@bygghammar/cms-platform 0.90.0-m7.9 → 0.91.0

package/docs/TYPOGRAPHY.md

@@ -0,0 +1,86 @@
+# Menu and footer typography
+
+The menu and the footer each choose their own font, independently. Everything
+else on the site keeps using the theme tokens.
+
+## The model
+
+```ts
+type FontChoice =
+  | { source: "theme"; token?: "sans" | "serif" }
+  | { source: "google"; family: string; weights?: number[] };
+
+type SiteTypography = Partial<Record<"menu" | "footer", FontChoice>>;
+```
+
+Two slots, `menu` and `footer`, and either can be left alone. The default is
+`{}` — no choice recorded — and `resolveTypography` maps an absent slot to its
+theme fallback (`TYPOGRAPHY_SLOTS`). This is what makes the feature backwards
+compatible: an existing site has no `typography` key in its config, resolves to
+the theme fonts, and looks *exactly* as it did before the upgrade.
+
+No font is pre-selected. In particular **DM Serif Display is not switched on for
+anyone** — it is available in the picker like every other family, and a site that
+wants it opts in.
+
+The value is stored in the existing site-config JSONB. There is no new table and
+no new migration for typography; `parseSiteTypography` validates whatever comes
+back and falls through to the theme on anything it does not recognise, so a
+hand-edited or downgraded config cannot break rendering.
+
+## No API key in the browser
+
+Google's font *catalogue* API needs a key. The picker does not use it.
+
+`GOOGLE_FONT_CATALOG` in `src/site/google-fonts.ts` is a static list compiled into
+the package, and `searchGoogleFonts(query, limit)` filters it in memory. The
+selector is searchable, fast, works offline, and requires no key anywhere —
+frontend or backend.
+
+The trade is that the catalogue is a curated subset rather than all ~1,700
+families. That is the right trade for a font picker in a CMS: shipping a key to
+the browser to make the list longer is not a good exchange, and neither is a
+server round trip per keystroke.
+
+## Loading
+
+`googleFontsCssUrl` builds one `fonts.googleapis.com/css2` URL for *all* requested
+families, so choosing different fonts for the menu and the footer is one stylesheet
+request, not two. `display=swap` is always set — text renders in the fallback
+immediately rather than staying invisible while the font downloads.
+
+`googleFontsHeadLinks` returns the link descriptors — the two preconnects Google
+recommends plus the stylesheet — for a host that builds its `<head>` itself. In a
+React 19 tree, `SiteFontLinks` does the same job through the framework:
+`preconnect()` from `react-dom` (which de-duplicates by origin) and a
+`<link rel="stylesheet" precedence="high">` that React hoists and de-duplicates.
+
+That stylesheet sits inside **its own `<Suspense>` boundary**, and that is not
+decoration. A `precedence` stylesheet suspends whatever boundary contains it
+until the file has loaded — so without the dedicated boundary, picking a menu
+font would delay the entire page's first paint on the font request.
+
+`sanitizeFontFamily` is applied before a family name ever reaches a URL or a CSS
+declaration. A family name is editor input, and editor input does not get
+concatenated into CSS unchecked.
+
+When both slots are on theme fonts, `googleFontsCssUrl` returns `null` and
+**nothing is requested at all**. A site that does not use the feature pays
+nothing for it.
+
+## Applying the font
+
+`fontStyle(font)` returns an inline `fontFamily` for the slot's own element —
+not a global override and not a change to the theme tokens. The menu's font
+applies to the menu and stops there, and `--font-sans` / `--font-serif` are never
+reassigned, which is why nothing else on the page shifts when an editor picks a
+menu font.
+
+For a slot left on the theme, `fontStyle` returns **`undefined`** rather than a
+style naming the current theme token. That distinction is the backwards
+compatibility guarantee in one line: an un-configured site emits no inline style
+at all and is pixel-identical to before, instead of merely computing to something
+that looks the same today.
+
+Each resolved font carries a real fallback stack, so the layout is stable before
+the webfont arrives and readable if it never does.

package/migrations/20260904090000_c54603f8-a155-40f8-a86c-54434aa5c0ae.sql

@@ -0,0 +1,33 @@
+-- Draft / published pages ------------------------------------------------
+--
+-- Publishing became an explicit, confirmed action in the backoffice, so
+-- `pages.status` went from a mostly-decorative column to the gate the public
+-- route, the sitemap and every other public discovery path check. This
+-- migration makes that read cheap and writes down what the column means.
