@bygghammar/cms-platform 0.90.0-m7.9 → 0.91.0

package/src/server/injections-core.ts

@@ -9,14 +9,19 @@
 
 import {
   EMPTY_BUNDLE,
+  MISSING_CREATED_ID,
   mergeBundles,
   normalizeHostname,
   selectProfiles,
   type InjectionBundle,
   type InjectionProfile,
 } from "../tracking/injections";
+import { resolveRequestLocale } from "../site/locale-domains";
 import { actorEmail, assertRole, type PlatformAuthContext } from "./guards";
 
+/** Re-exported so hosts that already import it from here keep working. */
+export { MISSING_CREATED_ID };
+
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /** Structural subset of a Supabase-shaped client used by this core. */
 export type InjectionsClient = { from: (table: string) => any };
@@ -89,11 +94,76 @@ function toRow(input: InjectionInput) {
   };
 }
 
+/** Where a failure gets reported. Defaults to `console.error`. */
+export type InjectionsLogger = (message: string, error: unknown) => void;
+
+const defaultLogger: InjectionsLogger = (message, error) => {
+  console.error(message, error);
+};
+
+/**
+ * Report a failure without letting the report become one.
+ *
+ * Everywhere this is called the outcome has already been decided: the row is
+ * written, or the request is about to be served an empty bundle so the page
+ * still renders. A logger that throws would undo that decision at the very
+ * last step — an injected reporter whose transport is down turns a completed
+ * create into a rejection the screen reads as "press Save again", and a
+ * degraded render into a 500 on a public page. The report is worth less than
+ * either.
+ *
+ * So the supplied logger is tried, then `console.error` on its own, and then
+ * the reporting failure is dropped, because at that point there is nothing
+ * left that can be told.
+ */
+function reportBestEffort(logger: InjectionsLogger, message: string, error: unknown): void {
+  try {
+    logger(message, error);
+  } catch (loggerError) {
+    try {
+      console.error(message, error);
+      console.error("[cms] injection logger failed", loggerError);
+    } catch {
+      // The console is gone too. Nothing here is worth the caller's outcome.
+    }
+  }
+}
+
+/**
+ * Write the audit entry, and let the mutation stand if that write fails.
+ *
+ * By the time this runs the row is already inserted, updated or deleted. A
+ * rejection here would hand the caller an ordinary failure for a change that
+ * did happen, and the obvious response to an ordinary failure — press Save
+ * again — inserts a second profile. Auditing is best-effort across this
+ * package for exactly that reason: the trail is worth less than the
+ * correctness of what it describes.
+ *
+ * The failure is reported rather than swallowed, so a host that has lost its
+ * audit table finds out from its logs instead of from the empty table.
+ */
+async function auditBestEffort(
+  audit: AuditWriter,
+  entry: Parameters<AuditWriter>[0],
+  logger: InjectionsLogger,
+): Promise<void> {
+  try {
+    await audit(entry);
+  } catch (error) {
+    reportBestEffort(
+      logger,
+      `[cms] injection audit failed for ${entry.action} ${entry.entityId}`,
+      error,
+    );
+  }
+}
+
 /** Admin-only create/update of one profile, with an audit entry. */
 export async function saveInjectionCore(
   context: PlatformAuthContext & { supabase: InjectionsClient },
   input: InjectionInput,
   audit: AuditWriter,
+  logger: InjectionsLogger = defaultLogger,
 ): Promise<{ id: string }> {
   await assertRole(context, "admin");
   const row = toRow(input);
@@ -105,14 +175,19 @@ export async function saveInjectionCore(
       .update(row)
       .eq("id", input.id);
     if (error) throw new Error(error.message);
-    await audit({
-      actorId: context.userId,
-      actorEmail: actorEmail(context),
-      action: "injection.update",
-      entity: "site_injections",
-      entityId: input.id,
-      meta: { name: input.name, scope, enabled: input.enabled },
-    });
+    await auditBestEffort(
+      audit,
+      {
+        actorId: context.userId,
+        actorEmail: actorEmail(context),
+        action: "injection.update",
+        entity: "site_injections",
+        entityId: input.id,
+        meta: { name: input.name, scope, enabled: input.enabled },
+      },
+      logger,
+    );
+    invalidateInjectionCache();
     return { id: input.id };
   }
 
