@bygghammar/cms-platform 0.93.0 → 0.95.0

package/src/admin/version-report.ts

@@ -0,0 +1,295 @@
+/**
+ * The version screen's data contract, and the update policy it is judged by.
+ *
+ * Neutral on purpose: the server builds a `VersionReport` (see `version-core`)
+ * and the backoffice renders it, so the types and the pure decisions live here,
+ * in a module both sides may import. Nothing in this file reads the network,
+ * the environment or the database.
+ *
+ * Update policy, stated once:
+ *
+ * - Versions are ordered by semver precedence, never as strings and never by
+ *   publication date.
+ * - A release install (`0.93.0`) follows the **stable** channel: the newest
+ *   published, non-deprecated release version. Prereleases never count as
+ *   updates for it, whatever their dist-tag.
+ * - A prerelease install (`0.2.0-m7.9`) follows its **prerelease line**: the
+ *   same `major.minor.patch` and first prerelease identifier (`0.2.0-m7`).
+ *   Being the newest of that line is reported as "prerelease installed", not
+ *   "up to date". A newer stable release, if one exists, is reported beside it
+ *   as advisory information, never as the line's update.
+ * - An installed version the registry does not list is "not published" or
+ *   "ahead of registry"; an unknown or unparseable installed version, or no
+ *   registry answer at all, is never called up to date.
+ */
+import { compareSemver, isPrerelease, parseSemver, prereleaseLine, type SemVer } from "./semver";
+
+/** One published version, as the registry describes it. */
+export type RegistryVersion = {
+  readonly publishedAt: string | null;
+  readonly deprecated: boolean;
+};
+
+/** The subset of registry metadata the version screen uses. */
+export type RegistryMetadata = {
+  readonly distTags: Readonly<Record<string, string>>;
+  /** Keyed by normalized version (`major.minor.patch[-prerelease]`). */
+  readonly versions: Readonly<Record<string, RegistryVersion>>;
+};
+
+/** Fixed, non-sensitive reasons a registry lookup did not produce metadata. */
+export type RegistryError =
+  | "timeout"
+  | "network"
+  | "http"
+  | "not-found"
+  | "malformed"
+  | "too-large"
+  | "not-allowed";
+
+/**
+ * `fresh`: the most recent attempt succeeded, within the cache lifetime.
+ * `stale`: an older successful answer is being shown, because the most recent
+ * attempt failed (see `error`) or the answer outlived the cache lifetime; it is
+ * cached, not re-verified. `unavailable`: no successful answer is held.
+ */
+export type RegistryCheckState = "fresh" | "stale" | "unavailable";
+
+export type RegistryCheck = {
+  readonly state: RegistryCheckState;
+  /** When the registry last answered with usable metadata (ISO 8601). */
+  readonly lastSuccessAt: string | null;
+  /** When the most recent lookup was attempted, successful or not (ISO 8601). */
+  readonly lastAttemptAt: string | null;
+  /** Why the most recent attempt failed, if it did. */
+  readonly error: RegistryError | null;
+};
+
+export type UpdateStatus =
+  | "up-to-date"
+  | "update-available"
+  | "prerelease-current"
+  | "check-unavailable"
+  | "not-published"
+  | "ahead-of-registry"
+  | "installed-unknown"
+  | "installed-invalid";
+
+export type UpdateChannel = { kind: "stable" } | { kind: "prerelease"; line: string };
+
+export type PublishedVersion = { version: string; publishedAt: string | null };
+
+export type PackageUpdate = {
+  readonly status: UpdateStatus;
+  readonly channel: UpdateChannel | null;
+  /** Publication date of the installed version, when the registry lists it. */
+  readonly installedPublishedAt: string | null;
+  readonly installedDeprecated: boolean;
+  /** Newest published, non-deprecated version in the installed version's channel. */
+  readonly latestInChannel: PublishedVersion | null;
+  /** For a prerelease install: the newest stable release newer than it. Advisory only. */
+  readonly newerStable: PublishedVersion | null;
+  /** Registry dist-tags that currently point at the installed version. */
+  readonly installedTags: readonly string[];
