@aphexcms/cms-core 0.1.9 → 0.1.10

package/src/lib/api/organizations.ts

@@ -1,154 +0,0 @@
-// Organizations API client - composable organization operations
-import { apiClient } from './client';
-import type { Organization, OrganizationMember, OrganizationRole } from '../types/organization';
-import type { ApiResponse } from './types';
-
-export interface CreateOrganizationData {
-	name: string;
-	slug: string;
-	metadata?: any;
-	parentOrganizationId?: string;
-}
-
-export interface OrganizationListItem extends Organization {
-	role: OrganizationRole;
-	joinedAt: Date;
-	isActive: boolean;
-}
-
-export interface SwitchOrganizationData {
-	organizationId: string;
-}
-
-export interface InviteMemberData {
-	email: string;
-	role: OrganizationRole;
-}
-
-export interface UpdateMemberRoleData {
-	userId: string;
-	role: OrganizationRole;
-}
-
-export interface RemoveMemberData {
-	userId: string;
-}
-
-export interface CancelInvitationData {
-	invitationId: string;
-}
-
-export interface UpdateOrganizationData {
-	name?: string;
-	slug?: string;
-	metadata?: any;
-}
-
-export class OrganizationsApi {
-	/**
-	 * List user's organizations
-	 */
-	static async list(): Promise<ApiResponse<OrganizationListItem[]>> {
-		return apiClient.get<OrganizationListItem[]>('/organizations');
-	}
-
-	/**
-	 * Create new organization (super_admin only)
-	 */
-	static async create(data: CreateOrganizationData): Promise<ApiResponse<Organization>> {
-		return apiClient.post<Organization>('/organizations', data);
-	}
-
-	/**
-	 * Switch to a different organization
-	 */
-	static async switch(data: SwitchOrganizationData): Promise<ApiResponse<{ success: boolean }>> {
-		return apiClient.post<{ success: boolean }>('/organizations/switch', data);
-	}
-
-	/**
-	 * Get organization by ID
-	 */
-	static async getById(id: string): Promise<ApiResponse<Organization>> {
-		return apiClient.get<Organization>(`/organizations/${id}`);
-	}
-
-	/**
-	 * Get active organization
-	 */
-	static async getActive(): Promise<ApiResponse<Organization>> {
-		const result = await this.list();
-		const active = result.data?.find((org) => org.isActive);
-		if (!active) {
-			throw new Error('No active organization found');
-		}
-		return {
-			success: true,
-			data: active
-		};
-	}
-
-	/**
-	 * Get organization members
-	 */
-	static async getMembers(): Promise<ApiResponse<OrganizationMember[]>> {
-		return apiClient.get<OrganizationMember[]>('/organizations/members');
-	}
-
-	/**
-	 * Invite a member to the organization
-	 */
-	static async inviteMember(data: InviteMemberData): Promise<ApiResponse<OrganizationMember>> {
-		return apiClient.post<OrganizationMember>('/organizations/invitations', data);
-	}
-
-	/**
-	 * Remove a member from the organization
-	 */
-	static async removeMember(data: RemoveMemberData): Promise<ApiResponse<{ success: boolean }>> {
-		return apiClient.delete<{ success: boolean }>('/organizations/members', data);
-	}
-
-	/**
-	 * Update a member's role
-	 */
-	static async updateMemberRole(
-		data: UpdateMemberRoleData
-	): Promise<ApiResponse<OrganizationMember>> {
-		return apiClient.patch<OrganizationMember>('/organizations/members', data);
-	}
-
-	/**
-	 * Update organization settings
-	 */
-	static async update(
-		id: string,
-		data: UpdateOrganizationData
-	): Promise<ApiResponse<Organization>> {
-		return apiClient.patch<Organization>(`/organizations/${id}`, data);
-	}
-
-	/**
-	 * Cancel a pending invitation
-	 */
-	static async cancelInvitation(
-		data: CancelInvitationData
-	): Promise<ApiResponse<{ success: boolean }>> {
-		return apiClient.delete<{ success: boolean }>('/organizations/invitations', data);
-	}
-}
-
-// Export convenience functions for direct use
-export const organizations = {
-	list: OrganizationsApi.list.bind(OrganizationsApi),
-	create: OrganizationsApi.create.bind(OrganizationsApi),
-	switch: OrganizationsApi.switch.bind(OrganizationsApi),
-	getById: OrganizationsApi.getById.bind(OrganizationsApi),
-	getActive: OrganizationsApi.getActive.bind(OrganizationsApi),
-	update: OrganizationsApi.update.bind(OrganizationsApi),
-	getMembers: OrganizationsApi.getMembers.bind(OrganizationsApi),
-	inviteMember: OrganizationsApi.inviteMember.bind(OrganizationsApi),
-	removeMember: OrganizationsApi.removeMember.bind(OrganizationsApi),
-	updateMemberRole: OrganizationsApi.updateMemberRole.bind(OrganizationsApi),
-	cancelInvitation: OrganizationsApi.cancelInvitation.bind(OrganizationsApi)
-};

