@btst/stack 2.12.0 → 2.12.2

package/src/plugins/cms/client/components/forms/relation-field.tsx

@@ -1,7 +1,14 @@
 "use client";
 
 import { useState, useCallback, useMemo } from "react";
+import { useQueries } from "@tanstack/react-query";
+import { createApiClient } from "@btst/stack/plugins/client";
+import { usePluginOverrides } from "@btst/stack/context";
 import { useContent, useCreateContent } from "../../hooks";
+import type { CMSApiRouter } from "../../../api";
+import type { SerializedContentItemWithType } from "../../../types";
+import type { CMSPluginOverrides } from "../../overrides";
+import { createCMSQueryKeys } from "../../../query-keys";
 import MultipleSelector from "@workspace/ui/components/multi-select";
 import type { Option } from "@workspace/ui/components/multi-select";
 import { Button } from "@workspace/ui/components/button";
@@ -19,6 +26,16 @@ import { Textarea } from "@workspace/ui/components/textarea";
 import type { AutoFormInputComponentProps } from "@workspace/ui/components/auto-form/types";
 import type { RelationConfig } from "../../../types";
 
+/** Match cms-hooks SHARED_QUERY_CONFIG for detail fetches (deduped labels). */
+const RELATION_DETAIL_QUERY_OPTS = {
+	retry: false,
+	refetchOnWindowFocus: false,
+	refetchOnMount: false,
+	refetchOnReconnect: false,
+	staleTime: 1000 * 60 * 5,
+	gcTime: 1000 * 60 * 10,
+} as const;
+
 interface RelationFieldProps extends AutoFormInputComponentProps {
 	relation: RelationConfig;
 }
@@ -43,16 +60,25 @@ export function RelationField({
 	const [newItemDescription, setNewItemDescription] = useState("");
 	const [createError, setCreateError] = useState<string | null>(null);
 
-	// For belongsTo (single relation), we only allow one selection
-	const isSingleSelect = relation.type === "belongsTo";
+	const { apiBaseURL, apiBasePath, headers } =
+		usePluginOverrides<CMSPluginOverrides>("cms");
 
-	// Fetch available items from the target content type
-	const { items: availableItems, isLoading } = useContent(relation.targetType, {
-		limit: 100, // Load a good chunk for the dropdown
-	});
+	const listClient = useMemo(
+		() =>
+			createApiClient<CMSApiRouter>({
+				baseURL: apiBaseURL,
+				basePath: apiBasePath,
+			}),
+		[apiBaseURL, apiBasePath],
+	);
 
-	// Mutation for creating new items
-	const createMutation = useCreateContent(relation.targetType);
+	const cmsQueries = useMemo(
+		() => createCMSQueryKeys(listClient, headers),
+		[listClient, headers],
+	);
+
+	// For belongsTo (single relation), we only allow one selection
+	const isSingleSelect = relation.type === "belongsTo";
 
 	// Normalize the field value to an array for internal use
 	// belongsTo stores as single object { id }, hasMany/manyToMany store as array
@@ -72,36 +98,95 @@ export function RelationField({
 		return (field.value as Array<{ id: string }>) || [];
 	}, [field.value, isSingleSelect]);
 
-	// Convert normalized value to Option[] for MultipleSelector
-	const selectedOptions: Option[] = normalizedValue
-		.map((v) => {
-			const item = availableItems.find((item) => item.id === v.id);
-			if (item) {
-				const displayValue =
-					(item.parsedData as Record<string, unknown>)?.[
-						relation.displayField
-					] || item.slug;
-				return {
-					value: item.id,
-					label: String(displayValue),
-				};
+	// Fetch available items from the target content type (first page only)
+	const { items: availableItems, isLoading } = useContent(relation.targetType, {
+		limit: 500,
+	});
+
+	const missingDetailIds = useMemo(() => {
+		const loadedIds = new Set(availableItems.map((i) => i.id));
+		return normalizedValue
+			.map((v) => v.id)
+			.filter((id) => id.length > 0 && !loadedIds.has(id));
+	}, [availableItems, normalizedValue]);
+
+	const hydrationResult = useQueries({
+		queries: missingDetailIds.map((id) => ({
+			...cmsQueries.cmsContent.detail(relation.targetType, id),
+			...RELATION_DETAIL_QUERY_OPTS,
+			enabled: Boolean(relation.targetType && id),
+		})),
+		combine: (results) => ({
+			data: results.map(
+				(r) => r.data as SerializedContentItemWithType | null | undefined,
+			),
+			isHydrating: results.some((r) => r.isFetching),
+		}),
+	});
+
+	const isHydratingLabels = hydrationResult.isHydrating;
+
+	const itemById = useMemo(() => {
+		const m = new Map<string, SerializedContentItemWithType>();
+		for (const it of availableItems) {
+			m.set(it.id, it as SerializedContentItemWithType);
+		}
+		for (let i = 0; i < missingDetailIds.length; i++) {
+			const row = hydrationResult.data[i];
+			if (row?.id) {
+				m.set(row.id, row);
 			}
-			// Item not found in loaded items - show ID
-			return { value: v.id, label: `ID: ${v.id.slice(0, 8)}...` };
-		})
-		.filter(Boolean);
+		}
+		return m;
+	}, [availableItems, missingDetailIds, hydrationResult.data]);
 
