info if available
+        if (document.createdBy && authProvider) {
+            try {
+                if (typeof document.createdBy === 'string') {
+                    const user = await authProvider.getUserById(document.createdBy);
+                    if (user) {
+                        document.createdBy = {
+                            id: user.id,
+                            name: user.name,
+                            email: user.email
+                        };
+                    }
+                }
+            }
+            catch (err) {
+                // If user fetch fails, keep the user ID
+                console.warn('[documents-by-id] Failed to populate createdBy user:', err);
+            }
+        }
+        return json({
+            success: true,
+            data: document
+        });
+    }
+    catch (error) {
+        console.error('Failed to fetch document:', error);
+        return json({
+            success: false,
+            error: 'Failed to fetch document',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+// PUT /api/documents/[id] - Update document
+export const PUT = async ({ params, request, locals }) => {
+    try {
+        const { databaseAdapter } = locals.aphexCMS;
+        const auth = locals.auth;
+        const { id } = params;
+        const body = await request.json();
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        // Check write permissions (viewers are read-only)
+        if (!canWrite(auth)) {
+            return json({
+                success: false,
+                error: 'Forbidden',
+                message: 'You do not have permission to update documents. Viewers have read-only access.'
+            }, { status: 403 });
+        }
+        const documentData = body.draftData;
+        if (!id) {
+            return json({ success: false, error: 'Document ID is required' }, { status: 400 });
+        }
+        let updatedDocument;
+        // NO VALIDATION FOR DRAFTS - Sanity-style: drafts can have any state
+        // Validation only happens on publish
+        if (auth.type == 'session') {
+            updatedDocument = await databaseAdapter.updateDocDraft(auth.organizationId, id, documentData, auth.user.id);
+        }
+        else {
+            updatedDocument = await databaseAdapter.updateDocDraft(auth.organizationId, id, documentData, auth.keyId);
+        }
+        if (!updatedDocument) {
+            return json({ success: false, error: 'Document not found' }, { status: 404 });
+        }
+        return json({
+            success: true,
+            data: updatedDocument
+        });
+    }
+    catch (error) {
+        console.error('Failed to update document:', error);
+        return json({
+            success: false,
+            error: 'Failed to update document',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+// DELETE /api/documents/[id] - Delete document
+export const DELETE = async ({ params, locals }) => {
+    try {
+        const { databaseAdapter } = locals.aphexCMS;
+        const auth = locals.auth;
+        const { id } = params;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        // Check write permissions (viewers are read-only)
+        if (!canWrite(auth)) {
+            return json({
+                success: false,
+                error: 'Forbidden',
+                message: 'You do not have permission to delete documents. Viewers have read-only access.'
+            }, { status: 403 });
+        }
+        if (!id) {
+            return json({ success: false, error: 'Document ID is required' }, { status: 400 });
+        }
+        const success = await databaseAdapter.deleteDocById(auth.organizationId, id);
+        if (!success) {
+            return json({ success: false, error: 'Document not found' }, { status: 404 });
+        }
+        return json({
+            success: true,
+            message: 'Document deleted successfully'
+        });
+    }
+    catch (error) {
+        console.error('Failed to delete document:', error);
+        return json({
+            success: false,
+            error: 'Failed to delete document',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes/documents-publish.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const POST: RequestHandler;
+export declare const DELETE: RequestHandler;
+//# sourceMappingURL=documents-publish.d.ts.map

package/dist/routes/documents-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-publish.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAkIlB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAsEpB,CAAC"}