@aphexcms/cms-core 0.1.11 → 0.1.13

package/dist/routes/assets-cdn.js

@@ -0,0 +1,155 @@
+export const GET = async ({ params, locals, setHeaders, request }) => {
+    console.log('[Asset CDN] ========== ROUTE HIT ==========');
+    console.log('[Asset CDN] Params:', params);
+    try {
+        const { assetService, databaseAdapter, storageAdapter, cmsEngine, config } = locals.aphexCMS;
+        let auth = locals.auth;
+        const { id, filename } = params;
+        console.log('[Asset CDN] Request for asset:', id, filename);
+        console.log('[Asset CDN] Has auth?', !!auth);
+        // If no session auth, check for API key in headers
+        if (!auth) {
+            const apiKey = request.headers.get('x-api-key');
+            console.log('[Asset CDN] API key present?', !!apiKey);
+            if (apiKey && config.auth?.provider) {
+                try {
+                    const apiKeyAuth = await config.auth.provider.validateApiKey(request, databaseAdapter);
+                    if (apiKeyAuth) {
+                        auth = apiKeyAuth;
+                        console.log('[Asset CDN] Authenticated via API key, org:', apiKeyAuth.organizationId);
+                    }
+                }
+                catch (err) {
+                    console.warn('[Asset CDN] API key validation failed:', err);
+                }
+            }
+        }
+        console.log('[Asset CDN] Auth type:', auth?.type);
+        if (!id) {
+            return new Response('Asset ID is required', { status: 400 });
+        }
+        // Try to fetch asset globally first (bypasses RLS for public assets)
+        const asset = await assetService.findAssetByIdGlobal(id);
+        console.log('[Asset CDN] Asset found globally?', !!asset);
+        if (!asset) {
+            console.warn('[Asset CDN] Asset not found:', id);
+            return new Response('Asset not found', { status: 404 });
+        }
+        const organizationId = auth?.organizationId;
+        console.log('[Asset CDN] Auth object:', JSON.stringify(auth, null, 2));
+        console.log('[Asset CDN] Auth organizationId:', organizationId);
+        console.log('[Asset CDN] Asset organizationId:', asset.organizationId);
+        // Check if this asset is used in a private field
+        // The field metadata (schemaType and fieldPath) is stored when the asset is uploaded
+        let isPrivate = false;
+        const schemaType = asset.metadata?.schemaType;
+        const fieldPath = asset.metadata?.fieldPath;
+        if (schemaType && fieldPath) {
+            // Get the schema definition from IN-MEMORY config (always up-to-date with code changes)
+            const schema = cmsEngine.getSchemaTypeByName(schemaType);
+            console.log(`[Asset CDN] Schema lookup for ${schemaType}:`, {
+                found: !!schema,
+                fieldCount: schema?.fields?.length
+            });
+            if (schema && schema.fields) {
+                // Navigate the field path to find the field definition
+                const findField = (fields, path) => {
+                    const parts = path.split('.');
+                    let current = null;
+                    for (let i = 0; i < parts.length; i++) {
+                        const part = parts[i];
+                        current = fields.find((f) => f.name === part);
+                        if (!current)
+                            return null;
+                        // If not the last part, navigate into nested fields
+                        if (i < parts.length - 1) {
+                            if (current.type === 'object' && current.fields) {
+                                fields = current.fields;
+                            }
+                            else {
+                                return null;
+                            }
+                        }
+                    }