+--
+-- Deliberately additive. Existing rows are NOT touched: a page that is live
+-- today stays live after the upgrade, and no site loses content because a
+-- migration decided its pages should be drafts. New pages default to 'draft'
+-- (as the original schema already declared), which is what makes a freshly
+-- created — or freshly duplicated — page invisible until somebody publishes it.
+
+-- Restated rather than changed, so a database restored from an older baseline
+-- ends up with the same default as a fresh install.
+ALTER TABLE public.pages ALTER COLUMN status SET DEFAULT 'draft';
+
+COMMENT ON COLUMN public.pages.status IS
+  'draft | published. A page is served publicly only when it is published, or '
+  'while a page_publications window is open for it. Unpublishing sets this back '
+  'to draft and deactivates those rows.';
+
+-- Public route discovery lists published, undeleted pages ordered by key
+-- (see listPublishedPageKeysCore). A partial index keeps drafts and trashed
+-- rows out of it entirely, so the index stays small on sites with many drafts.
+CREATE INDEX IF NOT EXISTS pages_published_key_idx
+  ON public.pages (key)
+  WHERE deleted_at IS NULL AND status = 'published';
+
+-- The Pages screen lists newest-first within a status filter.
+CREATE INDEX IF NOT EXISTS pages_status_updated_at_idx
+  ON public.pages (status, updated_at DESC)
+  WHERE deleted_at IS NULL;

package/migrations/20260904140000_9f2a7c41-06d5-4d6b-8b4e-1c7a5d3e9b20.sql

@@ -0,0 +1,383 @@
+-- One authoritative publication model ------------------------------------
+--
+-- Before this migration two things decided whether a page was public:
+-- `pages.status` and the rows in `page_publications`. The public reader
+-- consulted both and served a page when *either* said yes, which quietly broke
+-- every scheduled state built on top of it. A countdown target went live the
+-- moment it was scheduled instead of at its deadline; a version scheduled for
+-- next week appeared at once on an already-published page; an `unpublish_at`
+-- that had passed hid nothing, because the status column still said published.
+--
+-- From here `page_publications` alone decides what the public sees. The rule is
+-- one sentence: the newest active row whose `publish_at` has arrived governs,
+-- and the page is public while that row's `unpublish_at` has not. An older row
+-- never comes back into force behind a newer one — that is what makes
+-- "invisible at and after `unpublish_at`" true rather than "invisible until the
+-- previous publication takes over again".
+--
+-- `pages.status` keeps its editorial meaning (is this page finished?) and still
+-- drives the backoffice, but nothing public reads it any more.
+
+-- 1. Backfill --------------------------------------------------------------
+--
+-- Pages published before publication rows existed, and pages whose rows were
+-- retired by an older code path, have no active publication. They are public
+-- today and must stay public, so give each one an open publication naming the
+-- version it is already serving.
+--
+-- Pages that *do* have an active row are left alone on purpose. A page with a
+-- single row scheduled for next Tuesday is deliberately scheduled: writing an
+-- immediate publication next to it would publish it now, which is precisely the
+-- countdown leak this migration exists to close.
+INSERT INTO public.page_publications (page_id, version_id, publish_at, is_active, published_by, note)
+SELECT
+  p.id,
+  p.current_version_id,
+  now(),
+  true,
+  p.updated_by,
+  'Backfilled when publication rows became the single source of truth for public visibility.'
+FROM public.pages p
+WHERE p.deleted_at IS NULL
+  AND p.status = 'published'
+  AND p.current_version_id IS NOT NULL
+  AND NOT EXISTS (
+    SELECT 1 FROM public.page_publications pp
+    WHERE pp.page_id = p.id AND pp.is_active
+  );
+
+-- The public reader asks for one page's active rows newest-first. The existing
+-- `page_publications_active_idx` finds the page; this one also gives the order.
+CREATE INDEX IF NOT EXISTS page_publications_page_publish_at_idx
+  ON public.page_publications (page_id, publish_at DESC)
+  WHERE is_active;
+
+COMMENT ON TABLE public.page_publications IS
+  'Publication windows. The newest active row whose publish_at has arrived decides which version the public sees, and the page is public until that row''s unpublish_at. pages.status is editorial state only and is not consulted by the public reader.';
+
+-- Restated, because the previous migration's comment describes the two-source
+-- model this one replaces and a stale comment on a column this sensitive is
+-- worse than none.
