@bygghammar/cms-platform 0.80.1 → 0.90.0-m7.10

package/src/popups/runtime.tsx

@@ -0,0 +1,128 @@
+/**
+ * The Popups module's public-site integration.
+ *
+ * Importing this file registers the popup runtime with the module host, so a
+ * site enables popups by importing it once and switching the module on. It is
+ * the only popup entry a public bundle may reach: the builder, the statistics
+ * screen and the validator all live behind `./popups/admin`.
+ *
+ * Everything CMS-shaped is bridged here — the site's forms, its routing, its
+ * design tokens — so neither the popup package nor the site has to know about
+ * the other.
+ */
+import { useCallback, useEffect, useMemo, useRef } from "react";
+import type { ReactNode } from "react";
+import { useRouterState } from "@tanstack/react-router";
+import {
+  PopupRuntime,
+  withExcludedBase,
+} from "@bygghammar/lightweight-popup/runtime";
+import type {
+  FormRenderPort,
+  RuntimeAdapters,
+} from "@bygghammar/lightweight-popup/adapters";
+
+import { ManagedForm } from "../forms/FormRenderer";
+import { onFormSubmissionSuccess } from "../forms/success-listeners";
+import { siteConfig } from "../config/site-config";
+import type { PopupPublicHost } from "./host";
+import { popupPublicHost } from "./host";
+
+/**
+ * Renders one of the site's own forms inside a popup.
+ *
+ * `popupKey` goes into the submission itself, and that is the whole point of
+ * this component existing: without it the request is indistinguishable from
+ * the same form filled on an ordinary page, so the server stores an ordinary
+ * entry and every delivery configured on the popup quietly does nothing.
+ *
+ * Success comes from the CMS form seam rather than from this component, which
+ * is what makes a honeypot rejection impossible to miscount: the form runtime
+ * only announces submissions the host actually stored. That listener drives
+ * the popup's own flow and analytics — it is deliberately not a second way to
+ * deliver, because it would be delivering on the browser's word.
+ */
+function PopupForm({
+  popupKey,
+  formKey,
+  onSuccess,
+}: {
+  popupKey: string;
+  formKey: string;
+  onSuccess: () => void;
+}): ReactNode {
+  const latest = useRef(onSuccess);
+  latest.current = onSuccess;
+
+  useEffect(
+    () =>
+      onFormSubmissionSuccess((event) => {
+        if (event.formKey === formKey) latest.current();
+      }),
+    [formKey],
+  );
+
+  // The popup names itself here, in the popup module. The form renderer takes
+  // an opaque context and stays independent of the features that use it.
+  return <ManagedForm context={{ popupKey }} formKey={formKey} />;
+}
+
+/**
+ * Paths the runtime never displays on.
+ *
+ * Three sources, in one list. The site's own exclusions come first and are
+ * kept whole — this only ever adds to them. `/preview/**` is the platform's:
+ * a popup over the editor's live preview ends up in screenshots. The
+ * backoffice comes from the site's configured `backofficePath`, the same
+ * value `backofficePaths()` builds every backoffice address from, so a site
+ * that mounts its office at `/admin` or `/cms/backoffice` is covered without
+ * telling anyone twice.
+ *
+ * The popup package deliberately excludes nothing by itself. It cannot know
+ * which of a site's paths are private, and when it used to guess, every site
+ * whose office was named differently got popups over its own admin screens.
+ */
+export function popupExcludedPaths(
+  host: Pick<PopupPublicHost, "excludedPaths">,
+  backofficePath: string,
+): readonly string[] {
+  return withExcludedBase(
+    [...(host.excludedPaths ?? []), "/preview/**"],
+    backofficePath,
+  );
+}
+
+export function PopupModuleRuntime(): ReactNode {
+  const path = useRouterState({ select: (state) => state.location.pathname });
+  const host = popupPublicHost();
+
+  // The argument type comes from the port, not a copy of it: a package that
+  // stopped supplying `popupKey` would fail to compile here rather than
+  // quietly go back to submitting forms with no identity.
+  const renderForm = useCallback<FormRenderPort["renderForm"]>(
+    ({ popupKey, formKey, onSuccess }) => (
+      <PopupForm popupKey={popupKey} formKey={formKey} onSuccess={onSuccess} />
+    ),
+    [],
+  );
+
+  const adapters = useMemo<RuntimeAdapters>(
+    () => ({
+      configs: host.configs,
+      analytics: host.analytics,
+      forms: { renderForm },
+    }),
+    [host, renderForm],
+  );
+
+  return (
+    <PopupRuntime
+      path={path}
+      adapters={adapters}
+      excludedPaths={popupExcludedPaths(host, siteConfig().backofficePath)}
+    />
+  );
+}
+
+// Default export so the module host can load this file lazily.
+export default PopupModuleRuntime;

