@bygghammar/cms-platform 0.91.1 → 0.92.1

package/src/server/pages-core.ts

@@ -37,6 +37,8 @@ import {
   type PublicationWindow,
 } from "../cms/page-publication";
 import { resolveGlobalsDeep } from "./resolve-globals";
+import { CONTRACT_V2_MIGRATIONS, CONTRACT_V3_MIGRATIONS } from "../platform/contract";
+import { digestJson, type DigestValue } from "../platform/digest";
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
@@ -375,18 +377,12 @@ export async function getPageForEditCore({ context }: PagesDeps, key: string) {
 }
 
 /**
- * Codes and wording that mean "this installation has not run the publication
- * migration yet". `PGRST202`/`PGRST203` come from PostgREST, `42883`/`42P01`
- * from PostgreSQL itself.
+ * Codes and wording that mean "this installation has no such function, or none
+ * that takes these arguments". `PGRST202`/`PGRST203` come from PostgREST, which
+ * answers the same way for both; `42883`/`42P01` from PostgreSQL itself.
  */
 const FUNCTION_MISSING = new Set(["PGRST202", "PGRST203", "42883", "42P01"]);
 
-/** The migrations that install the functions below, named in the error. */
-const PUBLICATION_MIGRATIONS = [
-  "20260904140000_9f2a7c41-06d5-4d6b-8b4e-1c7a5d3e9b20.sql",
-  "20260904160000_0d565000-2839-4738-aacc-537d7090398f.sql",
-] as const;
-
 /**
  * One database-function call, for the writes that change what the public sees.
  *
@@ -409,6 +405,13 @@ async function publicationRpc(
   fn: string,
   args: Record<string, unknown>,
   whenFailed: string,
+  /**
+   * Which migrations install `fn`. Defaults to the contract-v2 pair, which
+   * installs every publication function except the ones contract v3 adds —
+   * those call sites name their own, because sending an operator after the
+   * wrong file is worse than telling them nothing.
+   */
+  installedBy: readonly string[] = CONTRACT_V2_MIGRATIONS,
 ): Promise<any> {
   const { data, error } = await client.rpc(fn, args);
   if (!error) return data;
@@ -418,9 +421,16 @@ async function publicationRpc(
     FUNCTION_MISSING.has(code) ||
     /could not find the function|does not exist/i.test(message)
   ) {
+    // A slice of the generated migration manifest rather than a second copy of
+    // the names: an operator sent after a file this package has stopped
+    // shipping is worse off than one told nothing. Only a code from the set
+    // above is repeated; the backend's own message is not.
     throw new Error(
-      `${whenFailed}: this database does not have ${fn}. Apply the migrations ` +
-        `${PUBLICATION_MIGRATIONS.join(" and ")} shipped with this package and try again.`,
+      `${whenFailed}: the database has no ${fn} that accepts this call` +
+        `${FUNCTION_MISSING.has(code) ? ` (${code})` : ""}. Either the migrations ` +
+        `${installedBy.join(" and ")} shipped with this package are not installed, ` +
+        `or the installed ${fn} takes different arguments than this package sends. ` +
+        `Compare the database's schema with this package before applying anything.`,
     );
   }
   throw new Error(message || whenFailed);
@@ -468,10 +478,10 @@ export async function savePageVersionCore(
       _note: input.note ?? null,
       _publish: Boolean(input.publish),
       _actor_email: actorEmail(context),
+      // No `_source_page_id`: the function takes none, and names `_page_id` as
+      // the source of every reveal itself, so a countdown pointing at the page
+      // being published is still refused rather than hiding it.
       _reveals: reveals,
-      // Named so a countdown pointing at the page being published is refused
-      // rather than hiding it until its own deadline.
-      _source_page_id: input.pageId,
       _audit: input.publish
         ? {
             description:
@@ -690,6 +700,9 @@ export async function setPageStatusCore(
   return { ok: true as const, status };
 }
 
