@bygghammar/cms-platform 0.3.1 → 0.4.0

package/src/backup/media-export.ts

@@ -0,0 +1,24 @@
+import {
+  buildBrowserMediaArchive as buildSharedBrowserMediaArchive,
+  type MediaExportProgress,
+} from "./browser-media";
+
+import { ARCHIVE_FORMAT_VERSION, SCHEMA_VERSION, type ArchiveManifest } from "./datasets";
+import type { MediaStorage } from "../media/storage";
+
+export type { MediaExportProgress };
+
+type MediaExportOptions = {
+  baseArchive: Uint8Array;
+  groups: string[];
+  storage: Pick<MediaStorage, "list" | "download">;
+  onProgress?: (progress: MediaExportProgress) => void;
+};
+
+export function buildBrowserMediaArchive(options: MediaExportOptions) {
+  return buildSharedBrowserMediaArchive<ArchiveManifest>({
+    ...options,
+    expectedFormat: ARCHIVE_FORMAT_VERSION,
+    expectedSchemaVersion: SCHEMA_VERSION,
+  });
+}

package/src/backup/restore-core.ts

@@ -0,0 +1,465 @@
+/**
+ * Pure restore logic shared by the standalone PostgreSQL tool and the tests.
+ *
+ * Nothing here opens a connection: it turns an archive into a validated,
+ * ordered list of SQL statements. That keeps every rule (order, conflict
+ * targets, sanitising, media verification) testable without a database.
+ */
+import { unzipSync, strFromU8 } from "fflate";
+
+import {
+  ARCHIVE_FORMAT_VERSION,
+  DATASET_GROUPS,
+  IMPORT_ORDER,
+  LINEAGE_KEYS,
+  SCHEMA_VERSION,
+  groupById,
+  type ArchiveManifest,
+  type ImportMode,
+  type TableSpec,
+} from "./datasets";
+import {
+  isSafeArchivePath,
+  neutralizeInjection,
+  rewriteMediaUrls,
+  verifyMediaFile,
+  MAX_TOTAL_UNCOMPRESSED_BYTES,
+  toJsonSafe,
+} from "./safety";
+
+export type ArchiveEntries = Record<string, Uint8Array>;
+
+export type ReadArchiveResult = {
+  manifest: ArchiveManifest;
+  entries: ArchiveEntries;
+};
+
+/** Unzip, validate entry paths and versions. Throws on anything suspicious. */
+export function readArchive(bytes: Uint8Array): ReadArchiveResult {
+  const entries = unzipSync(bytes);
+  let total = 0;
+  for (const [name, value] of Object.entries(entries)) {
+    if (!isSafeArchivePath(name)) throw new Error(`Unsafe entry in archive: ${name}`);
+    total += value.byteLength;
+    if (total > MAX_TOTAL_UNCOMPRESSED_BYTES) throw new Error("Archive is too large to restore.");
+  }
+  const raw = entries["manifest.json"];
+  if (!raw) throw new Error("Not a valid backup archive — manifest.json is missing.");
+  const manifest = JSON.parse(strFromU8(raw)) as ArchiveManifest;
+  if (manifest.format !== ARCHIVE_FORMAT_VERSION) {
+    throw new Error(
+      `Archive format ${manifest.format} cannot be restored — this tool reads format ${ARCHIVE_FORMAT_VERSION}.`,
+    );
+  }
+  if (manifest.schemaVersion !== SCHEMA_VERSION) {
+    throw new Error(
+      `Archive schema version ${manifest.schemaVersion} does not match this tool (${SCHEMA_VERSION}).`,
+    );
+  }
+  return { manifest, entries };
+}
+
+export function tableRows(entries: ArchiveEntries, table: string): Record<string, unknown>[] {
+  const raw = entries[`data/${table}.json`];
+  if (!raw) return [];
+  const parsed = JSON.parse(strFromU8(raw)) as unknown;
+  if (!Array.isArray(parsed)) throw new Error(`data/${table}.json is not an array`);
+  return parsed as Record<string, unknown>[];
+}
+
+export type PlannedTable = {
+  table: string;
+  spec: TableSpec;
+  insertOnly: boolean;
+  rows: Record<string, unknown>[];
+};
+
+export type PlanOptions = {
+  groups: string[];
+  mode: ImportMode;
+  /** Base URL that hosted media URLs are rewritten to. */
+  mediaBase?: string | null;
+  /** Keep restored tracking/code injections enabled (off by default). */
+  keepInjectionsEnabled?: boolean;
+};
+
+/** Ordered, prepared tables for a restore. Order follows IMPORT_ORDER. */
+export function planRestore(
+  entries: ArchiveEntries,
+  manifest: ArchiveManifest,
+  opts: PlanOptions,
+): PlannedTable[] {
+  const selected = opts.groups.filter((g) => (manifest.groups ?? []).includes(g));