-	// Convert available items to options
-	const options: Option[] = availableItems.map((item) => {
-		const displayValue =
-			(item.parsedData as Record<string, unknown>)?.[relation.displayField] ||
-			item.slug;
-		return {
-			value: item.id,
-			label: String(displayValue),
-		};
+	// Convert normalized value to Option[] for MultipleSelector
+	const selectedOptions: Option[] = normalizedValue.map((v) => {
+		const item = itemById.get(v.id);
+		if (item) {
+			const displayValue =
+				(item.parsedData as Record<string, unknown>)?.[relation.displayField] ||
+				item.slug;
+			return {
+				value: item.id,
+				label: String(displayValue),
+			};
+		}
+		return { value: v.id, label: `ID: ${v.id.slice(0, 8)}...` };
 	});
 
+	// Listed options + any selected partners loaded by id (not on first list page)
+	const options: Option[] = useMemo(() => {
+		const merged: SerializedContentItemWithType[] = [
+			...(availableItems as SerializedContentItemWithType[]),
+		];
+		const seen = new Set(merged.map((x) => x.id));
+		for (let i = 0; i < missingDetailIds.length; i++) {
+			const row = hydrationResult.data[i];
+			if (row?.id && !seen.has(row.id)) {
+				merged.push(row);
+				seen.add(row.id);
+			}
+		}
+		return merged.map((item) => {
+			const displayValue =
+				(item.parsedData as Record<string, unknown>)?.[relation.displayField] ||
+				item.slug;
+			return {
+				value: item.id,
+				label: String(displayValue),
+			};
+		});
+	}, [
+		availableItems,
+		hydrationResult.data,
+		missingDetailIds,
+		relation.displayField,
+	]);
+
+	// Mutation for creating new items
+	const createMutation = useCreateContent(relation.targetType);
+
 	// Handle selection change - convert back to appropriate format
 	const handleChange = useCallback(
 		(newOptions: Option[]) => {
@@ -187,11 +272,11 @@ export function RelationField({
 						onChange={handleChange}
 						options={options}
 						placeholder={
-							isLoading
+							isLoading || isHydratingLabels
 								? "Loading..."
 								: `Select ${relation.targetType}${isSingleSelect ? "" : "(s)"}...`
 						}
-						disabled={isLoading}
+						disabled={isLoading || isHydratingLabels}
 						hidePlaceholderWhenSelected
 						emptyIndicator={
 							<p className="text-center text-sm text-muted-foreground py-4">

package/src/plugins/cms/schemas.ts

@@ -1,13 +1,33 @@
 import { z } from "zod";
 
+/** Default upper bound for a single page when no maxPageSize is configured. */
+export const DEFAULT_MAX_PAGE_SIZE = 1000;
+
 /**
- * Schema for listing content items with pagination
+ * Factory that creates the list-content query schema with a configurable
+ * upper bound on the `limit` parameter.
+ *
+ * Use this inside the backend plugin factory (where `config.maxPageSize` is
+ * available) so the cap is set at registration time rather than hardcoded.
  */
-export const listContentQuerySchema = z.object({
-	slug: z.string().optional(),
-	limit: z.coerce.number().min(1).max(100).optional().default(20),
-	offset: z.coerce.number().min(0).optional().default(0),
-});
+export function createListContentQuerySchema(
+	maxPageSize = DEFAULT_MAX_PAGE_SIZE,
+) {
+	return z.object({
+		slug: z.string().optional(),
+		limit: z.coerce.number().min(1).max(maxPageSize).optional().default(20),
+		offset: z.coerce.number().min(0).optional().default(0),
+	});
+}
+
+/**
+ * Schema for listing content items with pagination.
+ * Uses the default maxPageSize (1000).
+ *
+ * @deprecated Prefer {@link createListContentQuerySchema} inside plugin
+ * factories so consumers can configure the upper bound via `maxPageSize`.
+ */
+export const listContentQuerySchema = createListContentQuerySchema();
 
