@bygghammar/cms-platform 0.91.1 → 0.92.1

package/src/server/backup-core.ts

@@ -8,10 +8,25 @@ import {
   LINEAGE_KEYS,
   SCHEMA_VERSION,
   groupById,
+  readSchemaVersion,
   type ArchiveManifest,
   type ImportMode,
   type TableSpec,
 } from "../backup/datasets";
+import {
+  buildClearPlan,
+  describeReviewConflicts,
+  indexUsersByEmail,
+  needsReconciliation,
+  replaceRefusals,
+  resolveActors,
+  reviewConflicts,
+  writableColumns,
+  type ClearStep,
+  type LocalReviewState,
+  type ReviewConflict,
+  type UnlinkedActor,
+} from "../backup/restore-core";
 import {
   hasAllowedMediaExtension,
   isSafeArchivePath,
@@ -348,10 +363,9 @@ export async function analyzeArchiveCore(deps: BackupDeps, bytes: Uint8Array): P
       `Archive format ${manifest.format} does not match this site (${ARCHIVE_FORMAT_VERSION}).`,
     );
   }
-  if (manifest.schemaVersion !== SCHEMA_VERSION) {
-    problems.push(
-      `Archive was made for database version ${manifest.schemaVersion}, this site runs version ${SCHEMA_VERSION}.`,
-    );
+  const reading = readSchemaVersion(manifest.schemaVersion);
+  if (!reading.supported) {
+    problems.push(`This archive cannot be restored — ${reading.reason}.`);
   }
 
   const media = measureMedia(entries);
@@ -408,6 +422,168 @@ export async function analyzeArchiveCore(deps: BackupDeps, bytes: Uint8Array): P
   };
 }
 
