@aphexcms/cms-core 0.1.3 → 0.1.4

package/dist/plugins/README.md

@@ -0,0 +1,154 @@
+# Plugin Architecture: A Sanity-like "Parts" System
+
+This document outlines a vision for a highly extensible, decoupled plugin architecture for Aphex CMS, inspired by the "parts" system used in Sanity Studio.
+
+## Core Concept: The "Parts" System
+
+The goal is to move away from a specialized plugin system, where the core application knows about specific plugin properties like `routes` or `adminUI`, to a generic one.
+
+The core concept is a **"parts" system**. A "part" is a formally defined, named extension point in the application that a plugin can provide an implementation for. The core application doesn't know what a "GraphQL Plugin" is; it only knows how to find and render a "tool" in the admin bar, or how to register a "server route".
+
+---
+
+## The Plugin Contract
+
+We would redefine the `CMSPlugin` interface to be centered around this "parts" concept.
+
+```typescript
+/**
+ * A generic definition for any piece of functionality a plugin can provide.
+ */
+export interface PluginPart {
+	/**
+	 * The name of the part this plugin implements.
+	 * @example 'aphex/admin/tool', 'aphex/server/route'
+	 */
+	implements: string;
+
+	/** The actual implementation (can be a component, a function, etc.) */
+	component?: any; // In practice, a SvelteComponent constructor
+
+	/** The handler function for a route part */
+	handler?: (event: import('@sveltejs/kit').RequestEvent) => Response | Promise<Response>;
+
+	/** Other metadata the part might need for rendering or execution */
+	[key: string]: any;
+}
+
+/**
+ * The new plugin contract. A plugin is a collection of parts.
+ */
+export interface CMSPlugin {
+	name: string;
+	version: string;
+	parts?: PluginPart[];
+	/** `install` can still be used for complex, one-time setup logic */
+	install?: (cms: any) => Promise<void>;
+}
+```
+
+---
+
+## Defining Core Parts
+
+We would define a set of core "parts" for Aphex CMS. This list can grow over time as more extension points are needed.
+
+- `aphex/server/route`: Implemented by plugins that need to add a server-side API endpoint. The part would include a `path` and a `handler`.
+- `aphex/admin/tool`: For adding a top-level, navigable tool (like a tab) to the main admin UI. The part would include an `id`, `title`, and a `component` to render.
+- `aphex/field/component`: For registering a custom Svelte component to use for a specific schema field type (e.g., a special string input, a map selector, etc.).
+- `aphex/document/action`: For adding a custom action button to the document editor (e.g., "Duplicate", "Translate", "Preview").
+
+---
+
+## Implementation with SvelteKit and Svelte 5
+
+This architecture fits beautifully with SvelteKit's and Svelte 5's features.
+
+### The Part Resolver Service
+
+A singleton service, the "Part Resolver," would be the heart of the system.
+
+1.  **Initialization:** At application startup, the main `hooks.server.ts` would process the `cmsConfig.plugins` array once. It would loop through every plugin and every part, organizing them into a `Map<string, PluginPart[]>`. For example, the key `'aphex/admin/tool'` would hold an array of all tool parts from all installed plugins.
+2.  **Injection:** This resolver instance would be attached to SvelteKit's `event.locals`, making it universally available in `load` functions, server-side hooks, and API routes without needing global variables.
+
+### Rendering UI Parts with Svelte 5
+
+Dynamically rendering plugin components becomes trivial and efficient with Svelte 5.
+
+1.  **Data Loading:** In the `+page.server.ts` for the admin UI, the `load` function would use the resolver from `locals` to fetch the necessary parts.
+    ```typescript
+    // in /routes/admin/+page.server.ts
+    export async function load({ locals }) {
+    	const { partResolver } = locals.aphexCMS;
+    	const adminTools = partResolver.getParts('aphex/admin/tool');
+    	return { adminTools };
+    }
+    ```
+2.  **Dynamic Rendering:** The `AdminApp.svelte` component would receive `adminTools` as a prop. It can then dynamically render the tabs and their content using `<svelte:component>`.
+
+    ```svelte
+    <!-- AdminApp.svelte -->
+    <script lang="ts">
+    	let { adminTools = [] } = $props();
+    </script>
+
+    <Tabs.Root>
+    	<Tabs.List>
+    		<!-- Render a trigger for each tool -->
+    		{#each adminTools as tool}
+    			<Tabs.Trigger value={tool.id}>{tool.title}</Tabs.Trigger>
+    		{/each}
+    	</Tabs.List>
+
+    	<!-- Render the content for each tool -->
+    	{#each adminTools as tool}
+    		<Tabs.Content value={tool.id}>
+    			<svelte:component this={tool.component} />
+    		</Tabs.Content>
+    	{/each}
+    </Tabs.Root>
+    ```
+
+### Handling Server Parts in SvelteKit
+
+The main `hooks.server.ts` would use the resolver to handle non-UI parts. For example, it would get all `aphex/server/route` parts and register their handlers in a dynamic routing map, similar to how `pluginRoutes` works now but in a fully generic way.
+
+---
+
+## Example: The GraphQL Plugin Revisited
+
+Under this system, the GraphQL plugin becomes a clean, declarative manifest of its parts.
+
+```typescript
+// In packages/graphql-plugin/src/index.ts
+import GraphQLTabComponent from './GraphQLTab.svelte';
+import { createYoga } from 'graphql-yoga';
+
+// ... (yoga setup)
+
+export function createGraphQLPlugin(config: GraphQLPluginConfig = {}): CMSPlugin {
+    const endpoint = config.endpoint ?? '/api/graphql';
+    const yogaApp = /* ... create yoga instance ... */;
+
+    return {
+        name: '@aphexcms/graphql-plugin',
+        parts: [
+            // Part 1: The API endpoint
+            {
+                implements: 'aphex/server/route',
+                path: endpoint,
+                handler: (event) => yogaApp.fetch(event.request, event)
+            },
+            // Part 2: The UI tab in the admin interface
+            {
+                implements: 'aphex/admin/tool',
+                id: 'graphql',
+                title: 'GraphQL',
+                component: GraphQLTabComponent
+            }
+        ]
+    };
+}
+```
+
+With this, the core system remains completely agnostic. It doesn't know what "GraphQL" is, it simply knows how to render a "tool" and route a "server route". This is the foundation of a truly configurable and powerful plugin architecture.