@@ -122,15 +197,35 @@ export async function saveInjectionCore(
     .select("id")
     .single();
   if (error) throw new Error(error.message);
-  const id = String(inserted?.id ?? "");
-  await audit({
-    actorId: context.userId,
-    actorEmail: actorEmail(context),
-    action: "injection.create",
-    entity: "site_injections",
-    entityId: id || null,
-    meta: { name: input.name, scope },
-  });
+  const id = String(inserted?.id ?? "").trim();
+  /*
+   * No id means the insert cannot be reported as a success.
+   *
+   * Whether the row exists is now unknown, and everything below this line
+   * states that it does: an audit entry naming no entity, a cache invalidation
+   * announcing a change, and a `{ id: "" }` the caller reads as "created".
+   * Throwing before any of them leaves one indeterminate insert to reconcile
+   * rather than a trail of confident records about a row nobody can find.
+   */
+  if (!id) throw new Error(MISSING_CREATED_ID);
+  /*
+   * The row exists and its id is in hand. Nothing after this point may take
+   * that away from the caller: a create reported as failed is a create the
+   * administrator will send again, and the second one is a duplicate.
+   */
+  await auditBestEffort(
+    audit,
+    {
+      actorId: context.userId,
+      actorEmail: actorEmail(context),
+      action: "injection.create",
+      entity: "site_injections",
+      entityId: id,
+      meta: { name: input.name, scope },
+    },
+    logger,
+  );
+  invalidateInjectionCache();
   return { id };
 }
 
@@ -139,29 +234,76 @@ export async function deleteInjectionCore(
   context: PlatformAuthContext & { supabase: InjectionsClient },
   id: string,
   audit: AuditWriter,
+  logger: InjectionsLogger = defaultLogger,
 ): Promise<{ ok: true }> {
   await assertRole(context, "admin");
   const { error } = await context.supabase.from("site_injections").delete().eq("id", id);
   if (error) throw new Error(error.message);
-  await audit({
-    actorId: context.userId,
-    actorEmail: actorEmail(context),
-    action: "injection.delete",
-    entity: "site_injections",
-    entityId: id,
-    meta: {},
-  });
+  await auditBestEffort(
+    audit,
+    {
+      actorId: context.userId,
+      actorEmail: actorEmail(context),
+      action: "injection.delete",
+      entity: "site_injections",
+      entityId: id,
+      meta: {},
+    },
+    logger,
+  );
+  invalidateInjectionCache();
   return { ok: true };
 }
 
 /* ---------------- Request-time resolution ---------------- */
 
 const CACHE_TTL_MS = 30_000;
+/**
+ * Bound on distinct hosts held at once. The cache key is a request header, so
+ * an unbounded map is something a stranger can grow; past the cap the oldest
+ * entries go, which for a real site is never reached.
+ */
+const CACHE_MAX_ENTRIES = 64;
 const cache = new Map<string, { at: number; bundle: InjectionBundle }>();
 
+/** Drop cached bundles — all of them, or just one host's. */
+export function invalidateInjectionCache(host?: string): void {
+  if (host === undefined) {
+    cache.clear();
+    return;
+  }
+  cache.delete(normalizeHostname(host));
+}
+
+function remember(key: string, bundle: InjectionBundle): void {
+  const now = Date.now();
+  for (const [host, entry] of cache) {
+    if (now - entry.at >= CACHE_TTL_MS) cache.delete(host);
+  }
+  while (cache.size >= CACHE_MAX_ENTRIES) {
+    const oldest = cache.keys().next();
+    if (oldest.done) break;
+    cache.delete(oldest.value);
+  }
+  cache.set(key, { at: now, bundle });
+}
+
+export type ResolveInjectionsOptions = {
+  defaultLocale?: string;
+  /** Reports a backend failure. Without one, failures reach `console.error`. */
+  logger?: InjectionsLogger;
+};
+
 /**
- * Resolve the merged bundle for a request host. Never throws: a backend hiccup
- * degrades to "no injection" so the site still renders.
+ * Resolve the merged bundle for a request host.
+ *
+ * Never throws: a backend hiccup degrades to "no injection" so the site still
+ * renders. It is not, however, allowed to do that *quietly* — a failed read is
+ * reported and is NOT cached, so the next request retries instead of serving
+ * a fabricated empty bundle for the rest of the TTL. A query that returns an
+ * error rather than throwing counts as a failure; that is the shape this
+ * backend uses, and treating it as "no profiles" is what made a broken
+ * deployment indistinguishable from an unconfigured one.
  *
  * `client` must be a privileged (service-role) client — `site_injections` and
  * `locale_domains` are not readable anonymously.
@@ -169,55 +311,94 @@ const cache = new Map<string, { at: number; bundle: InjectionBundle }>();
 export async function resolveInjectionsCore(
   client: InjectionsClient,
   host: string,
-  options: { defaultLocale?: string } = {},
+  options: ResolveInjectionsOptions = {},
 ): Promise<InjectionBundle> {
   const key = normalizeHostname(host);
   const hit = cache.get(key);
   if (hit && Date.now() - hit.at < CACHE_TTL_MS) return hit.bundle;
 