+/* ------------------------------------------------- local review history */
+
+const REVIEW_LOOKUP_CHUNK = 200;
+
+/** Read rows whose key is in `values`, in chunks small enough for a URL. */
+async function selectByKey(
+  supabaseAdmin: SupabaseClient,
+  table: string,
+  columns: string,
+  keyColumn: string,
+  values: string[],
+): Promise<Record<string, unknown>[]> {
+  const out: Record<string, unknown>[] = [];
+  for (let i = 0; i < values.length; i += REVIEW_LOOKUP_CHUNK) {
+    const chunk = values.slice(i, i + REVIEW_LOOKUP_CHUNK);
+    const { data, error } = await supabaseAdmin
+      .from(table as never)
+      .select(columns as never)
+      .in(keyColumn as never, chunk as never);
+    if (error) throw new Error(`Could not read ${table} to check for conflicts: ${error.message}`);
+    out.push(...((data ?? []) as unknown as Record<string, unknown>[]));
+  }
+  return out;
+}
+
+function archivedIds(
+  entries: Record<string, Uint8Array>,
+  table: string,
+  column: string,
+): string[] {
+  const seen = new Set<string>();
+  for (const row of tableRows(entries, table)) {
+    const v = row[column];
+    if (typeof v === "string" && v) seen.add(v);
+  }
+  return [...seen];
+}
+
+/**
+ * The local review rows the archive could possibly disagree with.
+ *
+ * Scoped to the ids the archive actually mentions rather than the whole
+ * history, which on a busy site is one row per page per scan and grows without
+ * bound. A row the archive says nothing about cannot conflict with it, so
+ * reading it would cost time to learn nothing.
+ */
+async function readLocalReviewState(
+  supabaseAdmin: SupabaseClient,
+  entries: Record<string, Uint8Array>,
+): Promise<LocalReviewState> {
+  const runIds = archivedIds(entries, "cms_publication_review_runs", "id");
+  const itemRunIds = archivedIds(entries, "cms_publication_review_items", "run_id");
+  const decisionItemIds = archivedIds(entries, "cms_publication_review_decisions", "item_id");
+
+  const runs = runIds.length
+    ? await selectByKey(
+        supabaseAdmin,
+        "cms_publication_review_runs",
+        "id,input_fingerprint",
+        "id",
+        runIds,
+      )
+    : [];
+  const items = itemRunIds.length
+    ? await selectByKey(
+        supabaseAdmin,
+        "cms_publication_review_items",
+        "id,run_id,page_id,classification",
+        "run_id",
+        itemRunIds,
+      )
+    : [];
+  const decisions = decisionItemIds.length
+    ? await selectByKey(
+        supabaseAdmin,
+        "cms_publication_review_decisions",
+        "item_id,decision",
+        "item_id",
+        decisionItemIds,
+      )
+    : [];
+
+  return {
+    runs: runs.map((r) => ({
+      id: String(r["id"]),
+      input_fingerprint: r["input_fingerprint"] == null ? null : String(r["input_fingerprint"]),
+    })),
+    items: items.map((r) => ({
+      id: String(r["id"]),
+      run_id: String(r["run_id"]),
+      page_id: String(r["page_id"]),
+      classification: r["classification"] == null ? null : String(r["classification"]),
+    })),
+    decisions: decisions.map((r) => ({
+      item_id: String(r["item_id"]),
+      decision: r["decision"] == null ? null : String(r["decision"]),
+    })),
+  };
+}
+
+/**
+ * Whether this database holds any review history at all.
+ *
+ * Asked separately from `readLocalReviewState`, and about the whole table
+ * rather than the archived ids, because the Replace refusal does not turn on
+ * overlap: a Replace that empties `pages` is blocked by *any* review item
+ * pointing at any page, whether or not the archive has ever heard of it.
+ */
+async function localHasReviewHistory(supabaseAdmin: SupabaseClient): Promise<boolean> {
+  const { count, error } = await supabaseAdmin
+    .from("cms_publication_review_items" as never)
+    .select("id" as never, { count: "exact", head: true });
+  if (error) {
+    // A database without the review tables has no history to protect, and a
+    // site that has not migrated to v3 yet must still be able to restore.
+    return false;
+  }
+  return (count ?? 0) > 0;
+}
+
+/**
+ * One clear step through supabase-js.
+ *
+ * `buildClear` renders the same step as SQL for the standalone tool; this is
+ * the same plan spoken to PostgREST, which has no SQL channel. Both need a
+ * row filter — PostgREST refuses an unqualified DELETE or UPDATE, on purpose —
+ * and `pk IS NOT NULL` is the one that matches every row, since a primary key
+ * is never null.
+ */
+async function runClearStep(
+  supabaseAdmin: SupabaseClient,
+  step: ClearStep,
+  pk: string,
+): Promise<string | null> {
+  if (step.kind === "release") {
+    const patch: Record<string, unknown> = {};
+    for (const c of step.columns) patch[c] = null;
+    const { error } = await supabaseAdmin
+      .from(step.table as never)
+      .update(patch as never)
+      .not(pk, "is", null);
+    return error ? error.message : null;
+  }
+  const { error } = await supabaseAdmin
+    .from(step.table as never)
+    .delete()
+    .not(pk, "is", null);
+  return error ? error.message : null;
+}
+
+/** Address → local account id, read once and reused for every actor column. */
+async function readUsersByEmail(supabaseAdmin: SupabaseClient): Promise<Map<string, string>> {
+  const { data, error } = await supabaseAdmin.from("app_users" as never).select("id,email" as never);
+  if (error) return new Map();
+  return indexUsersByEmail(
+    ((data ?? []) as unknown as Record<string, unknown>[]).map((r) => ({
+      id: String(r["id"]),
+      email: r["email"] == null ? null : String(r["email"]),
+    })),
+  );
+}
+
 export type ImportResult = {
   /** False when any row, table or media file could not be restored. */
   ok: boolean;
@@ -429,6 +605,23 @@ export type ImportResult = {
   mediaBytesInArchive: number;
   /** Archive entries that were not media and were deliberately not restored. */
   quarantinedMedia: string[];
+  /**
+   * Actor columns whose address matched no account here. The address itself
+   * was restored — it is the part that stays readable — but the pointer back
+   * to `app_users` was dropped, and an operator may want to relink these.
+   */
+  unlinkedActors: UnlinkedActor[];
+  /**
+   * Whether a fresh publication review scan was owed after this restore, and
+   * whether it ran. A schema-2 archive carries no review history, so the
+   * content it restores has no classification until something looks at it.
+   */
+  reconciliation: {
+    needed: boolean;
+    ran: boolean;
+    /** Present when it was owed and did not run. */
+    reason?: string;
+  };
   warnings: string[];
 };
 