+  const specs = new Map<string, { spec: TableSpec; insertOnly: boolean }>();
+  for (const id of selected) {
+    const group = groupById(id);
+    if (!group) continue;
+    for (const spec of group.tables) {
+      specs.set(spec.table, { spec, insertOnly: Boolean(group.insertOnly) });
+    }
+  }
+
+  const plan: PlannedTable[] = [];
+  for (const table of IMPORT_ORDER) {
+    const entry = specs.get(table);
+    if (!entry) continue;
+    const rows = tableRows(entries, table).map((row) => {
+      let out: Record<string, unknown> = opts.mediaBase
+        ? rewriteMediaUrls({ ...row }, opts.mediaBase)
+        : { ...row };
+      if (table === "site_injections") {
+        out = neutralizeInjection(out, Boolean(opts.keepInjectionsEnabled));
+      }
+      return out;
+    });
+    if (!rows.length) continue;
+    plan.push({ table, spec: entry.spec, insertOnly: entry.insertOnly, rows });
+  }
+  return plan;
+}
+
+/** Tables whose dataset file exists in the archive, even when it holds no rows. */
+export function datasetsPresent(entries: ArchiveEntries): Set<string> {
+  const out = new Set<string>();
+  for (const key of Object.keys(entries)) {
+    if (!key.startsWith("data/") || !key.endsWith(".json")) continue;
+    out.add(key.slice("data/".length).replace(/\.json$/, ""));
+  }
+  return out;
+}
+
+/**
+ * Tables in the plan whose declared dependencies are missing.
+ *
+ * A parent that was exported but happens to be empty is NOT missing: pass the
+ * archive's dataset set (or its manifest counts) so an empty-but-present
+ * parent still satisfies the requirement. Rows that actually point at an
+ * absent parent row are caught by `danglingReferences`.
+ */
+export function missingDependencies(
+  plan: PlannedTable[],
+  present?: Set<string> | Iterable<string>,
+): { table: string; missing: string[] }[] {
+  const exported = present ? new Set(present) : null;
+  const inPlan = new Set(plan.map((p) => p.table));
+  const out: { table: string; missing: string[] }[] = [];
+  for (const p of plan) {
+    const missing = (p.spec.requires ?? []).filter(
+      (t) => !inPlan.has(t) && !(exported?.has(t) ?? false),
+    );
+    if (missing.length) out.push({ table: p.table, missing });
+  }
+  return out;
+}
+
+/** Non-null foreign keys in the plan whose parent row is absent from the archive. */
+export function danglingReferences(
+  plan: PlannedTable[],
+  entries: ArchiveEntries,
+): { table: string; column: string; value: string; parent: string }[] {
+  const out: { table: string; column: string; value: string; parent: string }[] = [];
+  const parentIds = new Map<string, Set<string>>();
+  for (const p of plan) {
+    for (const ref of p.spec.references ?? []) {
+      const pk = ref.pk ?? "id";
+      const cacheKey = `${ref.table}.${pk}`;
+      let ids = parentIds.get(cacheKey);
+      if (!ids) {
+        ids = new Set(tableRows(entries, ref.table).map((r) => String(r[pk])));
+        parentIds.set(cacheKey, ids);
+      }
+      for (const row of p.rows) {
+        const value = row[ref.column];
+        if (value == null || value === "") continue;
+        if (!ids.has(String(value))) {
+          out.push({ table: p.table, column: ref.column, value: String(value), parent: ref.table });
+        }
+      }
+    }
+  }
+  return out;
+}
+
+/** True when the plan's order never places a child before its parent. */
+export function planOrderIsValid(plan: PlannedTable[]): boolean {
+  const seen = new Set<string>();
+  for (const p of plan) {
+    for (const req of p.spec.requires ?? []) {
+      if (!seen.has(req) && plan.some((q) => q.table === req)) return false;
+    }
+    seen.add(p.table);
+  }
+  return true;
+}
+
+/* --------------------------------------------------------------- lineage */
+
+export type LineageRow = { key: string; id: string };
+
+/**
+ * Compare business keys already in the target database with the archive.
