@bygghammar/cms-platform 0.94.0 → 0.96.0

package/src/server/page-visibility-core.ts

@@ -0,0 +1,450 @@
+/**
+ * Page listing, the booking switch and its exception pages: storage, staff
+ * writes and the public policy read.
+ *
+ * Stored in the existing `site_settings` key/value table, one row per decision,
+ * so no migration is needed and two editors changing two different pages never
+ * touch the same row:
+ *
+ * | key                           | value                          | absent means   |
+ * |-------------------------------|--------------------------------|----------------|
+ * | `page.listing.<page uuid>`    | `{ "listing": "link-only" }`   | listed         |
+ * | `booking`                     | `{ "enabled": false }`         | booking on     |
+ * | `booking.exception.<uuid>`    | `{ "exception": true }`        | no exception   |
+ *
+ * Keys use the page's id, never its key or address, so every alias and locale
+ * of a page shares one decision, a restored page keeps its own, and a page
+ * purged and recreated under the same key starts fresh.
+ *
+ * Every write is a compare-and-swap on the row's `updated_at` (which the
+ * table's trigger moves on each update): the editor sends the version it was
+ * shown, and a write against anything else is refused as a conflict instead of
+ * silently replacing a colleague's change. A first write inserts and refuses
+ * if someone else's insert got there first.
+ *
+ * None of these rows is an `OVERRIDABLE_SETTING_KEYS` key, so the generic
+ * settings save and reset cannot read, overwrite or erase them.
+ */
+import { EDIT_LOCK_TYPES } from "../cms/edit-lock";
+import {
+  nextPublicationBoundary,
+  publicVersionId,
+  toPublicationWindows,
+  type PublicationWindow,
+} from "../cms/page-publication";
+import {
+  normalizePageListing,
+  type PageListing,
+  type PolicyPage,
+  type PublicPolicySnapshot,
+} from "../cms/page-visibility";
+import { auditAs } from "./audit-core";
+import { assertEditable } from "./edit-locks-core";
+import { assertStaff, type PlatformAuthContext } from "./guards";
+import { invalidatePublishedCache, withPublishedCache } from "./published-cache";
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+export const SITE_SETTINGS = "site_settings";
+export const PAGE_LISTING_PREFIX = "page.listing.";
+export const BOOKING_SETTING_KEY = "booking";
+export const BOOKING_EXCEPTION_PREFIX = "booking.exception.";
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/** Request context of a signed-in staff user, as every page core takes it. */
+export type VisibilityContext = PlatformAuthContext & { supabase: any };
+
+export type VisibilityDeps = {
+  context: VisibilityContext;
+  /**
+   * Keys of pages that must always stay published and listed — for Voyara the
+   * start page and the contact page. Supplied by the host's server code, never
+   * by the browser.
+   */
+  protectedPageKeys: readonly string[];
+};
+
+/** Someone else changed the same decision since the editor last looked. */
+export class VisibilityConflictError extends Error {
+  readonly code = "visibility_conflict";
+  constructor(what: string) {
+    super(
+      `Someone else changed ${what} a moment ago, so nothing was saved. ` +
+        "Reload to see the current setting, then try again.",
+    );
+    this.name = "VisibilityConflictError";
+  }
+}
+
+/** A version token as the client may send it back: a timestamp string, or null for "no row yet". */
+export type VersionToken = string | null;
+
+type SettingRow = { key: string; value: unknown; updated_at: string | null };
+
+function record(value: unknown): Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+/** Every visibility row, read in one query. A failed read throws; it is never "nothing stored". */
+export async function readVisibilitySettingsCore(client: any): Promise<VisibilitySettings> {
+  const { data, error } = await client.from(SITE_SETTINGS).select("key, value, updated_at");
+  if (error) throw new Error(error.message);
+  const settings: VisibilitySettings = {
+    booking: { enabled: true, version: null },
+    listings: new Map(),
+    exceptions: new Map(),
+  };
+  for (const row of (data ?? []) as SettingRow[]) {
+    const version = row.updated_at ?? null;
+    if (row.key === BOOKING_SETTING_KEY) {
+      // Only an explicit `false` turns booking off; anything else is today's behaviour.