+};
+
+export type PackageRole = "cms" | "module";
+
+/** One first-party package as installed in this build, with its registry verdict. */
+export type PackageReport = {
+  readonly name: string;
+  readonly role: PackageRole;
+  /** Exact version in the build's installed dependency tree. */
+  readonly installed: string | null;
+  /** What the site's own manifest declares for it (a range or exact version). */
+  readonly declared: string | null;
+  /** The range the installed CMS package declares for it, for module packages. */
+  readonly requiredByCms: string | null;
+  readonly registry: RegistryCheck;
+  readonly update: PackageUpdate;
+};
+
+export type ReleaseIdentity = {
+  /** The deployed release, e.g. a full commit SHA. `null` when not reported. */
+  readonly value: string | null;
+  readonly kind: "commit" | "label" | null;
+  /** The runtime variable it was read from. */
+  readonly source: string | null;
+  /** True when a value was present but not in a recognised format (it is not echoed). */
+  readonly unrecognized: boolean;
+};
+
+export type ReleaseHistoryEntry = {
+  readonly version: string;
+  readonly publishedAt: string | null;
+  readonly prerelease: boolean;
+  readonly current: boolean;
+};
+
+export type VersionReport = {
+  readonly schemaVersion: 1;
+  /** When the server assembled this report (ISO 8601). */
+  readonly generatedAt: string;
+  readonly release: ReleaseIdentity;
+  readonly environment: { readonly name: string | null; readonly origin: string | null };
+  /** When the server bundle was built. Not a deployment time. */
+  readonly builtAt: string | null;
+  /** When this release went live, only if the host has real evidence of it. */
+  readonly deployedAt: string | null;
+  /** The CMS package first, then module packages. */
+  readonly packages: readonly PackageReport[];
+  /** Recent CMS package publications, newest publication first. */
+  readonly releaseHistory: readonly ReleaseHistoryEntry[];
+  /** The earliest time a manual "check again" will reach the registry (ISO 8601). */
+  readonly nextCheckAllowedAt: string | null;
+};
+
+type Published = { sv: SemVer; info: RegistryVersion };
+
+function maxOf(list: readonly Published[]): Published | null {
+  let best: Published | null = null;
+  for (const p of list) if (!best || compareSemver(p.sv, best.sv) > 0) best = p;
+  return best;
+}
+
+function asPublished(p: Published | null): PublishedVersion | null {
+  return p ? { version: p.sv.version, publishedAt: p.info.publishedAt } : null;
+}
+
+function inChannel(sv: SemVer, channel: UpdateChannel): boolean {
+  return channel.kind === "stable" ? !isPrerelease(sv) : prereleaseLine(sv) === channel.line;
+}
+
+const EMPTY_UPDATE = {
+  channel: null,
+  installedPublishedAt: null,
+  installedDeprecated: false,
+  latestInChannel: null,
+  newerStable: null,
+  installedTags: [],
+} as const;
+
+/** Judge one installed version against registry metadata, by the policy above. */
+export function evaluatePackageUpdate(
+  installedRaw: string | null | undefined,
+  metadata: RegistryMetadata | null | undefined,
+): PackageUpdate {
+  if (!installedRaw) return { ...EMPTY_UPDATE, status: "installed-unknown" };
+  const installed = parseSemver(installedRaw);
+  if (!installed) return { ...EMPTY_UPDATE, status: "installed-invalid" };
+
+  const line = prereleaseLine(installed);
+  const channel: UpdateChannel = line ? { kind: "prerelease", line } : { kind: "stable" };
+  if (!metadata) return { ...EMPTY_UPDATE, channel, status: "check-unavailable" };
+
+  const published: Published[] = [];
+  for (const [key, info] of Object.entries(metadata.versions)) {
+    const sv = parseSemver(key);
+    if (sv) published.push({ sv, info });
+  }
+  const own = published.find((p) => compareSemver(p.sv, installed) === 0) ?? null;
+  const live = published.filter((p) => !p.info.deprecated);
+  const latest = maxOf(live.filter((p) => inChannel(p.sv, channel)));
+  const installedTags = Object.entries(metadata.distTags)
+    .filter(([, v]) => {
