@aphexcms/cms-core 3.0.0 → 5.0.0

package/dist/server/api/index.d.ts

@@ -0,0 +1,55 @@
+import { Hono } from 'hono';
+import type { CMSInstances } from '../../hooks.js';
+import type { Auth } from '../../types/auth.js';
+/**
+ * Hono environment for the Aphex API.
+ *
+ * Variables on `c.var`:
+ * - `aphexCMS` — the singleton CMS service container (db, storage, services).
+ * - `auth` — the resolved auth principal for this request, or null if anonymous.
+ *
+ * These are populated by the SvelteKit catch-all, which invokes
+ * `app.fetch(request, { aphexCMS, auth })` and the bridge middleware below
+ * lifts them onto `c.var`.
+ */
+export type AphexEnv = {
+    Variables: {
+        aphexCMS: CMSInstances;
+        auth: Auth | null;
+    };
+    Bindings: {
+        aphexCMS: CMSInstances;
+        auth: Auth | null;
+    };
+};
+/**
+ * Build the Aphex API Hono app shell.
+ *
+ * Returns a Hono app with `/api` basePath and the bridge middleware that
+ * lifts `app.fetch(req, env)` values onto `c.var`. Built-in routes are NOT
+ * mounted yet — call `mountAphexBuiltins(app)` after registering any user
+ * middleware/overrides (Hono is registration-order-strict).
+ */
+export declare function createAphexApi(): import("hono/hono-base").HonoBase<AphexEnv, import("hono/types").BlankSchema, "/api", "/api">;
+/**
+ * Mount cms-core's built-in resource routes onto an Aphex API app.
+ *
+ * Called by `createCMSHook` after `config.api?.(app)` runs, so user-provided
+ * middleware (e.g. an email-sending wrap on `/organizations/invitations`)
+ * registers ahead of the built-in handler and gets the chance to wrap it.
+ */
+export declare function mountAphexBuiltins(app: Hono<AphexEnv>): void;
+export type ApiRoutes = ReturnType<typeof createAphexApi>;
+/**
+ * Adapter: wrap a SvelteKit-style `RequestHandler` so it can be mounted
+ * onto a Hono router.
+ *
+ * Used for handlers that already exist in SK form (e.g. the built-in
+ * GraphQL Yoga app) and don't need to be rewritten just to flow through
+ * the Hono catch-all. We synthesize the minimum `event` shape those
+ * handlers actually read: `request` + `locals.{aphexCMS,auth}` + `params`
+ * + `url`. If a future SK handler reaches for `cookies`, `setHeaders`, or
+ * `getClientAddress`, extend the synthesized event accordingly.
+ */
+export declare function toHonoHandler(skHandler: (event: any) => Promise<Response> | Response): (c: import("hono").Context<AphexEnv>) => Promise<Response>;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/server/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAoB7C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACtB,SAAS,EAAE;QACV,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;IACF,QAAQ,EAAE;QACT,QAAQ,EAAE,YAAY,CAAC;QACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;KAClB,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,kGAY7B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAoCrD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC5B,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,IAEzC,GAAG,OAAO,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,uBAejD"}

