@bygghammar/cms-platform 0.80.1 → 0.90.0-m7.10

package/src/server/injections-core.ts

@@ -9,14 +9,19 @@
 
 import {
   EMPTY_BUNDLE,
+  MISSING_CREATED_ID,
   mergeBundles,
   normalizeHostname,
   selectProfiles,
   type InjectionBundle,
   type InjectionProfile,
 } from "../tracking/injections";
+import { resolveRequestLocale } from "../site/locale-domains";
 import { actorEmail, assertRole, type PlatformAuthContext } from "./guards";
 
+/** Re-exported so hosts that already import it from here keep working. */
+export { MISSING_CREATED_ID };
+
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /** Structural subset of a Supabase-shaped client used by this core. */
 export type InjectionsClient = { from: (table: string) => any };
@@ -89,11 +94,76 @@ function toRow(input: InjectionInput) {
   };
 }
 
+/** Where a failure gets reported. Defaults to `console.error`. */
+export type InjectionsLogger = (message: string, error: unknown) => void;
+
+const defaultLogger: InjectionsLogger = (message, error) => {
+  console.error(message, error);
+};
+
+/**
+ * Report a failure without letting the report become one.
+ *
+ * Everywhere this is called the outcome has already been decided: the row is
+ * written, or the request is about to be served an empty bundle so the page
+ * still renders. A logger that throws would undo that decision at the very
+ * last step — an injected reporter whose transport is down turns a completed
+ * create into a rejection the screen reads as "press Save again", and a
+ * degraded render into a 500 on a public page. The report is worth less than
+ * either.
+ *
+ * So the supplied logger is tried, then `console.error` on its own, and then
+ * the reporting failure is dropped, because at that point there is nothing
+ * left that can be told.
+ */
+function reportBestEffort(logger: InjectionsLogger, message: string, error: unknown): void {
+  try {
+    logger(message, error);
+  } catch (loggerError) {
+    try {
+      console.error(message, error);
+      console.error("[cms] injection logger failed", loggerError);
+    } catch {
+      // The console is gone too. Nothing here is worth the caller's outcome.
+    }
+  }
+}
+
+/**
+ * Write the audit entry, and let the mutation stand if that write fails.
+ *
+ * By the time this runs the row is already inserted, updated or deleted. A
+ * rejection here would hand the caller an ordinary failure for a change that
+ * did happen, and the obvious response to an ordinary failure — press Save
+ * again — inserts a second profile. Auditing is best-effort across this
+ * package for exactly that reason: the trail is worth less than the
+ * correctness of what it describes.
+ *
+ * The failure is reported rather than swallowed, so a host that has lost its
+ * audit table finds out from its logs instead of from the empty table.
+ */
+async function auditBestEffort(
+  audit: AuditWriter,
+  entry: Parameters<AuditWriter>[0],
+  logger: InjectionsLogger,
+): Promise<void> {
+  try {
+    await audit(entry);
+  } catch (error) {
+    reportBestEffort(
+      logger,
+      `[cms] injection audit failed for ${entry.action} ${entry.entityId}`,
+      error,
+    );
+  }
+}
+
 /** Admin-only create/update of one profile, with an audit entry. */
 export async function saveInjectionCore(
   context: PlatformAuthContext & { supabase: InjectionsClient },
   input: InjectionInput,
   audit: AuditWriter,
+  logger: InjectionsLogger = defaultLogger,
 ): Promise<{ id: string }> {
   await assertRole(context, "admin");
   const row = toRow(input);
@@ -105,14 +175,19 @@ export async function saveInjectionCore(
       .update(row)
       .eq("id", input.id);
     if (error) throw new Error(error.message);
-    await audit({
-      actorId: context.userId,
-      actorEmail: actorEmail(context),
-      action: "injection.update",
-      entity: "site_injections",
-      entityId: input.id,
-      meta: { name: input.name, scope, enabled: input.enabled },
-    });
+    await auditBestEffort(
+      audit,
+      {
+        actorId: context.userId,
+        actorEmail: actorEmail(context),
+        action: "injection.update",
+        entity: "site_injections",
+        entityId: input.id,
+        meta: { name: input.name, scope, enabled: input.enabled },
+      },
+      logger,
+    );
+    invalidateInjectionCache();
     return { id: input.id };
   }
 