+      const sv = parseSemver(v);
+      return sv !== null && compareSemver(sv, installed) === 0;
+    })
+    .map(([tag]) => tag)
+    .sort();
+  const newerStable =
+    channel.kind === "prerelease"
+      ? maxOf(live.filter((p) => !isPrerelease(p.sv) && compareSemver(p.sv, installed) > 0))
+      : null;
+
+  const common = {
+    channel,
+    installedPublishedAt: own?.info.publishedAt ?? null,
+    installedDeprecated: own?.info.deprecated ?? false,
+    latestInChannel: asPublished(latest),
+    newerStable: asPublished(newerStable),
+    installedTags,
+  };
+
+  if (!own) {
+    // Not in the registry: a local or unpublished build. It is "ahead" only
+    // when it is newer than everything published in its channel (or, with an
+    // empty channel, than everything published at all).
+    const reference = latest ?? maxOf(published);
+    const ahead = reference !== null && compareSemver(installed, reference.sv) > 0;
+    return { ...common, status: ahead ? "ahead-of-registry" : "not-published" };
+  }
+  if (latest && compareSemver(installed, latest.sv) < 0) {
+    return { ...common, status: "update-available" };
+  }
+  return { ...common, status: channel.kind === "stable" ? "up-to-date" : "prerelease-current" };
+}
+
+/** Statuses that should draw an administrator's attention beyond "an update exists". */
+const ATTENTION: ReadonlySet<UpdateStatus> = new Set([
+  "not-published",
+  "ahead-of-registry",
+  "installed-unknown",
+  "installed-invalid",
+]);
+
+export type UpdateSummaryKind =
+  | "updates-available"
+  | "attention"
+  | "up-to-date"
+  | "partial"
+  | "unavailable";
+
+export type UpdateSummary = {
+  readonly kind: UpdateSummaryKind;
+  readonly updates: readonly string[];
+  readonly prereleases: readonly string[];
+  readonly attention: readonly string[];
+  readonly unavailable: readonly string[];
+  /** Oldest "last successful check" across the packages, when every one has one. */
+  readonly checkedAt: string | null;
+  /** True when any package's registry answer is cached rather than current. */
+  readonly stale: boolean;
+  /** Packages whose most recent registry attempt failed. */
+  readonly failed: readonly string[];
+  /**
+   * True only when every package has a fresh answer from a successful most
+   * recent attempt. A verdict built on cached answers is not verified.
+   */
+  readonly verified: boolean;
+};
+
+/** One overall verdict for the summary banner. */
+export function summarizeUpdates(packages: readonly PackageReport[]): UpdateSummary {
+  const updates: string[] = [];
+  const prereleases: string[] = [];
+  const attention: string[] = [];
+  const unavailable: string[] = [];
+  for (const p of packages) {
+    const s = p.update.status;
+    if (s === "update-available") updates.push(p.name);
+    if (s === "prerelease-current" || (s === "update-available" && p.update.channel?.kind === "prerelease"))
+      prereleases.push(p.name);
+    if (ATTENTION.has(s) || p.update.installedDeprecated) attention.push(p.name);
+    if (s === "check-unavailable") unavailable.push(p.name);
+  }
+  const successes = packages.map((p) => p.registry.lastSuccessAt);
+  const checkedAt =
+    packages.length > 0 && successes.every((t): t is string => typeof t === "string")
+      ? successes.reduce((a, b) => (a < b ? a : b))
+      : null;
+  const stale = packages.some((p) => p.registry.state === "stale");
+  const failed = packages.filter((p) => p.registry.error !== null).map((p) => p.name);
+  const verified =
+    packages.length > 0 &&
+    packages.every((p) => p.registry.state === "fresh" && p.registry.error === null);
+
+  let kind: UpdateSummaryKind;
+  if (packages.length === 0 || unavailable.length === packages.length) kind = "unavailable";
+  else if (updates.length > 0) kind = "updates-available";
+  else if (attention.length > 0) kind = "attention";
+  else if (unavailable.length > 0) kind = "partial";
+  else kind = "up-to-date";
+
+  return { kind, updates, prereleases, attention, unavailable, checkedAt, stale, failed, verified };
+}