package/dist/routes/assets-by-id.d.ts

@@ -0,0 +1,5 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const GET: RequestHandler;
+export declare const DELETE: RequestHandler;
+export declare const PATCH: RequestHandler;
+//# sourceMappingURL=assets-by-id.d.ts.map

package/dist/routes/assets-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-by-id.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,eAAO,MAAM,GAAG,EAAE,cAoDjB,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC;AAEF,eAAO,MAAM,KAAK,EAAE,cAwEnB,CAAC"}

package/dist/routes/assets-by-id.js

@@ -0,0 +1,138 @@
+import { json } from '@sveltejs/kit';
+export const GET = async ({ params, locals }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        const { id } = params;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        if (!id) {
+            return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
+        }
+        const asset = await assetService.findAssetById(auth.organizationId, id);
+        if (!asset) {
+            return json({ success: false, error: 'Asset not found' }, { status: 404 });
+        }
+        // Return JSON metadata for admin UI
+        return json({
+            success: true,
+            data: {
+                _type: asset.assetType === 'image' ? 'sanity.imageAsset' : 'sanity.fileAsset',
+                _id: asset.id,
+                url: asset.url,
+                originalFilename: asset.originalFilename,
+                mimeType: asset.mimeType,
+                size: asset.size,
+                metadata: {
+                    dimensions: asset.width && asset.height
+                        ? {
+                            width: asset.width,
+                            height: asset.height
+                        }
+                        : undefined,
+                    ...asset.metadata
+                },
+                title: asset.title,
+                description: asset.description,
+                alt: asset.alt,
+                creditLine: asset.creditLine,
+                _createdAt: asset.createdAt,
+                _updatedAt: asset.updatedAt
+            }
+        });
+    }
+    catch (error) {
+        console.error('[Asset API] Error fetching asset:', error);
+        return json({ success: false, error: 'Failed to fetch asset' }, { status: 500 });
+    }
+};
+export const DELETE = async ({ params, locals }) => {
+    try {
+        const { id } = params;
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        if (!id) {
+            return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
+        }
+        const result = await assetService.deleteAsset(auth.organizationId, id);
+        if (!result) {
+            return json({ success: false, error: 'Asset not found or could not be deleted' }, { status: 404 });
+        }
+        return json({ success: true });
+    }
+    catch (error) {
+        console.error('Error deleting asset:', error);
+        return json({ success: false, error: 'Failed to delete asset' }, { status: 500 });
+    }
+};
+export const PATCH = async ({ params, locals, request }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        const { id } = params;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        if (!id) {
+            return json({ success: false, error: 'Asset ID is required' }, { status: 400 });
+        }
+        const { title, description, alt, creditLine } = await request.json();
+        let updatedAsset;
+        if (auth.type == 'session') {
+            updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
+                title,
+                description,
+                alt,
+                creditLine,
+                updatedBy: auth.user.id
+            });
+        }
+        else {
+            updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
+                title,
+                description,
+                alt,
+                creditLine,
+                updatedBy: auth.keyId
+            });
+        }
+        if (!updatedAsset) {
+            return json({ success: false, error: 'Asset not found' }, { status: 404 });
+        }
+        // Return API response with success wrapper
+        return json({
+            success: true,
+            data: {
+                _type: updatedAsset.assetType === 'image' ? 'sanity.imageAsset' : 'sanity.fileAsset',
+                _id: updatedAsset.id,
+                url: updatedAsset.url,
+                originalFilename: updatedAsset.originalFilename,
+                mimeType: updatedAsset.mimeType,
+                size: updatedAsset.size,
+                metadata: {
+                    dimensions: updatedAsset.width && updatedAsset.height
+                        ? {
+                            width: updatedAsset.width,
+                            height: updatedAsset.height
+                        }
+                        : undefined,
+                    ...updatedAsset.metadata
+                },
+                title: updatedAsset.title,
+                description: updatedAsset.description,
+                alt: updatedAsset.alt,
+                creditLine: updatedAsset.creditLine,
+                _createdAt: updatedAsset.createdAt,
+                _updatedAt: updatedAsset.updatedAt
+            }
+        });
+    }
+    catch (error) {
+        console.error('Error updating asset:', error);
+        return json({ success: false, error: 'Failed to update asset' }, { status: 500 });
+    }
+};

package/dist/routes/assets-cdn.d.ts

@@ -0,0 +1,3 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const GET: RequestHandler;
+//# sourceMappingURL=assets-cdn.d.ts.map

package/dist/routes/assets-cdn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-cdn.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets-cdn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,GAAG,EAAE,cAsLjB,CAAC"}