package/dist/server/api/index.js

@@ -0,0 +1,106 @@
+import { Hono } from 'hono';
+import { schemasRouter } from './routes/schemas.js';
+import { documentsRouter } from './routes/documents.js';
+import { documentsByIdRouter } from './routes/documents-by-id.js';
+import { documentsPublishRouter } from './routes/documents-publish.js';
+import { documentsQueryRouter } from './routes/documents-query.js';
+import { documentVersionsRouter } from './routes/document-versions.js';
+import { assetsRouter } from './routes/assets.js';
+import { assetsByIdRouter } from './routes/assets-by-id.js';
+import { assetsBulkRouter } from './routes/assets-bulk.js';
+import { assetsReferencesRouter } from './routes/assets-references.js';
+import { organizationsRouter } from './routes/organizations.js';
+import { organizationsByIdRouter } from './routes/organizations-by-id.js';
+import { organizationsInvitationsRouter } from './routes/organizations-invitations.js';
+import { organizationsMembersRouter } from './routes/organizations-members.js';
+import { organizationsSwitchRouter } from './routes/organizations-switch.js';
+import { rolesRouter } from './routes/roles.js';
+import { userPreferencesRouter } from './routes/user-preferences.js';
+import { userRouter } from './routes/user.js';
+/**
+ * Build the Aphex API Hono app shell.
+ *
+ * Returns a Hono app with `/api` basePath and the bridge middleware that
+ * lifts `app.fetch(req, env)` values onto `c.var`. Built-in routes are NOT
+ * mounted yet — call `mountAphexBuiltins(app)` after registering any user
+ * middleware/overrides (Hono is registration-order-strict).
+ */
+export function createAphexApi() {
+    const app = new Hono().basePath('/api');
+    // Bridge: lift values passed via app.fetch(req, env) onto c.var so
+    // handlers can read c.var.aphexCMS / c.var.auth directly.
+    app.use('*', async (c, next) => {
+        c.set('aphexCMS', c.env.aphexCMS);
+        c.set('auth', c.env.auth);
+        await next();
+    });
+    return app;
+}
+/**
+ * Mount cms-core's built-in resource routes onto an Aphex API app.
+ *
+ * Called by `createCMSHook` after `config.api?.(app)` runs, so user-provided
+ * middleware (e.g. an email-sending wrap on `/organizations/invitations`)
+ * registers ahead of the built-in handler and gets the chance to wrap it.
+ */
+export function mountAphexBuiltins(app) {
+    // Order matters: more-specific paths (`/documents/query`,
+    // `/documents/:id/publish`, `/documents/:id/versions/...`) must be
+    // registered before `/documents/:id` so Hono's first-match-wins
+    // resolver doesn't capture them under the catch-all `:id` param.
+    app.route('/schemas', schemasRouter);
+    app.route('/documents', documentsQueryRouter);
+    app.route('/documents', documentsPublishRouter);
+    app.route('/documents', documentVersionsRouter);
+    app.route('/documents', documentsByIdRouter);
+    app.route('/documents', documentsRouter);
+    // Assets — same precedence rule: specific paths before parametric.
+    // `/assets/bulk` and `/assets/references/counts` must register before
+    // `/assets/:id` or Hono will capture them as `:id = "bulk"` etc.
+    app.route('/assets', assetsBulkRouter);
+    app.route('/assets', assetsReferencesRouter);
+    app.route('/assets', assetsByIdRouter);
+    app.route('/assets', assetsRouter);
+    // Organizations — specifics (/switch, /invitations, /members) before /:id.
+    app.route('/organizations', organizationsSwitchRouter);
+    app.route('/organizations', organizationsInvitationsRouter);
+    app.route('/organizations', organizationsMembersRouter);
+    app.route('/organizations', organizationsByIdRouter);
+    app.route('/organizations', organizationsRouter);
+    // Roles — combined router covers /, /:name, no precedence concern.
+    app.route('/roles', rolesRouter);
+    // User account routes — register specifics first.
+    // `/user/cms-preference`, `/user/request-password-reset`,
+    // `/user/reset-password` need to win over `/user` PATCH otherwise
+    // Hono would try to match them under the wrong handler chain.
+    app.route('/user', userPreferencesRouter);
+    app.route('/user', userRouter);
+}
+/**
+ * Adapter: wrap a SvelteKit-style `RequestHandler` so it can be mounted
+ * onto a Hono router.
+ *
+ * Used for handlers that already exist in SK form (e.g. the built-in
+ * GraphQL Yoga app) and don't need to be rewritten just to flow through
+ * the Hono catch-all. We synthesize the minimum `event` shape those
+ * handlers actually read: `request` + `locals.{aphexCMS,auth}` + `params`
+ * + `url`. If a future SK handler reaches for `cookies`, `setHeaders`, or
+ * `getClientAddress`, extend the synthesized event accordingly.
+ */
+export function toHonoHandler(skHandler) {
+    return async (c) => {
+        const fakeEvent = {
+            request: c.req.raw,
+            url: new URL(c.req.url),
+            params: c.req.param(),
+            locals: {
+                aphexCMS: c.var.aphexCMS,
+                auth: c.var.auth
+            },
+            // No-op fallbacks — only used if a wrapped SK handler probes for them.
+            setHeaders: () => undefined,
+            getClientAddress: () => c.req.header('x-forwarded-for') ?? '127.0.0.1'
+        };
+        return skHandler(fakeEvent);
+    };
+}

package/dist/server/api/routes/assets-bulk.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const assetsBulkRouter: Hono<AphexEnv>;
+//# sourceMappingURL=assets-bulk.d.ts.map

package/dist/server/api/routes/assets-bulk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-bulk.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-bulk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAkE3C,CAAC"}

