@aphexcms/cms-core 9.8.1 → 9.10.0

package/dist/auth/sign-up-policy.d.ts

@@ -0,0 +1,62 @@
+import type { BootstrapPolicy, InstanceRole } from './bootstrap.js';
+import type { DatabaseAdapter } from '../db/interfaces/index.js';
+import type { UserProfile } from '../types/index.js';
+/**
+ * Thrown when sign-up is refused by policy.
+ *
+ * Providers translate this into whatever their transport expects — Better Auth
+ * raises an `APIError`, a REST handler might return 403. The message is written
+ * to be safe to show a user.
+ */
+export declare class SignUpBlockedError extends Error {
+    readonly code = "SIGN_UP_BLOCKED";
+    constructor(message: string);
+}
+export interface SignUpGateOptions {
+    db: DatabaseAdapter;
+    /** Address attempting to register. Matched case-insensitively. */
+    email: string | undefined;
+    /** When false the gate is disabled entirely and this is a no-op. */
+    inviteOnly: boolean;
+}
+/**
+ * Throws `SignUpBlockedError` unless this address may create an account.
+ *
+ * Two ways through: the instance is provably empty (nobody exists yet to have
+ * sent an invitation, so gating the first sign-up would lock the door with the
+ * keys inside), or the address holds a pending invitation.
+ *
+ * Narrowing that first exception is the bootstrap policy's job — see
+ * `resolveBootstrapRole` — not this gate's.
+ */
+export declare function assertSignUpAllowed({ db, email, inviteOnly }: SignUpGateOptions): Promise<void>;
+export interface BootstrapRoleOptions {
+    db: DatabaseAdapter;
+    user: {
+        id: string;
+        email: string;
+        emailVerified: boolean;
+    };
+    /** The request that triggered profile creation, when there is one. */
+    request?: Request;
+    bootstrap: BootstrapPolicy;
+}
+/**
+ * Runs the bootstrap policy for a brand-new user, returning the instance role to
+ * grant or `null` for none.
+ *
+ * Deliberately not wrapped in a transaction. SQLite allows a single writer, and
+ * holding that lock across the policy's own round-trips collides with the auth
+ * provider's concurrent user/session inserts (SQLITE_BUSY). The atomicity was
+ * only partial anyway — see `claimCode`: a claim is single-use, not mutually
+ * exclusive.
+ */
+export declare function resolveBootstrapRole({ db, user, request, bootstrap }: BootstrapRoleOptions): Promise<InstanceRole | null>;
+/**
+ * The one place a CMS user profile is created for a newly-authenticated user.
+ *
+ * Every `AuthProvider` should route new profiles through here so bootstrap
+ * promotion happens identically regardless of who did the authenticating.
+ */
+export declare function createUserProfileWithBootstrap(options: BootstrapRoleOptions): Promise<UserProfile>;
+//# sourceMappingURL=sign-up-policy.d.ts.map

package/dist/auth/sign-up-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-up-policy.d.ts","sourceRoot":"","sources":["../../src/lib/auth/sign-up-policy.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;;;GAMG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,qBAAqB;gBACtB,OAAO,EAAE,MAAM;CAI3B;AAED,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,eAAe,CAAC;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,EACzC,EAAE,EACF,KAAK,EACL,UAAU,EACV,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnC;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,eAAe,CAAC;IACpB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5D,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,EAC1C,EAAE,EACF,IAAI,EACJ,OAAO,EACP,SAAS,EACT,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAerD;AAuBD;;;;;GAKG;AACH,wBAAsB,8BAA8B,CACnD,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAAC,WAAW,CAAC,CA6BtB"}