+                    return current;
+                };
+                const field = findField(schema.fields, fieldPath);
+                console.log(`[Asset CDN] Field lookup for ${fieldPath}:`, {
+                    found: !!field,
+                    type: field?.type,
+                    private: field?.private
+                });
+                if (field && field.type === 'image') {
+                    isPrivate = field.private === true;
+                    console.log(`[Asset CDN] Field check: ${schemaType}.${fieldPath} - private: ${isPrivate}`);
+                }
+                else {
+                    console.warn(`[Asset CDN] Could not find field: ${schemaType}.${fieldPath}`);
+                }
+            }
+        }
+        else {
+            console.log('[Asset CDN] No field metadata - treating as public');
+        }
+        console.log('[Asset CDN] Asset privacy result:', { isPrivate, schemaType, fieldPath });
+        // If asset is private, require auth
+        if (isPrivate && !organizationId) {
+            console.warn('[Asset CDN] Private asset accessed without auth - DENIED');
+            return new Response('Unauthorized - This asset is private', { status: 401 });
+        }
+        // If asset is private, verify org matches
+        if (isPrivate && organizationId && organizationId !== asset.organizationId) {
+            console.warn('[Asset CDN] Org mismatch for private asset - FORBIDDEN');
+            return new Response('Forbidden', { status: 403 });
+        }
+        // Log the decision
+        if (isPrivate && organizationId) {
+            console.log('[Asset CDN] Private asset access ALLOWED - user has auth and org matches');
+        }
+        else if (!isPrivate) {
+            console.log('[Asset CDN] Public asset access ALLOWED');
+        }
+        console.log('[Asset CDN] Asset found:', {
+            id: asset.id,
+            path: asset.path,
+            mimeType: asset.mimeType,
+            storageAdapter: asset.storageAdapter
+        });
+        // If asset has a direct URL (S3/R2), redirect to it
+        if (asset.url && asset.url.startsWith('http')) {
+            console.log('[Asset CDN] Redirecting to external URL:', asset.url);
+            return new Response(null, {
+                status: 302,
+                headers: { Location: asset.url }
+            });
+        }
+        // Otherwise, serve from local storage
+        if (!storageAdapter?.getObject) {
+            console.error('[Asset CDN] Storage adapter does not support getObject');
+            return new Response('Storage adapter does not support file serving', { status: 500 });
+        }
+        console.log('[Asset CDN] Reading file from storage:', asset.path);
+        const fileBuffer = await storageAdapter.getObject(asset.path);
+        console.log('[Asset CDN] Serving file:', {
+            size: fileBuffer.length,
+            mimeType: asset.mimeType
+        });
+        // Set appropriate headers for the asset
+        setHeaders({
+            'Content-Type': asset.mimeType || 'application/octet-stream',
+            'Content-Length': fileBuffer.length.toString(),
+            'Cache-Control': 'public, max-age=31536000, immutable', // Cache for 1 year
+            'Content-Disposition': `inline; filename="${encodeURIComponent(asset.originalFilename || asset.filename)}"`,
+            ...(asset.mimeType?.startsWith('image/') && {
+                'Accept-Ranges': 'bytes'
+            })
+        });
+        // Convert Buffer to ArrayBuffer for Response
+        const arrayBuffer = fileBuffer.buffer.slice(fileBuffer.byteOffset, fileBuffer.byteOffset + fileBuffer.byteLength);
+        return new Response(arrayBuffer);
+    }
+    catch (error) {
+        console.error('[Asset CDN] Error serving asset:', error);
+        return new Response('Failed to serve asset', { status: 500 });
+    }
+};

