@cancia/astro 0.10.0 → 0.12.0

package/dist/chunk-4PYVIIOO.js

@@ -0,0 +1,25 @@
+import {
+  authorizeRequest
+} from "./chunk-6GUOGDWO.js";
+
+// src/auth/guard.ts
+var unauthorized = () => new Response(JSON.stringify({ error: "Unauthorized" }), {
+  status: 401,
+  headers: { "Content-Type": "application/json" }
+});
+async function guardRequest(request, cfg) {
+  if (!cfg.secret && !cfg.auth) {
+    return { deny: null, email: null };
+  }
+  const result = await authorizeRequest({
+    request,
+    secret: cfg.secret,
+    auth: cfg.auth
+  });
+  if (!result.ok) return { deny: unauthorized(), email: null };
+  return { deny: null, email: result.email };
+}
+
+export {
+  guardRequest
+};

package/dist/{chunk-DIV2FFYX.js → chunk-5R3I5RLT.js}

@@ -1,3 +1,6 @@
+import {
+  guardRequest
+} from "./chunk-4PYVIIOO.js";
 import {
   loadListSchema
 } from "./chunk-VL6FO446.js";
@@ -23,13 +26,8 @@ function getSite(request) {
 function getLocale(request) {
   return new URL(request.url).searchParams.get("locale");
 }
-function checkAuth(request, secret) {
-  if (!secret) return null;
-  const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-  if (token !== secret) {
-    return json({ error: "Unauthorized" }, 401);
-  }
-  return null;
+async function checkAuth(request, secret, auth) {
+  return (await guardRequest(request, { secret, auth })).deny;
 }
 function json(body, status = 200) {
   return new Response(JSON.stringify(body), {
@@ -45,7 +43,7 @@ function makeListsRoutes(ctx) {
     if (!ctx.storageV2) {
       return json({ error: "Storage v2 not configured", code: "NO_STORAGE_V2" }, 503);
     }
-    const deny = checkAuth(request, ctx.secret);
+    const deny = await checkAuth(request, ctx.secret, ctx.auth);
     if (deny) return deny;
     const parsed = parseListPath(request.url);
     if (!parsed) return json({ error: "Bad request" }, 400);
@@ -103,6 +101,15 @@ function makeListsRoutes(ctx) {
       if (!body || !Array.isArray(body.ids) || !body.ids.every((id2) => typeof id2 === "string")) {
         return json({ error: "`ids` must be a string array" }, 400);
       }
+      if (typeof body.knownCount === "number") {
+        const existing = await lists.translations(site, parsed.listName);
+        if (existing.length !== body.knownCount) {
+          return json({
+            error: "This list changed while you were reordering it. Close and reopen the panel to see the latest entries.",
+            code: "REV_CONFLICT"
+          }, 409);
+        }
+      }
       try {
         await lists.reorder(site, parsed.listName, body.ids);
         return json({ ok: true });