package/dist/{lib → server/api}/routes/assets-bulk.js

@@ -1,35 +1,34 @@
-import { json } from '@sveltejs/kit';
-import { cmsLogger } from '../utils/logger.js';
-import { bulkDeleteAssetsRequest } from '../api/schemas/assets.js';
-export const DELETE = async ({ request, locals }) => {
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { bulkDeleteAssetsRequest } from '../../../api/schemas/assets.js';
+export const assetsBulkRouter = new Hono().delete('/bulk', zValidator('json', bulkDeleteAssetsRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'No asset IDs provided',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
     try {
-        const { assetService, databaseAdapter } = locals.aphexCMS;
-        const auth = locals.auth;
+        const { assetService, databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
         if (!auth || auth.type === 'partial_session') {
-            return json({ success: false, error: 'Unauthorized' }, { status: 401 });
-        }
-        const rawBody = await request.json();
-        const parsed = bulkDeleteAssetsRequest.safeParse(rawBody);
-        if (!parsed.success) {
-            return json({
-                success: false,
-                error: 'No asset IDs provided',
-                issues: parsed.error.issues
-            }, { status: 400 });
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
         }
-        const { ids } = parsed.data;
-        // Check for references before deleting
+        const { ids } = c.req.valid('json');
         let referencedIds = [];
         if (databaseAdapter.countDocumentReferencesForAssets) {
             const counts = await databaseAdapter.countDocumentReferencesForAssets(auth.organizationId, ids);
             referencedIds = ids.filter((id) => (counts[id] || 0) > 0);
         }
         if (referencedIds.length > 0) {
-            return json({
+            return c.json({
                 success: false,
                 error: `Cannot delete ${referencedIds.length} asset${referencedIds.length > 1 ? 's' : ''} because ${referencedIds.length > 1 ? 'they are' : 'it is'} still referenced by documents`,
                 referencedIds
-            }, { status: 409 });
+            }, 409);
         }
         const results = { deleted: 0, failed: 0 };
         for (const id of ids) {
@@ -46,11 +45,10 @@ export const DELETE = async ({ request, locals }) => {
                 results.failed++;
             }
         }
-        return json({ success: true, data: results });
+        return c.json({ success: true, data: results });
     }
     catch (error) {
         cmsLogger.error('Bulk delete failed:', error);
-        return json({ success: false, error: 'Bulk delete failed' }, { status: 500 });
+        return c.json({ success: false, error: 'Bulk delete failed' }, 500);
     }
-};
-//# sourceMappingURL=assets-bulk.js.map
+});

package/dist/server/api/routes/assets-by-id.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const assetsByIdRouter: Hono<AphexEnv>;
+//# sourceMappingURL=assets-by-id.d.ts.map

package/dist/server/api/routes/assets-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-by-id.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-by-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CA8HzC,CAAC"}

package/dist/server/api/routes/assets-by-id.js

@@ -0,0 +1,107 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { updateAssetRequest } from '../../../api/schemas/assets.js';
+export const assetsByIdRouter = new Hono()
+    .get('/:id', async (c) => {
+    try {
+        const { assetService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        if (!id) {
+            return c.json({ success: false, error: 'Asset ID is required' }, 400);
+        }
+        const asset = await assetService.findAssetById(auth.organizationId, id);
+        if (!asset) {
+            return c.json({ success: false, error: 'Asset not found' }, 404);
+        }
+        return c.json({ success: true, data: asset });
+    }
+    catch (error) {
+        cmsLogger.error('[Asset API] Error fetching asset:', error);
+        return c.json({ success: false, error: 'Failed to fetch asset' }, 500);
+    }
+})
+    .delete('/:id', async (c) => {
+    try {
+        const id = c.req.param('id');
+        const { assetService, databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        if (!id) {
+            return c.json({ success: false, error: 'Asset ID is required' }, 400);
+        }
+        if (databaseAdapter.findDocumentsReferencingAsset) {
+            const refs = await databaseAdapter.findDocumentsReferencingAsset(auth.organizationId, id);
+            if (refs.length > 0) {
+                return c.json({
+                    success: false,
+                    error: `Cannot delete asset — it is referenced by ${refs.length} document${refs.length > 1 ? 's' : ''}`
+                }, 409);
+            }
+        }
+        const result = await assetService.deleteAsset(auth.organizationId, id);
+        if (!result) {
+            return c.json({ success: false, error: 'Asset not found or could not be deleted' }, 404);
+        }
+        return c.json({ success: true });
+    }
+    catch (error) {
+        cmsLogger.error('Error deleting asset:', error);
+        return c.json({ success: false, error: 'Failed to delete asset' }, 500);
+    }
+})
+    .patch('/:id', zValidator('json', updateAssetRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { assetService } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        const id = c.req.param('id');
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        if (!id) {
+            return c.json({ success: false, error: 'Asset ID is required' }, 400);
+        }
+        const { title, description, alt, creditLine } = c.req.valid('json');
+        let updatedAsset;
+        if (auth.type === 'session') {
+            updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
+                title,
+                description,
+                alt,
+                creditLine,
+                updatedBy: auth.user.id
+            });
+        }
+        else {
+            updatedAsset = await assetService.updateAssetMetadata(auth.organizationId, id, {
+                title,
+                description,
+                alt,
+                creditLine,
+                updatedBy: auth.keyId
+            });
+        }
+        if (!updatedAsset) {
+            return c.json({ success: false, error: 'Asset not found' }, 404);
+        }
+        return c.json({ success: true, data: updatedAsset });
+    }
+    catch (error) {
+        cmsLogger.error('Error updating asset:', error);
+        return c.json({ success: false, error: 'Failed to update asset' }, 500);
+    }
+});