package/dist/routes/assets-cdn.js

@@ -0,0 +1,155 @@
+export const GET = async ({ params, locals, setHeaders, request }) => {
+    console.log('[Asset CDN] ========== ROUTE HIT ==========');
+    console.log('[Asset CDN] Params:', params);
+    try {
+        const { assetService, databaseAdapter, storageAdapter, cmsEngine, config } = locals.aphexCMS;
+        let auth = locals.auth;
+        const { id, filename } = params;
+        console.log('[Asset CDN] Request for asset:', id, filename);
+        console.log('[Asset CDN] Has auth?', !!auth);
+        // If no session auth, check for API key in headers
+        if (!auth) {
+            const apiKey = request.headers.get('x-api-key');
+            console.log('[Asset CDN] API key present?', !!apiKey);
+            if (apiKey && config.auth?.provider) {
+                try {
+                    const apiKeyAuth = await config.auth.provider.validateApiKey(request, databaseAdapter);
+                    if (apiKeyAuth) {
+                        auth = apiKeyAuth;
+                        console.log('[Asset CDN] Authenticated via API key, org:', apiKeyAuth.organizationId);
+                    }
+                }
+                catch (err) {
+                    console.warn('[Asset CDN] API key validation failed:', err);
+                }
+            }
+        }
+        console.log('[Asset CDN] Auth type:', auth?.type);
+        if (!id) {
+            return new Response('Asset ID is required', { status: 400 });
+        }
+        // Try to fetch asset globally first (bypasses RLS for public assets)
+        const asset = await assetService.findAssetByIdGlobal(id);
+        console.log('[Asset CDN] Asset found globally?', !!asset);
+        if (!asset) {
+            console.warn('[Asset CDN] Asset not found:', id);
+            return new Response('Asset not found', { status: 404 });
+        }
+        const organizationId = auth?.organizationId;
+        console.log('[Asset CDN] Auth object:', JSON.stringify(auth, null, 2));
+        console.log('[Asset CDN] Auth organizationId:', organizationId);
+        console.log('[Asset CDN] Asset organizationId:', asset.organizationId);
+        // Check if this asset is used in a private field
+        // The field metadata (schemaType and fieldPath) is stored when the asset is uploaded
+        let isPrivate = false;
+        const schemaType = asset.metadata?.schemaType;
+        const fieldPath = asset.metadata?.fieldPath;
+        if (schemaType && fieldPath) {
+            // Get the schema definition from IN-MEMORY config (always up-to-date with code changes)
+            const schema = cmsEngine.getSchemaTypeByName(schemaType);
+            console.log(`[Asset CDN] Schema lookup for ${schemaType}:`, {
+                found: !!schema,
+                fieldCount: schema?.fields?.length
+            });
+            if (schema && schema.fields) {
+                // Navigate the field path to find the field definition
+                const findField = (fields, path) => {
+                    const parts = path.split('.');
+                    let current = null;
+                    for (let i = 0; i < parts.length; i++) {
+                        const part = parts[i];
+                        current = fields.find((f) => f.name === part);
+                        if (!current)
+                            return null;
+                        // If not the last part, navigate into nested fields
+                        if (i < parts.length - 1) {
+                            if (current.type === 'object' && current.fields) {
+                                fields = current.fields;
+                            }
+                            else {
+                                return null;
+                            }
+                        }
+                    }
+                    return current;
