@aphexcms/cms-core 0.1.7 → 0.1.9

package/src/lib/routes/assets-cdn.ts

@@ -0,0 +1,185 @@
+import type { RequestHandler } from '@sveltejs/kit';
+
+export const GET: RequestHandler = async ({ params, locals, setHeaders, request }) => {
+	console.log('[Asset CDN] ========== ROUTE HIT ==========');
+	console.log('[Asset CDN] Params:', params);
+	try {
+		const { assetService, databaseAdapter, storageAdapter, cmsEngine, config } = locals.aphexCMS;
+		let auth = locals.auth;
+		const { id, filename } = params;
+
+		console.log('[Asset CDN] Request for asset:', id, filename);
+		console.log('[Asset CDN] Has auth?', !!auth);
+
+		// If no session auth, check for API key in headers
+		if (!auth) {
+			const apiKey = request.headers.get('x-api-key');
+			console.log('[Asset CDN] API key present?', !!apiKey);
+			if (apiKey && config.auth?.provider) {
+				try {
+					const apiKeyAuth = await config.auth.provider.validateApiKey(request, databaseAdapter);
+					if (apiKeyAuth) {
+						auth = apiKeyAuth;
+						console.log('[Asset CDN] Authenticated via API key, org:', apiKeyAuth.organizationId);
+					}
+				} catch (err) {
+					console.warn('[Asset CDN] API key validation failed:', err);
+				}
+			}
+		}
+
+		console.log('[Asset CDN] Auth type:', auth?.type);
+
+		if (!id) {
+			return new Response('Asset ID is required', { status: 400 });
+		}
+
+		// Try to fetch asset globally first (bypasses RLS for public assets)
+		const asset = await assetService.findAssetByIdGlobal(id);
+
+		console.log('[Asset CDN] Asset found globally?', !!asset);
+
+		if (!asset) {
+			console.warn('[Asset CDN] Asset not found:', id);
+			return new Response('Asset not found', { status: 404 });
+		}
+
+		const organizationId = auth?.organizationId;
+		console.log('[Asset CDN] Auth object:', JSON.stringify(auth, null, 2));
+		console.log('[Asset CDN] Auth organizationId:', organizationId);
+		console.log('[Asset CDN] Asset organizationId:', asset.organizationId);
+
+		// Check if this asset is used in a private field
+		// The field metadata (schemaType and fieldPath) is stored when the asset is uploaded
+		let isPrivate = false;
+
+		const schemaType = asset.metadata?.schemaType;
+		const fieldPath = asset.metadata?.fieldPath;
+
+		if (schemaType && fieldPath) {
+			// Get the schema definition from IN-MEMORY config (always up-to-date with code changes)
+			const schema = cmsEngine.getSchemaTypeByName(schemaType);
+			console.log(`[Asset CDN] Schema lookup for ${schemaType}:`, {
+				found: !!schema,
+				fieldCount: schema?.fields?.length
+			});
+
+			if (schema && schema.fields) {
+				// Navigate the field path to find the field definition
+				const findField = (fields: any[], path: string): any => {
+					const parts = path.split('.');
+					let current: any = null;
+
+					for (let i = 0; i < parts.length; i++) {
+						const part = parts[i];
+						current = fields.find((f) => f.name === part);
+
+						if (!current) return null;
+
+						// If not the last part, navigate into nested fields
+						if (i < parts.length - 1) {
+							if (current.type === 'object' && current.fields) {
+								fields = current.fields;
+							} else {
+								return null;
+							}
+						}
+					}
+
+					return current;
+				};
+
+				const field = findField(schema.fields, fieldPath);
+				console.log(`[Asset CDN] Field lookup for ${fieldPath}:`, {
+					found: !!field,
+					type: field?.type,
+					private: field?.private
+				});
+
+				if (field && field.type === 'image') {
+					isPrivate = field.private === true;
+					console.log(
+						`[Asset CDN] Field check: ${schemaType}.${fieldPath} - private: ${isPrivate}`
+					);
+				} else {
+					console.warn(`[Asset CDN] Could not find field: ${schemaType}.${fieldPath}`);
+				}
+			}
+		} else {
+			console.log('[Asset CDN] No field metadata - treating as public');
+		}
+
+		console.log('[Asset CDN] Asset privacy result:', { isPrivate, schemaType, fieldPath });
+
+		// If asset is private, require auth
+		if (isPrivate && !organizationId) {
+			console.warn('[Asset CDN] Private asset accessed without auth - DENIED');
+			return new Response('Unauthorized - This asset is private', { status: 401 });
+		}
+
+		// If asset is private, verify org matches
+		if (isPrivate && organizationId && organizationId !== asset.organizationId) {
+			console.warn('[Asset CDN] Org mismatch for private asset - FORBIDDEN');
+			return new Response('Forbidden', { status: 403 });
+		}
+
+		// Log the decision
+		if (isPrivate && organizationId) {
+			console.log('[Asset CDN] Private asset access ALLOWED - user has auth and org matches');
+		} else if (!isPrivate) {
+			console.log('[Asset CDN] Public asset access ALLOWED');
+		}
+
+		console.log('[Asset CDN] Asset found:', {
+			id: asset.id,
+			path: asset.path,
+			mimeType: asset.mimeType,
+			storageAdapter: asset.storageAdapter
+		});
+
+		// If asset has a direct URL (S3/R2), redirect to it
+		if (asset.url && asset.url.startsWith('http')) {
+			console.log('[Asset CDN] Redirecting to external URL:', asset.url);
+			return new Response(null, {
+				status: 302,
+				headers: { Location: asset.url }
+			});
+		}
+
+		// Otherwise, serve from local storage
+		if (!storageAdapter?.getObject) {
+			console.error('[Asset CDN] Storage adapter does not support getObject');
+			return new Response('Storage adapter does not support file serving', { status: 500 });
+		}
+
+		console.log('[Asset CDN] Reading file from storage:', asset.path);
+		const fileBuffer = await storageAdapter.getObject(asset.path);
+
+		console.log('[Asset CDN] Serving file:', {
+			size: fileBuffer.length,
+			mimeType: asset.mimeType
+		});
+
+		// Set appropriate headers for the asset
+		setHeaders({
+			'Content-Type': asset.mimeType || 'application/octet-stream',
+			'Content-Length': fileBuffer.length.toString(),
+			'Cache-Control': 'public, max-age=31536000, immutable', // Cache for 1 year
+			'Content-Disposition': `inline; filename="${encodeURIComponent(asset.originalFilename || asset.filename)}"`,
+			...(asset.mimeType?.startsWith('image/') && {
+				'Accept-Ranges': 'bytes'
+			})
+		});
+
+		// Convert Buffer to ArrayBuffer for Response
+		const arrayBuffer = fileBuffer.buffer.slice(
+			fileBuffer.byteOffset,
+			fileBuffer.byteOffset + fileBuffer.byteLength
+		) as ArrayBuffer;
+
+		return new Response(arrayBuffer);
+	} catch (error) {
+		console.error('[Asset CDN] Error serving asset:', error);
+		return new Response('Failed to serve asset', { status: 500 });
+	}
+};