+COMMENT ON COLUMN public.pages.status IS
+  'draft | published. Editorial state: is this page finished? It does not make a page public — an open row in page_publications does, and unpublishing retires those rows as well as setting this back to draft.';
+
+-- 2. Atomic visibility transitions -----------------------------------------
+--
+-- Publishing is several statements — retire the old publication, write the new
+-- one, move the current-version pointer, flip the status. Run from a PostgREST
+-- client they are four independent round trips, and a failure in the middle
+-- leaves the site in a state nobody asked for: an active publication with the
+-- status still draft, or worse, a retired publication and a status that says
+-- published. Reporting the failure honestly (which the previous commit does)
+-- stops the lie but not the damage.
+--
+-- These functions put the whole transition in one transaction. Either the page
+-- changes what it shows the public or it does not; there is no half of it, and
+-- no compensation logic in JavaScript to get wrong.
+
+-- Everything the public reader would need to re-derive after a write, so the
+-- caller can invalidate precisely and the audit trail records what happened.
+CREATE OR REPLACE FUNCTION public.cms_page_publication_json(_page_id uuid)
+RETURNS jsonb
+LANGUAGE sql
+STABLE
+SET search_path = public, pg_temp
+AS $$
+  SELECT jsonb_build_object(
+    'pageId',    _page_id,
+    'versionId', (SELECT pp.version_id
+                    FROM public.page_publications pp
+                   WHERE pp.page_id = _page_id
+                     AND pp.is_active
+                     AND pp.publish_at <= now()
+                     AND (pp.unpublish_at IS NULL OR pp.unpublish_at > now())
+                   ORDER BY pp.publish_at DESC, pp.published_at DESC
+                   LIMIT 1),
+    'now', now()
+  )
+$$;
+
+-- Who to name in version history and the audit log.
+--
+-- The server's own record wins; the caller's copy only fills the gap for an
+-- installation that signs people in without mirroring them into `app_users`.
+-- Display data may be completed by a caller, never overwritten by one.
+CREATE OR REPLACE FUNCTION public.cms_actor_email(_uid uuid, _fallback text)
+RETURNS text
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $$
+  SELECT COALESCE(
+    (SELECT NULLIF(btrim(au.email), '') FROM public.app_users au WHERE au.id = _uid),
+    NULLIF(btrim(_fallback), '')
+  )
+$$;
+
+-- Save a new version, and optionally publish it, in one go.
+--
+-- The page row is locked first, so two editors saving at the same moment cannot
+-- pick the same `version_no` — the unique constraint would refuse the second
+-- one anyway, but the lock turns a confusing constraint error into an orderly
+-- queue of two saves.
+CREATE OR REPLACE FUNCTION public.cms_save_page_version(
+  _page_id     uuid,
+  _blocks      jsonb,
+  _note        text    DEFAULT NULL,
+  _publish     boolean DEFAULT false,
+  _actor_email text    DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $$
+DECLARE
+  _uid        uuid := app.current_user_id();
+  _email      text;
+  _page       public.pages;
+  _next_no    integer;
+  _version_id uuid;
+BEGIN
+  IF _uid IS NULL OR NOT public.is_staff(_uid) THEN
+    RAISE EXCEPTION 'Forbidden' USING ERRCODE = '42501';
+  END IF;
+
+  SELECT * INTO _page FROM public.pages
+    WHERE id = _page_id AND deleted_at IS NULL
+    FOR UPDATE;
+  IF _page.id IS NULL THEN
+    RAISE EXCEPTION 'Page not found' USING ERRCODE = 'P0002';
+  END IF;
+
+  _email := public.cms_actor_email(_uid, _actor_email);
+
+  SELECT COALESCE(MAX(version_no), 0) + 1 INTO _next_no
+    FROM public.page_versions WHERE page_id = _page_id;
+
+  INSERT INTO public.page_versions
+    (page_id, version_no, blocks, note, created_by, created_by_email)
+  VALUES
+    (_page_id, _next_no, COALESCE(_blocks, '[]'::jsonb), _note, _uid, _email)
+  RETURNING id INTO _version_id;
+
+  UPDATE public.pages
+     SET current_version_id = _version_id,
+         updated_at         = now(),
+         updated_by         = _uid
+   WHERE id = _page_id;
+
+  IF _publish THEN
+    UPDATE public.page_publications
+       SET is_active = false
+     WHERE page_id = _page_id AND is_active;
+
+    INSERT INTO public.page_publications (page_id, version_id, is_active, published_by)
+    VALUES (_page_id, _version_id, true, _uid);
+
+    UPDATE public.pages SET status = 'published' WHERE id = _page_id;
+  END IF;
+
+  RETURN jsonb_build_object(
+    'versionId', _version_id,
+    'versionNo', _next_no,
+    'published', _publish,
+    'public',    public.cms_page_publication_json(_page_id)
+  );
+END;
+$$;
+
+-- Publish or unpublish a page that already has content.
