@aphexcms/cms-core 0.1.11 → 0.1.13

package/src/lib/api/client.ts

@@ -1,150 +0,0 @@
-// Base API client with common functionality
-import type { ApiResponse } from './types';
-
-// Default configuration
-const DEFAULT_BASE_URL = '/api';
-const DEFAULT_TIMEOUT = 10000; // 10 seconds
-
-export class ApiError extends Error {
-	constructor(
-		public status: number,
-		public response: any,
-		message?: string
-	) {
-		super(message || `API Error: ${status}`);
-		this.name = 'ApiError';
-	}
-}
-
-export class ApiClient {
-	private baseUrl: string;
-	private timeout: number;
-
-	constructor(baseUrl = DEFAULT_BASE_URL, timeout = DEFAULT_TIMEOUT) {
-		this.baseUrl = baseUrl;
-		this.timeout = timeout;
-	}
-
-	/**
-	 * Make HTTP request with proper error handling
-	 */
-	private async request<T>(endpoint: string, options: RequestInit = {}): Promise<ApiResponse<T>> {
-		const url = `${this.baseUrl}${endpoint}`;
-
-		// Set up request with defaults
-		// Don't set Content-Type for FormData (browser will set it with boundary)
-		const headers: Record<string, string> = {};
-		if (!(options.body instanceof FormData)) {
-			headers['Content-Type'] = 'application/json';
-		}
-
-		const requestOptions: RequestInit = {
-			headers: {
-				...headers,
-				...options.headers
-			},
-			...options
-		};
-
-		// Add timeout
-		const controller = new AbortController();
-		const timeoutId = setTimeout(() => controller.abort(), this.timeout);
-		requestOptions.signal = controller.signal;
-
-		try {
-			const response = await fetch(url, requestOptions);
-			clearTimeout(timeoutId);
-
-			const data: ApiResponse<T> = await response.json();
-
-			// Handle HTTP errors
-			if (!response.ok) {
-				throw new ApiError(response.status, data, data.message || data.error);
-			}
-
-			// Handle API-level errors
-			if (!data.success) {
-				throw new ApiError(response.status, data, data.message || data.error);
-			}
-
-			return data;
-		} catch (error) {
-			clearTimeout(timeoutId);
-
-			if (error instanceof ApiError) {
-				throw error;
-			}
-
-			// Handle fetch errors (network, timeout, etc.)
-			throw new ApiError(0, null, error instanceof Error ? error.message : 'Network error');
-		}
-	}
-
-	/**
-	 * GET request
-	 */
-	async get<T>(endpoint: string, params?: Record<string, any>): Promise<ApiResponse<T>> {
-		let url = endpoint;
-
-		if (params) {
-			const searchParams = new URLSearchParams();
-			Object.entries(params).forEach(([key, value]) => {
-				if (value !== undefined && value !== null) {
-					searchParams.append(key, String(value));
-				}
-			});
-
-			if (searchParams.toString()) {
-				url += `?${searchParams.toString()}`;
-			}
-		}
-
-		return this.request<T>(url, { method: 'GET' });
-	}
-
-	/**
-	 * POST request
-	 */
-	async post<T>(endpoint: string, body?: any): Promise<ApiResponse<T>> {
-		return this.request<T>(endpoint, {
-			method: 'POST',
-			// Don't stringify FormData - pass it directly
-			body: body instanceof FormData ? body : body ? JSON.stringify(body) : undefined
-		});
-	}
-
-	/**
-	 * PUT request
-	 */
-	async put<T>(endpoint: string, body?: any): Promise<ApiResponse<T>> {
-		return this.request<T>(endpoint, {
-			method: 'PUT',
-			// Don't stringify FormData - pass it directly
-			body: body instanceof FormData ? body : body ? JSON.stringify(body) : undefined
-		});
-	}
-
-	/**
-	 * DELETE request
-	 */
-	async delete<T>(endpoint: string, body?: any): Promise<ApiResponse<T>> {
-		return this.request<T>(endpoint, {
-			method: 'DELETE',
-			body: body ? JSON.stringify(body) : undefined
-		});
-	}
-
-	/**
-	 * PATCH request
-	 */
-	async patch<T>(endpoint: string, body?: any): Promise<ApiResponse<T>> {
-		return this.request<T>(endpoint, {
-			method: 'PATCH',
-			// Don't stringify FormData - pass it directly
-			body: body instanceof FormData ? body : body ? JSON.stringify(body) : undefined
-		});
-	}
-}
-
-// Export singleton instance
-export const apiClient = new ApiClient();