package/dist/routes/assets.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const POST: RequestHandler;
+export declare const GET: RequestHandler;
+//# sourceMappingURL=assets.d.ts.map

package/dist/routes/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,IAAI,EAAE,cAiElB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cA4CjB,CAAC"}

package/dist/routes/assets.js

@@ -0,0 +1,94 @@
+// Aphex CMS Asset API Handlers
+import { json } from '@sveltejs/kit';
+export const POST = async ({ request, locals }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        const formData = await request.formData();
+        const file = formData.get('file');
+        if (!file) {
+            return json({ success: false, error: 'No file provided' }, { status: 400 });
+        }
+        // Convert file to buffer
+        const arrayBuffer = await file.arrayBuffer();
+        const buffer = Buffer.from(arrayBuffer);
+        // Get optional metadata from form data
+        const title = formData.get('title') || undefined;
+        const description = formData.get('description') || undefined;
+        const alt = formData.get('alt') || undefined;
+        const creditLine = formData.get('creditLine') || undefined;
+        // Get field metadata for privacy checking
+        const schemaType = formData.get('schemaType') || undefined;
+        const fieldPath = formData.get('fieldPath') || undefined;
+        // Create asset upload data
+        const uploadData = {
+            buffer,
+            originalFilename: file.name,
+            mimeType: file.type,
+            size: file.size,
+            title,
+            description,
+            alt,
+            creditLine,
+            createdBy: auth.type === 'session' ? auth.user.id : undefined,
+            metadata: {
+                schemaType,
+                fieldPath
+            }
+        };
+        // Upload asset using the service
+        const asset = await assetService.uploadAsset(auth.organizationId, uploadData);
+        return json({
+            success: true,
+            data: asset
+        });
+    }
+    catch (error) {
+        console.error('Asset upload failed:', error);
+        return json({
+            success: false,
+            error: 'Asset upload failed',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+export const GET = async ({ url, locals }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        // Parse query parameters
+        const assetType = url.searchParams.get('assetType');
+        const mimeType = url.searchParams.get('mimeType') || undefined;
+        const search = url.searchParams.get('search') || undefined;
+        const limitParam = url.searchParams.get('limit');
+        const offsetParam = url.searchParams.get('offset');
+        const limit = limitParam ? parseInt(limitParam) : 20;
+        const offset = offsetParam ? parseInt(offsetParam) : 0;
+        const filters = {
+            assetType,
+            mimeType,
+            search,
+            limit: isNaN(limit) ? 20 : limit,
+            offset: isNaN(offset) ? 0 : offset
+        };
+        const assets = await assetService.findAssets(auth.organizationId, filters);
+        return json({
+            success: true,
+            data: assets
+        });
+    }
+    catch (error) {
+        console.error('Failed to fetch assets:', error);
+        return json({
+            success: false,
+            error: 'Failed to fetch assets',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes/documents-by-id.d.ts

@@ -0,0 +1,5 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const GET: RequestHandler;
+export declare const PUT: RequestHandler;
+export declare const DELETE: RequestHandler;
+//# sourceMappingURL=documents-by-id.d.ts.map

package/dist/routes/documents-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cAuEjB,CAAC;AAGF,eAAO,MAAM,GAAG,EAAE,cAqEjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cA+DpB,CAAC"}