@@ -122,15 +197,35 @@ export async function saveInjectionCore(
     .select("id")
     .single();
   if (error) throw new Error(error.message);
-  const id = String(inserted?.id ?? "");
-  await audit({
-    actorId: context.userId,
-    actorEmail: actorEmail(context),
-    action: "injection.create",
-    entity: "site_injections",
-    entityId: id || null,
-    meta: { name: input.name, scope },
-  });
+  const id = String(inserted?.id ?? "").trim();
+  /*
+   * No id means the insert cannot be reported as a success.
+   *
+   * Whether the row exists is now unknown, and everything below this line
+   * states that it does: an audit entry naming no entity, a cache invalidation
+   * announcing a change, and a `{ id: "" }` the caller reads as "created".
+   * Throwing before any of them leaves one indeterminate insert to reconcile
+   * rather than a trail of confident records about a row nobody can find.
+   */
+  if (!id) throw new Error(MISSING_CREATED_ID);
+  /*
+   * The row exists and its id is in hand. Nothing after this point may take
+   * that away from the caller: a create reported as failed is a create the
+   * administrator will send again, and the second one is a duplicate.
+   */
+  await auditBestEffort(
+    audit,
+    {
+      actorId: context.userId,
+      actorEmail: actorEmail(context),
+      action: "injection.create",
+      entity: "site_injections",
+      entityId: id,
+      meta: { name: input.name, scope },
+    },
+    logger,
+  );
+  invalidateInjectionCache();
   return { id };
 }
 
@@ -139,29 +234,76 @@ export async function deleteInjectionCore(
   context: PlatformAuthContext & { supabase: InjectionsClient },
   id: string,
   audit: AuditWriter,
+  logger: InjectionsLogger = defaultLogger,
 ): Promise<{ ok: true }> {
   await assertRole(context, "admin");
   const { error } = await context.supabase.from("site_injections").delete().eq("id", id);
   if (error) throw new Error(error.message);
-  await audit({
-    actorId: context.userId,
-    actorEmail: actorEmail(context),
-    action: "injection.delete",
-    entity: "site_injections",
-    entityId: id,
-    meta: {},
-  });
+  await auditBestEffort(
+    audit,
+    {
+      actorId: context.userId,
+      actorEmail: actorEmail(context),
+      action: "injection.delete",
+      entity: "site_injections",
+      entityId: id,
+      meta: {},
+    },
+    logger,
+  );
+  invalidateInjectionCache();
   return { ok: true };
 }
 
 /* ---------------- Request-time resolution ---------------- */
 
 const CACHE_TTL_MS = 30_000;
+/**
+ * Bound on distinct hosts held at once. The cache key is a request header, so
+ * an unbounded map is something a stranger can grow; past the cap the oldest
+ * entries go, which for a real site is never reached.
+ */
+const CACHE_MAX_ENTRIES = 64;
 const cache = new Map<string, { at: number; bundle: InjectionBundle }>();
 