+      settings.booking = { enabled: record(row.value)["enabled"] !== false, version };
+    } else if (row.key.startsWith(PAGE_LISTING_PREFIX)) {
+      const pageId = row.key.slice(PAGE_LISTING_PREFIX.length);
+      if (UUID.test(pageId)) {
+        settings.listings.set(pageId.toLowerCase(), {
+          listing: normalizePageListing(record(row.value)["listing"]),
+          version,
+        });
+      }
+    } else if (row.key.startsWith(BOOKING_EXCEPTION_PREFIX)) {
+      const pageId = row.key.slice(BOOKING_EXCEPTION_PREFIX.length);
+      if (UUID.test(pageId)) {
+        settings.exceptions.set(pageId.toLowerCase(), {
+          exception: record(row.value)["exception"] === true,
+          version,
+        });
+      }
+    }
+  }
+  return settings;
+}
+
+export type VisibilitySettings = {
+  booking: { enabled: boolean; version: VersionToken };
+  listings: Map<string, { listing: PageListing; version: VersionToken }>;
+  exceptions: Map<string, { exception: boolean; version: VersionToken }>;
+};
+
+/**
+ * A version that differs from `expected` even on a table without the
+ * `updated_at` trigger. With the trigger the database replaces it with its own
+ * `now()`, which differs too.
+ */
+function nextVersion(expected: string): string {
+  const seen = Date.parse(expected);
+  return new Date(Math.max(Date.now(), Number.isFinite(seen) ? seen + 1 : 0)).toISOString();
+}
+
+/**
+ * Write one row only if it is still the version the editor saw. Returns the
+ * new version, or throws {@link VisibilityConflictError}.
+ */
+async function compareAndSwap(
+  client: any,
+  key: string,
+  value: Record<string, unknown>,
+  expected: VersionToken,
+  actorId: string,
+  what: string,
+): Promise<string> {
+  if (expected === null) {
+    const { data, error } = await client
+      .from(SITE_SETTINGS)
+      .upsert({ key, value, updated_by: actorId }, { onConflict: "key", ignoreDuplicates: true })
+      .select("updated_at");
+    if (error) throw new Error(error.message);
+    const row = ((data ?? []) as SettingRow[])[0];
+    if (!row) throw new VisibilityConflictError(what);
+    return String(row.updated_at ?? "");
+  }
+  const { data, error } = await client
+    .from(SITE_SETTINGS)
+    .update({ value, updated_by: actorId, updated_at: nextVersion(expected) })
+    .eq("key", key)
+    .eq("updated_at", expected)
+    .select("updated_at");
+  if (error) throw new Error(error.message);
+  const row = ((data ?? []) as SettingRow[])[0];
+  if (!row) throw new VisibilityConflictError(what);
+  return String(row.updated_at ?? "");
+}
+
+type PageRow = { id: string; key: string; name: string };
+
+async function readLivePage(client: any, pageId: string): Promise<PageRow> {
+  if (!UUID.test(pageId)) throw new Error("Page not found");
+  const { data, error } = await client
+    .from("pages")
+    .select("id,key,name")
+    .eq("id", pageId)
+    .is("deleted_at", null)
+    .maybeSingle();
+  if (error) throw new Error(error.message);
+  if (!data) throw new Error("Page not found");
+  return data as PageRow;
+}
+
+/** Thrown when an action would take a protected page off the site or out of its lists. */
+export class ProtectedPageError extends Error {
+  readonly code = "protected_page";
+  constructor(name: string, action: string) {
+    super(
+      `“${name}” is protected and cannot be ${action}: the start page and the contact page ` +
+        "always stay published and listed.",
+    );
+    this.name = "ProtectedPageError";
+  }
+}
+
+/** Throws when `key` is one of the host's protected pages. */
+export function assertNotProtected(
+  protectedPageKeys: readonly string[] | undefined,
+  page: { key: string; name: string },
+  action: string,
+): void {
+  if ((protectedPageKeys ?? []).includes(page.key)) throw new ProtectedPageError(page.name, action);
+}
+
+/**
+ * Make a page link-only, or list it again.
+ *
+ * Changes listing and nothing else: no publication, version, schedule or
+ * status is read for writing, let alone changed — so "Show on website" cannot
+ * publish an offline page, and a link-only page stays link-only through every
+ * later save, publish or scheduled replacement.