+--
+-- Publishing retires whatever was live or scheduled and opens one window on the
+-- current version, starting now and with no end. Unpublishing retires
+-- everything and opens nothing, so the page goes dark the instant this commits.
+CREATE OR REPLACE FUNCTION public.cms_set_page_status(
+  _page_id     uuid,
+  _status      text,
+  _audit       jsonb DEFAULT '{}'::jsonb,
+  _actor_email text  DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $$
+DECLARE
+  _uid  uuid := app.current_user_id();
+  _page public.pages;
+  _next text := lower(btrim(COALESCE(_status, '')));
+BEGIN
+  IF _uid IS NULL OR NOT public.is_staff(_uid) THEN
+    RAISE EXCEPTION 'Forbidden' USING ERRCODE = '42501';
+  END IF;
+  IF _next NOT IN ('draft', 'published') THEN
+    RAISE EXCEPTION 'Unknown page status %', _status USING ERRCODE = '22023';
+  END IF;
+
+  SELECT * INTO _page FROM public.pages
+    WHERE id = _page_id AND deleted_at IS NULL
+    FOR UPDATE;
+  IF _page.id IS NULL THEN
+    RAISE EXCEPTION 'Page not found' USING ERRCODE = 'P0002';
+  END IF;
+  IF _next = 'published' AND _page.current_version_id IS NULL THEN
+    RAISE EXCEPTION 'This page has no saved content yet, so there is nothing to publish.'
+      USING ERRCODE = '22023';
+  END IF;
+
+  UPDATE public.page_publications
+     SET is_active = false
+   WHERE page_id = _page_id AND is_active;
+
+  IF _next = 'published' THEN
+    INSERT INTO public.page_publications (page_id, version_id, is_active, published_by)
+    VALUES (_page_id, _page.current_version_id, true, _uid);
+  END IF;
+
+  UPDATE public.pages SET status = _next, updated_at = now(), updated_by = _uid
+   WHERE id = _page_id;
+
+  -- The audit row belongs to the same transaction: a publish nobody can account
+  -- for afterwards is its own kind of half-applied write.
+  INSERT INTO public.audit_logs (actor_id, actor_email, action, entity, entity_id, meta)
+  VALUES (
+    _uid,
+    public.cms_actor_email(_uid, _actor_email),
+    CASE WHEN _next = 'published' THEN 'page.publish' ELSE 'page.unpublish' END,
+    'pages',
+    _page_id::text,
+    COALESCE(_audit, '{}'::jsonb) || jsonb_build_object('key', _page.key, 'status', _next)
+  );
+
+  RETURN jsonb_build_object(
+    'status', _next,
+    'key',    _page.key,
+    'public', public.cms_page_publication_json(_page_id)
+  );
+END;
+$$;
+
+-- Schedule a page to appear at a given instant, replacing whatever was live or
+-- already scheduled for it. Used by countdown blocks set to reveal a page.
+--
+-- `pages.status` is deliberately untouched: the page becomes public when the
+-- window opens, not when somebody schedules it, and the backoffice should go on
+-- describing it as the draft it still is until then.
+CREATE OR REPLACE FUNCTION public.cms_schedule_page_reveal(
+  _page_key    text,
+  _publish_at  timestamptz,
+  _audit       jsonb DEFAULT '{}'::jsonb,
+  _actor_email text  DEFAULT NULL
+)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public, pg_temp
+AS $$
+DECLARE
+  _uid  uuid := app.current_user_id();
+  _page public.pages;
+BEGIN
+  IF _uid IS NULL OR NOT public.is_staff(_uid) THEN
+    RAISE EXCEPTION 'Forbidden' USING ERRCODE = '42501';
+  END IF;
+  IF _publish_at IS NULL THEN
+    RAISE EXCEPTION 'A reveal needs an instant to happen at' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT * INTO _page FROM public.pages
+    WHERE key = btrim(_page_key) AND deleted_at IS NULL
+    FOR UPDATE;
+
+  -- A countdown may name a page that was renamed, deleted or never written to.