package/dist/auth/sign-up-policy.js

@@ -0,0 +1,120 @@
+// Who may sign up, and what they get when they do.
+//
+// These are **CMS policy decisions, not auth-provider concerns**. Whether an
+// instance is invite-only, and who becomes its first administrator, should mean
+// the same thing whether the app authenticates with Better Auth, Keycloak,
+// Supabase, or something hand-rolled — so they live behind the `AuthProvider`
+// port rather than inside any one implementation of it.
+//
+// Before this existed, both rules were enforced inside `@aphexcms/auth`'s
+// Better Auth wiring, which meant a third-party provider silently inherited
+// neither: `inviteOnly: true` would be configured and quietly do nothing. An
+// implementation is free to call these wherever its lifecycle allows, but it is
+// no longer free to *re-derive* them.
+import { cmsLogger } from '../utils/logger.js';
+import { isInstanceEmpty, canDetermineInstanceEmptiness } from './instance-state.js';
+import { isPendingInvitation } from './invitation-status.js';
+/**
+ * Thrown when sign-up is refused by policy.
+ *
+ * Providers translate this into whatever their transport expects — Better Auth
+ * raises an `APIError`, a REST handler might return 403. The message is written
+ * to be safe to show a user.
+ */
+export class SignUpBlockedError extends Error {
+    code = 'SIGN_UP_BLOCKED';
+    constructor(message) {
+        super(message);
+        this.name = 'SignUpBlockedError';
+    }
+}
+/**
+ * Throws `SignUpBlockedError` unless this address may create an account.
+ *
+ * Two ways through: the instance is provably empty (nobody exists yet to have
+ * sent an invitation, so gating the first sign-up would lock the door with the
+ * keys inside), or the address holds a pending invitation.
+ *
+ * Narrowing that first exception is the bootstrap policy's job — see
+ * `resolveBootstrapRole` — not this gate's.
+ */
+export async function assertSignUpAllowed({ db, email, inviteOnly }) {
+    if (!inviteOnly)
+        return;
+    if (await isInstanceEmpty(db)) {
+        cmsLogger.info('[SignUp]', 'Allowing first sign-up on an empty instance');
+        return;
+    }
+    // Invitations are stored lower-cased and matched exactly, so a mixed-case
+    // sign-up would otherwise find nothing and be refused.
+    const address = email?.toLowerCase().trim();
+    const invitations = address ? await db.findInvitationsByEmail(address) : [];
+    if (!invitations.some((invitation) => isPendingInvitation(invitation))) {
+        cmsLogger.warn('[SignUp]', `Blocked sign-up for ${address} — no pending invitation`);
+        throw new SignUpBlockedError('Sign-up is by invitation only. Ask an administrator for an invite.');
+    }
+}
+/**
+ * Runs the bootstrap policy for a brand-new user, returning the instance role to
+ * grant or `null` for none.
+ *
+ * Deliberately not wrapped in a transaction. SQLite allows a single writer, and
+ * holding that lock across the policy's own round-trips collides with the auth
+ * provider's concurrent user/session inserts (SQLITE_BUSY). The atomicity was
+ * only partial anyway — see `claimCode`: a claim is single-use, not mutually
+ * exclusive.
+ */
+export async function resolveBootstrapRole({ db, user, request, bootstrap }) {
+    // "Provably empty", not "couldn't prove otherwise". An adapter that can't
+    // answer this must not read as "no users exist" — that inversion once
+    // promoted every single sign-up to super admin.
+    const isFirstUser = await isInstanceEmpty(db);
+    if (!canDetermineInstanceEmptiness(db)) {
+        cmsLogger.warn('[SignUp]', 'Database adapter does not implement hasAnyUserProfiles() — skipping bootstrap. ' +
+            'Provision the first administrator out of band.');
+    }
+    return bootstrap({ user, isFirstUser, request, db });
+}
+/**
+ * Take the one-time bootstrap claim, or report that somebody else has it.
+ *
+ * An adapter without `tryClaimBootstrap` keeps the old, racy behaviour rather
+ * than never promoting anyone — the opposite of the rule `isInstanceEmpty`
+ * follows, and on purpose. There, failing closed skips a promotion; here it
+ * would leave a fresh install with no administrator and no way to get one.
+ */
+async function claimBootstrapPromotion(db) {
+    const claim = db.tryClaimBootstrap?.bind(db);
+    if (!claim) {
+        cmsLogger.warn('[SignUp]', 'Database adapter does not implement tryClaimBootstrap() — bootstrap promotion is not ' +
+            'race-safe. Concurrent first sign-ups could both be promoted.');
+        return true;
+    }
+    return claim();
+}
+/**
+ * The one place a CMS user profile is created for a newly-authenticated user.
+ *
+ * Every `AuthProvider` should route new profiles through here so bootstrap
+ * promotion happens identically regardless of who did the authenticating.
+ */
+export async function createUserProfileWithBootstrap(options) {
+    const proposed = await resolveBootstrapRole(options);
+    // The policy decided *whether* this user qualifies; the claim decides whether
+    // they got there first. Both are needed: the policy's own `isFirstUser` check
+    // reads a snapshot taken before the profile insert, so two sign-ups racing on
+    // a fresh instance can both pass it and both be promoted. Every promotion in
+    // the instance's lifetime funnels through this one call, so claiming here
+    // covers every policy — including a custom one — without each having to know
+    // about the race.
+    const granted = proposed && (await claimBootstrapPromotion(options.db)) ? proposed : null;
+    if (proposed && !granted) {
+        cmsLogger.warn('[SignUp]', `Bootstrap promotion for ${options.user.id} lost the claim — another sign-up got there first. ` +
+            'Creating an ordinary profile instead.');
+    }
+    cmsLogger.info('[SignUp]', `Creating profile for ${options.user.id}${granted ? ` with role ${granted.toUpperCase()}` : ''}`);
+    return options.db.createUserProfile({
+        userId: options.user.id,
+        role: granted ?? 'editor'
+    });
+}

