@byline/host-tanstack-start 0.9.3

package/src/server-fns/admin-users/list.ts

@@ -0,0 +1,40 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+
+import {
+  type AdminUserListOrder,
+  type AdminUserListResponse,
+  listAdminUsersCommand,
+} from '@byline/admin/admin-users'
+
+import { getAdminRequestContext } from '../../auth/auth-context.js'
+import { bylineCore } from '../../integrations/byline-core.js'
+
+export interface ListAdminUsersInput {
+  page?: number
+  pageSize?: number
+  query?: string
+  order?: AdminUserListOrder
+  desc?: boolean
+}
+
+/**
+ * List admin users. Thin server-fn wrapper over `listAdminUsersCommand`
+ * — validation, ability assertion, and shaping all live in the command.
+ * The wrapper's job is to resolve the request context from session
+ * cookies, pass the `AdminStore` in, and let errors propagate to the
+ * TanStack Start transport layer for the client to branch on.
+ */
+export const listAdminUsers = createServerFn({ method: 'GET' })
+  .inputValidator((input: ListAdminUsersInput) => input ?? {})
+  .handler(async ({ data }): Promise<AdminUserListResponse> => {
+    const context = await getAdminRequestContext()
+    return listAdminUsersCommand(context, data, { store: bylineCore().adminStore! })
+  })

package/src/server-fns/admin-users/set-password.ts

@@ -0,0 +1,27 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+
+import { type AdminUserResponse, setAdminUserPasswordCommand } from '@byline/admin/admin-users'
+
+import { getAdminRequestContext } from '../../auth/auth-context.js'
+import { bylineCore } from '../../integrations/byline-core.js'
+
+export interface SetAdminUserPasswordInput {
+  id: string
+  vid: number
+  password: string
+}
+
+export const setAdminUserPassword = createServerFn({ method: 'POST' })
+  .inputValidator((input: SetAdminUserPasswordInput) => input)
+  .handler(async ({ data }): Promise<AdminUserResponse> => {
+    const context = await getAdminRequestContext()
+    return setAdminUserPasswordCommand(context, data, { store: bylineCore().adminStore! })
+  })

package/src/server-fns/admin-users/set-user-roles.ts

@@ -0,0 +1,26 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+
+import { setRolesForUserCommand, type UserRolesResponse } from '@byline/admin/admin-roles'
+
+import { getAdminRequestContext } from '../../auth/auth-context.js'
+import { bylineCore } from '../../integrations/byline-core.js'
+
+export interface SetUserRolesInput {
+  userId: string
+  roleIds: string[]
+}
+
+export const setUserRoles = createServerFn({ method: 'POST' })
+  .inputValidator((input: SetUserRolesInput) => input)
+  .handler(async ({ data }): Promise<UserRolesResponse> => {
+    const context = await getAdminRequestContext()
+    return setRolesForUserCommand(context, data, { store: bylineCore().adminStore! })
+  })

package/src/server-fns/admin-users/update.ts

@@ -0,0 +1,34 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+
+import { type AdminUserResponse, updateAdminUserCommand } from '@byline/admin/admin-users'
+
+import { getAdminRequestContext } from '../../auth/auth-context.js'
+import { bylineCore } from '../../integrations/byline-core.js'
+
+export interface UpdateAdminUserInput {
+  id: string
+  vid: number
+  patch: {
+    email?: string
+    given_name?: string | null
+    family_name?: string | null
+    username?: string | null
+    is_super_admin?: boolean
+    is_email_verified?: boolean
+  }
+}
+
+export const updateAdminUser = createServerFn({ method: 'POST' })
+  .inputValidator((input: UpdateAdminUserInput) => input)
+  .handler(async ({ data }): Promise<AdminUserResponse> => {
+    const context = await getAdminRequestContext()
+    return updateAdminUserCommand(context, data, { store: bylineCore().adminStore! })
+  })