package/src/lib/api/documents.ts

@@ -1,102 +0,0 @@
-// Documents API client - composable document operations
-import { apiClient } from './client';
-import type {
-	Document,
-	DocumentListParams,
-	CreateDocumentData,
-	UpdateDocumentData,
-	ApiResponse
-} from './types';
-
-export class DocumentsApi {
-	/**
-	 * List documents with optional filtering
-	 */
-	static async list(params: DocumentListParams = {}): Promise<ApiResponse<Document[]>> {
-		return apiClient.get<Document[]>('/documents', params);
-	}
-
-	/**
-	 * Get document by ID
-	 */
-	static async getById(id: string): Promise<ApiResponse<Document>> {
-		return apiClient.get<Document>(`/documents/${id}`);
-	}
-
-	/**
-	 * Create new document
-	 */
-	static async create(data: CreateDocumentData): Promise<ApiResponse<Document>> {
-		return apiClient.post<Document>('/documents', data);
-	}
-
-	/**
-	 * Update document draft by ID (auto-save)
-	 */
-	static async updateById(id: string, data: UpdateDocumentData): Promise<ApiResponse<Document>> {
-		return apiClient.put<Document>(`/documents/${id}`, data);
-	}
-
-	/**
-	 * Publish document (copy draft -> published)
-	 */
-	static async publish(id: string): Promise<ApiResponse<Document>> {
-		return apiClient.post<Document>(`/documents/${id}/publish`);
-	}
-
-	/**
-	 * Unpublish document (revert to draft only)
-	 */
-	static async unpublish(id: string): Promise<ApiResponse<Document>> {
-		return apiClient.delete<Document>(`/documents/${id}/publish`);
-	}
-
-	/**
-	 * Delete document by ID
-	 */
-	static async deleteById(id: string): Promise<ApiResponse<void>> {
-		return apiClient.delete<void>(`/documents/${id}`);
-	}
-
-	/**
-	 * Get documents by type (convenience method)
-	 */
-	static async getByType(
-		docType: string,
-		params: Omit<DocumentListParams, 'docType'> = {}
-	): Promise<ApiResponse<Document[]>> {
-		return this.list({ ...params, docType });
-	}
-
-	/**
-	 * Get published documents only (convenience method)
-	 */
-	static async getPublished(
-		params: Omit<DocumentListParams, 'status'> = {}
-	): Promise<ApiResponse<Document[]>> {
-		return this.list({ ...params, status: 'published' });
-	}
-
-	/**
-	 * Get draft documents only (convenience method)
-	 */
-	static async getDrafts(
-		params: Omit<DocumentListParams, 'status'> = {}
-	): Promise<ApiResponse<Document[]>> {
-		return this.list({ ...params, status: 'draft' });
-	}
-}
-
-// Export convenience functions for direct use
-export const documents = {
-	list: DocumentsApi.list.bind(DocumentsApi),
-	getById: DocumentsApi.getById.bind(DocumentsApi),
-	create: DocumentsApi.create.bind(DocumentsApi),
-	updateById: DocumentsApi.updateById.bind(DocumentsApi),
-	publish: DocumentsApi.publish.bind(DocumentsApi),
-	unpublish: DocumentsApi.unpublish.bind(DocumentsApi),
-	deleteById: DocumentsApi.deleteById.bind(DocumentsApi),
-	getByType: DocumentsApi.getByType.bind(DocumentsApi),
-	getPublished: DocumentsApi.getPublished.bind(DocumentsApi),
-	getDrafts: DocumentsApi.getDrafts.bind(DocumentsApi)
-};

package/src/lib/api/index.ts

@@ -1,7 +0,0 @@
-// API Client exports
-export { type ApiClient, ApiError, apiClient } from './client';
-export { type ApiResponse } from './types';
-export { documents } from './documents';
-export { organizations } from './organizations';
-export { assets } from './assets';
-export type * from '../types/index';