+/** A key the database will accept as `uuid`, checked here to say why. */
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 /**
  * Copy a page, content and all, into a new draft.
  *
@@ -698,14 +711,34 @@ export async function setPageStatusCore(
  * copied — canonical URLs, slugs and meta titles are per-page facts, and
  * duplicating them would publish two pages claiming the same canonical address.
  * The copy starts as a draft whatever the source's status is.
+ *
+ * Three reads decide what to propose, and one transaction decides whether the
+ * proposal still describes the page. The reads cannot be inside that
+ * transaction — a PostgREST client has no way to hold one open — so nothing
+ * here is trusted afterwards: the database re-checks the address, re-checks
+ * which version was on screen, and recomputes the digest of that version's
+ * content under its own lock. It has to recompute rather than compare ids,
+ * because content under a stable version id is not immutable in this schema.
+ *
+ * `idempotencyKey` is which duplication this is. A caller that wants a retry to
+ * be recognised as a retry has to supply it and reuse the same value; one is
+ * generated when it is absent, which is honest about what that buys — it makes
+ * this call unique, and it makes a second call a second copy.
  */
 export async function duplicatePageCore(
   { context }: PagesDeps,
-  input: { pageId: string; name: string; key?: string },
+  input: { pageId: string; name: string; key?: string; idempotencyKey?: string },
 ) {
   await assertStaff(context);
   const name = input.name.trim();
   if (!name) throw new Error("A name is required for the copy.");
+  const idempotencyKey = (input.idempotencyKey ?? crypto.randomUUID()).trim();
+  if (!UUID.test(idempotencyKey)) {
+    throw new Error(
+      "An idempotency key for a copy must be a UUID, so that a retry can be told " +
+        "apart from a second copy.",
+    );
+  }
 
   const { data: source, error: srcErr } = await context.supabase
     .from("pages")
@@ -722,55 +755,59 @@ export async function duplicatePageCore(
   const taken = ((existing ?? []) as Array<{ key: string }>).map((row) => row.key);
   const key = uniquePageKey(input.key?.trim() || name, taken);
 
+  // What the source holds and what the copy will hold are two different values.
+  // The digest binds the first; the second is the first with every block
+  // re-identified, so the two pages never share a block id.
   let blocks: BlockInstance[] = [];
+  let blocksDigest: string | null = null;
   if (source.current_version_id) {
-    const { data: version } = await context.supabase
+    const { data: version, error: versionReadErr } = await context.supabase
       .from("page_versions")
       .select("blocks")
       .eq("id", source.current_version_id)
       .maybeSingle();
-    blocks = duplicateBlockTree(blocksOf(version?.blocks));
+    if (versionReadErr) throw new Error(versionReadErr.message);
+    // A page pointing at a version that is not there is broken, and copying it
+    // as an empty page would invent content rather than report the breakage.
+    if (!version) throw new Error("Version not found");
+    blocksDigest = await digestJson(version.blocks as DigestValue);
+    blocks = duplicateBlockTree(blocksOf(version.blocks));
   }
 
   invalidatePublishedCache();
-  const { data: page, error } = await context.supabase
-    .from("pages")
-    .insert({ key, name, is_system: false, status: DEFAULT_PAGE_STATUS })
-    .select("id")
-    .single();
-  if (error) throw new Error(error.message);
-
-  const { data: created, error: versionErr } = await context.supabase
-    .from("page_versions")
-    .insert({
-      page_id: page.id,
-      version_no: 1,
-      blocks: blocks as unknown as any,
-      note: `Copied from "${source.name}"`,
-      created_by: context.userId,
-      created_by_email: actorEmail(context),
-    })
-    .select("id")
-    .single();
-  if (versionErr) throw new Error(versionErr.message);
-  await context.supabase
-    .from("pages")
-    .update({ current_version_id: created.id })
-    .eq("id", page.id);
-
-  await context.supabase.from("audit_logs").insert({
-    actor_id: context.userId,
-    action: "page.duplicate",
-    entity: "pages",
-    entity_id: page.id,
-    meta: {
-      key,
-      source_key: source.key,
-      description: `Duplicated the page "${source.name}" as the draft "${name}" (${key}).`,
+  const copy = await publicationRpc(
+    context.supabase,
+    "cms_duplicate_page",
+    {
+      _source_page_id: input.pageId,
+      _expected_version_id: source.current_version_id ?? null,
+      _expected_blocks_digest: blocksDigest,
+      _idempotency_key: idempotencyKey,
+      _key: key,
+      _name: name,
+      _blocks: blocks as unknown,
+      // The description is composed in the function, from the names it read
+      // under the lock, so there is nothing to say here that it does not know.
+      _audit: {},
+      _actor_email: actorEmail(context),
     },
-  });
+    "Could not copy the page",
+    CONTRACT_V3_MIGRATIONS,
+  );
 