package/src/runtime/server-entry.ts

@@ -31,6 +31,11 @@ export type ServerEntryOptions = {
    * enters the SSR module graph for sites that do not use it.
    */
   injections?: () => Promise<SiteCodeInjections>;
+  /**
+   * The site's backoffice path, so a site that moved it off the default still
+   * keeps tracking code out of its admin pages.
+   */
+  backofficePath?: string;
 };
 
 type ServerEntry = {
@@ -86,6 +91,7 @@ async function injectSiteCode(
   request: Request,
   response: Response,
   load: () => Promise<SiteCodeInjections>,
+  backofficePath: string | undefined,
 ): Promise<Response> {
   if (response.status >= 400) return response;
   const contentType = response.headers.get("content-type") ?? "";
@@ -94,7 +100,7 @@ async function injectSiteCode(
   try {
     const injections = await load();
     const url = new URL(request.url);
-    if (!injections.isInjectablePath(url.pathname)) return response;
+    if (!injections.isInjectablePath(url.pathname, backofficePath)) return response;
 
     const bundle = await injections.resolve(url.host);
     if (!bundle.head && !bundle.bodyStart && !bundle.bodyEnd) return response;
@@ -118,7 +124,7 @@ export function createServerEntry(options: ServerEntryOptions = {}) {
         const response = await handler.fetch(request, env, ctx);
         const normalized = await normalizeCatastrophicSsrResponse(response);
         const injected = options.injections
-          ? await injectSiteCode(request, normalized, options.injections)
+          ? await injectSiteCode(request, normalized, options.injections, options.backofficePath)
           : normalized;
         return await applyEdgeHeaders(request, injected, { compress: compressionEnabled() });
       } catch (error) {

package/src/server/content-sections-core.ts

@@ -9,6 +9,8 @@
 
 import type { Json } from "../i18n/json";
 import { stampManualEdits } from "../i18n/translation-meta";
+import { EDIT_LOCK_TYPES } from "../cms/edit-lock";
+import { assertEditable } from "./edit-locks-core";
 import { assertStaff, type PlatformAuthContext } from "./guards";
 import { auditAs } from "./audit-core";
 
@@ -25,8 +27,12 @@ export type ContentOverrides = Record<string, Json>;
  * Never throws: a backend hiccup degrades to "no overrides" so the site still
  * renders its in-code defaults.
  */
-export async function getContentOverridesCore(client: ContentClient): Promise<ContentOverrides> {
-  const { data, error } = await client.from("content_sections").select("key, data");
+export async function getContentOverridesCore(
+  client: ContentClient,
+): Promise<ContentOverrides> {
+  const { data, error } = await client
+    .from("content_sections")
+    .select("key, data");
   if (error) {
     console.error("[cms] getContentOverrides", error);
     return {};
@@ -37,8 +43,12 @@ export async function getContentOverridesCore(client: ContentClient): Promise<Co
 }
 