package/src/lib/api/organizations.ts

@@ -1,154 +0,0 @@
-// Organizations API client - composable organization operations
-import { apiClient } from './client';
-import type { Organization, OrganizationMember, OrganizationRole } from '../types/organization';
-import type { ApiResponse } from './types';
-
-export interface CreateOrganizationData {
-	name: string;
-	slug: string;
-	metadata?: any;
-	parentOrganizationId?: string;
-}
-
-export interface OrganizationListItem extends Organization {
-	role: OrganizationRole;
-	joinedAt: Date;
-	isActive: boolean;
-}
-
-export interface SwitchOrganizationData {
-	organizationId: string;
-}
-
-export interface InviteMemberData {
-	email: string;
-	role: OrganizationRole;
-}
-
-export interface UpdateMemberRoleData {
-	userId: string;
-	role: OrganizationRole;
-}
-
-export interface RemoveMemberData {
-	userId: string;
-}
-
-export interface CancelInvitationData {
-	invitationId: string;
-}
-
-export interface UpdateOrganizationData {
-	name?: string;
-	slug?: string;
-	metadata?: any;
-}
-
-export class OrganizationsApi {
-	/**
-	 * List user's organizations
-	 */
-	static async list(): Promise<ApiResponse<OrganizationListItem[]>> {
-		return apiClient.get<OrganizationListItem[]>('/organizations');
-	}
-
-	/**
-	 * Create new organization (super_admin only)
-	 */
-	static async create(data: CreateOrganizationData): Promise<ApiResponse<Organization>> {
-		return apiClient.post<Organization>('/organizations', data);
-	}
-
-	/**
-	 * Switch to a different organization
-	 */
-	static async switch(data: SwitchOrganizationData): Promise<ApiResponse<{ success: boolean }>> {
-		return apiClient.post<{ success: boolean }>('/organizations/switch', data);
-	}
-
-	/**
-	 * Get organization by ID
-	 */
-	static async getById(id: string): Promise<ApiResponse<Organization>> {
-		return apiClient.get<Organization>(`/organizations/${id}`);
-	}
-
-	/**
-	 * Get active organization
-	 */
-	static async getActive(): Promise<ApiResponse<Organization>> {
-		const result = await this.list();
-		const active = result.data?.find((org) => org.isActive);
-		if (!active) {
-			throw new Error('No active organization found');
-		}
-		return {
-			success: true,
-			data: active
-		};
-	}
-
-	/**
-	 * Get organization members
-	 */
-	static async getMembers(): Promise<ApiResponse<OrganizationMember[]>> {
-		return apiClient.get<OrganizationMember[]>('/organizations/members');
-	}
-
-	/**
-	 * Invite a member to the organization
-	 */
-	static async inviteMember(data: InviteMemberData): Promise<ApiResponse<OrganizationMember>> {
-		return apiClient.post<OrganizationMember>('/organizations/invitations', data);
-	}
-
-	/**
-	 * Remove a member from the organization
-	 */
-	static async removeMember(data: RemoveMemberData): Promise<ApiResponse<{ success: boolean }>> {
-		return apiClient.delete<{ success: boolean }>('/organizations/members', data);
-	}
-
-	/**
-	 * Update a member's role
-	 */
-	static async updateMemberRole(
-		data: UpdateMemberRoleData
-	): Promise<ApiResponse<OrganizationMember>> {
-		return apiClient.patch<OrganizationMember>('/organizations/members', data);
-	}
-
-	/**
-	 * Update organization settings
-	 */
-	static async update(
-		id: string,
-		data: UpdateOrganizationData
-	): Promise<ApiResponse<Organization>> {
-		return apiClient.patch<Organization>(`/organizations/${id}`, data);
-	}
-
-	/**
-	 * Cancel a pending invitation
-	 */
-	static async cancelInvitation(
-		data: CancelInvitationData
-	): Promise<ApiResponse<{ success: boolean }>> {
-		return apiClient.delete<{ success: boolean }>('/organizations/invitations', data);
-	}
-}
-
-// Export convenience functions for direct use
-export const organizations = {
-	list: OrganizationsApi.list.bind(OrganizationsApi),
-	create: OrganizationsApi.create.bind(OrganizationsApi),
-	switch: OrganizationsApi.switch.bind(OrganizationsApi),
-	getById: OrganizationsApi.getById.bind(OrganizationsApi),
-	getActive: OrganizationsApi.getActive.bind(OrganizationsApi),
-	update: OrganizationsApi.update.bind(OrganizationsApi),
-	getMembers: OrganizationsApi.getMembers.bind(OrganizationsApi),
-	inviteMember: OrganizationsApi.inviteMember.bind(OrganizationsApi),
-	removeMember: OrganizationsApi.removeMember.bind(OrganizationsApi),
-	updateMemberRole: OrganizationsApi.updateMemberRole.bind(OrganizationsApi),
-	cancelInvitation: OrganizationsApi.cancelInvitation.bind(OrganizationsApi)
-};