-  return { id: page.id as string, key, name, status: DEFAULT_PAGE_STATUS };
+  const id = typeof copy?.pageId === "string" ? copy.pageId : "";
+  if (!id) throw new Error("The database made no copy of this page.");
+  return {
+    id,
+    key: String(copy.key ?? key),
+    name: String(copy.name ?? name),
+    status: String(copy.status ?? DEFAULT_PAGE_STATUS),
+    /**
+     * True when this key had already been spent, so the copy being returned is
+     * the one the first call made rather than a new one.
+     */
+    idempotent: Boolean(copy.idempotent),
+  };
 }
 
 export async function renamePageCore(

package/src/server/redirects-core.ts

@@ -7,6 +7,7 @@
  */
 
 import { auditAs } from "./audit-core";
+import { normalizeRoutePath, servedPath, type RoutePathPolicy } from "../site/route-index";
 
 /** Structural subset of a Supabase-shaped client used by these cores. */
 export type RedirectClient = {
@@ -22,7 +23,7 @@ export type RedirectRow = {
 };
 
 export type PathResolution =
-  | { kind: "page"; pageKey: string }
+  | { kind: "page"; pageKey: string; locale: string }
   | { kind: "redirect"; to: string; status: number }
   | { kind: "notfound" };
 
@@ -106,6 +107,23 @@ export type PageSlugRegistry = Record<string, { slug: Record<string, string | un
 
 /**
  * Resolve a URL path to a CMS page key, a redirect, or nothing.
+ *
+ * `locale` is the locale the host worked out from the domain; a locale prefix
+ * in the path overrides it, because the address the visitor typed is the
+ * address they asked for. The answer carries the locale it resolved under, so
+ * the caller renders the page in the language the URL named rather than the one
+ * the host guessed.
+ *
+ * Slugs are compared as addresses, not as strings: both sides go through
+ * `servedPath` and `normalizeRoutePath`, the same pair the site builds its own
+ * links with. Before this, every locale's slugs went into one flat map and the
+ * first one entered won, so a Swedish and an English page sharing a slug were
+ * one page and the loser was unreachable — and `/Om-Oss` reached nothing at all.
+ *
+ * Within the resolved locale a slug answers both prefixed and bare, because a
+ * locale served from its own domain has no prefix to strip. Across locales
+ * nothing is shared, which is the whole point.
+ *
  * Slug overrides from `page_seo` win over the static registry; builder-created
  * pages resolve by bare key through the `lookupPageByKey` callback.
  */
@@ -115,15 +133,31 @@ export async function resolvePathCore(
     client: RedirectClient;
     pages: PageSlugRegistry;
     locales: readonly string[];
+    locale: string;
+    defaultLocale: string;
     lookupPageByKey: (key: string) => Promise<string | null>;
+    policy?: RoutePathPolicy;
   },
 ): Promise<PathResolution> {
-  const target = normalizePath(path);
+  const policy: RoutePathPolicy = { locales: deps.locales, ...(deps.policy ?? {}) };
+  const target = normalizeRoutePath(path, policy);
+
+  // The prefix in the URL beats the locale the host derived from the domain.
+  const first = target.split("/")[1] ?? "";
+  const prefixed = deps.locales.find((l) => l.toLowerCase() === first.toLowerCase());
+  const locale =
+    prefixed ?? (deps.locales.includes(deps.locale) ? deps.locale : deps.defaultLocale);
+
   const bySlug = new Map<string, string>();
   const put = (slug: string | undefined, key: string) => {
     if (slug === undefined || slug === null) return;
-    const p = slug === "" ? "/" : `/${slug.replace(/^\/+|\/+$/g, "")}`;
-    if (!bySlug.has(p)) bySlug.set(p, key);
+    for (const candidate of [
+      servedPath(slug, locale, deps.defaultLocale),
+      servedPath(slug, deps.defaultLocale, deps.defaultLocale),
+    ]) {
+      const p = normalizeRoutePath(candidate, policy);
+      if (!bySlug.has(p)) bySlug.set(p, key);
+    }
   };
 
   const { data: seoRows } = await deps.client.from("page_seo").select("page_key, slugs");
@@ -131,27 +165,35 @@ export async function resolvePathCore(
   for (const row of (seoRows ?? []) as { page_key: string; slugs: unknown }[]) {
     overrides.set(row.page_key, (row.slugs as Record<string, string>) ?? {});
   }
+  // Only this locale's slugs are consulted. A page with none falls back to its
+  // default-locale slug, exactly as path building does, so a page nobody has
+  // translated stays reachable under the prefix.
   for (const [key, slugs] of overrides) {
-    for (const locale of deps.locales) put(slugs[locale], key);
+    put(slugs[locale] ?? slugs[deps.defaultLocale], key);
   }
   for (const key of Object.keys(deps.pages)) {
     if (overrides.has(key)) continue;
-    for (const locale of deps.locales) put(deps.pages[key].slug[locale], key);
+    const slugs = deps.pages[key].slug;
+    put(slugs[locale] ?? slugs[deps.defaultLocale], key);
   }
 