package/src/server-fns/auth/current-user.ts

@@ -0,0 +1,117 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Admin profile lookup for the authenticated request.
+ *
+ * Thin wrapper that resolves the `AdminAuth` via `getAdminRequestContext()`
+ * (which handles verify + lazy refresh + cookie rewrites), then fetches the
+ * admin user's profile row so the UI can render "signed in as X" without
+ * embedding identity metadata in the JWT itself.
+ *
+ * Throws `ERR_UNAUTHENTICATED` through `getAdminRequestContext` when there
+ * is no valid session — callers treat that as "redirect to sign-in".
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+
+import { type Actor, AuthError } from '@byline/auth'
+import { getServerConfig } from '@byline/core'
+import type { PgAdapter } from '@byline/db-postgres'
+import { createAdminUsersRepository } from '@byline/db-postgres/admin'
+
+import { getAdminRequestContext } from '../../auth/auth-context.js'
+
+export interface CurrentAdminUser {
+  id: string
+  email: string
+  given_name: string | null
+  family_name: string | null
+  is_super_admin: boolean
+  /**
+   * Flat ability set resolved from the actor's role grants. Sent to the
+   * client so the admin shell can render cosmetic ability cues (hide
+   * Users / Roles / Permissions menu items, disable buttons, etc.). The
+   * real enforcement boundary is server-side (`assertActorCanPerform` /
+   * `assertAdminActor`) — UI cues are an affordance, never a security
+   * guarantee.
+   *
+   * Empty for a non-super-admin who happens to hold zero abilities.
+   * Super-admins also receive an empty array here; the `is_super_admin`
+   * flag is what callers should branch on for the bypass.
+   */
+  abilities: string[]
+}
+
+export const getCurrentAdminUser = createServerFn({ method: 'GET' }).handler(
+  async (): Promise<CurrentAdminUser> => {
+    const { actor } = await getAdminRequestContext()
+    if (!actor) {
+      // getAdminRequestContext always returns an AdminAuth on success; the
+      // null branch is compile-time impossible here but satisfies the type.
+      throw new Error('unexpected null actor after getAdminRequestContext')
+    }
+
+    const db = (getServerConfig().db as PgAdapter).drizzle
+    const users = createAdminUsersRepository(db)
+    const row = await users.getById(actor.id)
+    if (!row) {
+      // Session resolved to an admin id that no longer exists — force the
+      // caller back through sign-in rather than return partial data.
+      throw new Error('admin user not found for current session')
+    }
+
+    return {
+      id: row.id,
+      email: row.email,
+      given_name: row.given_name,
+      family_name: row.family_name,
+      is_super_admin: row.is_super_admin,
+      abilities: Array.from(actor.abilities),
+    }
+  }
+)
+
+/**
+ * Soft variant for public-page consumers (e.g. the content admin bar that
+ * renders only when the visitor is signed in). Returns `null` instead of
+ * throwing when there is no session — anonymous visitors are the common
+ * case here, so a thrown error would be wrong shape for a public route
+ * loader. Other failure modes (DB unavailable, session points to a
+ * deleted admin) are still coerced to `null` so the bar simply hides.
+ */
+export const getCurrentAdminUserSoft = createServerFn({ method: 'GET' }).handler(
+  async (): Promise<CurrentAdminUser | null> => {
+    try {
+      let actor: Actor
+      try {
+        ;({ actor } = await getAdminRequestContext())
+      } catch (err) {
+        if (err instanceof AuthError) return null
+        throw err
+      }
+      if (!actor) return null
+
+      const db = (getServerConfig().db as PgAdapter).drizzle
+      const users = createAdminUsersRepository(db)
+      const row = await users.getById(actor.id)
+      if (!row) return null
+
+      return {
+        id: row.id,
+        email: row.email,
+        given_name: row.given_name,
+        family_name: row.family_name,
+        is_super_admin: row.is_super_admin,
+        abilities: Array.from(actor.abilities),
+      }
+    } catch {
+      return null
+    }
+  }
+)