+/** Drop cached bundles — all of them, or just one host's. */
+export function invalidateInjectionCache(host?: string): void {
+  if (host === undefined) {
+    cache.clear();
+    return;
+  }
+  cache.delete(normalizeHostname(host));
+}
+
+function remember(key: string, bundle: InjectionBundle): void {
+  const now = Date.now();
+  for (const [host, entry] of cache) {
+    if (now - entry.at >= CACHE_TTL_MS) cache.delete(host);
+  }
+  while (cache.size >= CACHE_MAX_ENTRIES) {
+    const oldest = cache.keys().next();
+    if (oldest.done) break;
+    cache.delete(oldest.value);
+  }
+  cache.set(key, { at: now, bundle });
+}
+
+export type ResolveInjectionsOptions = {
+  defaultLocale?: string;
+  /** Reports a backend failure. Without one, failures reach `console.error`. */
+  logger?: InjectionsLogger;
+};
+
 /**
- * Resolve the merged bundle for a request host. Never throws: a backend hiccup
- * degrades to "no injection" so the site still renders.
+ * Resolve the merged bundle for a request host.
+ *
+ * Never throws: a backend hiccup degrades to "no injection" so the site still
+ * renders. It is not, however, allowed to do that *quietly* — a failed read is
+ * reported and is NOT cached, so the next request retries instead of serving
+ * a fabricated empty bundle for the rest of the TTL. A query that returns an
+ * error rather than throwing counts as a failure; that is the shape this
+ * backend uses, and treating it as "no profiles" is what made a broken
+ * deployment indistinguishable from an unconfigured one.
  *
  * `client` must be a privileged (service-role) client — `site_injections` and
  * `locale_domains` are not readable anonymously.
@@ -169,55 +311,94 @@ const cache = new Map<string, { at: number; bundle: InjectionBundle }>();
 export async function resolveInjectionsCore(
   client: InjectionsClient,
   host: string,
-  options: { defaultLocale?: string } = {},
+  options: ResolveInjectionsOptions = {},
 ): Promise<InjectionBundle> {
   const key = normalizeHostname(host);
   const hit = cache.get(key);
   if (hit && Date.now() - hit.at < CACHE_TTL_MS) return hit.bundle;
 
-  let bundle = EMPTY_BUNDLE;
+  const log = options.logger ?? defaultLogger;
   try {
-    const [{ data: rows }, { data: domains }] = await Promise.all([
+    const [profileResult, domainResult] = await Promise.all([
       client.from("site_injections").select("*").eq("enabled", true),
       client.from("locale_domains").select("locale, domain, is_default"),
     ]);
 
-    if (rows && rows.length > 0) {
-      const list = (domains ?? []) as { locale: string; domain: string; is_default: boolean }[];
-      const match = list.find((d) => normalizeHostname(d.domain) === key);
-      const fallback = list.find((d) => d.is_default);
-      const locale = match?.locale ?? fallback?.locale ?? options.defaultLocale ?? "en";
-      const profiles = (rows as Record<string, unknown>[]).map(rowToInjectionProfile);
-      bundle = mergeBundles(selectProfiles(profiles, locale, host));
+    if (profileResult?.error) throw new Error(String(profileResult.error.message ?? profileResult.error));
+    if (domainResult?.error) throw new Error(String(domainResult.error.message ?? domainResult.error));
+
+    const rows = (profileResult?.data ?? []) as Record<string, unknown>[];
+    if (rows.length === 0) {
+      remember(key, EMPTY_BUNDLE);
+      return EMPTY_BUNDLE;
     }
-  } catch {
-    bundle = EMPTY_BUNDLE;
+
+    const list = ((domainResult?.data ?? []) as {
+      locale: string;
+      domain: string;
+      is_default: boolean;
+    }[]).map((d) => ({ locale: d.locale, domain: d.domain, isDefault: d.is_default }));
+
+    const { locale } = resolveRequestLocale(list, host, options.defaultLocale ?? "en");
+    const bundle = mergeBundles(selectProfiles(rows.map(rowToInjectionProfile), locale, host));
+    remember(key, bundle);
+    return bundle;
+  } catch (error) {
+    reportBestEffort(log, "site code injection: could not resolve tracking profiles", error);
+    return EMPTY_BUNDLE;
   }
+}
 
-  cache.set(key, { at: Date.now(), bundle });
-  return bundle;
+/** A path reduced to `/a/b`: leading slash, no trailing one, no query. */
+function normalizePath(value: string): string {
+  const path = (value ?? "").split(/[?#]/)[0] ?? "";
+  const withSlash = path.startsWith("/") ? path : `/${path}`;
+  return withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+}
+
+/**
+ * Whether `pathname` is `prefix` itself or something beneath it.
+ *
+ * Compared segment by segment rather than by string prefix, because
+ * `/administrator` is a public page and `startsWith("/admin")` called it part
+ * of the backoffice — a site whose backoffice lives at `/admin` then silently
+ * lost tracking on every page whose path merely began with those letters.
+ */
+function isPathWithin(pathname: string, prefix: string): boolean {
+  const path = normalizePath(pathname);
+  const base = normalizePath(prefix);
+  if (base === "/") return true;
+  return path === base || path.startsWith(`${base}/`);
 }
 