package/dist/server/api/routes/assets-references.d.ts

@@ -0,0 +1,15 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+/**
+ * Asset references endpoints. Two distinct paths sharing one router file:
+ *   - GET  /:id/references          → docs that reference one asset
+ *   - POST /references/counts       → batch reference counts for many ids
+ *
+ * Mounted under `/assets`, so the wire paths are
+ * `/api/assets/:id/references` and `/api/assets/references/counts`.
+ *
+ * Order matters in createAphexApi(): mount this BEFORE assetsByIdRouter so
+ * `/references/counts` doesn't get captured as `:id = "references"`.
+ */
+export declare const assetsReferencesRouter: Hono<AphexEnv>;
+//# sourceMappingURL=assets-references.d.ts.map

package/dist/server/api/routes/assets-references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets-references.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC,QAAQ,CAkFhD,CAAC"}

package/dist/server/api/routes/assets-references.js

@@ -0,0 +1,77 @@
+import { Hono } from 'hono';
+import { zValidator } from '@hono/zod-validator';
+import { cmsLogger } from '../../../utils/logger.js';
+import { assetReferenceCountsRequest } from '../../../api/schemas/assets.js';
+/**
+ * Asset references endpoints. Two distinct paths sharing one router file:
+ *   - GET  /:id/references          → docs that reference one asset
+ *   - POST /references/counts       → batch reference counts for many ids
+ *
+ * Mounted under `/assets`, so the wire paths are
+ * `/api/assets/:id/references` and `/api/assets/references/counts`.
+ *
+ * Order matters in createAphexApi(): mount this BEFORE assetsByIdRouter so
+ * `/references/counts` doesn't get captured as `:id = "references"`.
+ */
+export const assetsReferencesRouter = new Hono()
+    .get('/:id/references', async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        const id = c.req.param('id');
+        if (!id) {
+            return c.json({ success: false, error: 'Asset ID is required' }, 400);
+        }
+        if (!databaseAdapter.findDocumentsReferencingAsset) {
+            return c.json({ success: true, data: { references: [], total: 0 } });
+        }
+        const references = await databaseAdapter.findDocumentsReferencingAsset(auth.organizationId, id);
+        return c.json({
+            success: true,
+            data: {
+                references,
+                total: references.length
+            }
+        });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to find asset references:', error);
+        return c.json({ success: false, error: 'Failed to find asset references' }, 500);
+    }
+})
+    .post('/references/counts', zValidator('json', assetReferenceCountsRequest, (result, c) => {
+    if (!result.success) {
+        return c.json({
+            success: false,
+            error: 'Invalid request body',
+            issues: result.error.issues
+        }, 400);
+    }
+}), async (c) => {
+    try {
+        const { databaseAdapter } = c.var.aphexCMS;
+        const auth = c.var.auth;
+        if (!auth || auth.type === 'partial_session') {
+            return c.json({ success: false, error: 'Unauthorized' }, 401);
+        }
+        const { ids } = c.req.valid('json');
+        if (ids.length === 0) {
+            return c.json({ success: true, data: {} });
+        }
+        if (!databaseAdapter.countDocumentReferencesForAssets) {
+            const counts = {};
+            for (const id of ids)
+                counts[id] = 0;
+            return c.json({ success: true, data: counts });
+        }
+        const counts = await databaseAdapter.countDocumentReferencesForAssets(auth.organizationId, ids);
+        return c.json({ success: true, data: counts });
+    }
+    catch (error) {
+        cmsLogger.error('Failed to count asset references:', error);
+        return c.json({ success: false, error: 'Failed to count asset references' }, 500);
+    }
+});

package/dist/server/api/routes/assets.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AphexEnv } from '../index.js';
+export declare const assetsRouter: Hono<AphexEnv>;
+//# sourceMappingURL=assets.d.ts.map

package/dist/server/api/routes/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/api/routes/assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,eAAO,MAAM,YAAY,EAAE,IAAI,CAAC,QAAQ,CA+IrC,CAAC"}