+ * A key that exists under a different primary key means the archive comes
+ * from another database lineage and Merge would corrupt references.
+ */
+export function lineageClashes(
+  table: string,
+  spec: TableSpec,
+  incoming: Record<string, unknown>[],
+  existing: LineageRow[],
+): string[] {
+  const keyCol = LINEAGE_KEYS[table];
+  if (!keyCol || spec.pk === keyCol) return [];
+  const byKey = new Map(incoming.map((r) => [String(r[keyCol]), String(r[spec.pk])]));
+  const clashes: string[] = [];
+  for (const row of existing) {
+    const incomingId = byKey.get(row.key);
+    if (incomingId && incomingId !== row.id) clashes.push(`${table}.${keyCol}="${row.key}"`);
+  }
+  return clashes;
+}
+
+/* ------------------------------------------------------------------- SQL */
+
+export function quoteIdent(name: string): string {
+  if (!/^[a-z_][a-z0-9_]*$/i.test(name)) throw new Error(`Unsafe identifier: ${name}`);
+  return `"${name}"`;
+}
+
+export type Statement = { text: string; values: unknown[] };
+
+/** Columns present across the rows, in stable first-seen order. */
+export function columnsOf(rows: Record<string, unknown>[]): string[] {
+  const cols: string[] = [];
+  for (const row of rows) for (const k of Object.keys(row)) if (!cols.includes(k)) cols.push(k);
+  return cols;
+}
+
+function encode(value: unknown): unknown {
+  if (value instanceof Date) return value.toISOString();
+  if (value !== null && typeof value === "object") return JSON.stringify(toJsonSafe(value));
+  return value;
+}
+
+/**
+ * Turn a failed chunk insert into an actionable message: which table, which
+ * chunk, which columns, and which specific `table.column` values look wrong
+ * (an object where the database expects a scalar, e.g. `{}` for a timestamp).
+ */
+export function describeInsertFailure(
+  table: string,
+  chunkIndex: number,
+  rows: Record<string, unknown>[],
+  error: unknown,
+): string {
+  const cols = columnsOf(rows);
+  const message = error instanceof Error ? error.message : String(error);
+  const suspects: string[] = [];
+  for (const col of cols) {
+    for (const row of rows) {
+      const v = row[col];
+      if (v !== null && typeof v === "object" && !Array.isArray(v)) {
+        const empty = Object.keys(v as Record<string, unknown>).length === 0;
+        suspects.push(`${table}.${col}${empty ? " (empty object — lost value)" : " (object)"}`);
+        break;
+      }
+    }
+  }
+  const parts = [
+    `Insert failed on ${table} (chunk ${chunkIndex + 1}, ${rows.length} rows)`,
+    `columns: ${cols.join(", ")}`,
+  ];
+  if (suspects.length) parts.push(`suspect values: ${suspects.join(", ")}`);
+  parts.push(`postgres: ${message}`);
+  return parts.join("\n  ");
+}
+
+/**
+ * Build a parameterised INSERT for one chunk of rows.
+ * - insertOnly tables use DO NOTHING so customer data is never overwritten.
+ * - other tables upsert on their conflict target (business key when they have
+ *   one), which keeps primary keys stable across restores.
