@aphexcms/cms-core 0.1.7 → 0.1.8

package/dist/routes/assets-cdn.js

@@ -1,155 +0,0 @@
-export const GET = async ({ params, locals, setHeaders, request }) => {
-    console.log('[Asset CDN] ========== ROUTE HIT ==========');
-    console.log('[Asset CDN] Params:', params);
-    try {
-        const { assetService, databaseAdapter, storageAdapter, cmsEngine, config } = locals.aphexCMS;
-        let auth = locals.auth;
-        const { id, filename } = params;
-        console.log('[Asset CDN] Request for asset:', id, filename);
-        console.log('[Asset CDN] Has auth?', !!auth);
-        // If no session auth, check for API key in headers
-        if (!auth) {
-            const apiKey = request.headers.get('x-api-key');
-            console.log('[Asset CDN] API key present?', !!apiKey);
-            if (apiKey && config.auth?.provider) {
-                try {
-                    const apiKeyAuth = await config.auth.provider.validateApiKey(request, databaseAdapter);
-                    if (apiKeyAuth) {
-                        auth = apiKeyAuth;
-                        console.log('[Asset CDN] Authenticated via API key, org:', apiKeyAuth.organizationId);
-                    }
-                }
-                catch (err) {
-                    console.warn('[Asset CDN] API key validation failed:', err);
-                }
-            }
-        }
-        console.log('[Asset CDN] Auth type:', auth?.type);
-        if (!id) {
-            return new Response('Asset ID is required', { status: 400 });
-        }
-        // Try to fetch asset globally first (bypasses RLS for public assets)
-        const asset = await assetService.findAssetByIdGlobal(id);
-        console.log('[Asset CDN] Asset found globally?', !!asset);
-        if (!asset) {
-            console.warn('[Asset CDN] Asset not found:', id);
-            return new Response('Asset not found', { status: 404 });
-        }
-        const organizationId = auth?.organizationId;
-        console.log('[Asset CDN] Auth object:', JSON.stringify(auth, null, 2));
-        console.log('[Asset CDN] Auth organizationId:', organizationId);
-        console.log('[Asset CDN] Asset organizationId:', asset.organizationId);
-        // Check if this asset is used in a private field
-        // The field metadata (schemaType and fieldPath) is stored when the asset is uploaded
-        let isPrivate = false;
-        const schemaType = asset.metadata?.schemaType;
-        const fieldPath = asset.metadata?.fieldPath;
-        if (schemaType && fieldPath) {
-            // Get the schema definition from IN-MEMORY config (always up-to-date with code changes)
-            const schema = cmsEngine.getSchemaTypeByName(schemaType);
-            console.log(`[Asset CDN] Schema lookup for ${schemaType}:`, {
-                found: !!schema,
-                fieldCount: schema?.fields?.length
-            });
-            if (schema && schema.fields) {
-                // Navigate the field path to find the field definition
-                const findField = (fields, path) => {
-                    const parts = path.split('.');
-                    let current = null;
-                    for (let i = 0; i < parts.length; i++) {
-                        const part = parts[i];
-                        current = fields.find((f) => f.name === part);
-                        if (!current)
-                            return null;
-                        // If not the last part, navigate into nested fields
-                        if (i < parts.length - 1) {
-                            if (current.type === 'object' && current.fields) {
-                                fields = current.fields;
-                            }
-                            else {
-                                return null;
-                            }
-                        }
-                    }