+ */
+export async function setPageListingCore(
+  deps: VisibilityDeps,
+  input: {
+    pageId: string;
+    listing: PageListing;
+    expectedVersion: VersionToken;
+    editSessionId?: string;
+  },
+): Promise<{ listing: PageListing; version: string }> {
+  const { context } = deps;
+  await assertStaff(context);
+  await assertEditable(context, {
+    resourceType: EDIT_LOCK_TYPES.page,
+    resourceId: input.pageId,
+    sessionId: input.editSessionId,
+  });
+  const page = await readLivePage(context.supabase, input.pageId);
+  const listing = normalizePageListing(input.listing);
+  if (listing === "link-only") assertNotProtected(deps.protectedPageKeys, page, "made link-only");
+
+  invalidatePublishedCache();
+  const version = await compareAndSwap(
+    context.supabase,
+    `${PAGE_LISTING_PREFIX}${page.id.toLowerCase()}`,
+    { listing },
+    input.expectedVersion,
+    context.userId,
+    `whether “${page.name}” is listed`,
+  );
+  invalidatePublishedCache();
+  await auditAs(context, {
+    action: "page.listing",
+    entity: "pages",
+    entityId: page.id,
+    meta: {
+      key: page.key,
+      listing,
+      description:
+        listing === "link-only"
+          ? `Made the page "${page.name}" link-only — it is left out of menus, footer and sitemap and marked noindex.`
+          : `Listed the page "${page.name}" on the website again.`,
+    },
+  });
+  return { listing, version };
+}
+
+/** Switch booking links on or off for the whole public site. */
+export async function setBookingEnabledCore(
+  deps: Pick<VisibilityDeps, "context">,
+  input: { enabled: boolean; expectedVersion: VersionToken },
+): Promise<{ enabled: boolean; version: string }> {
+  const { context } = deps;
+  await assertStaff(context);
+  invalidatePublishedCache();
+  const version = await compareAndSwap(
+    context.supabase,
+    BOOKING_SETTING_KEY,
+    { enabled: input.enabled },
+    input.expectedVersion,
+    context.userId,
+    "the booking setting",
+  );
+  invalidatePublishedCache();
+  await auditAs(context, {
+    action: "booking.settings",
+    entity: SITE_SETTINGS,
+    entityId: BOOKING_SETTING_KEY,
+    meta: {
+      enabled: input.enabled,
+      description: input.enabled
+        ? "Switched booking on — booking links and the header booking button show on the website again."
+        : "Switched booking off — booking links and the header booking button are hidden on the website.",
+    },
+  });
+  return { enabled: input.enabled, version };
+}
+
+/** Add a page to, or remove it from, the pages that keep booking while it is off. */
+export async function setBookingExceptionCore(
+  deps: Pick<VisibilityDeps, "context">,
+  input: { pageId: string; exception: boolean; expectedVersion: VersionToken },
+): Promise<{ exception: boolean; version: string }> {
+  const { context } = deps;
+  await assertStaff(context);
+  if (!UUID.test(input.pageId)) throw new Error("Page not found");
+  // Adding needs a page that exists; removing works even for one in the trash.
+  let name = "this page";
+  if (input.exception) name = (await readLivePage(context.supabase, input.pageId)).name;
+  invalidatePublishedCache();
+  const version = await compareAndSwap(
+    context.supabase,
+    `${BOOKING_EXCEPTION_PREFIX}${input.pageId.toLowerCase()}`,
+    { exception: input.exception },
+    input.expectedVersion,
+    context.userId,
+    `the booking exception for ${input.exception ? `“${name}”` : name}`,
+  );
+  invalidatePublishedCache();
+  await auditAs(context, {
+    action: "booking.exception",
+    entity: "pages",
+    entityId: input.pageId,
+    meta: {
+      exception: input.exception,
+      description: input.exception
+        ? `Kept booking links on the page "${name}" while booking is switched off.`
+        : "Removed a page from the pages that keep booking links while booking is switched off.",
+    },
+  });
+  return { exception: input.exception, version };
+}
+
+/** Booking setting and its exception pages, for the settings screen. */
+export type BookingSettingsView = {
+  enabled: boolean;
+  version: VersionToken;
+  exceptions: Array<{
+    pageId: string;
+    key: string | null;
+    name: string | null;
+    /** The page is in the trash or gone: the exception does nothing until restored. */
+    missing: boolean;
+    version: VersionToken;
+  }>;
+  /**
+   * The version of every stored exception row by page id, including removed
+   * ones: adding a page back has to send the version of the row it left.