 /** True for paths that must never receive tracking code. */
 export function isInjectablePath(pathname: string, backofficePath = "/kontoret"): boolean {
-  if (pathname.startsWith(backofficePath)) return false;
-  if (pathname.startsWith("/preview")) return false;
-  if (pathname.startsWith("/api")) return false;
-  if (pathname.startsWith("/_serverFn")) return false;
-  return true;
+  const excluded = [backofficePath, "/preview", "/api", "/_serverFn"];
+  return !excluded.some((prefix) => isPathWithin(pathname, prefix));
 }
 
-/** Insert the bundle's three chunks into a rendered HTML document. */
+/**
+ * Insert the bundle's three chunks into a rendered HTML document.
+ *
+ * Every insertion goes through a replacement *function*, never a replacement
+ * string. A string replacement is not a literal: `String.prototype.replace`
+ * reads `$&`, `` $` ``, `$'` and `$$` out of it and substitutes parts of the
+ * match. Administrator code is raw by design — a snippet containing `$&`
+ * (jQuery, a currency template, a regex in a tracker) would be silently
+ * rewritten into the matched tag, shipping something the administrator never
+ * wrote. A function's return value is used verbatim, so the injected bytes are
+ * exactly the bytes that were saved.
+ */
 export function applyInjections(html: string, bundle: InjectionBundle): string {
   let out = html;
   if (bundle.head && out.includes("</head>")) {
-    out = out.replace("</head>", `${bundle.head}</head>`);
+    out = out.replace("</head>", () => `${bundle.head}</head>`);
   }
   if (bundle.bodyStart) {
     out = out.replace(/<body([^>]*)>/i, (m) => `${m}${bundle.bodyStart}`);
   }
   if (bundle.bodyEnd && out.includes("</body>")) {
-    out = out.replace("</body>", `${bundle.bodyEnd}</body>`);
+    out = out.replace("</body>", () => `${bundle.bodyEnd}</body>`);
   }
   return out;
 }

package/src/server/page-seo-save-core.ts

@@ -5,12 +5,21 @@
  * The site owns only its page registry, its locales and its authenticated
  * client; every rule below is shared by every site.
  */
+import { EDIT_LOCK_TYPES } from "../cms/edit-lock";
 import { stampManualEdits } from "../i18n/translation-meta";
+import { assertEditable } from "./edit-locks-core";
+import type { PlatformAuthContext } from "./guards";
 import { slugRedirectRows, type SlugConflict } from "./page-seo-core";
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 type Client = {
   from: (table: string) => any;
+  /**
+   * Present on every real Supabase client. Optional here only because this
+   * context predates the editing locks and some hosts pass a narrower stub;
+   * without it the lock check is skipped rather than the save failing.
+   */
+  rpc?: (fn: any, args: any) => PromiseLike<{ data: any; error: any }>;
 };
 
 export type PageSeoWriteContext = { supabase: Client; userId: string };
@@ -19,6 +28,8 @@ export type PageSeoSaveInput = {
   pageKey: string;
   slugs: Record<string, unknown>;
   seo: Record<string, unknown>;
+  /** Editing session that holds the lock, when the host tracks one. */
+  editSessionId?: string;
 };
 
 export type PageSeoSaveResult =
@@ -40,6 +51,14 @@ export async function savePageSeoCore(
 ): Promise<PageSeoSaveResult> {
   const { context } = deps;
 
+  if (typeof context.supabase.rpc === "function") {
+    await assertEditable(context as unknown as PlatformAuthContext, {
+      resourceType: EDIT_LOCK_TYPES.pageSeo,
+      resourceId: data.pageKey,
+      sessionId: data.editSessionId,
+    });
+  }
+
   const conflicts = await deps.detectConflicts(data);
   if (conflicts.length > 0) return { ok: false, reason: "slug_conflict", conflicts };
 