package/src/backoffice/BookingSettingsCard.tsx

@@ -0,0 +1,252 @@
+/**
+ * Site settings → Booking: one switch for every booking link on the public
+ * site, and the pages that keep theirs while it is off.
+ *
+ * What it does is said on the card, because the switch is easy to misread in
+ * both directions: it hides links and the header button, it does not close the
+ * booking site, and an address somebody already has still works.
+ */
+import { useState, type ReactNode } from "react";
+import { toast } from "sonner";
+import { Plus, Trash2 } from "lucide-react";
+
+import { ConfirmDialog } from "./media/ConfirmDialog";
+
+export type BookingSettingsData = {
+  enabled: boolean;
+  version: string | null;
+  exceptions: Array<{
+    pageId: string;
+    key: string | null;
+    name: string | null;
+    missing: boolean;
+    version: string | null;
+  }>;
+  /** Versions of every stored exception row, removed ones included. */
+  rowVersions?: Record<string, string | null>;
+};
+
+export type BookingSettingsDeps = {
+  /** Undefined while loading. */
+  settings: BookingSettingsData | undefined;
+  /** A failed read: the card says so and offers nothing it cannot back up. */
+  error: Error | null;
+  /** Pages an exception can be added for. */
+  pages: Array<{ id: string; key: string; name: string }> | undefined;
+  /** Public path of a page key, for the list. */
+  pathFor: (key: string) => string;
+  setEnabled: (input: { enabled: boolean; expectedVersion: string | null }) => Promise<unknown>;
+  setException: (input: {
+    pageId: string;
+    exception: boolean;
+    expectedVersion: string | null;
+  }) => Promise<unknown>;
+  refresh: () => void;
+};
+
+const cardClass = "border border-ink/10 bg-white p-6";
+
+export function BookingSettingsCard({ deps }: { deps: BookingSettingsDeps }): ReactNode {
+  const { settings, error, pages, pathFor } = deps;
+  const [confirming, setConfirming] = useState<boolean | null>(null);
+  const [adding, setAdding] = useState("");
+  const [busy, setBusy] = useState(false);
+
+  const run = async (action: () => Promise<unknown>, done: string) => {
+    setBusy(true);
+    try {
+      await action();
+      toast.success(done);
+    } catch (e) {
+      toast.error(e instanceof Error ? e.message : "Failed to save");
+    } finally {
+      setBusy(false);
+      // Success or conflict alike: show what is stored now.
+      deps.refresh();
+    }
+  };
+
+  const exceptionIds = new Set((settings?.exceptions ?? []).map((row) => row.pageId));
+  const candidates = (pages ?? [])
+    .filter((page) => !exceptionIds.has(page.id.toLowerCase()))
+    .sort((a, b) => a.name.localeCompare(b.name));
+
+  return (
+    <section className={`mt-6 ${cardClass}`} aria-labelledby="booking-settings-title">
+      <h2 id="booking-settings-title" className="font-serif text-xl text-ink">
+        Booking
+      </h2>
+      <p className="mt-2 max-w-2xl text-sm text-ink/60">
+        Booking links are links and buttons whose address starts with{" "}
+        <code className="font-mono text-xs">https://booking</code>, for example{" "}
+        <code className="font-mono text-xs">https://booking.voyara.se</code>. Hiding booking removes
+        them from every page, together with the booking button in the menu. The booking site itself
+        keeps working, and an address someone already has still opens.
+      </p>
+
+      {error ? (
+        <p role="alert" className="mt-4 text-sm text-red-700">
+          The booking setting could not be read: {error.message}. Nothing is shown here until it
+          can be, so nothing is changed by mistake.
+        </p>
+      ) : !settings ? (
+        <p className="mt-4 text-sm text-ink/50">Loading…</p>
+      ) : (
+        <>
+          <div className="mt-5 flex flex-wrap items-center gap-4">
+            <p className="text-sm text-ink" aria-live="polite">
+              {settings.enabled ? (
+                <>
+                  Booking is <strong>shown</strong> on the website.
+                </>
+              ) : (
+                <>
+                  Booking is <strong>hidden</strong> on the website.
+                </>
+              )}
+            </p>
+            <button
+              type="button"
+              disabled={busy}
+              onClick={() => setConfirming(!settings.enabled)}
+              className={[
+                "inline-flex items-center gap-2 px-4 py-2 text-xs uppercase tracking-[0.18em] disabled:opacity-40",
+                settings.enabled
+                  ? "border border-red-300 text-red-700 hover:border-red-600"
+                  : "bg-ink text-paper hover:bg-ink/85",
+              ].join(" ")}
+            >
+              {settings.enabled ? "Hide booking" : "Show booking"}
+            </button>
+          </div>
+
+          <div className="mt-8 border-t border-ink/10 pt-5">
+            <h3 className="text-xs uppercase tracking-wider text-ink/60">
+              Pages that keep their booking links
+            </h3>
+            <p className="mt-2 max-w-2xl text-sm text-ink/60">
+              While booking is hidden, these pages still show the booking links in their own
+              content — for example a link-only page for one group. The booking button in the menu
+              stays hidden on them too.
+            </p>
+            <ul className="mt-4 divide-y divide-ink/10 border border-ink/10">
+              {settings.exceptions.length === 0 ? (