-                    return current;
-                };
-                const field = findField(schema.fields, fieldPath);
-                console.log(`[Asset CDN] Field lookup for ${fieldPath}:`, {
-                    found: !!field,
-                    type: field?.type,
-                    private: field?.private
-                });
-                if (field && field.type === 'image') {
-                    isPrivate = field.private === true;
-                    console.log(`[Asset CDN] Field check: ${schemaType}.${fieldPath} - private: ${isPrivate}`);
-                }
-                else {
-                    console.warn(`[Asset CDN] Could not find field: ${schemaType}.${fieldPath}`);
-                }
-            }
-        }
-        else {
-            console.log('[Asset CDN] No field metadata - treating as public');
-        }
-        console.log('[Asset CDN] Asset privacy result:', { isPrivate, schemaType, fieldPath });
-        // If asset is private, require auth
-        if (isPrivate && !organizationId) {
-            console.warn('[Asset CDN] Private asset accessed without auth - DENIED');
-            return new Response('Unauthorized - This asset is private', { status: 401 });
-        }
-        // If asset is private, verify org matches
-        if (isPrivate && organizationId && organizationId !== asset.organizationId) {
-            console.warn('[Asset CDN] Org mismatch for private asset - FORBIDDEN');
-            return new Response('Forbidden', { status: 403 });
-        }
-        // Log the decision
-        if (isPrivate && organizationId) {
-            console.log('[Asset CDN] Private asset access ALLOWED - user has auth and org matches');
-        }
-        else if (!isPrivate) {
-            console.log('[Asset CDN] Public asset access ALLOWED');
-        }
-        console.log('[Asset CDN] Asset found:', {
-            id: asset.id,
-            path: asset.path,
-            mimeType: asset.mimeType,
-            storageAdapter: asset.storageAdapter
-        });
-        // If asset has a direct URL (S3/R2), redirect to it
-        if (asset.url && asset.url.startsWith('http')) {
-            console.log('[Asset CDN] Redirecting to external URL:', asset.url);
-            return new Response(null, {
-                status: 302,
-                headers: { Location: asset.url }
-            });
-        }
-        // Otherwise, serve from local storage
-        if (!storageAdapter?.getObject) {
-            console.error('[Asset CDN] Storage adapter does not support getObject');
-            return new Response('Storage adapter does not support file serving', { status: 500 });
-        }
-        console.log('[Asset CDN] Reading file from storage:', asset.path);
-        const fileBuffer = await storageAdapter.getObject(asset.path);
-        console.log('[Asset CDN] Serving file:', {
-            size: fileBuffer.length,
-            mimeType: asset.mimeType
-        });
-        // Set appropriate headers for the asset
-        setHeaders({
-            'Content-Type': asset.mimeType || 'application/octet-stream',
-            'Content-Length': fileBuffer.length.toString(),
-            'Cache-Control': 'public, max-age=31536000, immutable', // Cache for 1 year
-            'Content-Disposition': `inline; filename="${encodeURIComponent(asset.originalFilename || asset.filename)}"`,
-            ...(asset.mimeType?.startsWith('image/') && {
-                'Accept-Ranges': 'bytes'
-            })
-        });
-        // Convert Buffer to ArrayBuffer for Response
-        const arrayBuffer = fileBuffer.buffer.slice(fileBuffer.byteOffset, fileBuffer.byteOffset + fileBuffer.byteLength);
-        return new Response(arrayBuffer);
-    }
-    catch (error) {
-        console.error('[Asset CDN] Error serving asset:', error);
-        return new Response('Failed to serve asset', { status: 500 });
-    }
-};