 /** True when the caller passes the host's `is_staff` check. */
-export async function isStaffCore(context: PlatformAuthContext): Promise<boolean> {
-  const { data, error } = await context.supabase.rpc("is_staff", { _user_id: context.userId });
+export async function isStaffCore(
+  context: PlatformAuthContext,
+): Promise<boolean> {
+  const { data, error } = await context.supabase.rpc("is_staff", {
+    _user_id: context.userId,
+  });
   if (error) throw new Error(error.message);
   return Boolean(data);
 }
@@ -50,9 +60,16 @@ export async function isStaffCore(context: PlatformAuthContext): Promise<boolean
  */
 export async function saveContentSectionCore(
   context: PlatformAuthContext & { supabase: ContentClient },
-  input: { key: string; data?: unknown },
+  input: { key: string; data?: unknown; editSessionId?: string },
 ): Promise<{ ok: true; key: string }> {
   await assertStaff(context);
+  // Navigation, the footer, shared content and contact details are all rows in
+  // this table, so one check covers every editor built on top of it.
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.contentSection,
+    resourceId: input.key,
+    sessionId: input.editSessionId,
+  });
 
   const { data: prevRow } = await context.supabase
     .from("content_sections")

package/src/server/domains-core.ts

@@ -1,39 +1,36 @@
 /**
- * Host-agnostic logic for locale → domain mapping (`locale_domains`).
+ * Host-agnostic database logic for locale → domain mapping (`locale_domains`).
  *
  * Reads use a privileged client because the table reveals which hostname serves
- * the backoffice; writes run as the signed-in staff user. The host owns the
- * server functions, its locale union and the request headers.
+ * the backoffice; writes run as the signed-in admin, matching the table's own
+ * row-level policies. The host owns the server functions, its locale union and
+ * the request headers.
+ *
+ * The routing itself — matching, the public projection, and which hostname
+ * serves the backoffice — is pure and lives in `src/site/locale-domains.ts`,
+ * re-exported here so server callers keep one import.
  */
 
-import { assertStaff, type PlatformAuthContext } from "./guards";
+import { assertRole, type PlatformAuthContext } from "./guards";
 import { auditAs } from "./audit-core";
+import {
+  canonicalDomainProblemMessage,
+  parseCanonicalDomain,
+} from "../site/host";
+import {
+  domainChangeProblemMessage,
+  validateDomainChange,
+  type AdminDomainChange,
+  type LocaleDomainRecord,
+} from "../site/locale-domains";
+
+export * from "../site/locale-domains";
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /** Structural subset of a Supabase-shaped client used by this core. */
 export type DomainsClient = { from: (table: string) => any };
 /* eslint-enable @typescript-eslint/no-explicit-any */
 
-export type LocaleDomainRecord = {
-  locale: string;
-  domain: string;
-  isDefault: boolean;
-  isAdminDomain: boolean;
-};
-
-/** Strip protocol, trailing slashes and casing from a stored domain. */
-export function normalizeDomain(domain: string): string {
-  return domain
-    .replace(/^https?:\/\//, "")
-    .replace(/\/+$/, "")
-    .toLowerCase();
-}
-
-/** Strip a leading `www.` and casing from a request host. */
-export function normalizeHost(host: string): string {
-  return host.replace(/^www\./, "").toLowerCase();
-}
-
 function rowToDomain(row: {
   locale: string;
   domain: string;
@@ -58,115 +55,127 @@ export async function listLocaleDomainsCore(client: DomainsClient): Promise<Loca
   return (data ?? []).map(rowToDomain);
 }
 