 /**
  * Schema for creating a content item

package/src/plugins/cms/types.ts

@@ -303,4 +303,14 @@ export interface CMSBackendConfig {
 	contentTypes: ContentTypeConfig[];
 	/** Optional hooks for customizing behavior */
 	hooks?: CMSBackendHooks;
+	/**
+	 * Maximum number of items that can be requested in a single page.
+	 * Applied to all list endpoints (`/content/:typeSlug`, by-relation, and inverse-relation).
+	 *
+	 * Raise this when your content types have many items and you need to fetch
+	 * large pages (e.g. for SSG, CSV export, or programmatic access).
+	 *
+	 * @default 1000
+	 */
+	maxPageSize?: number;
 }

package/src/plugins/media/__tests__/plugin.test.ts

@@ -293,6 +293,52 @@ describe("mediaBackendPlugin create-asset URL validation", () => {
 			"https://cdn.example.com/uploads/photo.jpg",
 		);
 	});
+
+	it("allows any HTTP(S) URL when protocol prefixes are explicitly configured", async () => {
+		const backend = createVercelBlobBackend({
+			allowedUrlPrefixes: ["https://", "http://"],
+		});
+
+		const response = await backend.handler(
+			new Request("http://localhost/api/media/assets", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(
+					createAssetRequestBody(
+						"https://images.example.net/affiliate/photo.jpg",
+					),
+				),
+			}),
+		);
+
+		expect(response.status).toBe(200);
+
+		const assets = await backend.api.media.listAssets();
+		expect(assets.items).toHaveLength(1);
+		expect(assets.items[0]?.url).toBe(
+			"https://images.example.net/affiliate/photo.jpg",
+		);
+
+		const httpResponse = await backend.handler(
+			new Request("http://localhost/api/media/assets", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(
+					createAssetRequestBody(
+						"http://images.example.net/affiliate/photo.jpg",
+					),
+				),
+			}),
+		);
+
+		expect(httpResponse.status).toBe(200);
+
+		const updatedAssets = await backend.api.media.listAssets();
+		expect(updatedAssets.items).toHaveLength(2);
+		expect(
+			updatedAssets.items.some((asset) => asset.url.startsWith("http://")),
+		).toBe(true);
+	});
 });
 
 describe("mediaBackendPlugin S3 URL validation", () => {

package/src/plugins/media/api/plugin.ts

@@ -41,7 +41,19 @@ function sanitizeS3KeySegment(s: string): string {
 }
 
 function matchesUrlPrefix(url: string, prefix: string): boolean {
-	const normalizedPrefix = `${prefix.replace(/\/+$/, "")}/`;
+	const trimmedPrefix = prefix.trim();
+	if (!trimmedPrefix) return false;
+
+	if (/^[a-z][a-z\d+.-]*:\/\//i.test(trimmedPrefix)) {
+		if (trimmedPrefix.endsWith("://")) {
+			return url.startsWith(trimmedPrefix);
+		}
+
+		const normalizedPrefix = trimmedPrefix.replace(/\/+$/, "");
+		return url === normalizedPrefix || url.startsWith(`${normalizedPrefix}/`);
+	}
+
+	const normalizedPrefix = `${trimmedPrefix.replace(/\/+$/, "")}/`;
 	return url.startsWith(normalizedPrefix);
 }
 
@@ -181,6 +193,15 @@ export interface MediaBackendConfig {
 	 * Provide this option only when you need to override the automatic default (e.g. to allow
 	 * assets from a CDN in front of your storage that uses a different domain). When using
 	 * `localAdapter`, setting `allowedUrlPrefixes` explicitly opts `POST /media/assets` back in.
+	 *
+	 * @remarks
+	 * Protocol-only prefixes such as `"https://"` (and especially `"http://"`) disable
+	 * origin-based restrictions entirely — any URL with that scheme will be accepted.
+	 * Only use them when you intentionally want to allow assets from arbitrary hosts:
+	 * `"http://"` URLs will be blocked as mixed content on HTTPS pages, and if your
+	 * `onAfterUpload` hook fetches asset URLs server-side, accepting arbitrary hosts
+	 * can expose an SSRF surface. Prefer full origin prefixes like
+	 * `"https://cdn.example.com"` whenever possible.
 	 */
 	allowedUrlPrefixes?: string[];
 

package/src/plugins/media/client/components/media-picker/url-tab.tsx

@@ -18,6 +18,7 @@ export function UrlTab({
 
 	const handleSubmit = async (e: React.FormEvent) => {
 		e.preventDefault();
+		e.stopPropagation();
 		setError(null);
 		const trimmed = url.trim();
 		if (!trimmed) return;
@@ -43,7 +44,10 @@ export function UrlTab({
 			<form onSubmit={handleSubmit} className="flex flex-col gap-2">
 				<div className="flex flex-col gap-2 sm:flex-row">
 					<Input
-						type="url"
+						type="text"
+						inputMode="url"
+						autoCapitalize="none"
+						autoCorrect="off"
 						value={url}
 						onChange={(e) => setUrl(e.target.value)}
 						placeholder="https://example.com/image.png"