+  -- That is an editing mistake, not a database error: say nothing happened.
+  IF _page.id IS NULL OR _page.current_version_id IS NULL THEN
+    RETURN jsonb_build_object('scheduled', false, 'reason', 'no-such-page');
+  END IF;
+
+  -- Saving the same page twice must not pile up identical reveals.
+  IF EXISTS (
+    SELECT 1 FROM public.page_publications pp
+     WHERE pp.page_id    = _page.id
+       AND pp.version_id = _page.current_version_id
+       AND pp.publish_at = _publish_at
+       AND pp.is_active
+  ) THEN
+    RETURN jsonb_build_object('scheduled', false, 'reason', 'already-scheduled',
+                              'pageId', _page.id);
+  END IF;
+
+  UPDATE public.page_publications
+     SET is_active = false
+   WHERE page_id = _page.id AND is_active;
+
+  INSERT INTO public.page_publications
+    (page_id, version_id, publish_at, is_active, published_by)
+  VALUES
+    (_page.id, _page.current_version_id, _publish_at, true, _uid);
+
+  INSERT INTO public.audit_logs (actor_id, actor_email, action, entity, entity_id, meta)
+  VALUES (
+    _uid, public.cms_actor_email(_uid, _actor_email), 'page.schedule', 'pages', _page.id::text,
+    COALESCE(_audit, '{}'::jsonb) || jsonb_build_object('publish_at', _publish_at)
+  );
+
+  RETURN jsonb_build_object('scheduled', true, 'pageId', _page.id);
+END;
+$$;
+
+-- Who may call these -------------------------------------------------------
+--
+-- Definer functions that decide what the public website shows are not
+-- something to leave on PUBLIC's default grant, and none of them is for
+-- anonymous callers. The bodies check `is_staff` regardless; this is the
+-- second lock.
+--
+-- Taking the grant away from PUBLIC is plain SQL and runs anywhere. The role
+-- names below are not: `anon`, `authenticated` and `service_role` are
+-- PostgREST deployment conventions, and this package also runs on a plain
+-- PostgreSQL server where none of them exists — where `REVOKE ... FROM anon`
+-- is not a warning but an error that stops the migration. So every statement
+-- naming one of them is executed only if that role is actually present.
+--
+-- A self-hosted installation grants EXECUTE to whichever role its application
+-- connects as, in its own migration. `docs/PAGES.md` lists the statements.
+REVOKE ALL ON FUNCTION public.cms_page_publication_json(uuid) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.cms_actor_email(uuid, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.cms_save_page_version(uuid, jsonb, text, boolean, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.cms_set_page_status(uuid, text, jsonb, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.cms_schedule_page_reveal(text, timestamptz, jsonb, text) FROM PUBLIC;
+
+DO $$
+DECLARE
+  _signature text;
+  _role      text;
+  -- Helpers first: nobody calls these directly, in any deployment.
+  _internal  text[] := ARRAY[
+    'public.cms_page_publication_json(uuid)',
+    'public.cms_actor_email(uuid, text)'
+  ];
+  -- The writes the backoffice makes, as the signed-in editor.
+  _writers   text[] := ARRAY[
+    'public.cms_save_page_version(uuid, jsonb, text, boolean, text)',
+    'public.cms_set_page_status(uuid, text, jsonb, text)',
+    'public.cms_schedule_page_reveal(text, timestamptz, jsonb, text)'
+  ];
+BEGIN
+  FOREACH _role IN ARRAY ARRAY['anon', 'authenticated', 'service_role'] LOOP
+    IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = _role) THEN
+      CONTINUE;
+    END IF;
+    FOREACH _signature IN ARRAY _internal || _writers LOOP
+      EXECUTE format('REVOKE ALL ON FUNCTION %s FROM %I', _signature, _role);
+    END LOOP;
+    IF _role <> 'anon' THEN
+      FOREACH _signature IN ARRAY _writers LOOP
+        EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO %I', _signature, _role);
+      END LOOP;
+    END IF;
+  END LOOP;
+END
+$$;