-/** The mapping whose domain matches `host`, ignoring protocol and `www.`. */
-export function matchDomain(
-  domains: LocaleDomainRecord[],
-  host: string,
-): LocaleDomainRecord | undefined {
-  const normalizedHost = normalizeHost(host);
-  return domains.find((d) => {
-    const normalized = normalizeDomain(d.domain);
-    return normalizedHost === normalized || normalizedHost === `www.${normalized}`;
-  });
-}
-
 /**
- * Resolve the active locale for a request host, falling back to the default
- * mapping, then to the first mapping, then to a synthetic host-based record.
+ * Refuse a change the table must not be left in after.
+ *
+ * The current rows are read here rather than accepted from the caller. A host
+ * that forgot to pass them would otherwise skip every check silently, and the
+ * checks exist for cases — two languages on aliases of one hostname, a table
+ * left with no default — that a screen can prevent but only the database can
+ * actually know about at the moment of writing.
  */
-export function resolveRequestLocale(
-  domains: LocaleDomainRecord[],
-  host: string,
-  defaultLocale: string,
-): { locale: string; domain: LocaleDomainRecord } {
-  const match = matchDomain(domains, host);
-  if (match) return { locale: match.locale, domain: match };
-
-  const fallback = domains.find((d) => d.isDefault) ??
-    domains[0] ?? {
-      locale: defaultLocale,
-      domain: host || "localhost",
-      isDefault: true,
-      isAdminDomain: true,
-    };
-  return { locale: fallback.locale, domain: fallback };
+async function assertChangeIsAllowed(
+  client: DomainsClient,
+  change: AdminDomainChange,
+  options: { siteUrlAuthoritative: boolean; invalidDomainMessage?: string },
+): Promise<void> {
+  const problem = validateDomainChange(await listLocaleDomainsCore(client), change, {
+    siteUrlAuthoritative: options.siteUrlAuthoritative,
+  });
+  if (!problem) return;
+  if (problem.reason === "invalid-domain" && options.invalidDomainMessage) {
+    throw new Error(options.invalidDomainMessage);
+  }
+  throw new Error(domainChangeProblemMessage(problem));
 }
 
+export type SaveLocaleDomainOptions = {
+  /** Host-supplied message replacing the generic rejection text. */
+  invalidDomainMessage?: string;
+  /** `SITE_URL`'s hostname, when this install has one. */
+  forcedHost?: string | null;
+};
+
+export type DeleteLocaleDomainOptions = {
+  /** `SITE_URL`'s hostname, when this install has one. */
+  forcedHost?: string | null;
+};
+
 /**
- * The domain that serves the backoffice.
+ * Whether `SITE_URL` — not the table — decides where the backoffice is.
  *
- * `forcedHost` (a self-host `SITE_URL`) is authoritative: an imported row from
- * another deployment must never send the backoffice to that other hostname.
- * Otherwise the flagged database row wins, and the request host is last resort.
+ * The value is checked exactly as it was configured, before any normalizing.
+ * Normalizing first strips the scheme, so `ftp://example.com` becomes the
+ * perfectly valid `example.com` and a `SITE_URL` nobody can serve is treated
+ * as authoritative. That is not a cosmetic mistake: authority here switches
+ * off the lockout check below, so a malformed `SITE_URL` would let an admin
+ * domain of `localhost` be saved on an install where the flag is still what
+ * routes the backoffice — and the next administrator to sign out could not
+ * get back in.
  */
-export function resolveAdminDomain(
-  domains: LocaleDomainRecord[],
-  options: { forcedHost?: string | null; requestHost?: string | null; defaultLocale: string },
-): LocaleDomainRecord {
-  const dbAdmin = domains.find((d) => d.isAdminDomain) ?? domains[0];
-
-  if (options.forcedHost) {
-    return {
-      locale: dbAdmin?.locale ?? options.defaultLocale,
-      domain: options.forcedHost,
-      isDefault: dbAdmin?.isDefault ?? true,
-      isAdminDomain: true,
-    };
-  }
-  if (dbAdmin) return dbAdmin;
-  return {
-    locale: options.defaultLocale,
-    domain: options.requestHost || "localhost",
-    isDefault: true,
-    isAdminDomain: true,
-  };
-}
-
-/** Absolute origin for a locale, or "" when the locale has no mapping. */
-export function resolveLocaleOrigin(locale: string, domains: LocaleDomainRecord[]): string {
-  const match = domains.find((d) => d.locale === locale);
-  if (!match) return "";
-  return `https://${normalizeDomain(match.domain)}`;
+function siteUrlDecides(forcedHost: string | null | undefined): boolean {
+  return parseCanonicalDomain(forcedHost ?? "").ok;
 }
 