package/dist/routes/assets.d.ts

@@ -1,4 +0,0 @@
-import type { RequestHandler } from '@sveltejs/kit';
-export declare const POST: RequestHandler;
-export declare const GET: RequestHandler;
-//# sourceMappingURL=assets.d.ts.map

package/dist/routes/assets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../src/lib/routes/assets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,IAAI,EAAE,cAiElB,CAAC;AAEF,eAAO,MAAM,GAAG,EAAE,cA4CjB,CAAC"}

package/dist/routes/assets.js

@@ -1,94 +0,0 @@
-// Aphex CMS Asset API Handlers
-import { json } from '@sveltejs/kit';
-export const POST = async ({ request, locals }) => {
-    try {
-        const { assetService } = locals.aphexCMS;
-        const auth = locals.auth;
-        if (!auth) {
-            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-        }
-        const formData = await request.formData();
-        const file = formData.get('file');
-        if (!file) {
-            return json({ success: false, error: 'No file provided' }, { status: 400 });
-        }
-        // Convert file to buffer
-        const arrayBuffer = await file.arrayBuffer();
-        const buffer = Buffer.from(arrayBuffer);
-        // Get optional metadata from form data
-        const title = formData.get('title') || undefined;
-        const description = formData.get('description') || undefined;
-        const alt = formData.get('alt') || undefined;
-        const creditLine = formData.get('creditLine') || undefined;
-        // Get field metadata for privacy checking
-        const schemaType = formData.get('schemaType') || undefined;
-        const fieldPath = formData.get('fieldPath') || undefined;
-        // Create asset upload data
-        const uploadData = {
-            buffer,
-            originalFilename: file.name,
-            mimeType: file.type,
-            size: file.size,
-            title,
-            description,
-            alt,
-            creditLine,
-            createdBy: auth.type === 'session' ? auth.user.id : undefined,
-            metadata: {
-                schemaType,
-                fieldPath
-            }
-        };
-        // Upload asset using the service
-        const asset = await assetService.uploadAsset(auth.organizationId, uploadData);
-        return json({
-            success: true,
-            data: asset
-        });
-    }
-    catch (error) {
-        console.error('Asset upload failed:', error);
-        return json({
-            success: false,
-            error: 'Asset upload failed',
-            message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
-    }
-};
-export const GET = async ({ url, locals }) => {
-    try {
-        const { assetService } = locals.aphexCMS;
-        const auth = locals.auth;
-        if (!auth) {
-            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-        }
-        // Parse query parameters
-        const assetType = url.searchParams.get('assetType');
-        const mimeType = url.searchParams.get('mimeType') || undefined;
-        const search = url.searchParams.get('search') || undefined;
-        const limitParam = url.searchParams.get('limit');
-        const offsetParam = url.searchParams.get('offset');
-        const limit = limitParam ? parseInt(limitParam) : 20;
-        const offset = offsetParam ? parseInt(offsetParam) : 0;
-        const filters = {
-            assetType,
-            mimeType,
-            search,
-            limit: isNaN(limit) ? 20 : limit,
-            offset: isNaN(offset) ? 0 : offset
-        };
-        const assets = await assetService.findAssets(auth.organizationId, filters);
-        return json({
-            success: true,
-            data: assets
-        });
-    }
-    catch (error) {
-        console.error('Failed to fetch assets:', error);
-        return json({
-            success: false,
-            error: 'Failed to fetch assets',
-            message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
-    }
-};

package/dist/routes/documents-by-id.d.ts

@@ -1,5 +0,0 @@
-import type { RequestHandler } from '@sveltejs/kit';
-export declare const GET: RequestHandler;
-export declare const PUT: RequestHandler;
-export declare const DELETE: RequestHandler;
-//# sourceMappingURL=documents-by-id.d.ts.map

package/dist/routes/documents-by-id.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"documents-by-id.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-by-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,GAAG,EAAE,cA2DjB,CAAC;AAGF,eAAO,MAAM,GAAG,EAAE,cAoEjB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cA+CpB,CAAC"}