@@ -454,10 +647,9 @@ export async function importArchiveCore(
       `Incompatible archive — this site reads format ${ARCHIVE_FORMAT_VERSION} archives, this one is format ${manifest.format}. Re-export it from the site that produced it.`,
     );
   }
-  if (manifest.schemaVersion !== SCHEMA_VERSION) {
-    throw new Error(
-      `Incompatible archive — it was made for database version ${manifest.schemaVersion}, this site runs version ${SCHEMA_VERSION}.`,
-    );
+  const reading = readSchemaVersion(manifest.schemaVersion);
+  if (!reading.supported) {
+    throw new Error(`Incompatible archive — ${reading.reason}.`);
   }
 
   const selected = opts.groups.filter((g) => (manifest.groups ?? []).includes(g));
@@ -500,9 +692,23 @@ export async function importArchiveCore(
     }
   }
 
+  // Nothing below this point is reversible, so everything that can refuse the
+  // restore outright happens here, before the first write. The old code could
+  // report "completed with conflicts" after it had already applied half the
+  // content; there is no such outcome any more.
+  const refusals = replaceRefusals(
+    { groups: selected, mode: opts.mode },
+    await localHasReviewHistory(supabaseAdmin),
+  );
+  if (refusals.length) throw new Error(refusals.join(" "));
+
+  const conflicts = reviewConflicts(entries, await readLocalReviewState(supabaseAdmin, entries));
+  if (conflicts.length) throw new Error(describeReviewConflicts(conflicts));
+
   const applied: ImportResult["applied"] = [];
   const aborted: string[] = [];
   const warnings: string[] = [];
+  const unlinkedActors: UnlinkedActor[] = [];
   const failedTables = new Set<string>();
   const deferredWork: {
     table: string;
@@ -511,6 +717,35 @@ export async function importArchiveCore(
     cols: string[];
   }[] = [];
 
+  // Replace mode: empty the selected tables once, here, in reverse dependency
+  // order — not inside the per-table loop below, where a later table's DELETE
+  // would remove rows an earlier one had just written, and where a table the
+  // archive is silent about was skipped by `if (!rows.length) continue;` and
+  // so never cleared at all.
+  if (opts.mode === "replace") {
+    const pkOf = new Map([...specs].map(([table, e]) => [table, e.spec.pk]));
+    for (const step of buildClearPlan(selected)) {
+      const pk = pkOf.get(step.table);
+      if (!pk) continue;
+      const error = await runClearStep(supabaseAdmin, step, pk);
+      if (!error) continue;
+      // A clear that fails is not a warning. Everything downstream of it would
+      // be written into a table still holding the rows this restore was
+      // supposed to replace, so the table is marked failed and its children
+      // are aborted by the dependency check in the loop.
+      warnings.push(`Could not clear ${step.table}: ${error}`);
+      failedTables.add(step.table);
+    }
+  }
+
+  // Read at most once, and only if some selected table actually has actor
+  // columns. Most restores do not touch the review tables at all.
+  let usersByEmail: Map<string, string> | null = null;
+  const users = async (): Promise<Map<string, string>> => {
+    usersByEmail ??= await readUsersByEmail(supabaseAdmin);
+    return usersByEmail;
+  };
+
   const base = opts.rewriteMediaBase?.trim();
   const prepare = (table: string, row: Record<string, unknown>) => {
     let out = base ? rewriteMediaUrls(row, base) : row;
@@ -556,21 +791,23 @@ export async function importArchiveCore(
     const mode: ImportMode = insertOnly ? "merge" : opts.mode;
     const conflict = entry.spec.conflict ?? entry.spec.pk;
 