+   */
+  rowVersions: Record<string, VersionToken>;
+};
+
+export async function readBookingSettingsCore(
+  deps: Pick<VisibilityDeps, "context">,
+): Promise<BookingSettingsView> {
+  const { context } = deps;
+  await assertStaff(context);
+  const settings = await readVisibilitySettingsCore(context.supabase);
+  const ids = [...settings.exceptions].filter(([, row]) => row.exception).map(([id]) => id);
+  const pages = new Map<string, PageRow>();
+  if (ids.length > 0) {
+    const { data, error } = await context.supabase
+      .from("pages")
+      .select("id,key,name")
+      .in("id", ids)
+      .is("deleted_at", null);
+    if (error) throw new Error(error.message);
+    for (const row of (data ?? []) as PageRow[]) pages.set(row.id.toLowerCase(), row);
+  }
+  return {
+    enabled: settings.booking.enabled,
+    version: settings.booking.version,
+    exceptions: ids
+      .map((pageId) => {
+        const page = pages.get(pageId);
+        return {
+          pageId,
+          key: page?.key ?? null,
+          name: page?.name ?? null,
+          missing: !page,
+          version: settings.exceptions.get(pageId)?.version ?? null,
+        };
+      })
+      .sort((a, b) => (a.name ?? "~").localeCompare(b.name ?? "~")),
+    rowVersions: Object.fromEntries([...settings.exceptions].map(([id, row]) => [id, row.version])),
+  };
+}
+
+/**
+ * The public policy: every page's publication and listing, the booking switch
+ * and its exceptions, from one consistent set of reads.
+ *
+ * Runs with the host's trusted server client, because `pages` and
+ * `page_publications` are not readable anonymously. Cached like published
+ * pages: dropped by every page, publication or visibility write, and never
+ * held past the next publication boundary, so a scheduled publish or expiry
+ * changes the policy at its instant without anybody saving anything. A read
+ * that fails throws and is not cached; the caller decides how to fail closed.
+ */
+export async function loadPublicPolicyCore(client: any): Promise<PublicPolicySnapshot> {
+  return withPublishedCache(
+    "policy",
+    "site",
+    () => readPublicPolicy(client),
+    (policy) => policy.revalidateAt,
+  );
+}
+
+async function readPublicPolicy(client: any): Promise<PublicPolicySnapshot> {
+  const settings = await readVisibilitySettingsCore(client);
+
+  const { data: pubs, error: pubError } = await client
+    .from("page_publications")
+    .select("page_id, version_id, publish_at, unpublish_at, published_at")
+    .eq("is_active", true)
+    .order("publish_at", { ascending: false });
+  if (pubError) throw new Error(pubError.message);
+
+  const { data: pageRows, error: pageError } = await client
+    .from("pages")
+    .select("id,key")
+    .is("deleted_at", null)
+    .order("key");
+  if (pageError) throw new Error(pageError.message);
+
+  const byPage = new Map<string, PublicationWindow[]>();
+  for (const row of (pubs ?? []) as Array<Record<string, string | null>>) {
+    const pageId = row.page_id;
+    if (!pageId) continue;
+    byPage.set(pageId, [...(byPage.get(pageId) ?? []), ...toPublicationWindows([row])]);
+  }
+
+  const now = Date.now();
+  let revalidateAt: number | null = null;
+  for (const windows of byPage.values()) {
+    const boundary = nextPublicationBoundary(windows, now);
+    if (boundary !== null && (revalidateAt === null || boundary < revalidateAt)) revalidateAt = boundary;
+  }
+
+  const pages: PolicyPage[] = ((pageRows ?? []) as Array<{ id: string; key: string }>).map((row) => {
+    const id = String(row.id).toLowerCase();
+    return {
+      id,
+      key: row.key,
+      live: publicVersionId(byPage.get(row.id) ?? [], now) !== null,
+      listing: settings.listings.get(id)?.listing ?? "listed",
+      bookingException: settings.exceptions.get(id)?.exception === true,
+    };
+  });
+
+  return { known: true, bookingEnabled: settings.booking.enabled, pages, revalidateAt };
+}