   let pageKey = bySlug.get(target);
   if (!pageKey) {
-    const candidate = target.replace(/^\//, "");
+    const rest = prefixed ? target.slice(`/${prefixed}`.length) || "/" : target;
+    const candidate = rest.replace(/^\//, "");
     if (/^[a-z0-9_-]+$/.test(candidate)) {
       pageKey = (await deps.lookupPageByKey(candidate)) ?? undefined;
     }
   }
-  if (pageKey) return { kind: "page", pageKey };
+  if (pageKey) return { kind: "page", pageKey, locale };
 
+  // Redirect rows are literal strings an editor typed, matched as they were
+  // stored. Only page addresses go through the route identity; re-spelling a
+  // stored row here would look it up at an address the table does not hold.
   const { data: hit } = await deps.client
     .from("redirects")
     .select("to_path, status")
-    .eq("from_path", target)
+    .eq("from_path", normalizePath(path))
     .maybeSingle();
   if (hit) return { kind: "redirect", to: hit.to_path, status: hit.status ?? 301 };
 

package/src/server/schema-drift.ts

@@ -2,73 +2,29 @@
  * Canonical schema baseline shipped with this package version.
  *
  * `SCHEMA_MIGRATIONS` is the ordered list of migration files under
- * `@bygghammar/cms-platform/migrations`. A site compares it to the migrations
- * its database has actually applied so drift is visible in the backoffice
- * version screen instead of surfacing as a runtime error months later.
+ * `@bygghammar/cms-platform/migrations`, read from the generated manifest. A
+ * site compares it to the migrations its database has actually applied so
+ * drift is visible in the backoffice version screen instead of surfacing as a
+ * runtime error months later.
+ *
+ * The comparison is by name, because that is what migration tooling records.
+ * The manifest also carries each file's digest, and `platform/contract` exposes
+ * it as `migrationDigest`, for the separate question of whether a file by the
+ * right name holds the right bytes.
  */
 