+ */
+export function buildInsert(
+  table: string,
+  spec: TableSpec,
+  rows: Record<string, unknown>[],
+  insertOnly: boolean,
+): Statement {
+  if (!rows.length) throw new Error("buildInsert called with no rows");
+  const cols = columnsOf(rows);
+  const quoted = cols.map(quoteIdent);
+  const values: unknown[] = [];
+  const tuples = rows.map((row) => {
+    const placeholders = cols.map((c) => {
+      values.push(encode(row[c] ?? null));
+      return `$${values.length}`;
+    });
+    return `(${placeholders.join(", ")})`;
+  });
+
+  const conflictCols = (spec.conflict ?? spec.pk).split(",").map((c) => quoteIdent(c.trim()));
+  const target = `(${conflictCols.join(", ")})`;
+  const updatable = cols.filter((c) => !conflictCols.includes(quoteIdent(c)));
+  const action =
+    insertOnly || !updatable.length
+      ? "DO NOTHING"
+      : `DO UPDATE SET ${updatable.map((c) => `${quoteIdent(c)} = EXCLUDED.${quoteIdent(c)}`).join(", ")}`;
+
+  return {
+    text:
+      `INSERT INTO public.${quoteIdent(table)} (${quoted.join(", ")}) VALUES ${tuples.join(", ")} ` +
+      `ON CONFLICT ${target} ${action}`,
+    values,
+  };
+}
+
+/** Deferred self-references (pages.current_version_id) written in a 2nd pass. */
+/**
+ * Columns whose value must survive the deferred UPDATE. The schema keeps
+ * `touch_*` BEFORE UPDATE triggers that would otherwise rewrite them, which
+ * would silently change migrated audit data. Restoring never needs superuser
+ * rights to disable triggers — it simply re-asserts the exported values.
+ */
+const PRESERVED_ON_UPDATE = ["updated_at", "updated_by"] as const;
+
+export function buildDeferredUpdates(planned: PlannedTable): Statement[] {
+  const cols = planned.spec.deferred ?? [];
+  if (!cols.length) return [];
+  const out: Statement[] = [];
+  for (const row of planned.rows) {
+    const set = cols.filter((c) => row[c] != null);
+    if (!set.length) continue;
+    for (const c of PRESERVED_ON_UPDATE) {
+      if (c in row && !set.includes(c)) set.push(c);
+    }
+    const values: unknown[] = [];
+    const assignments = set.map((c) => {
+      values.push(encode(row[c]));
+      return `${quoteIdent(c)} = $${values.length}`;
+    });
+    values.push(row[planned.spec.pk]);
+    out.push({
+      text: `UPDATE public.${quoteIdent(planned.table)} SET ${assignments.join(", ")} WHERE ${quoteIdent(planned.spec.pk)} = $${values.length}`,
+      values,
+    });
+  }
+  return out;
+}
+
+/** Statement used by Replace mode. Insert-only tables are never cleared. */
+export function buildClear(planned: PlannedTable): Statement | null {
+  if (planned.insertOnly) return null;
+  return { text: `DELETE FROM public.${quoteIdent(planned.table)}`, values: [] };
+}
+
+/* ------------------------------------------------------------ auth users */
+
+export type AuthUserRow = {
+  id: string;
+  email: string | null;
+  created_at?: string | null;
+  user_metadata?: Record<string, unknown> | null;
+};
+
+/**
+ * Plain PostgreSQL has no `auth.users`, so exported accounts are mapped into
+ * `public.app_users`, which owns every foreign key in the portable schema.
+ * UUIDs are preserved so existing references keep resolving.
+ */
+export function mapAuthUsersToAppUsers(users: AuthUserRow[]): Record<string, unknown>[] {
+  return users
+    .filter((u) => typeof u.id === "string" && u.id.length > 0)
+    .map((u) => ({
+      id: u.id,
+      email: u.email ?? null,
+      display_name:
+        (u.user_metadata && typeof u.user_metadata["display_name"] === "string"
+          ? (u.user_metadata["display_name"] as string)
+          : null) ??