package/src/lib/api/types.ts

@@ -1,34 +0,0 @@
-// API client types
-import type { Document, NewDocument } from '../types/index';
-
-// API Response wrappers
-export interface ApiResponse<T> {
-	success: boolean;
-	data?: T;
-	error?: string;
-	message?: string;
-	meta?: {
-		count: number;
-		limit: number;
-		offset: number;
-		filters: Record<string, any>;
-	};
-}
-
-// Document-related types
-export interface DocumentListParams {
-	docType?: string;
-	status?: string;
-	limit?: number;
-	offset?: number;
-}
-
-// Use database types directly instead of duplicating
-export type CreateDocumentData = Omit<
-	NewDocument,
-	'id' | 'createdAt' | 'updatedAt' | 'publishedAt'
->;
-export type UpdateDocumentData = Partial<Pick<Document, 'draftData' | 'status'>>;
-
-// Re-export database types for convenience
-export type { Document, NewDocument };

package/src/lib/auth/auth-errors.ts

@@ -1,23 +0,0 @@
-// Custom authentication errors with error codes for better error handling
-
-export type AuthErrorCode =
-	| 'no_session'
-	| 'session_expired'
-	| 'no_organization'
-	| 'kicked_from_org'
-	| 'unauthorized';
-
-export class AuthError extends Error {
-	code: AuthErrorCode;
-
-	constructor(code: AuthErrorCode, message: string) {
-		super(message);
-		this.code = code;
-		this.name = 'AuthError';
-	}
-}
-
-// Helper function to create auth errors
-export function createAuthError(code: AuthErrorCode, message: string): AuthError {
-	return new AuthError(code, message);
-}