package/dist/components/AdminApp.svelte

@@ -5,6 +5,7 @@
 	 */
 	import { Alert, AlertDescription, AlertTitle } from '@aphexcms/ui/shadcn/alert';
 	import { Button } from '@aphexcms/ui/shadcn/button';
+	import { Input } from '@aphexcms/ui/shadcn/input';
 	import { useSidebar } from '@aphexcms/ui/shadcn/sidebar';
 	import * as Tabs from '@aphexcms/ui/shadcn/tabs';
 	import * as Popover from '@aphexcms/ui/shadcn/popover';
@@ -18,6 +19,7 @@
 	import type { AdminArea } from '../admin/types';
 	import { setAdminNav } from '../admin/nav.svelte';
 	import type { Component } from 'svelte';
+	import { tick } from 'svelte';
 	import { setFieldComponents } from '../admin/field-components.svelte';
 	import { setBlockPreviews, type BlockPreviewProps } from '../admin/block-previews.svelte';
 	import AdminSlot from './admin/AdminSlot.svelte';
@@ -39,7 +41,9 @@
 		ArrowUp10,
 		ArrowDownUp,
 		ChevronLeft,
-		ChevronRight
+		ChevronRight,
+		Search,
+		X
 	} from '@lucide/svelte';
 	import type { Organization } from '../types/organization';
 	import { getOrderingsForSchema } from '../utils/default-orderings';
@@ -254,6 +258,20 @@
 	let docTotalDocs = $state(0);
 	let docPageSize = $state(20);
 	const PAGE_SIZE_OPTIONS = [20, 50, 100] as const;
+	let docSearchQuery = $state('');
+	let docSearchOpen = $state(false);
+	let docSearchInputEl = $state<HTMLInputElement | null>(null);
+	let docSearchTimeout: ReturnType<typeof setTimeout>;
+
+	function toggleDocSearch() {
+		if (docSearchOpen) {
+			docSearchOpen = false;
+			if (docSearchQuery) handleDocSearchInput('');
+		} else {
+			docSearchOpen = true;
+			tick().then(() => docSearchInputEl?.focus());
+		}
+	}
 
 	// Organizations lookup map for displaying org names
 	let organizationsMap = $state<Map<string, Organization>>(new Map());
@@ -617,6 +635,7 @@
 			editorStack = [];
 			if (selectedDocumentType !== docType) {
 				docCurrentPage = 1;
+				docSearchQuery = '';
 				selectedDocumentType = docType;
 				fetchDocuments(docType);
 			}
@@ -703,6 +722,7 @@
 			// Only fetch if docType changed (org changes are handled by separate effect)
 			if (selectedDocumentType !== docType) {
 				docCurrentPage = 1;
+				docSearchQuery = '';
 				selectedDocumentType = docType;
 				fetchDocuments(docType);
 			} else {
@@ -973,6 +993,15 @@
 		}
 	}
 