-    if (mode === "replace" && !insertOnly) {
-      const { error } = await supabaseAdmin
-        .from(table as never)
-        .delete()
-        .not(entry.spec.pk, "is", null);
-      if (error) {
-        warnings.push(`Could not clear ${table}: ${error.message}`);
-        failedTables.add(table);
-      }
-    }
+    // Actor pointers are settled before the insert, never after it. The review
+    // tables refuse UPDATE by trigger, so a deferred write-back would fail
+    // *after* the row was already in — a restore reporting success on a table
+    // whose every actor pointer had been rejected.
+    const resolved = (entry.spec.actors ?? []).length
+      ? resolveActors(table, entry.spec, rows, await users())
+      : { rows, unlinked: [] as UnlinkedActor[] };
+    rows = resolved.rows;
+    unlinkedActors.push(...resolved.unlinked);
 
     const deferred = entry.spec.deferred ?? [];
+    const generated = new Set(entry.spec.generated ?? []);
     const payload = rows.map((r) => {
       const copy = prepare(table, { ...r });
       for (const c of deferred) copy[c] = null;
+      // PostgreSQL rejects a write that names a generated column outright.
+      for (const c of generated) delete copy[c];
       return copy;
     });
     if (deferred.length) {
@@ -684,6 +921,36 @@ export async function importArchiveCore(
 
   const ok = failedTables.size === 0 && aborted.length === 0;
 
+  // Reconciliation. A schema-2 archive carries no review history, so the
+  // content it just restored has no classification and nothing else will ever
+  // give it one.
+  //
+  // It runs only when the restore actually finished: a run states
+  // expected_page_count, which is a claim about a database that has stopped
+  // changing, and half a restore is not that. A partial restore therefore
+  // leaves the site unclassified and the result says so, rather than recording
+  // a run that would read as "this database has been reviewed".
+  const reconciliationNeeded = needsReconciliation(manifest) && selected.includes("content");
+  let reconciliationRan = false;
+  let reconciliationReason: string | undefined;
+  if (reconciliationNeeded) {
+    if (!ok) {
+      reconciliationReason =
+        "the restore did not complete cleanly, so no review scan was recorded — " +
+        "the pages that did arrive have no publication classification until one is run.";
+    } else {
+      const { error } = await supabaseAdmin.rpc("cms_publication_review_reconcile" as never, {
+        _operator_email: caller.email,
+      } as never);
+      if (error) {
+        reconciliationReason = `the review scan could not be recorded: ${error.message}`;
+      } else {
+        reconciliationRan = true;
+      }
+    }
+    if (reconciliationReason) warnings.push(reconciliationReason);
+  }
+
   await audit(deps, caller, "backup.import", {
     groups: selected,
     mode: opts.mode,
@@ -708,6 +975,12 @@ export async function importArchiveCore(
     mediaFilesInArchive: archiveMedia.files,
     mediaBytesInArchive: archiveMedia.bytes,
     quarantinedMedia: archiveMedia.quarantined,
+    unlinkedActors,
+    reconciliation: {
+      needed: reconciliationNeeded,
+      ran: reconciliationRan,
+      ...(reconciliationReason ? { reason: reconciliationReason } : {}),
+    },
     warnings,
   };
 }

package/src/server/page-seo-core.ts

@@ -4,34 +4,80 @@
  */
 import { normalizePath } from "./redirects-core";
 import type { PageSlugRegistry } from "./redirects-core";
+import { normalizeRoutePath, servedPath, type RoutePathPolicy } from "../site/route-index";
 