package/src/lib/api/types.ts

@@ -1,34 +0,0 @@
-// API client types
-import type { Document, NewDocument } from '../types/index';
-
-// API Response wrappers
-export interface ApiResponse<T> {
-	success: boolean;
-	data?: T;
-	error?: string;
-	message?: string;
-	meta?: {
-		count: number;
-		limit: number;
-		offset: number;
-		filters: Record<string, any>;
-	};
-}
-
-// Document-related types
-export interface DocumentListParams {
-	docType?: string;
-	status?: string;
-	limit?: number;
-	offset?: number;
-}
-
-// Use database types directly instead of duplicating
-export type CreateDocumentData = Omit<
-	NewDocument,
-	'id' | 'createdAt' | 'updatedAt' | 'publishedAt'
->;
-export type UpdateDocumentData = Partial<Pick<Document, 'draftData' | 'status'>>;
-
-// Re-export database types for convenience
-export type { Document, NewDocument };

package/src/lib/auth/auth-errors.ts

@@ -1,23 +0,0 @@
-// Custom authentication errors with error codes for better error handling
-
-export type AuthErrorCode =
-	| 'no_session'
-	| 'session_expired'
-	| 'no_organization'
-	| 'kicked_from_org'
-	| 'unauthorized';
-
-export class AuthError extends Error {
-	code: AuthErrorCode;
-
-	constructor(code: AuthErrorCode, message: string) {
-		super(message);
-		this.code = code;
-		this.name = 'AuthError';
-	}
-}
-
-// Helper function to create auth errors
-export function createAuthError(code: AuthErrorCode, message: string): AuthError {
-	return new AuthError(code, message);
-}