package/src/lib/routes/assets.ts

@@ -0,0 +1,116 @@
+// Aphex CMS Asset API Handlers
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
+
+export const POST: RequestHandler = async ({ request, locals }) => {
+	try {
+		const { assetService } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth) {
+			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+		}
+
+		const formData = await request.formData();
+		const file = formData.get('file') as File;
+
+		if (!file) {
+			return json({ success: false, error: 'No file provided' }, { status: 400 });
+		}
+
+		// Convert file to buffer
+		const arrayBuffer = await file.arrayBuffer();
+		const buffer = Buffer.from(arrayBuffer);
+
+		// Get optional metadata from form data
+		const title = (formData.get('title') as string) || undefined;
+		const description = (formData.get('description') as string) || undefined;
+		const alt = (formData.get('alt') as string) || undefined;
+		const creditLine = (formData.get('creditLine') as string) || undefined;
+
+		// Get field metadata for privacy checking
+		const schemaType = (formData.get('schemaType') as string) || undefined;
+		const fieldPath = (formData.get('fieldPath') as string) || undefined;
+
+		// Create asset upload data
+		const uploadData = {
+			buffer,
+			originalFilename: file.name,
+			mimeType: file.type,
+			size: file.size,
+			title,
+			description,
+			alt,
+			creditLine,
+			createdBy: auth.type === 'session' ? auth.user.id : undefined,
+			metadata: {
+				schemaType,
+				fieldPath
+			}
+		};
+
+		// Upload asset using the service
+		const asset = await assetService.uploadAsset(auth.organizationId, uploadData);
+
+		return json({
+			success: true,
+			data: asset
+		});
+	} catch (error) {
+		console.error('Asset upload failed:', error);
+		return json(
+			{
+				success: false,
+				error: 'Asset upload failed',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};
+
+export const GET: RequestHandler = async ({ url, locals }) => {
+	try {
+		const { assetService } = locals.aphexCMS;
+		const auth = locals.auth;
+
+		if (!auth) {
+			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+		}
+
+		// Parse query parameters
+		const assetType = url.searchParams.get('assetType') as 'image' | 'file' | undefined;
+		const mimeType = url.searchParams.get('mimeType') || undefined;
+		const search = url.searchParams.get('search') || undefined;
+		const limitParam = url.searchParams.get('limit');
+		const offsetParam = url.searchParams.get('offset');
+
+		const limit = limitParam ? parseInt(limitParam) : 20;
+		const offset = offsetParam ? parseInt(offsetParam) : 0;
+
+		const filters = {
+			assetType,
+			mimeType,
+			search,
+			limit: isNaN(limit) ? 20 : limit,
+			offset: isNaN(offset) ? 0 : offset
+		};
+
+		const assets = await assetService.findAssets(auth.organizationId, filters);
+
+		return json({
+			success: true,
+			data: assets
+		});
+	} catch (error) {
+		console.error('Failed to fetch assets:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to fetch assets',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};

