@beechcms/api 0.4.0-preview.4 → 0.4.0-preview.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/api",
-  "version": "0.4.0-preview.4",
+  "version": "0.4.0-preview.5",
   "type": "module",
   "exports": {
     ".": "./src/factory.ts"
@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.995.0",
-    "@beechcms/core": "^0.4.0-preview.4",
+    "@beechcms/core": "^0.4.0-preview.5",
     "bcryptjs": "^2.4.3",
     "hono": "^4.11.9",
     "jose": "^6.1.3"

package/src/factory.ts

@@ -118,6 +118,7 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
 
   app.use('*', async (c, next) => {
     await next()
+    if (c.req.path.startsWith('/admin')) return
     c.header('X-Frame-Options', 'DENY')
     c.header('X-Content-Type-Options', 'nosniff')
     c.header('Referrer-Policy', 'strict-origin-when-cross-origin')
@@ -271,5 +272,27 @@ export function createBeechApp(config: BeechConfig): Hono<{ Bindings: Env; Varia
   apiPublic.route('/', publicRoutes)
   app.route('/api/v1/public', apiPublic)
 
+  // 7. Dashboard SPA — serve static assets from Workers Assets binding
+  app.get('/admin', (c) => c.redirect('/admin/', 301))
+  app.get('/admin/*', async (c) => {
+    if (!c.env.ASSETS) {
+      return c.text('Dashboard not configured. Set up the ASSETS binding in wrangler.toml pointing to @beechcms/dashboard/dist', 503)
+    }
+    let assetResponse = await c.env.ASSETS.fetch(c.req.raw)
+    if (assetResponse.status === 404) {
+      // SPA fallback: any unmatched /admin/* route serves index.html
+      assetResponse = await c.env.ASSETS.fetch(new Request(new URL('/admin/index.html', c.req.url)))
+    }
+    // ASSETS returns an immutable Response — wrap it to inject security headers
+    const headers = new Headers(assetResponse.headers)
+    headers.set('Content-Security-Policy',
+      "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; connect-src 'self'; frame-ancestors 'none'"
+    )
+    headers.set('X-Frame-Options', 'DENY')
+    headers.set('X-Content-Type-Options', 'nosniff')
+    headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')
+    return new Response(assetResponse.body, { status: assetResponse.status, headers })
+  })
+
   return app
 }

package/src/features/password-reset/request.ts

@@ -67,7 +67,7 @@ export async function requestPasswordReset(
     .run()
 
   const appUrl = (c.env.APP_URL ?? new URL(c.req.url).origin).replace(/\/$/, '')
-  const resetUrl = `${appUrl}/reset-password?token=${token}`
+  const resetUrl = `${appUrl}/admin/reset-password?token=${token}`
 
   try {
     await sendPasswordResetEmail({

package/src/search-utils.ts

@@ -175,6 +175,10 @@ export function buildFtsQuery(
 
 // ─── Mapper ──────────────────────────────────────────────────────────────────
 
+function stripHtmlPreserveMark(html: string): string {
+  return html.replace(/<(?!\/?mark\b)[^>]*>/gi, ' ').replace(/\s+/g, ' ').trim()
+}
+
 export function mapFtsRow(row: FtsRow): SearchResultItem {
   return {
     id:          row.entry_id,
@@ -182,7 +186,7 @@ export function mapFtsRow(row: FtsRow): SearchResultItem {
     slug:        row.slug,
     status:      row.status,
     title:       row.title ?? "",
-    excerpt:     row.excerpt ?? "",
+    excerpt:     stripHtmlPreserveMark(row.excerpt ?? ""),
     data:        {},
   }
 }

package/src/types.ts

@@ -26,6 +26,7 @@ export interface Env {
   FORGOT_PASSWORD_RATE_LIMITER?: RateLimit
   RESET_PASSWORD_RATE_LIMITER?: RateLimit
   ENV?: string
+  ASSETS?: Fetcher
 }
 
 export interface Variables {