package/src/lib/auth/auth-hooks.ts

@@ -1,132 +0,0 @@
-import type { RequestEvent } from '@sveltejs/kit';
-import { redirect } from '@sveltejs/kit';
-import type { DatabaseAdapter } from '../db/index';
-import type { CMSConfig, Auth } from '../types/index';
-import type { AuthProvider } from './provider';
-import { AuthError } from './auth-errors';
-
-export async function handleAuthHook(
-	event: RequestEvent,
-	config: CMSConfig,
-	authProvider: AuthProvider,
-	db: DatabaseAdapter
-): Promise<Response | null> {
-	const path = event.url.pathname;
-
-	// 1. Admin UI routes - require session authentication
-	if (path.startsWith('/admin')) {
-		try {
-			const session = await authProvider.requireSession(event.request, db);
-			event.locals.auth = session;
-		} catch (error) {
-			// If it's an AuthError, redirect to login with error code
-			if (error instanceof AuthError) {
-				const loginUrl = config.auth?.loginUrl || '/login';
-				throw redirect(302, `${loginUrl}?error=${error.code}`);
-			}
-			// For other errors, redirect without error code
-			throw redirect(302, config.auth?.loginUrl || '/login');
-		}
-	}
-
-	// 2. Asset CDN routes - accept session OR API key OR signed token
-	// Support both /assets/ and /media/ paths (media is Sanity-style URL)
-	if (path.startsWith('/assets/') || path.startsWith('/media/')) {
-		// Try session first (for admin UI)
-		let auth: Auth | null = await authProvider.getSession(event.request, db);
-
-		// If no session, try API key
-		if (!auth) {
-			auth = await authProvider.validateApiKey(event.request, db);
-		}
-
-		// Make auth available (can be null, route will check for signed token)
-		if (auth) {
-			event.locals.auth = auth;
-		}
-	}
-
-	// 3. API routes - accept session OR API key
-	if (path.startsWith('/api/')) {
-		// Skip auth routes (Better Auth handles these)
-		if (path.startsWith('/api/auth')) {
-			return null; // Let the main hook continue
-		}
-
-		// If API key is explicitly provided, prioritize it over session
-		// This allows public content access even when user is logged in to a different org
-		const hasApiKey = event.request.headers.has('x-api-key');
-		let auth: Auth | null = null;
-
-		if (hasApiKey) {
-			// API key takes precedence when explicitly provided
-			auth = await authProvider.validateApiKey(event.request, db);
-		} else {
-			// Otherwise, try session (for admin UI making API calls)
-			auth = await authProvider.getSession(event.request, db);
-		}
-
-		// Dynamically find the GraphQL endpoint from plugins
-		let graphqlEndpoint: string | undefined;
-		const graphqlPlugin = config.plugins?.find((p) => p.name === '@aphexcms/graphql-plugin');
-		if (graphqlPlugin && graphqlPlugin.routes) {
-			graphqlEndpoint = Object.keys(graphqlPlugin.routes)[0];
-		}
-
-		// Require authentication for protected API routes
-		const protectedApiRoutes = [
-			'/api/documents',
-			'/api/assets',
-			'/api/schemas',
-			'/api/organizations',
-			'/api/settings'
-		];
-		if (graphqlEndpoint) {
-			protectedApiRoutes.push(graphqlEndpoint);
-		}
-		const isProtectedRoute = protectedApiRoutes.some((route) => path.startsWith(route));
-
-		if (isProtectedRoute && !auth) {
-			return new Response(JSON.stringify({ error: 'Unauthorized' }), {
-				status: 401,
-				headers: { 'Content-Type': 'application/json' }
-			});
-		}
-
-		// Check write permission for mutations
-		if (auth && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(event.request.method)) {
-			// Special handling for GraphQL
-			if (graphqlEndpoint && path.startsWith(graphqlEndpoint)) {
-				// We need to read the body to check if it's a mutation.
-				// It's important to clone the request so we don't consume the body stream.
-				const requestBody = await event.request.clone().text();
-				const isMutation = requestBody.trim().startsWith('mutation');
-
-				if (isMutation && auth.type === 'api_key' && !auth.permissions.includes('write')) {
-					return new Response(
-						JSON.stringify({ error: 'Forbidden: Write permission required for mutations' }),
-						{
-							status: 403,
-							headers: { 'Content-Type': 'application/json' }
-						}
-					);
-				}
-			} else {
-				// Existing logic for other API routes
-				if (auth.type === 'api_key' && !auth.permissions.includes('write')) {
-					return new Response(JSON.stringify({ error: 'Forbidden: Write permission required' }), {
-						status: 403,
-						headers: { 'Content-Type': 'application/json' }
-					});
-				}
-			}
-		}
-
-		// Make auth available in API routes
-		if (auth) {
-			event.locals.auth = auth;
-		}
-	}
-
-	return null; // Tell the main hook to continue
-}

package/src/lib/auth/provider.ts

@@ -1,25 +0,0 @@
-// packages/cms-core/src/auth/provider.ts
-import type { SessionAuth, ApiKeyAuth } from '../types/index';
-import type { DatabaseAdapter } from '../db/interfaces/index';
-
-export interface AuthProvider {
-	// Session auth (browser, admin UI)
-	getSession(request: Request, db: DatabaseAdapter): Promise<SessionAuth | null>;
-	requireSession(request: Request, db: DatabaseAdapter): Promise<SessionAuth>;
-
-	// API key auth (programmatic access)
-	validateApiKey(request: Request, db: DatabaseAdapter): Promise<ApiKeyAuth | null>;
-	requireApiKey(
-		request: Request,
-		db: DatabaseAdapter,
-		permission?: 'read' | 'write'
-	): Promise<ApiKeyAuth>;
-
-	// User management
-	getUserById(userId: string): Promise<{ id: string; name?: string; email: string } | null>;
-	changeUserName(userId: string, name: string): Promise<void>;
-
-	// Password reset
-	requestPasswordReset(email: string, redirectTo?: string): Promise<void>;
-	resetPassword(token: string, newPassword: string): Promise<void>;
-}