+	function handleDocSearchInput(value: string) {
+		docSearchQuery = value;
+		clearTimeout(docSearchTimeout);
+		docSearchTimeout = setTimeout(() => {
+			docCurrentPage = 1;
+			if (selectedDocumentType) fetchDocuments(selectedDocumentType);
+		}, 300);
+	}
+
 	async function fetchDocuments(docType: string) {
 		// No type = nothing to list (e.g. mid-navigation from a plugin tab before a
 		// type is selected). Bail quietly rather than hitting the API and toasting
@@ -988,7 +1017,8 @@
 				page: docCurrentPage,
 				pageSize: docPageSize,
 				includeChildOrganizations: userPreferences?.includeChildOrganizations ?? false,
-				sort: sortString
+				sort: sortString,
+				search: docSearchQuery.trim() || undefined
 			});
 
 			if (result.success && result.data) {
@@ -1330,6 +1360,15 @@
 													</div>
 												</div>
 												<div class="flex items-center gap-1">
+													<Button
+														size="sm"
+														variant="ghost"
+														onclick={toggleDocSearch}
+														class="h-8 w-8 p-0 {docSearchOpen || docSearchQuery ? 'bg-muted' : ''}"
+														title="Search documents"
+													>
+														<Search class="h-4 w-4" />
+													</Button>
 													{#if perms.can('document.create') && !schemas.find((s) => s.name === selectedDocumentType)?.singleton}
 														<Button
 															size="sm"
@@ -1459,6 +1498,37 @@
 													</Popover.Root>
 												</div>
 											</div>
+
+											{#if docSearchOpen}
+												<div class="relative mt-2">
+													<Search
+														size={14}
+														class="text-muted-foreground absolute top-1/2 left-2.5 -translate-y-1/2"
+													/>
+													<Input
+														bind:ref={docSearchInputEl}
+														placeholder="Search {pluralize(
+															currentDocType?.title || selectedDocumentType
+														).toLowerCase()}"
+														class="h-8 pl-8 text-sm {docSearchQuery ? 'pr-8' : ''}"
+														value={docSearchQuery}
+														oninput={(e) =>
+															handleDocSearchInput((e.target as HTMLInputElement).value)}
+														onkeydown={(e) => {
+															if (e.key === 'Escape') toggleDocSearch();
+														}}
+													/>
+													{#if docSearchQuery}
+														<button
+															onclick={() => handleDocSearchInput('')}
+															class="text-muted-foreground hover:text-foreground absolute top-1/2 right-2.5 -translate-y-1/2"
+															title="Clear search"
+														>
+															<X class="h-3.5 w-3.5" />
+														</button>
+													{/if}
+												</div>
+											{/if}
 										</div>
 
 										<div class="flex-1 overflow-y-auto">
@@ -1547,10 +1617,17 @@
 															<FileText class="text-muted-foreground h-8 w-8" />
 														{/if}
 													</div>
-													<h3 class="mb-2 font-medium">No documents found</h3>
-													<p class="text-muted-foreground text-sm">
-														Create your first {selectedDocumentType} document using the + button above
-													</p>
+													{#if docSearchQuery}
+														<h3 class="mb-2 font-medium">No matching documents</h3>
+														<p class="text-muted-foreground text-sm">
+															No results for "{docSearchQuery}". Try a different search.
+														</p>
+													{:else}
+														<h3 class="mb-2 font-medium">No documents found</h3>
+														<p class="text-muted-foreground text-sm">
+															Create your first {selectedDocumentType} document using the + button above
+														</p>
+													{/if}
 												</div>
 											{/if}
 										</div>

package/dist/components/AdminApp.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminApp.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/AdminApp.svelte.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,kBAAkB,CAAC;AAElE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAE1F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AA4BnE,UAAU,KAAK;IACd,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IACjC,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,eAAe,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAChD;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;CAC7D;AA+mDF,QAAA,MAAM,QAAQ,0BAAwC,CAAC;AACvD,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAC5C,eAAe,QAAQ,CAAC"}
+{"version":3,"file":"AdminApp.svelte.d.ts","sourceRoot":"","sources":["../../src/lib/components/AdminApp.svelte.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,kBAAkB,CAAC;AAElE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAE1F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AA8BnE,UAAU,KAAK;IACd,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IACjC,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,eAAe,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAChD;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;CAC7D;AAsqDF,QAAA,MAAM,QAAQ,0BAAwC,CAAC;AACvD,KAAK,QAAQ,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC;AAC5C,eAAe,QAAQ,CAAC"}