 /**
- * Staff-only upsert of one mapping. Keeps at most one default and one admin
- * domain by clearing the flags on every other locale first.
+ * Admin-only upsert of one mapping, matching the table's row-level policies.
+ * Keeps at most one default and one admin domain by clearing the flags on
+ * every other locale afterwards.
+ *
+ * The order is deliberate. There is no transaction here, so the row being
+ * saved is written first and the flags elsewhere are cleared only once it
+ * exists: an upsert that fails then changes nothing, instead of stripping the
+ * default or the admin domain off the rows that still hold it. Every statement
+ * is checked, and the audit entry is written only after all of them succeeded,
+ * so the log never claims a change that half happened. A later migration can
+ * make this atomic; until then this is the order that fails safely.
  */
 export async function saveLocaleDomainCore(
   context: PlatformAuthContext & { supabase: DomainsClient },
   input: { locale: string; domain: string; isDefault: boolean; isAdminDomain: boolean },
-  options: { invalidDomainMessage?: string } = {},
+  options: SaveLocaleDomainOptions = {},
 ): Promise<{ ok: true }> {
-  await assertStaff(context);
+  await assertRole(context, "admin");
+
+  const parsed = parseCanonicalDomain(input.domain);
+  if (!parsed.ok) {
+    throw new Error(
+      options.invalidDomainMessage ?? canonicalDomainProblemMessage(parsed.reason),
+    );
+  }
+  const normalized = parsed.domain;
+
+  await assertChangeIsAllowed(
+    context.supabase,
+    {
+      kind: "save",
+      locale: input.locale,
+      domain: normalized,
+      isDefault: input.isDefault,
+      isAdminDomain: input.isAdminDomain,
+    },
+    {
+      siteUrlAuthoritative: siteUrlDecides(options.forcedHost),
+      invalidDomainMessage: options.invalidDomainMessage,
+    },
+  );
 
-  const normalized = normalizeDomain(input.domain);
-  if (!normalized) throw new Error(options.invalidDomainMessage ?? "Invalid domain");
+  const upserted = await context.supabase.from("locale_domains").upsert(
+    {
+      locale: input.locale,
+      domain: normalized,
+      is_default: input.isDefault,
+      is_admin_domain: input.isAdminDomain,
+    },
+    { onConflict: "locale" },
+  );
+  if (upserted.error) throw new Error(upserted.error.message);
 
   if (input.isDefault) {
-    await context.supabase
+    const cleared = await context.supabase
       .from("locale_domains")
       .update({ is_default: false })
       .neq("locale", input.locale);
+    if (cleared.error) throw new Error(cleared.error.message);
   }
   if (input.isAdminDomain) {
-    await context.supabase
+    const cleared = await context.supabase
       .from("locale_domains")
       .update({ is_admin_domain: false })
       .neq("locale", input.locale);
+    if (cleared.error) throw new Error(cleared.error.message);
   }
 
-  const { error } = await context.supabase.from("locale_domains").upsert(
-    {
-      locale: input.locale,
-      domain: normalized,
-      is_default: input.isDefault,
-      is_admin_domain: input.isAdminDomain,
-    },
-    { onConflict: "locale" },
-  );
-  if (error) throw new Error(error.message);
-
   await auditAs(context as never, {
     action: "domain.save",
     entity: "locale_domains",
@@ -181,12 +190,20 @@ export async function saveLocaleDomainCore(
   return { ok: true };
 }
 