package/src/lib/auth/auth-hooks.ts

@@ -1,132 +0,0 @@
-import type { RequestEvent } from '@sveltejs/kit';
-import { redirect } from '@sveltejs/kit';
-import type { DatabaseAdapter } from '../db/index';
-import type { CMSConfig, Auth } from '../types/index';
-import type { AuthProvider } from './provider';
-import { AuthError } from './auth-errors';
-
-export async function handleAuthHook(
-	event: RequestEvent,
-	config: CMSConfig,
-	authProvider: AuthProvider,
-	db: DatabaseAdapter
-): Promise<Response | null> {
-	const path = event.url.pathname;
-
-	// 1. Admin UI routes - require session authentication
-	if (path.startsWith('/admin')) {
-		try {
-			const session = await authProvider.requireSession(event.request, db);
-			event.locals.auth = session;
-		} catch (error) {
-			// If it's an AuthError, redirect to login with error code
-			if (error instanceof AuthError) {
-				const loginUrl = config.auth?.loginUrl || '/login';
-				throw redirect(302, `${loginUrl}?error=${error.code}`);
-			}
-			// For other errors, redirect without error code
-			throw redirect(302, config.auth?.loginUrl || '/login');
-		}
-	}
-
-	// 2. Asset CDN routes - accept session OR API key OR signed token
-	// Support both /assets/ and /media/ paths (media is Sanity-style URL)
-	if (path.startsWith('/assets/') || path.startsWith('/media/')) {
-		// Try session first (for admin UI)
-		let auth: Auth | null = await authProvider.getSession(event.request, db);
-
-		// If no session, try API key
-		if (!auth) {
-			auth = await authProvider.validateApiKey(event.request, db);
-		}
-
-		// Make auth available (can be null, route will check for signed token)
-		if (auth) {
-			event.locals.auth = auth;
-		}
-	}
-
-	// 3. API routes - accept session OR API key
-	if (path.startsWith('/api/')) {
-		// Skip auth routes (Better Auth handles these)
-		if (path.startsWith('/api/auth')) {
-			return null; // Let the main hook continue
-		}
-
-		// If API key is explicitly provided, prioritize it over session
-		// This allows public content access even when user is logged in to a different org
-		const hasApiKey = event.request.headers.has('x-api-key');
-		let auth: Auth | null = null;
-
-		if (hasApiKey) {
-			// API key takes precedence when explicitly provided
-			auth = await authProvider.validateApiKey(event.request, db);
-		} else {
-			// Otherwise, try session (for admin UI making API calls)
-			auth = await authProvider.getSession(event.request, db);
-		}
-
-		// Dynamically find the GraphQL endpoint from plugins
-		let graphqlEndpoint: string | undefined;
-		const graphqlPlugin = config.plugins?.find((p) => p.name === '@aphexcms/graphql-plugin');
-		if (graphqlPlugin && graphqlPlugin.routes) {
-			graphqlEndpoint = Object.keys(graphqlPlugin.routes)[0];
-		}
-
-		// Require authentication for protected API routes
-		const protectedApiRoutes = [
-			'/api/documents',
-			'/api/assets',
-			'/api/schemas',
-			'/api/organizations',
-			'/api/settings'
-		];
-		if (graphqlEndpoint) {
-			protectedApiRoutes.push(graphqlEndpoint);
-		}
-		const isProtectedRoute = protectedApiRoutes.some((route) => path.startsWith(route));
-
-		if (isProtectedRoute && !auth) {
-			return new Response(JSON.stringify({ error: 'Unauthorized' }), {
-				status: 401,
-				headers: { 'Content-Type': 'application/json' }
-			});
-		}
-
-		// Check write permission for mutations
-		if (auth && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(event.request.method)) {
-			// Special handling for GraphQL
-			if (graphqlEndpoint && path.startsWith(graphqlEndpoint)) {
-				// We need to read the body to check if it's a mutation.
-				// It's important to clone the request so we don't consume the body stream.
-				const requestBody = await event.request.clone().text();
-				const isMutation = requestBody.trim().startsWith('mutation');
-
-				if (isMutation && auth.type === 'api_key' && !auth.permissions.includes('write')) {
-					return new Response(
-						JSON.stringify({ error: 'Forbidden: Write permission required for mutations' }),
-						{
-							status: 403,
-							headers: { 'Content-Type': 'application/json' }
-						}
-					);
-				}
-			} else {
-				// Existing logic for other API routes
-				if (auth.type === 'api_key' && !auth.permissions.includes('write')) {
-					return new Response(JSON.stringify({ error: 'Forbidden: Write permission required' }), {
-						status: 403,
-						headers: { 'Content-Type': 'application/json' }
-					});
-				}
-			}
-		}
-
-		// Make auth available in API routes
-		if (auth) {
-			event.locals.auth = auth;
-		}
-	}
-
-	return null; // Tell the main hook to continue
-}

package/src/lib/auth/provider.ts

@@ -1,25 +0,0 @@
-// packages/cms-core/src/auth/provider.ts
-import type { SessionAuth, ApiKeyAuth } from '../types/index';
-import type { DatabaseAdapter } from '../db/interfaces/index';
-
-export interface AuthProvider {
-	// Session auth (browser, admin UI)
-	getSession(request: Request, db: DatabaseAdapter): Promise<SessionAuth | null>;
-	requireSession(request: Request, db: DatabaseAdapter): Promise<SessionAuth>;
-
-	// API key auth (programmatic access)
-	validateApiKey(request: Request, db: DatabaseAdapter): Promise<ApiKeyAuth | null>;
-	requireApiKey(
-		request: Request,
-		db: DatabaseAdapter,
-		permission?: 'read' | 'write'
-	): Promise<ApiKeyAuth>;
-
-	// User management
-	getUserById(userId: string): Promise<{ id: string; name?: string; email: string } | null>;
-	changeUserName(userId: string, name: string): Promise<void>;
-
-	// Password reset
-	requestPasswordReset(email: string, redirectTo?: string): Promise<void>;
-	resetPassword(token: string, newPassword: string): Promise<void>;
-}

package/src/lib/config.ts

@@ -1,18 +0,0 @@
-// Aphex CMS Configuration System
-import type { CMSConfig } from './types/index';
-
-export function createCMSConfig(config: CMSConfig): CMSConfig {
-	return {
-		// Start with the user's config and apply defaults for missing properties
-		...config,
-		storage: config.storage ?? null, // Default to null if not provided
-		customization: {
-			branding: {
-				title: 'Aphex CMS',
-				...config.customization?.branding
-			},
-			...config.customization
-		},
-		plugins: config.plugins ?? []
-	};
-}