-  let bundle = EMPTY_BUNDLE;
+  const log = options.logger ?? defaultLogger;
   try {
-    const [{ data: rows }, { data: domains }] = await Promise.all([
+    const [profileResult, domainResult] = await Promise.all([
       client.from("site_injections").select("*").eq("enabled", true),
       client.from("locale_domains").select("locale, domain, is_default"),
     ]);
 
-    if (rows && rows.length > 0) {
-      const list = (domains ?? []) as { locale: string; domain: string; is_default: boolean }[];
-      const match = list.find((d) => normalizeHostname(d.domain) === key);
-      const fallback = list.find((d) => d.is_default);
-      const locale = match?.locale ?? fallback?.locale ?? options.defaultLocale ?? "en";
-      const profiles = (rows as Record<string, unknown>[]).map(rowToInjectionProfile);
-      bundle = mergeBundles(selectProfiles(profiles, locale, host));
+    if (profileResult?.error) throw new Error(String(profileResult.error.message ?? profileResult.error));
+    if (domainResult?.error) throw new Error(String(domainResult.error.message ?? domainResult.error));
+
+    const rows = (profileResult?.data ?? []) as Record<string, unknown>[];
+    if (rows.length === 0) {
+      remember(key, EMPTY_BUNDLE);
+      return EMPTY_BUNDLE;
     }
-  } catch {
-    bundle = EMPTY_BUNDLE;
+
+    const list = ((domainResult?.data ?? []) as {
+      locale: string;
+      domain: string;
+      is_default: boolean;
+    }[]).map((d) => ({ locale: d.locale, domain: d.domain, isDefault: d.is_default }));
+
+    const { locale } = resolveRequestLocale(list, host, options.defaultLocale ?? "en");
+    const bundle = mergeBundles(selectProfiles(rows.map(rowToInjectionProfile), locale, host));
+    remember(key, bundle);
+    return bundle;
+  } catch (error) {
+    reportBestEffort(log, "site code injection: could not resolve tracking profiles", error);
+    return EMPTY_BUNDLE;
   }
+}
 
-  cache.set(key, { at: Date.now(), bundle });
-  return bundle;
+/** A path reduced to `/a/b`: leading slash, no trailing one, no query. */
+function normalizePath(value: string): string {
+  const path = (value ?? "").split(/[?#]/)[0] ?? "";
+  const withSlash = path.startsWith("/") ? path : `/${path}`;
+  return withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+}
+
+/**
+ * Whether `pathname` is `prefix` itself or something beneath it.
+ *
+ * Compared segment by segment rather than by string prefix, because
+ * `/administrator` is a public page and `startsWith("/admin")` called it part
+ * of the backoffice — a site whose backoffice lives at `/admin` then silently
+ * lost tracking on every page whose path merely began with those letters.
+ */
+function isPathWithin(pathname: string, prefix: string): boolean {
+  const path = normalizePath(pathname);
+  const base = normalizePath(prefix);
+  if (base === "/") return true;
+  return path === base || path.startsWith(`${base}/`);
 }
 
 /** True for paths that must never receive tracking code. */
 export function isInjectablePath(pathname: string, backofficePath = "/kontoret"): boolean {
-  if (pathname.startsWith(backofficePath)) return false;
-  if (pathname.startsWith("/preview")) return false;
-  if (pathname.startsWith("/api")) return false;
-  if (pathname.startsWith("/_serverFn")) return false;
-  return true;
+  const excluded = [backofficePath, "/preview", "/api", "/_serverFn"];
+  return !excluded.some((prefix) => isPathWithin(pathname, prefix));
 }
 