package/src/lib/config.ts

@@ -1,18 +0,0 @@
-// Aphex CMS Configuration System
-import type { CMSConfig } from './types/index';
-
-export function createCMSConfig(config: CMSConfig): CMSConfig {
-	return {
-		// Start with the user's config and apply defaults for missing properties
-		...config,
-		storage: config.storage ?? null, // Default to null if not provided
-		customization: {
-			branding: {
-				title: 'Aphex CMS',
-				...config.customization?.branding
-			},
-			...config.customization
-		},
-		plugins: config.plugins ?? []
-	};
-}

package/src/lib/db/interfaces/asset.ts

@@ -1,61 +0,0 @@
-// Asset interface for asset operations
-import type { Asset } from '../../types/index';
-
-export interface AssetFilters {
-	organizationId: string; // Required for multi-tenancy (user's current org for RLS context)
-	assetType?: 'image' | 'file';
-	mimeType?: string;
-	search?: string;
-	limit?: number;
-	offset?: number;
-	filterOrganizationIds?: string[]; // Optional: Filter to specific org(s). RLS still enforces access.
-}
-
-export interface CreateAssetData {
-	organizationId: string; // Required for multi-tenancy
-	assetType: 'image' | 'file';
-	filename: string;
-	originalFilename: string;
-	mimeType: string;
-	size: number;
-	url: string;
-	path: string;
-	storageAdapter: string; // Which storage adapter was used
-	width?: number;
-	height?: number;
-	metadata?: any;
-	title?: string;
-	description?: string;
-	alt?: string;
-	creditLine?: string;
-	createdBy?: string; // User ID (optional for backward compatibility)
-}
-
-export interface UpdateAssetData {
-	url?: string; // Allow updating URL (for local storage after asset creation)
-	title?: string;
-	description?: string;
-	alt?: string;
-	creditLine?: string;
-	updatedBy?: string; // User ID (optional for backward compatibility)
-}
-
-/**
- * Asset adapter interface for asset-specific operations
- */
-export interface AssetAdapter {
-	// Asset CRUD operations
-	createAsset(data: CreateAssetData): Promise<Asset>;
-	findAssetById(organizationId: string, id: string): Promise<Asset | null>;
-	findAssets(
-		organizationId: string,
-		filters?: Omit<AssetFilters, 'organizationId'>
-	): Promise<Asset[]>;
-	updateAsset(organizationId: string, id: string, data: UpdateAssetData): Promise<Asset | null>;
-	deleteAsset(organizationId: string, id: string): Promise<boolean>;
-
-	// Asset analytics
-	countAssets(organizationId: string): Promise<number>;
-	countAssetsByType(organizationId: string): Promise<Record<string, number>>;
-	getTotalAssetsSize(organizationId: string): Promise<number>;
-}