-/** Staff-only delete of one mapping. */
+/** Admin-only delete of one mapping. */
 export async function deleteLocaleDomainCore(
   context: PlatformAuthContext & { supabase: DomainsClient },
   locale: string,
+  options: DeleteLocaleDomainOptions = {},
 ): Promise<{ ok: true }> {
-  await assertStaff(context);
+  await assertRole(context, "admin");
+
+  await assertChangeIsAllowed(
+    context.supabase,
+    { kind: "delete", locale },
+    { siteUrlAuthoritative: siteUrlDecides(options.forcedHost) },
+  );
+
   const { error } = await context.supabase.from("locale_domains").delete().eq("locale", locale);
   if (error) throw new Error(error.message);
   await auditAs(context as never, {

package/src/server/edit-lock-adapter.ts

@@ -0,0 +1,91 @@
+/**
+ * The host-facing contract for editing locks.
+ *
+ * `edit-locks-core` expresses *what* it needs — take this lock, tell me who
+ * holds it, give it back — and nothing about how a host stores it. An
+ * application on ordinary PostgreSQL implements these five methods with
+ * whatever it already uses (`pg`, Kysely, Drizzle, a stored function, an HTTP
+ * service); an application on Supabase gets the same thing prebuilt from
+ * `createSupabaseEditLockAdapter`. Neither has to know the other exists.
+ *
+ * Two rules keep an adapter honest:
+ *
+ * 1. `acquire` must be **one atomic statement**. Two editors opening the same
+ *    resource in the same instant have to contend on a unique index, so
+ *    exactly one wins. A read-then-write leaves a window where both do — which
+ *    is the whole failure this feature exists to prevent.
+ * 2. `sessionId` is a bearer token. Never return it to a caller, and never
+ *    expose the column that stores it to ordinary clients.
+ */
+import type { EditLockRef, EditLockState } from "../cms/edit-lock";
+
+/** One live lock as an administrator sees it. Note the absent `session_id`. */
+export type EditLockRow = {
+  resource_type: string;
+  resource_id: string;
+  user_id: string;
+  user_email: string | null;
+  user_name: string | null;
+  acquired_at: string;
+  refreshed_at: string;
+  expires_at: string;
+};
+
+/** Take a lock, extend one, or take it over. `ttlSeconds` arrives clamped. */
+export type EditLockAcquireInput = EditLockRef & {
+  sessionId: string;
+  ttlSeconds: number;
+  /** Take it from whoever holds it. An adapter must refuse a non-superadmin. */
+  steal: boolean;
+};
+
+/** Read a lock. A null `sessionId` asks "is anyone holding this at all". */
+export type EditLockStatusInput = EditLockRef & { sessionId: string | null };
+
+/** Give a lock back. Only the holder's own session may succeed. */
+export type EditLockReleaseInput = EditLockRef & { sessionId: string };
+
+/**
+ * Raised by an adapter when this installation has no lock storage yet.
+ *
+ * A CMS that upgrades the package before it upgrades its database must keep
+ * saving exactly as it did, so the core treats this one error as "no locks
+ * configured" and lets the write through. Every other failure surfaces.
+ */
+export class EditLockNotInstalledError extends Error {
+  readonly code = "edit_lock_not_installed" as const;
+  constructor(message = "Editing locks are not installed on this database") {
+    super(message);
+    this.name = "EditLockNotInstalledError";
+  }
+}
+
+/** What a host application supplies to make editing locks work. */
+export type EditLockAdapter = {
+  /**
+   * Throw unless the acting user may use the backoffice at all.
+   *
+   * Defence in depth: storage is expected to enforce this too, and an adapter
+   * whose storage already does may implement this as a no-op deliberately.
+   */
+  assertStaff(): Promise<void>;
+  acquire(input: EditLockAcquireInput): Promise<EditLockState>;
+  status(input: EditLockStatusInput): Promise<EditLockState>;
+  /** True when a row was actually removed. */
+  release(input: EditLockReleaseInput): Promise<boolean>;
+  list(): Promise<EditLockRow[]>;
+};
+
+/** A request context that carries its own lock storage. */
+export type EditLockHostContext = { editLocks: EditLockAdapter };
+
+export function hasEditLockAdapter(
+  context: unknown,
+): context is EditLockHostContext {
+  return (
+    !!context &&
+    typeof context === "object" &&
+    typeof (context as EditLockHostContext).editLocks === "object" &&
+    (context as EditLockHostContext).editLocks !== null
+  );
+}