-/** Insert the bundle's three chunks into a rendered HTML document. */
+/**
+ * Insert the bundle's three chunks into a rendered HTML document.
+ *
+ * Every insertion goes through a replacement *function*, never a replacement
+ * string. A string replacement is not a literal: `String.prototype.replace`
+ * reads `$&`, `` $` ``, `$'` and `$$` out of it and substitutes parts of the
+ * match. Administrator code is raw by design — a snippet containing `$&`
+ * (jQuery, a currency template, a regex in a tracker) would be silently
+ * rewritten into the matched tag, shipping something the administrator never
+ * wrote. A function's return value is used verbatim, so the injected bytes are
+ * exactly the bytes that were saved.
+ */
 export function applyInjections(html: string, bundle: InjectionBundle): string {
   let out = html;
   if (bundle.head && out.includes("</head>")) {
-    out = out.replace("</head>", `${bundle.head}</head>`);
+    out = out.replace("</head>", () => `${bundle.head}</head>`);
   }
   if (bundle.bodyStart) {
     out = out.replace(/<body([^>]*)>/i, (m) => `${m}${bundle.bodyStart}`);
   }
   if (bundle.bodyEnd && out.includes("</body>")) {
-    out = out.replace("</body>", `${bundle.bodyEnd}</body>`);
+    out = out.replace("</body>", () => `${bundle.bodyEnd}</body>`);
   }
   return out;
 }

package/src/server/media-library-core.ts

@@ -14,6 +14,12 @@ import type { SupabaseClient } from "@supabase/supabase-js";
 import { getMediaStorage } from "../media/storage";
 import { isSecondaryVariant, variantSiblings } from "../media/srcset";
 import { uniqueFileName } from "../media/filename";
+import {
+  assertMediaFolder,
+  joinMediaPath,
+  mediaBaseName,
+  monthFolder,
+} from "../media/folders";
 import { auditWriter } from "./audit-core";
 import type { PlatformAuthContext } from "./guards";
 import {
@@ -331,10 +337,22 @@ export function signMediaUrlCore(
  */
 export async function uploadMediaBundleCore(
   deps: MediaLibraryDeps,
-  input: { files: UploadMediaFile[]; upsert?: boolean },
-): Promise<{ urls: string[] }> {
+  input: {
+    files: UploadMediaFile[];
+    upsert?: boolean;
+    /**
+     * Destination folder. Omitted or empty means the automatic `YYYY-MM`
+     * folder; a value is sanitized here (never trusted from the browser) and
+     * rejected outright if nothing safe is left of it.
+     */
+    folder?: string | null;
+    /** Site timezone, so the automatic folder rolls over at local midnight. */
+    timezone?: string | null;
+  },
+): Promise<{ urls: string[]; folder: string }> {
   const storage = getMediaStorage(deps.context.supabase);
   const upsert = input.upsert ?? false;
+  const folder = assertMediaFolder(input.folder) || monthFolder(Date.now(), input.timezone);
 
   const withSuffix = (name: string, n: number) => {
     if (n <= 1) return name;
@@ -348,9 +366,11 @@ export async function uploadMediaBundleCore(
     uploaded = [];
     try {
       for (const f of input.files) {
-        const name = withSuffix(f.name, attempt);
-        await storage.upload(name, new Uint8Array(f.bytes), f.contentType, { upsert });
-        uploaded.push(name);
+        // Any directory part in the client-supplied name is dropped: the folder
+        // is the only thing that decides where a file lands.
+        const path = joinMediaPath(folder, withSuffix(mediaBaseName(f.name), attempt));
+        await storage.upload(path, new Uint8Array(f.bytes), f.contentType, { upsert });
+        uploaded.push(path);
       }
       break;
     } catch (err) {
@@ -365,8 +385,9 @@ export async function uploadMediaBundleCore(
   await audit(deps, "media.upload", uploaded[0] ?? "upload", {
     paths: uploaded,
     count: uploaded.length,
+    folder,
   });
-  return { urls: uploaded.map((n) => storage.publicUrl(n)) };
+  return { urls: uploaded.map((n) => storage.publicUrl(n)), folder };
 }
 
 /**