+                <li className="px-4 py-3 text-sm text-ink/50">No pages.</li>
+              ) : (
+                settings.exceptions.map((row) => (
+                  <li
+                    key={row.pageId}
+                    className="flex flex-wrap items-center justify-between gap-3 px-4 py-3 text-sm"
+                  >
+                    <span className="min-w-0">
+                      <span className="text-ink">{row.name ?? "Page no longer exists"}</span>
+                      {row.key ? (
+                        <span className="ml-2 break-all font-mono text-xs text-ink/50">
+                          {pathFor(row.key)}
+                        </span>
+                      ) : null}
+                      {row.missing ? (
+                        <span className="ml-2 text-xs text-ink/50">
+                          (in the trash or deleted — has no effect)
+                        </span>
+                      ) : null}
+                    </span>
+                    <button
+                      type="button"
+                      disabled={busy}
+                      onClick={() =>
+                        run(
+                          () =>
+                            deps.setException({
+                              pageId: row.pageId,
+                              exception: false,
+                              expectedVersion: row.version,
+                            }),
+                          `Removed ${row.name ?? "the page"}`,
+                        )
+                      }
+                      className="inline-flex items-center gap-1 text-xs text-red-700 hover:underline disabled:opacity-40"
+                    >
+                      <Trash2 className="size-3.5" aria-hidden="true" /> Remove
+                      <span className="sr-only"> {row.name ?? "page"} from the list</span>
+                    </button>
+                  </li>
+                ))
+              )}
+            </ul>
+            <div className="mt-4 flex flex-wrap items-end gap-3">
+              <label className="block min-w-0 flex-1 sm:max-w-sm">
+                <span className="mb-1 block text-xs uppercase tracking-wider text-ink/60">
+                  Add a page
+                </span>
+                <select
+                  value={adding}
+                  onChange={(e) => setAdding(e.target.value)}
+                  disabled={busy || !pages}
+                  className="w-full border border-ink/15 bg-white px-3 py-2 text-sm text-ink"
+                >
+                  <option value="">Choose a page…</option>
+                  {candidates.map((page) => (
+                    <option key={page.id} value={page.id}>
+                      {page.name} — {pathFor(page.key)}
+                    </option>
+                  ))}
+                </select>
+              </label>
+              <button
+                type="button"
+                disabled={busy || !adding}
+                onClick={() => {
+                  const page = candidates.find((p) => p.id === adding);
+                  // An exception removed earlier leaves its row behind; send its version.
+                  const previous = settings.rowVersions?.[adding.toLowerCase()] ?? null;
+                  void run(
+                    () =>
+                      deps.setException({
+                        pageId: adding,
+                        exception: true,
+                        expectedVersion: previous,
+                      }),
+                    `${page?.name ?? "The page"} keeps its booking links`,
+                  ).then(() => setAdding(""));
+                }}
+                className="inline-flex items-center gap-2 border border-ink/20 px-4 py-2 text-xs uppercase tracking-[0.18em] hover:border-ink disabled:opacity-40"
+              >
+                <Plus className="size-4" aria-hidden="true" /> Add
+              </button>
+            </div>
+          </div>
+        </>
+      )}
+
+      {confirming !== null && settings ? (
+        <ConfirmDialog
+          title={confirming ? "Show booking on the website?" : "Hide booking on the website?"}
+          description={
+            confirming
+              ? "Booking links and the booking button in the menu appear again on every page."
+              : "Every link and button that goes to a booking site is removed from the public website, on every page, together with the booking button in the menu."
+          }
+          consequences={
+            confirming
+              ? ["The booking button in the menu also needs its booking page to be published and listed."]
+              : [
+                  "Pages in the list below keep the booking links in their own content.",
+                  "The booking site itself is not closed: anyone who already has a booking address can still use it.",
+                ]
+          }
+          confirmLabel={confirming ? "Show booking" : "Hide booking"}
+          danger={!confirming}
+          busy={busy}
+          onConfirm={() =>
+            void run(
+              () => deps.setEnabled({ enabled: confirming, expectedVersion: settings.version }),
+              confirming ? "Booking is shown on the website" : "Booking is hidden on the website",
+            ).then(() => setConfirming(null))
+          }
+          onCancel={() => setConfirming(null)}
+        />
+      ) : null}
+    </section>
+  );
+}