package/src/lib/db/interfaces/document.ts

@@ -1,53 +0,0 @@
-// Document interface for document operations
-import type { Document } from '../../types/index';
-
-export interface DocumentFilters {
-	organizationId: string; // Required for multi-tenancy (user's current org for RLS context)
-	type?: string;
-	status?: string;
-	limit?: number;
-	offset?: number;
-	depth?: number; // How deep to resolve nested references (0 = no resolution, default = 0)
-	filterOrganizationIds?: string[]; // Optional: Filter to specific org(s). RLS still enforces access.
-}
-
-export interface CreateDocumentData {
-	organizationId: string; // Required for multi-tenancy
-	type: string;
-	draftData: any;
-	createdBy?: string; // User ID (optional for backward compatibility)
-}
-
-export interface UpdateDocumentData {
-	draftData?: any;
-	status?: string;
-	updatedBy?: string; // User ID (optional for backward compatibility)
-}
-
-/**
- * Document adapter interface for document-specific operations
- */
-export interface DocumentAdapter {
-	// Document CRUD operations
-	findManyDoc(
-		organizationId: string,
-		filters?: Omit<DocumentFilters, 'organizationId'>
-	): Promise<Document[]>;
-	findByDocId(organizationId: string, id: string, depth?: number): Promise<Document | null>;
-	createDocument(data: CreateDocumentData): Promise<Document>;
-	updateDocDraft(
-		organizationId: string,
-		id: string,
-		data: any,
-		updatedBy?: string
-	): Promise<Document | null>;
-	deleteDocById(organizationId: string, id: string): Promise<boolean>;
-
-	// Publishing operations
-	publishDoc(organizationId: string, id: string): Promise<Document | null>;
-	unpublishDoc(organizationId: string, id: string): Promise<Document | null>;
-
-	// Analytics/counts
-	countDocsByType(organizationId: string, type: string): Promise<number>;
-	getDocCountsByType(organizationId: string): Promise<Record<string, number>>;
-}

package/src/lib/db/interfaces/index.ts

@@ -1,98 +0,0 @@
-// Combined database interface
-import type { DocumentAdapter } from './document';
-import type { AssetAdapter } from './asset';
-import type { UserProfileAdapter } from './user';
-import type { SchemaAdapter } from './schema';
-import type { OrganizationAdapter } from './organization';
-
-// Re-export individual interfaces
-export type {
-	DocumentAdapter,
-	DocumentFilters,
-	CreateDocumentData,
-	UpdateDocumentData
-} from './document';
-export type { AssetAdapter, CreateAssetData, UpdateAssetData } from './asset';
-export type { UserProfileAdapter, NewUserProfileData } from './user';
-export type { SchemaAdapter } from './schema';
-export type { OrganizationAdapter } from './organization';
-
-/**
- * Combined database adapter interface
- * Extends all entity-specific adapters for full database functionality
- */
-export interface DatabaseAdapter
-	extends DocumentAdapter,
-		AssetAdapter,
-		UserProfileAdapter,
-		SchemaAdapter,
-		OrganizationAdapter {
-	// Connection management
-	connect?(): Promise<void>;
-	disconnect?(): Promise<void>;
-
-	// Health check
-	isHealthy(): Promise<boolean>;
-
-	// Multi-tenancy RLS methods (optional - only for adapters that support RLS)
-	/**
-	 * Initialize RLS (enable/disable) on tables - call after migrations
-	 */
-	initializeRLS?(): Promise<void>;
-
-	/**
-	 * Execute a function within a transaction with organization context set for RLS
-	 * Ensures proper isolation with connection pooling
-	 */
-	withOrgContext?<T>(organizationId: string, fn: () => Promise<T>): Promise<T>;
-
-	/**
-	 * Get all child organizations for a parent (for hierarchy support)
-	 */
-	getChildOrganizations?(parentOrganizationId: string): Promise<string[]>;
-
-	/**
-	 * Check if any user profiles exist in the system (for first-user detection)
-	 */
-	hasAnyUserProfiles?(): Promise<boolean>;
-}
-
-/**
- * Database provider factory interface
- * Providers are pre-configured and create adapters on demand
- */
-export interface DatabaseProvider {
-	name: string;
-	createAdapter(): DatabaseAdapter;
-}
-
-/**
- * Generic database configuration
- */
-export interface DatabaseConfig {
-	connectionString?: string; // Optional if client is provided
-	client?: any; // Pre-initialized database client (recommended for database agnosticism)
-	options?: {
-		maxConnections?: number;
-		timeout?: number;
-		ssl?: boolean;
-		[key: string]: any;
-	};
-}
-
-/**
- * Database transaction interface (optional for advanced providers)
- */
-export interface DatabaseTransaction {
-	commit(): Promise<void>;
-	rollback(): Promise<void>;
-	isActive(): boolean;
-}
-
-/**
- * Extended database adapter with transaction support
- */
-export interface TransactionalDatabaseAdapter extends DatabaseAdapter {
-	beginTransaction(): Promise<DatabaseTransaction>;
-	withTransaction<T>(fn: (adapter: DatabaseAdapter) => Promise<T>): Promise<T>;
-}