package/src/lib/routes/documents-by-id.ts

@@ -0,0 +1,188 @@
+// Aphex CMS Document by ID API Handlers
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
+import type { Document } from '../types/document';
+import { canWrite } from '../types/auth';
+
+// GET /api/documents/[id] - Get document by ID
+export const GET: RequestHandler = async ({ params, url, locals }) => {
+	try {
+		const { databaseAdapter, auth: authProvider } = locals.aphexCMS;
+		const auth = locals.auth;
+		const { id } = params;
+
+		if (!auth) {
+			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+		}
+
+		if (!id) {
+			return json({ success: false, error: 'Document ID is required' }, { status: 400 });
+		}
+
+		// Parse depth parameter
+		const depthParam = url.searchParams.get('depth');
+		const depth = depthParam ? parseInt(depthParam) : 0;
+		const clampedDepth = isNaN(depth) ? 0 : Math.max(0, Math.min(depth, 5)); // Clamp between 0-5
+
+		const document = await databaseAdapter.findByDocId(auth.organizationId, id, clampedDepth);
+
+		if (!document) {
+			return json({ success: false, error: 'Document not found' }, { status: 404 });
+		}
+
+		// Populate createdBy user info if available
+		if (document.createdBy && authProvider) {
+			try {
+				if (typeof document.createdBy === 'string') {
+					const user = await authProvider.getUserById(document.createdBy);
+					if (user) {
+						document.createdBy = {
+							id: user.id,
+							name: user.name,
+							email: user.email
+						};
+					}
+				}
+			} catch (err) {
+				// If user fetch fails, keep the user ID
+				console.warn('[documents-by-id] Failed to populate createdBy user:', err);
+			}
+		}
+
+		return json({
+			success: true,
+			data: document
+		});
+	} catch (error) {
+		console.error('Failed to fetch document:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to fetch document',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};
+
+// PUT /api/documents/[id] - Update document
+export const PUT: RequestHandler = async ({ params, request, locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+		const { id } = params;
+		const body = await request.json();
+
+		if (!auth) {
+			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+		}
+
+		// Check write permissions (viewers are read-only)
+		if (!canWrite(auth)) {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'You do not have permission to update documents. Viewers have read-only access.'
+				},
+				{ status: 403 }
+			);
+		}
+
+		const documentData = body.draftData;
+
+		if (!id) {
+			return json({ success: false, error: 'Document ID is required' }, { status: 400 });
+		}
+
+		let updatedDocument: Document | null;
+
+		// NO VALIDATION FOR DRAFTS - Sanity-style: drafts can have any state
+		// Validation only happens on publish
+		if (auth.type == 'session') {
+			updatedDocument = await databaseAdapter.updateDocDraft(
+				auth.organizationId,
+				id,
+				documentData,
+				auth.user.id
+			);
+		} else {
+			updatedDocument = await databaseAdapter.updateDocDraft(
+				auth.organizationId,
+				id,
+				documentData,
+				auth.keyId
+			);
+		}
+
+		if (!updatedDocument) {
+			return json({ success: false, error: 'Document not found' }, { status: 404 });
+		}
+
+		return json({
+			success: true,
+			data: updatedDocument
+		});
+	} catch (error) {
+		console.error('Failed to update document:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to update document',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};
+
+// DELETE /api/documents/[id] - Delete document
+export const DELETE: RequestHandler = async ({ params, locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+		const { id } = params;
+
+		if (!auth) {
+			return json({ success: false, error: 'Unauthorized' }, { status: 401 });
+		}
+
+		// Check write permissions (viewers are read-only)
+		if (!canWrite(auth)) {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'You do not have permission to delete documents. Viewers have read-only access.'
+				},
+				{ status: 403 }
+			);
+		}
+
+		if (!id) {
+			return json({ success: false, error: 'Document ID is required' }, { status: 400 });
+		}
+
+		const success = await databaseAdapter.deleteDocById(auth.organizationId, id);
+
+		if (!success) {
+			return json({ success: false, error: 'Document not found' }, { status: 404 });
+		}
+
+		return json({
+			success: true,
+			message: 'Document deleted successfully'
+		});
+	} catch (error) {
+		console.error('Failed to delete document:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to delete document',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};