package/dist/routes/documents-by-id.js

@@ -1,142 +0,0 @@
-// Aphex CMS Document by ID API Handlers
-import { json } from '@sveltejs/kit';
-import { canWrite } from '../types/auth.js';
-// GET /api/documents/[id] - Get document by ID
-export const GET = async ({ params, url, locals }) => {
-    try {
-        const { databaseAdapter, auth: authProvider } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
-        if (!auth) {
-            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-        }
-        if (!id) {
-            return json({ success: false, error: 'Document ID is required' }, { status: 400 });
-        }
-        // Parse depth parameter
-        const depthParam = url.searchParams.get('depth');
-        const depth = depthParam ? parseInt(depthParam) : 0;
-        const clampedDepth = isNaN(depth) ? 0 : Math.max(0, Math.min(depth, 5)); // Clamp between 0-5
-        const document = await databaseAdapter.findByDocId(auth.organizationId, id, clampedDepth);
-        if (!document) {
-            return json({ success: false, error: 'Document not found' }, { status: 404 });
-        }
-        // Populate createdBy user info if available
-        if (document.createdBy && authProvider) {
-            try {
-                if (typeof document.createdBy === 'string') {
-                    const user = await authProvider.getUserById(document.createdBy);
-                    if (user) {
-                        document.createdBy = {
-                            id: user.id,
-                            name: user.name,
-                            email: user.email
-                        };
-                    }
-                }
-            }
-            catch (err) {
-                // If user fetch fails, keep the user ID
-                console.warn('[documents-by-id] Failed to populate createdBy user:', err);
-            }
-        }
-        return json({
-            success: true,
-            data: document
-        });
-    }
-    catch (error) {
-        console.error('Failed to fetch document:', error);
-        return json({
-            success: false,
-            error: 'Failed to fetch document',
-            message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
-    }
-};
-// PUT /api/documents/[id] - Update document
-export const PUT = async ({ params, request, locals }) => {
-    try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
-        const body = await request.json();
-        if (!auth) {
-            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-        }
-        // Check write permissions (viewers are read-only)
-        if (!canWrite(auth)) {
-            return json({
-                success: false,
-                error: 'Forbidden',
-                message: 'You do not have permission to update documents. Viewers have read-only access.'
-            }, { status: 403 });
-        }
-        const documentData = body.draftData;
-        if (!id) {
-            return json({ success: false, error: 'Document ID is required' }, { status: 400 });
-        }
-        let updatedDocument;
-        // NO VALIDATION FOR DRAFTS - Sanity-style: drafts can have any state
-        // Validation only happens on publish
-        if (auth.type == 'session') {
-            updatedDocument = await databaseAdapter.updateDocDraft(auth.organizationId, id, documentData, auth.user.id);
-        }
-        else {
-            updatedDocument = await databaseAdapter.updateDocDraft(auth.organizationId, id, documentData, auth.keyId);
-        }
-        if (!updatedDocument) {
-            return json({ success: false, error: 'Document not found' }, { status: 404 });
-        }
-        return json({
-            success: true,
-            data: updatedDocument
-        });
-    }
-    catch (error) {
-        console.error('Failed to update document:', error);
-        return json({
-            success: false,
-            error: 'Failed to update document',
-            message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
-    }
-};
-// DELETE /api/documents/[id] - Delete document
-export const DELETE = async ({ params, locals }) => {
-    try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
-        if (!auth) {
-            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-        }
-        // Check write permissions (viewers are read-only)
-        if (!canWrite(auth)) {
-            return json({
-                success: false,
-                error: 'Forbidden',
-                message: 'You do not have permission to delete documents. Viewers have read-only access.'
-            }, { status: 403 });
-        }
-        if (!id) {
-            return json({ success: false, error: 'Document ID is required' }, { status: 400 });
-        }
-        const success = await databaseAdapter.deleteDocById(auth.organizationId, id);
-        if (!success) {
-            return json({ success: false, error: 'Document not found' }, { status: 404 });
-        }
-        return json({
-            success: true,
-            message: 'Document deleted successfully'
-        });
-    }
-    catch (error) {
-        console.error('Failed to delete document:', error);
-        return json({
-            success: false,
-            error: 'Failed to delete document',
-            message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
-    }
-};

package/dist/routes/documents-publish.d.ts

@@ -1,4 +0,0 @@
-import type { RequestHandler } from '@sveltejs/kit';
-export declare const POST: RequestHandler;
-export declare const DELETE: RequestHandler;
-//# sourceMappingURL=documents-publish.d.ts.map

package/dist/routes/documents-publish.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"documents-publish.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents-publish.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,eAAO,MAAM,IAAI,EAAE,cAkIlB,CAAC;AAGF,eAAO,MAAM,MAAM,EAAE,cAsEpB,CAAC"}