package/dist/chunk-6GUOGDWO.js

@@ -0,0 +1,172 @@
+// src/auth/cookie.ts
+var SESSION_COOKIE = "cancia_session";
+function serialiseSessionCookie(value, opts = {}) {
+  const parts = [
+    `${SESSION_COOKIE}=${value}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    `Max-Age=${opts.maxAgeSeconds ?? 60 * 60 * 24 * 30}`
+  ];
+  if (opts.secure !== false) parts.push("Secure");
+  return parts.join("; ");
+}
+function clearSessionCookie(opts = {}) {
+  const parts = [
+    `${SESSION_COOKIE}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    "Max-Age=0"
+  ];
+  if (opts.secure !== false) parts.push("Secure");
+  return parts.join("; ");
+}
+function readSessionCookie(request) {
+  const header = request.headers.get("cookie");
+  if (!header) return void 0;
+  const values = [];
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    if (pair.slice(0, eq).trim() !== SESSION_COOKIE) continue;
+    const value = pair.slice(eq + 1).trim();
+    if (value !== "") values.push(value);
+  }
+  return values.length > 0 ? values[values.length - 1] : void 0;
+}
+function isSecureRequest(request) {
+  const proto = request.headers.get("x-forwarded-proto");
+  if (proto) return proto.split(",")[0].trim() === "https";
+  try {
+    const url = new URL(request.url);
+    if (url.protocol === "https:") return true;
+    if (url.hostname === "localhost" || url.hostname === "127.0.0.1") return false;
+  } catch {
+  }
+  return true;
+}
+
+// src/auth/tokens.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+var TOKEN_BYTES = 32;
+function mintToken() {
+  return randomBytes(TOKEN_BYTES).toString("base64url");
+}
+function hashToken(raw) {
+  return createHash("sha256").update(raw, "utf8").digest("hex");
+}
+function safeEqual(a, b) {
+  const bufA = Buffer.from(a, "utf8");
+  const bufB = Buffer.from(b, "utf8");
+  if (bufA.length !== bufB.length) {
+    timingSafeEqual(bufA, bufA);
+    return false;
+  }
+  return timingSafeEqual(bufA, bufB);
+}
+function normaliseEmail(email) {
+  return email.trim().toLowerCase();
+}
+
+// src/auth/magic-link.ts
+var LOGIN_TOKEN_TTL_MS = 15 * 60 * 1e3;
+var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var SESSION_TOUCH_AFTER_MS = 24 * 60 * 60 * 1e3;
+async function requestLoginLink(store, site, rawEmail, now = Date.now()) {
+  const email = normaliseEmail(rawEmail);
+  if (!await store.isEditor(site, email)) {
+    return { token: null, email };
+  }
+  const token = mintToken();
+  await store.createLoginToken(site, {
+    hash: hashToken(token),
+    email,
+    expiresAt: new Date(now + LOGIN_TOKEN_TTL_MS).toISOString()
+  });
+  return { token, email };
+}
+var FAILED = { sessionToken: null, email: null, expiresAt: null };
+async function redeemLoginToken(store, site, rawToken, now = Date.now()) {
+  if (!rawToken) return FAILED;
+  const record = await store.consumeLoginToken(site, hashToken(rawToken));
+  if (!record) return FAILED;
+  if (Date.parse(record.expiresAt) <= now) return FAILED;
+  if (!await store.isEditor(site, record.email)) return FAILED;
+  const sessionToken = mintToken();
+  const expiresAt = new Date(now + SESSION_TTL_MS).toISOString();
+  await store.createSession(site, {
+    id: hashToken(sessionToken),
+    email: record.email,
+    createdAt: new Date(now).toISOString(),
+    expiresAt
+  });
+  return { sessionToken, email: record.email, expiresAt };
+}
+var INVALID = { valid: false, email: null };
+async function verifySession(store, site, rawToken, now = Date.now()) {
+  if (!rawToken) return INVALID;
+  const id = hashToken(rawToken);
+  const session = await store.getSession(site, id);
+  if (!session) return INVALID;
+  if (Date.parse(session.expiresAt) <= now) {
+    await store.deleteSession(site, id);
+    return INVALID;
+  }
+  if (!await store.isEditor(site, session.email)) {
+    await store.deleteSession(site, id);
+    return INVALID;
+  }
+  const elapsed = now - Date.parse(session.createdAt);
+  const remaining = Date.parse(session.expiresAt) - now;
+  if (elapsed > 0 && remaining < SESSION_TTL_MS - SESSION_TOUCH_AFTER_MS) {
+    const renewedExpiresAt = new Date(now + SESSION_TTL_MS).toISOString();
+    await store.touchSession(site, id, renewedExpiresAt);
+    return { valid: true, email: session.email, renewedExpiresAt };
+  }
+  return { valid: true, email: session.email };
+}
+async function revokeSession(store, site, rawToken) {
+  if (!rawToken) return;
+  await store.deleteSession(site, hashToken(rawToken));
+}
+
+// src/auth/authorize.ts
+var DENY = { ok: false, email: null };
+async function authorizeRequest(cfg) {
+  const { request, secret, auth, editorsConfigured } = cfg;
+  if (auth) {
+    const raw = readSessionCookie(request);
+    if (raw) {
+      const verdict = await verifySession(auth.store, auth.site, raw, cfg.now);
+      if (verdict.valid) {
+        return {
+          ok: true,
+          email: verdict.email,
+          renewedExpiresAt: verdict.renewedExpiresAt
+        };
+      }
+    }
+  }
+  const header = request.headers.get("Authorization");
+  if (header && secret) {
+    const token = header.replace("Bearer ", "").trim();
+    if (safeEqual(token, secret)) {
+      return { ok: true, email: null };
+    }
+  }
+  return DENY;
+}
+
+export {
+  serialiseSessionCookie,
+  clearSessionCookie,
+  readSessionCookie,
+  isSecureRequest,
+  normaliseEmail,
+  SESSION_TTL_MS,
+  requestLoginLink,
+  redeemLoginToken,
+  revokeSession,
+  authorizeRequest
+};