-/** Every canonical migration filename, oldest first. */
-export const SCHEMA_MIGRATIONS: readonly string[] = [
-  "20260728113741_f9744b19-078b-46e5-b00f-31c84aaf71ab.sql",
-  "20260728113757_4156a886-21fb-4a1f-9c12-acb7bb145102.sql",
-  "20260728113823_6e0237e1-99e3-4e1a-8a68-804b7bcdbbb8.sql",
-  "20260728115305_506d92b4-129f-4d2b-961f-cf76e592677e.sql",
-  "20260728115320_717d4447-f433-4a1d-89d2-fc8f028d4ac6.sql",
-  "20260728115347_c77f5a56-19db-4117-bb60-9ad692b817ab.sql",
-  "20260728132052_b692dcfe-a944-4a19-afd0-187f7600feb8.sql",
-  "20260728183318_05b05a47-ba05-4a66-ab8f-69f2688fea84.sql",
-  "20260728193035_84b68d27-c3f3-4516-a3a9-15fc6f476163.sql",
-  "20260728193707_8438ee2d-d589-4048-86e2-464fd209af80.sql",
-  "20260729055312_08862d7e-0279-4d4f-8709-a59b9f068c55.sql",
-  "20260729055348_418b7e36-4877-4304-831f-290ca73e56f3.sql",
-  "20260729055358_20b467e2-4efd-42c1-bd34-773ed6b77fc5.sql",
-  "20260729061039_306859eb-a38c-44ef-af1a-6c02a8fd84db.sql",
-  "20260730065600_54c25861-3355-4600-a72f-3d67b457ecb1.sql",
-  "20260730071745_d4904314-15ff-4c58-ac66-85e7371e04b5.sql",
-  "20260730071914_48163aa3-830e-4dcc-bdd4-c35be282ab87.sql",
-  "20260730085949_bcfc3270-ea80-4617-86a3-2555ed34a280.sql",
-  "20260730095256_c977c30e-b285-4041-8804-c0bd72b6d9b3.sql",
-  "20260730100057_e341b887-eb0e-4a74-850e-0ee5ffb70d7a.sql",
-  "20260730103703_d5c4e1b7-1e2c-4dd0-be4e-185c159ade69.sql",
-  "20260730105635_3557b7da-919e-48db-8c92-8221d68d3cf9.sql",
-  "20260730120308_12ff8cfb-43f9-4070-abde-61531ad3b75f.sql",
-  "20260730125024_1baf8926-12a2-48f4-8edc-7309941309e9.sql",
-  "20260730173510_feb974d1-510e-4f52-9e20-5fd0582d8952.sql",
-  "20260730175409_9f60743f-f5e1-418c-a700-c91fb3704db8.sql",
-  "20260730181224_1c52ff16-c7a2-4ef1-a0a8-e493c2c9106f.sql",
-  "20260730183129_933adb75-f985-4d82-ad5d-213b69fd42e5.sql",
-  "20260730183918_7bc7a827-2100-49f1-bc6e-24509249350b.sql",
-  "20260730202628_7ceade5e-644c-4bc2-91b8-594133329f31.sql",
-  "20260730211056_57f42049-00b4-473b-a2cd-65a13570b8d2.sql",
-  "20260730214340_98af2e55-9031-4c11-9659-c47a37a8d6b7.sql",
-  "20260731091630_8a6f28ce-5833-4901-ab17-27648cef32ec.sql",
-  "20260731094716_4c68a1df-83ed-4ba8-8019-fa2fe2b9681e.sql",
-  "20260731191655_fef97c3c-1397-47b4-8b56-afb020298e97.sql",
-  "20260731192212_95772a2f-19a1-4013-b463-2eb161e96737.sql",
-  "20260731192815_c490653e-1232-4ad9-a150-3c83d2b90f5e.sql",
-  "20260731193135_7966e740-5e86-4b14-8e1d-5119069666ba.sql",
-  "20260731193245_599790d0-ca5e-4b5d-a3e7-d69b2a79e1a3.sql",
-  "20260731212959_a748cb0d-4dc7-45dc-be90-f6bacbfab26c.sql",
-  "20260801003057_1195f4c1-fb54-42dc-9718-638a25e6a82e.sql",
-  "20260801003300_fc591960-cb41-41cf-837d-2eef23b29ca9.sql",
-  "20260802151445_a56b0023-eaf7-41e2-a7fb-d4beddfc587c.sql",
-  "20260802202621_d661af8a-8513-4b54-b375-f963ae824c8f.sql",
-  "20260802202702_c30cd837-744c-4641-85f1-edd3a7ebbcb6.sql",
-  "20260802202720_4418d18d-c851-42dc-9345-78fc330128ae.sql",
-  "20260803132514_78ba1f53-c85b-4457-96b1-7d49c5c8b494.sql",
-  "20260803181201_28c8aa09-baa8-431c-8338-90b1af9c8172.sql",
-  "20260803201518_6e8a6028-b70f-4a7d-8bc9-95c86304e7ae.sql",
-  "20260803201535_32a9a213-cb92-4035-b8cd-8211ca34af68.sql",
-  "20260811103505_29df753d-14fa-4a05-8fea-f4207785fba3.sql",
-  "20260811130318_7cb95e95-9baa-40af-8f3f-de1d4e09cec4.sql",
-  "20260818040722_1bdf1b8f-7fb0-4ae8-8ecf-73f1fadff3c2.sql",
-  "20260818040808_69a5e832-57e8-4aa7-aff8-7fd7777faa7c.sql",
-  "20260818040839_e6523163-bbf5-4a39-9233-91759059569a.sql",
-  "20260902090000_dc072b25-8467-46ae-aef3-0ccdf40aa7eb.sql",
-  "20260904090000_c54603f8-a155-40f8-a86c-54434aa5c0ae.sql",
-  "20260904140000_9f2a7c41-06d5-4d6b-8b4e-1c7a5d3e9b20.sql",
-  "20260904160000_0d565000-2839-4738-aacc-537d7090398f.sql",
-];
+import { MIGRATION_NAMES } from "../platform/migration-manifest";
+
+/**
+ * Every canonical migration filename, oldest first.
+ *
+ * Derived from the generated catalog, which is written from the `migrations/`
+ * directory itself. This module and `platform/contract` used to hold separate
+ * copies of the same sixty names; a site that trusts one and displays the
+ * other must not be able to see two answers, and equality by construction is a
+ * stronger guarantee than a test noticing they had already diverged.
+ */
+export const SCHEMA_MIGRATIONS: readonly string[] = MIGRATION_NAMES;
 
 /** Schema baseline version = the newest canonical migration. */
 export const SCHEMA_BASELINE = SCHEMA_MIGRATIONS[SCHEMA_MIGRATIONS.length - 1] ?? "";