package/src/lib/db/interfaces/organization.ts

@@ -1,51 +0,0 @@
-// Organization adapter interface for multi-tenancy operations
-import type {
-	Organization,
-	NewOrganization,
-	OrganizationMember,
-	NewOrganizationMember,
-	Invitation,
-	NewInvitation,
-	UserSession,
-	OrganizationMembership
-} from '../../types/organization';
-
-export interface OrganizationAdapter {
-	// Organization CRUD
-	createOrganization(data: NewOrganization): Promise<Organization>;
-	findOrganizationById(id: string): Promise<Organization | null>;
-	findOrganizationBySlug(slug: string): Promise<Organization | null>;
-	updateOrganization(
-		id: string,
-		data: Partial<Omit<Organization, 'id' | 'createdAt' | 'createdBy'>>
-	): Promise<Organization | null>;
-	deleteOrganization(id: string): Promise<boolean>;
-
-	// Member management
-	addMember(data: NewOrganizationMember): Promise<OrganizationMember>;
-	removeMember(organizationId: string, userId: string): Promise<boolean>;
-	removeAllMembers(organizationId: string): Promise<boolean>;
-	updateMemberRole(
-		organizationId: string,
-		userId: string,
-		role: 'owner' | 'admin' | 'editor' | 'viewer'
-	): Promise<OrganizationMember | null>;
-	findUserMembership(userId: string, organizationId: string): Promise<OrganizationMember | null>;
-	findUserOrganizations(userId: string): Promise<OrganizationMembership[]>;
-	findOrganizationMembers(organizationId: string): Promise<OrganizationMember[]>;
-
-	// Invitation management
-	createInvitation(data: NewInvitation): Promise<Invitation>;
-	findInvitationByToken(token: string): Promise<Invitation | null>;
-	findOrganizationInvitations(organizationId: string): Promise<Invitation[]>;
-	findInvitationsByEmail(email: string): Promise<Invitation[]>;
-	acceptInvitation(token: string, userId: string): Promise<OrganizationMember>;
-	deleteInvitation(id: string): Promise<boolean>;
-	removeAllInvitations(organizationId: string): Promise<boolean>;
-	cleanupExpiredInvitations(): Promise<number>;
-
-	// User session management
-	updateUserSession(userId: string, organizationId: string): Promise<void>;
-	findUserSession(userId: string): Promise<UserSession | null>;
-	deleteUserSession(userId: string): Promise<boolean>;
-}

package/src/lib/db/interfaces/schema.ts

@@ -1,13 +0,0 @@
-import type { SchemaType } from '../../types/index';
-
-/**
- * Defines database operations for managing schemas.
- */
-export interface SchemaAdapter {
-	registerSchemaType(schemaType: SchemaType): Promise<void>;
-	getSchemaType(name: string): Promise<SchemaType | null>;
-	listSchemas(): Promise<SchemaType[]>;
-	listDocumentTypes(): Promise<Array<{ name: string; title: string; description?: string }>>;
-	listObjectTypes(): Promise<Array<{ name: string; title: string; description?: string }>>;
-	deleteSchemaType(name: string): Promise<void>;
-}

package/src/lib/db/interfaces/user.ts

@@ -1,16 +0,0 @@
-import type { UserProfile } from '../../types/index';
-
-export interface NewUserProfileData {
-	userId: string;
-	role?: 'super_admin' | 'admin' | 'editor' | 'viewer';
-	preferences?: Record<string, any>;
-}
-
-/**
- * Defines database operations for managing user profiles.
- */
-export interface UserProfileAdapter {
-	createUserProfile(data: NewUserProfileData): Promise<UserProfile>;
-	findUserProfileById(userId: string): Promise<UserProfile | null>;
-	deleteUserProfile(userId: string): Promise<boolean>;
-}