+                };
+                const field = findField(schema.fields, fieldPath);
+                console.log(`[Asset CDN] Field lookup for ${fieldPath}:`, {
+                    found: !!field,
+                    type: field?.type,
+                    private: field?.private
+                });
+                if (field && field.type === 'image') {
+                    isPrivate = field.private === true;
+                    console.log(`[Asset CDN] Field check: ${schemaType}.${fieldPath} - private: ${isPrivate}`);
+                }
+                else {
+                    console.warn(`[Asset CDN] Could not find field: ${schemaType}.${fieldPath}`);
+                }
+            }
+        }
+        else {
+            console.log('[Asset CDN] No field metadata - treating as public');
+        }
+        console.log('[Asset CDN] Asset privacy result:', { isPrivate, schemaType, fieldPath });
+        // If asset is private, require auth
+        if (isPrivate && !organizationId) {
+            console.warn('[Asset CDN] Private asset accessed without auth - DENIED');
+            return new Response('Unauthorized - This asset is private', { status: 401 });
+        }
+        // If asset is private, verify org matches
+        if (isPrivate && organizationId && organizationId !== asset.organizationId) {
+            console.warn('[Asset CDN] Org mismatch for private asset - FORBIDDEN');
+            return new Response('Forbidden', { status: 403 });
+        }
+        // Log the decision
+        if (isPrivate && organizationId) {
+            console.log('[Asset CDN] Private asset access ALLOWED - user has auth and org matches');
+        }
+        else if (!isPrivate) {
+            console.log('[Asset CDN] Public asset access ALLOWED');
+        }
+        console.log('[Asset CDN] Asset found:', {
+            id: asset.id,
+            path: asset.path,
+            mimeType: asset.mimeType,
+            storageAdapter: asset.storageAdapter
+        });
+        // If asset has a direct URL (S3/R2), redirect to it
+        if (asset.url && asset.url.startsWith('http')) {
+            console.log('[Asset CDN] Redirecting to external URL:', asset.url);
+            return new Response(null, {
+                status: 302,
+                headers: { Location: asset.url }
+            });
+        }
+        // Otherwise, serve from local storage
+        if (!storageAdapter?.getObject) {
+            console.error('[Asset CDN] Storage adapter does not support getObject');
+            return new Response('Storage adapter does not support file serving', { status: 500 });
+        }
+        console.log('[Asset CDN] Reading file from storage:', asset.path);
+        const fileBuffer = await storageAdapter.getObject(asset.path);
+        console.log('[Asset CDN] Serving file:', {
+            size: fileBuffer.length,
+            mimeType: asset.mimeType
+        });
+        // Set appropriate headers for the asset
+        setHeaders({
+            'Content-Type': asset.mimeType || 'application/octet-stream',
+            'Content-Length': fileBuffer.length.toString(),
+            'Cache-Control': 'public, max-age=31536000, immutable', // Cache for 1 year
+            'Content-Disposition': `inline; filename="${encodeURIComponent(asset.originalFilename || asset.filename)}"`,
+            ...(asset.mimeType?.startsWith('image/') && {
+                'Accept-Ranges': 'bytes'
+            })
+        });
+        // Convert Buffer to ArrayBuffer for Response
+        const arrayBuffer = fileBuffer.buffer.slice(fileBuffer.byteOffset, fileBuffer.byteOffset + fileBuffer.byteLength);
+        return new Response(arrayBuffer);
+    }
+    catch (error) {
+        console.error('[Asset CDN] Error serving asset:', error);
+        return new Response('Failed to serve asset', { status: 500 });
+    }
+};