+        (u.user_metadata && typeof u.user_metadata["full_name"] === "string"
+          ? (u.user_metadata["full_name"] as string)
+          : null),
+      created_at: u.created_at ?? new Date().toISOString(),
+    }));
+}
+
+/* ----------------------------------------------------------------- media */
+
+export type MediaEntry = { name: string; bytes: Uint8Array };
+
+/** Verified media staged out of the archive, plus everything rejected. */
+export function stageMedia(entries: ArchiveEntries): {
+  files: MediaEntry[];
+  quarantined: string[];
+  bytes: number;
+} {
+  const files: MediaEntry[] = [];
+  const quarantined: string[] = [];
+  let bytes = 0;
+  for (const [key, value] of Object.entries(entries)) {
+    if (!key.startsWith("media/")) continue;
+    const name = key.slice("media/".length);
+    if (!name) continue;
+    if (!isSafeArchivePath(name)) {
+      quarantined.push(`${name} (unsafe path)`);
+      continue;
+    }
+    const verdict = verifyMediaFile(name, value);
+    if (!verdict.ok) {
+      quarantined.push(`${name} (${verdict.reason})`);
+      continue;
+    }
+    files.push({ name, bytes: value });
+    bytes += value.byteLength;
+  }
+  return { files, quarantined, bytes };
+}
+
+/* ------------------------------------------------------------- analysis */
+
+export type AnalysisReport = {
+  manifest: ArchiveManifest;
+  tables: { table: string; rows: number; insertOnly: boolean; conflict: string }[];
+  media: { files: number; bytes: number; quarantined: string[] };
+  authUsers: number;
+  problems: string[];
+};
+
+export function analyzeArchive(bytes: Uint8Array, opts: PlanOptions): AnalysisReport {
+  const { manifest, entries } = readArchive(bytes);
+  const plan = planRestore(entries, manifest, opts);
+  const problems: string[] = [];
+  const present = datasetsPresent(entries);
+  for (const c of Object.keys(manifest.counts ?? {})) present.add(c);
+  for (const { table, missing } of missingDependencies(plan, present)) {
+    problems.push(`${table} depends on ${missing.join(", ")}, which is not in this restore.`);
+  }
+  for (const d of danglingReferences(plan, entries)) {
+    problems.push(
+      `${d.table}.${d.column} points at ${d.parent} "${d.value}", which is not in this restore.`,
+    );
+  }
+  if (!planOrderIsValid(plan))
+    problems.push("Import order places a child table before its parent.");
+  const known = new Set(DATASET_GROUPS.flatMap((g) => g.tables.map((t) => t.table)));
+  for (const key of Object.keys(entries)) {
+    if (!key.startsWith("data/")) continue;
+    const table = key.slice("data/".length).replace(/\.json$/, "");
+    if (table !== "auth_users" && !known.has(table))
+      problems.push(`Unknown table in archive: ${table}`);
+  }
+  const media = stageMedia(entries);
+  const authUsers = tableRows(entries, "auth_users").length;
+  return {
+    manifest,
+    tables: plan.map((p) => ({
+      table: p.table,
+      rows: p.rows.length,
+      insertOnly: p.insertOnly,
+      conflict: p.spec.conflict ?? p.spec.pk,
+    })),
+    media: { files: media.files.length, bytes: media.bytes, quarantined: media.quarantined },
+    authUsers,
+    problems,
+  };
+}

package/src/cms/shared-draft-store.ts

@@ -0,0 +1,66 @@
+/**
+ * Pending edits to shared content sections made from inside the page builder
+ * inspector. Kept in a module store so:
+ *  - the builder canvas can preview them live (pushed into the iframe), and
+ *  - Save / Publish on the page can flush them to the database in one go.
+ *
+ * Nothing here is destructive: flushing writes through the normal
+ * `saveContentSection` server function (append/upsert on content_sections).
+ */
+type Listener = (drafts: Record<string, unknown>) => void;
+
+const drafts: Record<string, unknown> = {};
+const listeners = new Set<Listener>();
+
+function emit() {
+  const snap = { ...drafts };
+  listeners.forEach((l) => l(snap));
+}
+
+export function setSharedDraft(key: string, value: unknown) {
+  drafts[key] = value;
+  emit();
+}
+
+export function clearSharedDraft(key: string) {
+  delete drafts[key];
+  emit();
+}
+
+export function clearAllSharedDrafts() {
+  for (const k of Object.keys(drafts)) delete drafts[k];
+  emit();
+}
+
+export function getSharedDrafts(): Record<string, unknown> {
+  return { ...drafts };
+}
+
+export function hasSharedDrafts() {
+  return Object.keys(drafts).length > 0;
+}
+
+export function subscribeSharedDrafts(l: Listener) {
+  listeners.add(l);
+  l({ ...drafts });
+  return () => {
+    listeners.delete(l);
+  };
+}
+
+/**
+ * Persist every pending shared-content edit. Returns the keys written.