package/dist/routes/documents-by-id.js

@@ -0,0 +1,163 @@
+// Aphex CMS Document by ID API Handlers
+import { json } from '@sveltejs/kit';
+import { authToContext } from '../local-api/auth-helpers.js';
+import { PermissionError } from '../local-api/permissions.js';
+// GET /api/documents/[id] - Get document by ID
+export const GET = async ({ params, url, locals }) => {
+    try {
+        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const context = authToContext(locals.auth);
+        const { id } = params;
+        if (!id) {
+            return json({ success: false, error: 'Document ID is required' }, { status: 400 });
+        }
+        // Parse query params
+        const depthParam = url.searchParams.get('depth');
+        const depth = depthParam ? Math.max(0, Math.min(parseInt(depthParam), 5)) : 0;
+        const perspective = url.searchParams.get('perspective') || 'draft';
+        // First, fetch document to get its type (need this for collection-specific API)
+        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        if (!rawDoc) {
+            return json({ success: false, error: 'Document not found' }, { status: 404 });
+        }
+        // Get collection API (TypeScript-safe)
+        const collection = localAPI.collections[rawDoc.type];
+        if (!collection) {
+            return json({
+                success: false,
+                error: 'Invalid document type',
+                message: `Collection '${rawDoc.type}' not found`
+            }, { status: 400 });
+        }
+        // Now use LocalAPI for permission-checked retrieval
+        const document = await collection.findByID(context, id, {
+            depth,
+            perspective
+        });
+        if (!document) {
+            return json({ success: false, error: 'Document not found' }, { status: 404 });
+        }
+        return json({
+            success: true,
+            data: document
+        });
+    }
+    catch (error) {
+        console.error('Failed to fetch document:', error);
+        if (error instanceof PermissionError) {
+            return json({
+                success: false,
+                error: 'Forbidden',
+                message: error.message
+            }, { status: 403 });
+        }
+        return json({
+            success: false,
+            error: 'Failed to fetch document',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+// PUT /api/documents/[id] - Update document
+export const PUT = async ({ params, request, locals }) => {
+    try {
+        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const context = authToContext(locals.auth);
+        const { id } = params;
+        const body = await request.json();
+        if (!id) {
+            return json({ success: false, error: 'Document ID is required' }, { status: 400 });
+        }
+        const documentData = body.draftData || body.data;
+        const shouldPublish = body.publish || false;
+        // Fetch document to get its type
+        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        if (!rawDoc) {
+            return json({ success: false, error: 'Document not found' }, { status: 404 });
+        }
+        // Get collection API (TypeScript-safe)
+        const collection = localAPI.collections[rawDoc.type];
+        if (!collection) {
+            return json({
+                success: false,
+                error: 'Invalid document type',
+                message: `Collection '${rawDoc.type}' not found`
+            }, { status: 400 });
+        }
+        // Update via LocalAPI (permission checks happen inside)
+        const updatedDocument = await collection.update(context, id, documentData, {
+            publish: shouldPublish
+        });
+        if (!updatedDocument) {
+            return json({ success: false, error: 'Document not found' }, { status: 404 });
+        }
+        return json({
+            success: true,
+            data: updatedDocument
+        });
+    }
+    catch (error) {
+        console.error('Failed to update document:', error);
+        if (error instanceof PermissionError) {
+            return json({
+                success: false,
+                error: 'Forbidden',
+                message: error.message
+            }, { status: 403 });
+        }
+        return json({
+            success: false,
+            error: 'Failed to update document',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+// DELETE /api/documents/[id] - Delete document
+export const DELETE = async ({ params, locals }) => {
+    try {
+        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const context = authToContext(locals.auth);
+        const { id } = params;
+        if (!id) {
+            return json({ success: false, error: 'Document ID is required' }, { status: 400 });
+        }
+        // Fetch document to get its type
+        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        if (!rawDoc) {
+            return json({ success: false, error: 'Document not found' }, { status: 404 });
+        }
+        // Get collection API (TypeScript-safe)
+        const collection = localAPI.collections[rawDoc.type];
+        if (!collection) {
+            return json({
+                success: false,
+                error: 'Invalid document type',
+                message: `Collection '${rawDoc.type}' not found`
+            }, { status: 400 });
+        }
+        // Delete via LocalAPI (permission checks happen inside)
+        const success = await collection.delete(context, id);
+        if (!success) {
+            return json({ success: false, error: 'Document not found' }, { status: 404 });
+        }
+        return json({
+            success: true,
+            message: 'Document deleted successfully'
+        });
+    }
+    catch (error) {
+        console.error('Failed to delete document:', error);
+        if (error instanceof PermissionError) {
+            return json({
+                success: false,
+                error: 'Forbidden',
+                message: error.message
+            }, { status: 403 });
+        }
+        return json({
+            success: false,
+            error: 'Failed to delete document',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes/documents-publish.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const POST: RequestHandler;
+export declare const DELETE: RequestHandler;
+//# sourceMappingURL=documents-publish.d.ts.map

package/dist/routes/documents-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-publish.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAiGlB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAqFpB,CAAC"}