package/dist/routes/assets.d.ts

@@ -0,0 +1,4 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const POST: RequestHandler;
+export declare const GET: RequestHandler;
+//# sourceMappingURL=assets.d.ts.map

package/dist/routes/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,IAAI,EAAE,cAiElB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cA4CjB,CAAC"}

package/dist/routes/assets.js

@@ -0,0 +1,94 @@
+// Aphex CMS Asset API Handlers
+import { json } from '@sveltejs/kit';
+export const POST = async ({ request, locals }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        const formData = await request.formData();
+        const file = formData.get('file');
+        if (!file) {
+            return json({ success: false, error: 'No file provided' }, { status: 400 });
+        }
+        // Convert file to buffer
+        const arrayBuffer = await file.arrayBuffer();
+        const buffer = Buffer.from(arrayBuffer);
+        // Get optional metadata from form data
+        const title = formData.get('title') || undefined;
+        const description = formData.get('description') || undefined;
+        const alt = formData.get('alt') || undefined;
+        const creditLine = formData.get('creditLine') || undefined;
+        // Get field metadata for privacy checking
+        const schemaType = formData.get('schemaType') || undefined;
+        const fieldPath = formData.get('fieldPath') || undefined;
+        // Create asset upload data
+        const uploadData = {
+            buffer,
+            originalFilename: file.name,
+            mimeType: file.type,
+            size: file.size,
+            title,
+            description,
+            alt,
+            creditLine,
+            createdBy: auth.type === 'session' ? auth.user.id : undefined,
+            metadata: {
+                schemaType,
+                fieldPath
+            }
+        };
+        // Upload asset using the service
+        const asset = await assetService.uploadAsset(auth.organizationId, uploadData);
+        return json({
+            success: true,
+            data: asset
+        });
+    }
+    catch (error) {
+        console.error('Asset upload failed:', error);
+        return json({
+            success: false,
+            error: 'Asset upload failed',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};
+export const GET = async ({ url, locals }) => {
+    try {
+        const { assetService } = locals.aphexCMS;
+        const auth = locals.auth;
+        if (!auth) {
+            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+        }
+        // Parse query parameters
+        const assetType = url.searchParams.get('assetType');
+        const mimeType = url.searchParams.get('mimeType') || undefined;
+        const search = url.searchParams.get('search') || undefined;
+        const limitParam = url.searchParams.get('limit');
+        const offsetParam = url.searchParams.get('offset');
+        const limit = limitParam ? parseInt(limitParam) : 20;
+        const offset = offsetParam ? parseInt(offsetParam) : 0;
+        const filters = {
+            assetType,
+            mimeType,
+            search,
+            limit: isNaN(limit) ? 20 : limit,
+            offset: isNaN(offset) ? 0 : offset
+        };
+        const assets = await assetService.findAssets(auth.organizationId, filters);
+        return json({
+            success: true,
+            data: assets
+        });
+    }
+    catch (error) {
+        console.error('Failed to fetch assets:', error);
+        return json({
+            success: false,
+            error: 'Failed to fetch assets',
+            message: error instanceof Error ? error.message : 'Unknown error'
+        }, { status: 500 });
+    }
+};

package/dist/routes/documents-by-id.d.ts

@@ -0,0 +1,5 @@
+import type { RequestHandler } from '@sveltejs/kit';
+export declare const GET: RequestHandler;
+export declare const PUT: RequestHandler;
+export declare const DELETE: RequestHandler;
+//# sourceMappingURL=documents-by-id.d.ts.map

package/dist/routes/documents-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cA2DjB,CAAC;AAGF,eAAO,MAAM,GAAG,EAAE,cAoEjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cA+CpB,CAAC"}