-export type SlugConflict = { locale: string; pageKey: string };
+/**
+ * A page whose address is already taken.
+ *
+ * `path` is the address as the route authority spells it, and `heldBy` names
+ * the page that reached it first. "That slug is taken" is not something an
+ * editor can act on: the two pages need not look alike, and on a site that
+ * folds case or normalizes Unicode they need not even be spelled alike.
+ */
+export type SlugConflict = {
+  locale: string;
+  pageKey: string;
+  path: string;
+  heldBy: string;
+};
 
 /**
- * No two pages may resolve to the same URL in the same locale.
- * `existing` is the stored override map, `pending` the edit being saved.
+ * No two pages may resolve to the same URL.
+ *
+ * Not "in the same locale": in the same *site*. The locale prefix is part of
+ * the address, so a Swedish page whose slug is `en` and the English front page
+ * both answer at `/en`, and a comparison run once per locale calls that pair
+ * fine. Every locale's addresses go into one table here for that reason.
+ *
+ * The addresses come from `servedPath` and `normalizeRoutePath` — the two
+ * functions the site builds its own links with — so this check cannot disagree
+ * with what the site serves. It used to compare bare slug strings, which made
+ * `/Om-Oss` and `/om-oss` two pages to the editor and one page to the browser.
+ *
+ * It does not consult a list of reserved paths. The release's own claims are
+ * the authority on those, and a second list of forbidden strings kept here
+ * would be a second authority waiting to disagree with the first.
+ *
+ * `existing` is the stored override map, `slugs` the edit being saved.
  */
 export function detectSlugConflictsCore(input: {
   pages: PageSlugRegistry;
   locales: readonly string[];
+  defaultLocale: string;
   existing: Record<string, Record<string, string>>;
   pageKey: string;
   slugs: Record<string, string>;
+  policy?: RoutePathPolicy;
 }): SlugConflict[] {
   const pendingByKey = new Map<string, Record<string, string>>(Object.entries(input.existing));
   pendingByKey.set(input.pageKey, input.slugs);
 
+  // Registry pages, pages that exist only as an override row, and the page
+  // being saved. A builder-created page is in no static registry, and leaving
+  // it out of the comparison is exactly how it comes to take an address the
+  // registry already serves.
+  const keys = [...new Set([...Object.keys(input.pages), ...pendingByKey.keys()])];
+
+  const policy: RoutePathPolicy = { locales: input.locales, ...(input.policy ?? {}) };
   const conflicts: SlugConflict[] = [];
+  const seen = new Map<string, string>();
+
   for (const locale of input.locales) {
-    const seen = new Map<string, string>();
-    for (const key of Object.keys(input.pages)) {
-      const base = input.pages[key].slug[locale];
+    for (const key of keys) {
       const override = pendingByKey.get(key)?.[locale];
-      const effective = override ?? base;
+      const base = input.pages[key]?.slug[locale];
+      // A page with no slug in this locale is still served here when it has
+      // one in the default locale: path building falls back, so the address
+      // exists and can collide whether or not anyone translated the slug.
+      const fallback =
+        pendingByKey.get(key)?.[input.defaultLocale] ?? input.pages[key]?.slug[input.defaultLocale];
+      const effective = override ?? base ?? fallback;
       if (effective === undefined) continue;
-      const existing = seen.get(effective);
-      if (existing && existing !== key) conflicts.push({ locale, pageKey: key });
-      else seen.set(effective, key);
+
+      const path = normalizeRoutePath(servedPath(effective, locale, input.defaultLocale), policy);
+      const holder = seen.get(path);
+      if (holder === undefined) seen.set(path, key);
+      else if (holder !== key) conflicts.push({ locale, pageKey: key, path, heldBy: holder });
     }
   }
   return conflicts;