package/dist/routes/documents-publish.js

@@ -0,0 +1,136 @@
+// Aphex CMS Document Publish API Handlers
+import { json } from '@sveltejs/kit';
+import { authToContext } from '../local-api/auth-helpers.js';
+import { PermissionError } from '../local-api/permissions.js';
+// POST /api/documents/[id]/publish - Publish document
+export const POST = async ({ params, locals }) => {
+    try {
+        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const context = authToContext(locals.auth);
+        const { id } = params;
+        if (!id) {
+            return json({
+                success: false,
+                error: 'Missing document ID',
+                message: 'Document ID is required'
+            }, { status: 400 });
+        }
+        // Fetch document to get its type
+        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        if (!rawDoc) {
+            return json({
+                success: false,
+                error: 'Document not found',
+                message: 'Document may not exist'
+            }, { status: 404 });
+        }
+        // Get collection API (TypeScript-safe)
+        const collection = localAPI.collections[rawDoc.type];
+        if (!collection) {
+            return json({
+                success: false,
+                error: 'Invalid document type',
+                message: `Collection '${rawDoc.type}' not found`
+            }, { status: 400 });
+        }
+        // Publish via LocalAPI (permission checks and validation happen inside)
+        const publishedDocument = await collection.publish(context, id);
+        if (!publishedDocument) {
+            return json({
+                success: false,
+                error: 'Document not found or cannot be published',
+                message: 'Document may not have draft content to publish'
+            }, { status: 404 });
+        }
+        return json({
+            success: true,
+            data: publishedDocument,
+            message: 'Document published successfully'
+        });
+    }
+    catch (error) {
+        console.error('Failed to publish document:', error);
+        if (error instanceof PermissionError) {
+            return json({
+                success: false,
+                error: 'Forbidden',
+                message: error.message
+            }, { status: 403 });
+        }
+        // Validation errors from LocalAPI are regular errors with specific messages
+        if (error instanceof Error && error.message.includes('validation errors')) {
+            return json({
+                success: false,
+                error: 'Cannot publish: validation errors',
+                message: error.message
+            }, { status: 400 });
+        }
+        return json({
+            success: false,
+            error: 'Failed to publish document',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+// DELETE /api/documents/[id]/publish - Unpublish document
+export const DELETE = async ({ params, locals }) => {
+    try {
+        const { localAPI, databaseAdapter } = locals.aphexCMS;
+        const context = authToContext(locals.auth);
+        const { id } = params;
+        if (!id) {
+            return json({
+                success: false,
+                error: 'Missing document ID',
+                message: 'Document ID is required'
+            }, { status: 400 });
+        }
+        // Fetch document to get its type
+        const rawDoc = await databaseAdapter.findByDocId(context.organizationId, id, 0);
+        if (!rawDoc) {
+            return json({
+                success: false,
+                error: 'Document not found',
+                message: `No document found with ID: ${id}`
+            }, { status: 404 });
+        }
+        // Get collection API (TypeScript-safe)
+        const collection = localAPI.collections[rawDoc.type];
+        if (!collection) {
+            return json({
+                success: false,
+                error: 'Invalid document type',
+                message: `Collection '${rawDoc.type}' not found`
+            }, { status: 400 });
+        }
+        // Unpublish via LocalAPI (permission checks happen inside)
+        const unpublishedDocument = await collection.unpublish(context, id);
+        if (!unpublishedDocument) {
+            return json({
+                success: false,
+                error: 'Document not found',
+                message: `No document found with ID: ${id}`
+            }, { status: 404 });
+        }
+        return json({
+            success: true,
+            data: unpublishedDocument,
+            message: 'Document unpublished successfully'
+        });
+    }
+    catch (error) {
+        console.error('Failed to unpublish document:', error);
+        if (error instanceof PermissionError) {
+            return json({
+                success: false,
+                error: 'Forbidden',
+                message: error.message
+            }, { status: 403 });
+        }
+        return json({
+            success: false,
+            error: 'Failed to unpublish document',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes/documents-query.d.ts

@@ -0,0 +1,24 @@
+import type { RequestHandler } from '@sveltejs/kit';
+/**
+ * POST /api/documents/query - Advanced document querying with complex filters
+ *
+ * Accepts LocalAPI FindOptions in request body for full filtering power
+ *
+ * @example
+ * POST /api/documents/query
+ * {
+ *   "type": "page",
+ *   "where": {
+ *     "status": { "equals": "published" },
+ *     "hero.heading": { "contains": "Welcome" },
+ *     "publishedAt": { "gte": "2024-01-01" }
+ *   },
+ *   "limit": 20,
+ *   "page": 1,
+ *   "sort": ["-publishedAt", "title"],
+ *   "depth": 1,
+ *   "perspective": "published"
+ * }
+ */
+export declare const POST: RequestHandler;
+//# sourceMappingURL=documents-query.d.ts.map

package/dist/routes/documents-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents-query.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-query.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AASpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,IAAI,EAAE,cAqFlB,CAAC"}