package/dist/routes/documents-publish.js

@@ -1,151 +0,0 @@
-// Aphex CMS Document Publish API Handlers
-import { json } from '@sveltejs/kit';
-import { validateField } from '../field-validation/utils.js';
-import { canWrite } from '../types/auth.js';
-// POST /api/documents/[id]/publish - Publish document
-export const POST = async ({ params, locals }) => {
-    try {
-        const { databaseAdapter, cmsEngine } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
-        if (!auth) {
-            return json({
-                success: false,
-                error: 'Unauthorized',
-                message: 'Authentication required'
-            }, { status: 401 });
-        }
-        // Check write permissions (viewers are read-only)
-        if (!canWrite(auth)) {
-            return json({
-                success: false,
-                error: 'Forbidden',
-                message: 'You do not have permission to publish documents. Viewers have read-only access.'
-            }, { status: 403 });
-        }
-        if (!id) {
-            return json({
-                success: false,
-                error: 'Missing document ID',
-                message: 'Document ID is required'
-            }, { status: 400 });
-        }
-        // Get document to validate
-        const document = await databaseAdapter.findByDocId(auth.organizationId, id);
-        if (!document || !document.draftData) {
-            return json({
-                success: false,
-                error: 'Document not found or cannot be published',
-                message: 'Document may not exist or may not have draft content'
-            }, { status: 404 });
-        }
-        // Get schema for validation (from config to preserve validation functions)
-        const schema = cmsEngine.getSchemaTypeByName(document.type);
-        if (!schema) {
-            return json({
-                success: false,
-                error: 'Invalid document type',
-                message: `Schema type '${document.type}' not found`
-            }, { status: 400 });
-        }
-        // VALIDATE before publishing - block if errors exist
-        const validationErrors = [];
-        for (const field of schema.fields) {
-            const value = document.draftData[field.name];
-            const result = await validateField(field, value, document.draftData);
-            if (!result.isValid) {
-                const errorMessages = result.errors
-                    .filter((e) => e.level === 'error')
-                    .map((e) => e.message);
-                if (errorMessages.length > 0) {
-                    validationErrors.push({
-                        field: field.name,
-                        errors: errorMessages
-                    });
-                }
-            }
-        }
-        // Block publishing if validation errors exist
-        if (validationErrors.length > 0) {
-            return json({
-                success: false,
-                error: 'Cannot publish: validation errors',
-                message: 'Please fix all validation errors before publishing',
-                validationErrors
-            }, { status: 400 });
-        }
-        // All validation passed - proceed with publish
-        const publishedDocument = await databaseAdapter.publishDoc(auth.organizationId, id);
-        if (!publishedDocument) {
-            return json({
-                success: false,
-                error: 'Document not found or cannot be published',
-                message: 'Document may not exist or may not have draft content'
-            }, { status: 404 });
-        }
-        return json({
-            success: true,
-            data: publishedDocument,
-            message: 'Document published successfully'
-        });
-    }
-    catch (error) {
-        console.error('Failed to publish document:', error);
-        return json({
-            success: false,
-            error: 'Failed to publish document',
-            message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
-    }
-};
-// DELETE /api/documents/[id]/publish - Unpublish document
-export const DELETE = async ({ params, locals }) => {
-    try {
-        const { databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
-        const { id } = params;
-        if (!auth) {
-            return json({
-                success: false,
-                error: 'Unauthorized',
-                message: 'Authentication required'
-            }, { status: 401 });
-        }
-        // Check write permissions (viewers are read-only)
-        if (!canWrite(auth)) {
-            return json({
-                success: false,
-                error: 'Forbidden',
-                message: 'You do not have permission to unpublish documents. Viewers have read-only access.'
-            }, { status: 403 });
-        }
-        if (!id) {
-            return json({
-                success: false,
-                error: 'Missing document ID',
-                message: 'Document ID is required'
-            }, { status: 400 });
-        }
-        const unpublishedDocument = await databaseAdapter.unpublishDoc(auth.organizationId, id);
-        if (!unpublishedDocument) {
-            return json({
-                success: false,
-                error: 'Document not found',
-                message: `No document found with ID: ${id}`
-            }, { status: 404 });
-        }
-        return json({
-            success: true,
-            data: unpublishedDocument,
-            message: 'Document unpublished successfully'
-        });
-    }
-    catch (error) {
-        console.error('Failed to unpublish document:', error);
-        return json({
-            success: false,
-            error: 'Failed to unpublish document',
-            message: error instanceof Error ? error.message : 'Unknown error'
-        }, { status: 500 });
-    }
-};

package/dist/routes/documents.d.ts

@@ -1,4 +0,0 @@
-import type { RequestHandler } from '@sveltejs/kit';
-export declare const GET: RequestHandler;
-export declare const POST: RequestHandler;
-//# sourceMappingURL=documents.d.ts.map

package/dist/routes/documents.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../src/lib/routes/documents.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAQpD,eAAO,MAAM,GAAG,EAAE,cAsEjB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,cAwFlB,CAAC"}