package/src/server-fns/auth/index.ts

@@ -0,0 +1,15 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+export {
+  type CurrentAdminUser,
+  getCurrentAdminUser,
+  getCurrentAdminUserSoft,
+} from './current-user.js'
+export { adminSignIn, type SignInInput, type SignInResult } from './sign-in.js'
+export { adminSignOut } from './sign-out.js'

package/src/server-fns/auth/sign-in.ts

@@ -0,0 +1,71 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Admin sign-in server function.
+ *
+ * Verifies email/password against the configured `SessionProvider`, sets
+ * the two-cookie session pair on success, and returns a minimal caller
+ * shape (just the admin user id). Errors propagate as `AuthError`s from
+ * `@byline/auth` — the UI surface renders a generic "invalid credentials"
+ * message rather than distinguishing unknown-email from wrong-password
+ * (the provider also equalises timing for the same reason).
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+import { getRequestHeader } from '@tanstack/react-start/server'
+
+import { getServerConfig } from '@byline/core'
+
+import { setSessionCookies } from '../../auth/auth-cookies.js'
+
+export interface SignInInput {
+  email: string
+  password: string
+}
+
+export interface SignInResult {
+  userId: string
+}
+
+export const adminSignIn = createServerFn({ method: 'POST' })
+  .inputValidator((input: SignInInput) => {
+    if (typeof input?.email !== 'string' || input.email.length === 0) {
+      throw new Error('email is required')
+    }
+    if (typeof input?.password !== 'string' || input.password.length === 0) {
+      throw new Error('password is required')
+    }
+    return { email: input.email, password: input.password }
+  })
+  .handler(async ({ data }): Promise<SignInResult> => {
+    const provider = getServerConfig().sessionProvider
+    if (!provider) {
+      throw new Error('no sessionProvider configured')
+    }
+
+    // TanStack Start doesn't currently expose the raw request IP in a
+    // cross-runtime way; pass what we can observe and leave the ip field
+    // unset. Operators who need accurate client IPs for refresh-token
+    // provenance will typically run behind a reverse proxy that stamps
+    // `x-forwarded-for` — revisit when Phase 5 sees real deployments.
+    const userAgent = getRequestHeader('user-agent') ?? undefined
+    const forwardedFor = getRequestHeader('x-forwarded-for') ?? undefined
+    const ip = forwardedFor?.split(',')[0]?.trim() || undefined
+
+    const result = await provider.signInWithPassword({
+      email: data.email,
+      password: data.password,
+      userAgent,
+      ip,
+    })
+
+    setSessionCookies(result)
+
+    return { userId: result.actor.id }
+  })

package/src/server-fns/auth/sign-out.ts

@@ -0,0 +1,42 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+/**
+ * Admin sign-out server function.
+ *
+ * Revokes the current refresh token (so a stolen copy cannot be reused)
+ * and clears both session cookies. Idempotent — if the caller already
+ * lacks a refresh cookie, we still clear whatever's there and return
+ * successfully.
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+
+import { getServerConfig } from '@byline/core'
+
+import { clearSessionCookies, readRefreshTokenCookie } from '../../auth/auth-cookies.js'
+
+export const adminSignOut = createServerFn({ method: 'POST' }).handler(async () => {
+  const provider = getServerConfig().sessionProvider
+  const refreshToken = readRefreshTokenCookie()
+
+  if (provider && refreshToken) {
+    // Best-effort revoke — `revokeSession` itself is idempotent for
+    // unknown/already-revoked tokens, so failures here would almost
+    // certainly be transport-level. Swallow and continue: the cookies
+    // get cleared regardless, so the caller's session ends.
+    try {
+      await provider.revokeSession(refreshToken)
+    } catch {
+      // no-op
+    }
+  }
+
+  clearSessionCookies()
+  return { status: 'ok' as const }
+})