package/src/backoffice/NavigationView.tsx

@@ -7,6 +7,11 @@ import { EDIT_LOCK_TYPES } from "../cms/edit-lock";
 import type { SiteTypography, TypographySlot } from "../config/typography";
 import { EditLockBanner, EditLockFence, useEditLock } from "./EditLock";
 import { TypographyPanel } from "./TypographyPanel";
+import {
+  HIDDEN_LINK_REASONS,
+  hiddenSavedLinks,
+  type LinkVisibilityPolicy,
+} from "../navigation/visibility";
 
 /** The two site-wide content sections this screen edits. */
 export type NavigationSectionKey = "nav" | "footer";
@@ -19,6 +24,12 @@ const TYPOGRAPHY_SLOT: Record<NavigationSectionKey, TypographySlot> = {
 
 /** Host-provided data and actions for the navigation & footer screen. */
 export type NavigationDeps = {
+  /**
+   * The link policy the public site applies right now. With it, the editor
+   * lists saved items the site is not showing and says why; without it,
+   * nothing is said. The saved menu is never changed either way.
+   */
+  linkPolicy?: LinkVisibilityPolicy;
   /** Saved overrides keyed by section, as stored in the CMS. */
   overrides: Record<string, unknown> | undefined;
   /** Resolved live site content (defaults merged with overrides). */
@@ -77,6 +88,11 @@ function Editor({
   }, [overrides, site, sectionKey]);
 
   const [draft, setDraft] = useState<unknown>(current);
+  // About what is saved, not the unsaved draft: this is what visitors get now.
+  const notShown = useMemo(
+    () => (deps.linkPolicy ? hiddenSavedLinks(sectionKey, current, deps.linkPolicy) : []),
+    [deps.linkPolicy, sectionKey, current],
+  );
   const [busy, setBusy] = useState(false);
   const [dirty, setDirty] = useState(false);
 
@@ -127,6 +143,28 @@ function Editor({
 
       <div className="p-6">
         <EditLockBanner lock={lock} className="mb-6" />
+        {notShown.length > 0 ? (
+          <div
+            role="status"
+            className="mb-6 border border-brass/50 bg-brass/10 px-4 py-3 text-sm text-ink"
+          >
+            <p className="font-medium">
+              {notShown.length === 1
+                ? "1 saved link is not shown on the site right now."
+                : `${notShown.length} saved links are not shown on the site right now.`}{" "}
+              They stay saved and come back by themselves.
+            </p>
+            <ul className="mt-2 space-y-1">
+              {notShown.map((item, index) => (
+                <li key={`${item.href}-${index}`} className="break-words">
+                  <span className="text-ink">{item.label}</span>{" "}
+                  <span className="font-mono text-xs text-ink/60">{item.href}</span> —{" "}
+                  <span className="text-ink/70">{HIDDEN_LINK_REASONS[item.reason]}</span>
+                </li>
+              ))}
+            </ul>
+          </div>
+        ) : null}
 
         <EditLockFence lock={lock}>
           <SectionForm