@@ -92,7 +111,15 @@ export async function savePageSeoCore(
 export async function deletePageSeoOverrideCore(
   context: PageSeoWriteContext,
   pageKey: string,
+  editSessionId?: string,
 ): Promise<{ ok: true; pageKey: string }> {
+  if (typeof context.supabase.rpc === "function") {
+    await assertEditable(context as unknown as PlatformAuthContext, {
+      resourceType: EDIT_LOCK_TYPES.pageSeo,
+      resourceId: pageKey,
+      sessionId: editSessionId,
+    });
+  }
   const { error } = await context.supabase.from("page_seo").delete().eq("page_key", pageKey);
   if (error) throw new Error(error.message);
   return { ok: true, pageKey };

package/src/server/pages-core.ts

@@ -10,6 +10,8 @@
 import type { BlockInstance } from "../blocks/types";
 import { diffBlocks, summarizeChanges } from "../cms/version-diff";
 import type { VersionChange } from "../cms/version-diff";
+import { EDIT_LOCK_TYPES } from "../cms/edit-lock";
+import { assertEditable } from "./edit-locks-core";
 import { actorEmail, assertStaff, assertSuperadmin } from "./guards";
 import type { PlatformAuthContext } from "./guards";
 import {
@@ -136,9 +138,21 @@ export async function getPageForEditCore({ context }: PagesDeps, key: string) {
 
 export async function savePageVersionCore(
   { context }: PagesDeps,
-  input: { pageId: string; blocks: BlockInstance[]; publish?: boolean; note?: string },
+  input: {
+    pageId: string;
+    blocks: BlockInstance[];
+    publish?: boolean;
+    note?: string;
+    /** Editing session that holds the lock, when the host tracks one. */
+    editSessionId?: string;
+  },
 ) {
   await assertStaff(context);
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.page,
+    resourceId: input.pageId,
+    sessionId: input.editSessionId,
+  });
   invalidatePublishedCache();
   const { data: last } = await context.supabase
     .from("page_versions")
@@ -302,7 +316,11 @@ export async function listPageVersionsCore(deps: PagesDeps, pageId: string) {
   });
 }
 
-export async function restorePageVersionCore(deps: PagesDeps, versionId: string) {
+export async function restorePageVersionCore(
+  deps: PagesDeps,
+  versionId: string,
+  editSessionId?: string,
+) {
   await assertStaff(deps.context);
   const { data: v, error } = await deps.context.supabase
     .from("page_versions")
@@ -315,6 +333,7 @@ export async function restorePageVersionCore(deps: PagesDeps, versionId: string)
     blocks: blocksOf(v.blocks),
     publish: true,
     note: "Restored from earlier version",
+    editSessionId,
   });
 }
 
@@ -341,9 +360,14 @@ export async function createPageCore({ context }: PagesDeps, input: { key: strin
 
 export async function renamePageCore(
   { context }: PagesDeps,
-  input: { pageId: string; name: string },
+  input: { pageId: string; name: string; editSessionId?: string },
 ) {
   await assertStaff(context);
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.page,
+    resourceId: input.pageId,
+    sessionId: input.editSessionId,
+  });
   invalidatePublishedCache();
   const { error } = await context.supabase
     .from("pages")
@@ -361,8 +385,17 @@ export async function renamePageCore(
 }
 
 /** Soft delete: moves the page to the trash bin. Never destroys data. */
-export async function deletePageCore({ context }: PagesDeps, pageId: string) {
+export async function deletePageCore(
+  { context }: PagesDeps,
+  pageId: string,
+  editSessionId?: string,
+) {
   await assertStaff(context);
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.page,
+    resourceId: pageId,
+    sessionId: editSessionId,
+  });
   invalidatePublishedCache();
   const email = actorEmail(context);
   const { data: page } = await context.supabase
@@ -568,9 +601,18 @@ export async function createGlobalSectionCore(
 