package/src/server-fns/collections/create.ts

@@ -0,0 +1,58 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+
+import { ERR_NOT_FOUND, getLogger, getServerConfig } from '@byline/core'
+import type { DocumentLifecycleContext } from '@byline/core/services'
+import { createDocument } from '@byline/core/services'
+
+import { getAdminRequestContext } from '../../auth/auth-context.js'
+import { ensureCollection } from '../../integrations/api-utils.js'
+
+// ---------------------------------------------------------------------------
+// Create document
+// ---------------------------------------------------------------------------
+
+export const createCollectionDocument = createServerFn({ method: 'POST' })
+  .inputValidator(
+    (input: { collection: string; data: any; locale?: string; path?: string }) => input
+  )
+  .handler(async ({ data: input }) => {
+    const { collection: path, data: documentData, locale, path: explicitPath } = input
+    const logger = getLogger()
+    const config = await ensureCollection(path)
+    if (!config) {
+      throw ERR_NOT_FOUND({
+        message: 'Collection not found',
+        details: { collectionPath: path },
+      }).log(logger)
+    }
+
+    const serverConfig = getServerConfig()
+    const ctx: DocumentLifecycleContext = {
+      db: serverConfig.db,
+      definition: config.definition,
+      collectionId: config.collection.id,
+      collectionVersion: config.collection.version,
+      collectionPath: path,
+      logger,
+      defaultLocale: serverConfig.i18n.content.defaultLocale,
+      slugifier: serverConfig.slugifier,
+      requestContext: await getAdminRequestContext(),
+    }
+
+    await createDocument(ctx, {
+      data: structuredClone(documentData),
+      status: documentData.status,
+      locale: locale ?? serverConfig.i18n.content.defaultLocale,
+      path: explicitPath,
+    })
+
+    return { status: 'ok' as const }
+  })

package/src/server-fns/collections/delete.ts

@@ -0,0 +1,62 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createServerFn } from '@tanstack/react-start'
+
+import { ERR_NOT_FOUND, getLogger, getServerConfig, getUploadFields } from '@byline/core'
+import type { DocumentLifecycleContext } from '@byline/core/services'
+import { deleteDocument as deleteDocumentService } from '@byline/core/services'
+
+import { getAdminRequestContext } from '../../auth/auth-context.js'
+import { ensureCollection } from '../../integrations/api-utils.js'
+
+// ---------------------------------------------------------------------------
+// Delete document (soft-delete — marks all versions as deleted)
+// ---------------------------------------------------------------------------
+
+export const deleteDocument = createServerFn({ method: 'POST' })
+  .inputValidator((input: { collection: string; id: string }) => input)
+  .handler(async ({ data: input }) => {
+    const { collection: path, id } = input
+    const logger = getLogger()
+    const config = await ensureCollection(path)
+    if (!config) {
+      throw ERR_NOT_FOUND({
+        message: 'Collection not found',
+        details: { collectionPath: path },
+      }).log(logger)
+    }
+
+    const serverConfig = getServerConfig()
+    // Resolve the storage provider so the lifecycle service can clean up
+    // uploaded files and variants on deletion. With per-field upload
+    // config, a collection may have one (or more) image/file fields with
+    // their own storage. The delete path needs *a* provider; we pick the
+    // first upload-capable field's, falling back to the site-wide
+    // default. Multi-storage collections are out of scope today —
+    // deletion routes everything through one provider, which is fine
+    // when all upload fields target the same backend (the common case).
+    const firstUploadField = getUploadFields(config.definition)[0]
+    const storage = firstUploadField?.upload?.storage ?? serverConfig.storage
+    const db = serverConfig.db
+    const ctx: DocumentLifecycleContext = {
+      db,
+      definition: config.definition,
+      collectionId: config.collection.id,
+      collectionVersion: config.collection.version,
+      collectionPath: path,
+      ...(storage ? { storage } : {}),
+      logger,
+      defaultLocale: serverConfig.i18n.content.defaultLocale,
+      slugifier: serverConfig.slugifier,
+      requestContext: await getAdminRequestContext(),
+    }
+
+    const result = await deleteDocumentService(ctx, { documentId: id })
+    return { status: 'ok' as const, deletedVersionCount: result.deletedVersionCount }
+  })