+ */
+export async function flushSharedDrafts(
+  save: (args: { data: { key: string; data: unknown } }) => Promise<unknown>,
+): Promise<string[]> {
+  const entries = Object.entries(drafts);
+  const written: string[] = [];
+  for (const [key, data] of entries) {
+    await save({ data: { key, data } });
+    written.push(key);
+    delete drafts[key];
+  }
+  if (written.length) emit();
+  return written;
+}

package/src/cms/version-diff.ts

@@ -0,0 +1,89 @@
+import type { BlockInstance } from "../blocks/types";
+
+export type VersionChange = {
+  kind: "added" | "removed" | "edited" | "moved" | "shown" | "hidden";
+  blockType: string;
+  detail?: string;
+};
+
+function stableStringify(value: unknown): string {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  const obj = value as Record<string, unknown>;
+  const keys = Object.keys(obj).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+}
+
+/**
+ * Compare two block lists and produce a human-readable change list.
+ * Blocks are matched by id; falls back to index when ids are missing.
+ */
+export function diffBlocks(prev: BlockInstance[], next: BlockInstance[]): VersionChange[] {
+  const changes: VersionChange[] = [];
+  const prevById = new Map<string, { block: BlockInstance; index: number }>();
+  prev.forEach((block, index) => prevById.set(block.id ?? `#${index}`, { block, index }));
+  const nextIds = new Set<string>();
+
+  next.forEach((block, index) => {
+    const id = block.id ?? `#${index}`;
+    nextIds.add(id);
+    const before = prevById.get(id);
+    if (!before) {
+      changes.push({ kind: "added", blockType: block.type });
+      return;
+    }
+    const wasVisible = before.block.visible !== false;
+    const isVisible = block.visible !== false;
+    if (wasVisible !== isVisible) {
+      changes.push({ kind: isVisible ? "shown" : "hidden", blockType: block.type });
+    }
+    if ((before.block.name ?? "") !== (block.name ?? "")) {
+      changes.push({
+        kind: "edited",
+        blockType: block.type,
+        detail: `renamed to "${block.name || "(default)"}"`,
+      });
+    }
+    if (stableStringify(before.block.props ?? {}) !== stableStringify(block.props ?? {})) {
+      changes.push({
+        kind: "edited",
+        blockType: block.type,
+        detail: changedPropKeys(before.block, block),
+      });
+    }
+    if (before.index !== index) {
+      changes.push({
+        kind: "moved",
+        blockType: block.type,
+        detail: `position ${before.index + 1} → ${index + 1}`,
+      });
+    }
+  });
+
+  prev.forEach((block, index) => {
+    const id = block.id ?? `#${index}`;
+    if (!nextIds.has(id)) changes.push({ kind: "removed", blockType: block.type });
+  });
+
+  return changes;
+}
+
+function changedPropKeys(a: BlockInstance, b: BlockInstance): string | undefined {
+  const pa = (a.props ?? {}) as Record<string, unknown>;
+  const pb = (b.props ?? {}) as Record<string, unknown>;
+  const keys = Array.from(new Set([...Object.keys(pa), ...Object.keys(pb)]));
+  const changed = keys.filter((k) => stableStringify(pa[k]) !== stableStringify(pb[k]));
+  if (changed.length === 0) return undefined;
+  return (
+    changed.slice(0, 6).join(", ") + (changed.length > 6 ? `, +${changed.length - 6} more` : "")
+  );
+}
+
+export function summarizeChanges(changes: VersionChange[]): string {
+  if (changes.length === 0) return "No block changes";
+  const counts: Record<string, number> = {};
+  for (const c of changes) counts[c.kind] = (counts[c.kind] ?? 0) + 1;
+  return Object.entries(counts)
+    .map(([kind, n]) => `${n} ${kind}`)
+    .join(" · ");
+}