 export async function setGlobalSectionKindCore(
   { context }: PagesDeps,
-  input: { sectionId: string; kind: "block" | "section" },
+  input: {
+    sectionId: string;
+    kind: "block" | "section";
+    editSessionId?: string;
+  },
 ) {
   await assertStaff(context);
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.globalSection,
+    resourceId: input.sectionId,
+    sessionId: input.editSessionId,
+  });
   invalidatePublishedCache();
   if (input.kind === "block") {
     const { data: gs } = await context.supabase
@@ -597,9 +639,20 @@ export async function setGlobalSectionKindCore(
 
 export async function saveGlobalSectionVersionCore(
   { context }: PagesDeps,
-  input: { sectionId: string; blocks: BlockInstance[]; note?: string },
+  input: {
+    sectionId: string;
+    blocks: BlockInstance[];
+    note?: string;
+    /** Editing session that holds the lock, when the host tracks one. */
+    editSessionId?: string;
+  },
 ) {
   await assertStaff(context);
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.globalSection,
+    resourceId: input.sectionId,
+    sessionId: input.editSessionId,
+  });
   invalidatePublishedCache();
   const { data: meta } = await context.supabase
     .from("global_sections")
@@ -636,9 +689,14 @@ export async function saveGlobalSectionVersionCore(
 
 export async function renameGlobalSectionCore(
   { context }: PagesDeps,
-  input: { sectionId: string; name: string },
+  input: { sectionId: string; name: string; editSessionId?: string },
 ) {
   await assertStaff(context);
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.globalSection,
+    resourceId: input.sectionId,
+    sessionId: input.editSessionId,
+  });
   invalidatePublishedCache();
   const { error } = await context.supabase
     .from("global_sections")
@@ -648,8 +706,17 @@ export async function renameGlobalSectionCore(
   return { ok: true as const };
 }
 
-export async function deleteGlobalSectionCore({ context }: PagesDeps, sectionId: string) {
+export async function deleteGlobalSectionCore(
+  { context }: PagesDeps,
+  sectionId: string,
+  editSessionId?: string,
+) {
   await assertStaff(context);
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.globalSection,
+    resourceId: sectionId,
+    sessionId: editSessionId,
+  });
   invalidatePublishedCache();
   const { error } = await context.supabase
     .from("global_sections")
@@ -681,16 +748,29 @@ export async function getPageVersionPreviewCore(
 
 export async function schedulePageVersionCore(
   { context }: PagesDeps,
-  input: { versionId: string; publishAt: string; unpublishAt?: string | null; note?: string },
+  input: {
+    versionId: string;
+    publishAt: string;
+    unpublishAt?: string | null;
+    note?: string;
+    editSessionId?: string;
+  },
 ) {
   await assertStaff(context);
-  invalidatePublishedCache();
   const { data: v, error: vErr } = await context.supabase
     .from("page_versions")
     .select("page_id")
     .eq("id", input.versionId)
     .single();
   if (vErr) throw new Error(vErr.message);
+  // Scheduling changes what the public site will show, so it belongs to
+  // whoever holds the page — the same rule as saving it.
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.page,
+    resourceId: v.page_id,
+    sessionId: input.editSessionId,
+  });
+  invalidatePublishedCache();
   const { data: inserted, error } = await context.supabase
     .from("page_publications")
     .insert({
@@ -736,8 +816,25 @@ export async function listPagePublicationsCore(
   return (rows ?? []) as PagePublicationRow[];
 }
 
-export async function cancelPagePublicationCore({ context }: PagesDeps, publicationId: string) {
+export async function cancelPagePublicationCore(
+  { context }: PagesDeps,
+  publicationId: string,
+  editSessionId?: string,
+) {
   await assertStaff(context);
+  const { data: pub, error: pubErr } = await context.supabase
+    .from("page_publications")
+    .select("page_id")
+    .eq("id", publicationId)
+    .single();
+  if (pubErr) throw new Error(pubErr.message);
+  // Cancelling somebody else's scheduled publication is a change to their
+  // page, so it goes through the same lock as every other write to it.
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.page,
+    resourceId: pub.page_id,
+    sessionId: editSessionId,
+  });
   invalidatePublishedCache();
   const { error } = await context.supabase
     .from("page_publications")