package/src/lib/routes/documents-publish.ts

@@ -0,0 +1,211 @@
+// Aphex CMS Document Publish API Handlers
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
+import { validateField } from '../field-validation/utils';
+import { canWrite } from '../types/auth';
+
+// POST /api/documents/[id]/publish - Publish document
+export const POST: RequestHandler = async ({ params, locals }) => {
+	try {
+		const { databaseAdapter, cmsEngine } = locals.aphexCMS;
+		const auth = locals.auth;
+		const { id } = params;
+
+		if (!auth) {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		// Check write permissions (viewers are read-only)
+		if (!canWrite(auth)) {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message: 'You do not have permission to publish documents. Viewers have read-only access.'
+				},
+				{ status: 403 }
+			);
+		}
+
+		if (!id) {
+			return json(
+				{
+					success: false,
+					error: 'Missing document ID',
+					message: 'Document ID is required'
+				},
+				{ status: 400 }
+			);
+		}
+
+		// Get document to validate
+		const document = await databaseAdapter.findByDocId(auth.organizationId, id);
+		if (!document || !document.draftData) {
+			return json(
+				{
+					success: false,
+					error: 'Document not found or cannot be published',
+					message: 'Document may not exist or may not have draft content'
+				},
+				{ status: 404 }
+			);
+		}
+
+		// Get schema for validation (from config to preserve validation functions)
+		const schema = cmsEngine.getSchemaTypeByName(document.type);
+		if (!schema) {
+			return json(
+				{
+					success: false,
+					error: 'Invalid document type',
+					message: `Schema type '${document.type}' not found`
+				},
+				{ status: 400 }
+			);
+		}
+
+		// VALIDATE before publishing - block if errors exist
+		const validationErrors: Array<{ field: string; errors: string[] }> = [];
+
+		for (const field of schema.fields) {
+			const value = document.draftData[field.name];
+			const result = await validateField(field, value, document.draftData);
+
+			if (!result.isValid) {
+				const errorMessages = result.errors
+					.filter((e) => e.level === 'error')
+					.map((e) => e.message);
+
+				if (errorMessages.length > 0) {
+					validationErrors.push({
+						field: field.name,
+						errors: errorMessages
+					});
+				}
+			}
+		}
+
+		// Block publishing if validation errors exist
+		if (validationErrors.length > 0) {
+			return json(
+				{
+					success: false,
+					error: 'Cannot publish: validation errors',
+					message: 'Please fix all validation errors before publishing',
+					validationErrors
+				},
+				{ status: 400 }
+			);
+		}
+
+		// All validation passed - proceed with publish
+		const publishedDocument = await databaseAdapter.publishDoc(auth.organizationId, id);
+
+		if (!publishedDocument) {
+			return json(
+				{
+					success: false,
+					error: 'Document not found or cannot be published',
+					message: 'Document may not exist or may not have draft content'
+				},
+				{ status: 404 }
+			);
+		}
+
+		return json({
+			success: true,
+			data: publishedDocument,
+			message: 'Document published successfully'
+		});
+	} catch (error) {
+		console.error('Failed to publish document:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to publish document',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};
+
+// DELETE /api/documents/[id]/publish - Unpublish document
+export const DELETE: RequestHandler = async ({ params, locals }) => {
+	try {
+		const { databaseAdapter } = locals.aphexCMS;
+		const auth = locals.auth;
+		const { id } = params;
+
+		if (!auth) {
+			return json(
+				{
+					success: false,
+					error: 'Unauthorized',
+					message: 'Authentication required'
+				},
+				{ status: 401 }
+			);
+		}
+
+		// Check write permissions (viewers are read-only)
+		if (!canWrite(auth)) {
+			return json(
+				{
+					success: false,
+					error: 'Forbidden',
+					message:
+						'You do not have permission to unpublish documents. Viewers have read-only access.'
+				},
+				{ status: 403 }
+			);
+		}
+
+		if (!id) {
+			return json(
+				{
+					success: false,
+					error: 'Missing document ID',
+					message: 'Document ID is required'
+				},
+				{ status: 400 }
+			);
+		}
+
+		const unpublishedDocument = await databaseAdapter.unpublishDoc(auth.organizationId, id);
+
+		if (!unpublishedDocument) {
+			return json(
+				{
+					success: false,
+					error: 'Document not found',
+					message: `No document found with ID: ${id}`
+				},
+				{ status: 404 }
+			);
+		}
+
+		return json({
+			success: true,
+			data: unpublishedDocument,
+			message: 'Document unpublished successfully'
+		});
+	} catch (error) {
+		console.error('Failed to unpublish document:', error);
+		return json(
+			{
+				success: false,
+				error: 'Failed to unpublish document',
+				message: error instanceof Error ? error.message : 'Unknown error'
+			},
+			{ status: 500 }
+		);
+	}
+};