package/dist/chunk-DEI3FBNY.js

@@ -0,0 +1,65 @@
+import {
+  handleLoginCallback,
+  handleLoginRequest,
+  handleLogout,
+  handleSessionCheck,
+  resolveLoginEmailSender
+} from "./chunk-XZCXWILA.js";
+import {
+  createRateLimiter
+} from "./chunk-ECPYHIAW.js";
+import {
+  authorizeRequest
+} from "./chunk-6GUOGDWO.js";
+
+// src/endpoints/auth-magic.ts
+import { getCanciaRuntime } from "virtual:cancia/runtime";
+var limiter = createRateLimiter();
+var notConfigured = () => new Response(JSON.stringify({ error: "Magic-link login is not configured for this site." }), {
+  status: 404,
+  headers: { "Content-Type": "application/json" }
+});
+function ctxFrom(rt) {
+  if (!rt.auth) return null;
+  return {
+    store: rt.auth.store,
+    site: rt.auth.site,
+    sendEmail: resolveLoginEmailSender(rt.sendLoginEmail),
+    limiter
+  };
+}
+async function requestLink({ request }) {
+  const rt = getCanciaRuntime();
+  const ctx = ctxFrom(rt);
+  if (!ctx) return notConfigured();
+  return handleLoginRequest(request, ctx, new URL(request.url).origin);
+}
+async function callback({ request }) {
+  const rt = getCanciaRuntime();
+  const ctx = ctxFrom(rt);
+  if (!ctx) return notConfigured();
+  return handleLoginCallback(request, ctx);
+}
+async function logout({ request }) {
+  const rt = getCanciaRuntime();
+  const ctx = ctxFrom(rt);
+  if (!ctx) return notConfigured();
+  return handleLogout(request, ctx);
+}
+async function session({ request }) {
+  const rt = getCanciaRuntime();
+  const ctx = ctxFrom(rt);
+  if (!ctx) return notConfigured();
+  return handleSessionCheck(
+    request,
+    ctx,
+    () => authorizeRequest({ request, secret: rt.secret, auth: rt.auth })
+  );
+}
+
+export {
+  requestLink,
+  callback,
+  logout,
+  session
+};

package/dist/{chunk-ONKCUTPU.js → chunk-DOFLZ7KG.js}

@@ -1,9 +1,12 @@
+import {
+  guardRequest
+} from "./chunk-4PYVIIOO.js";
 import {
   loadSchemas
 } from "./chunk-VL6FO446.js";
 import {
   describeList
-} from "./chunk-YGJ3JHXF.js";
+} from "./chunk-QQEUCOXQ.js";
 
 // src/routes/schemas.ts
 function json(body, status = 200) {
@@ -14,12 +17,8 @@ function json(body, status = 200) {
 }
 function makeSchemasRoute(ctx) {
   return async function schemasRoute(request) {
-    if (ctx.secret) {
-      const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-      if (token !== ctx.secret) {
-        return json({ error: "Unauthorized" }, 401);
-      }
-    }
+    const deny = (await guardRequest(request, { secret: ctx.secret, auth: ctx.auth })).deny;
+    if (deny) return deny;
     const schemas = await loadSchemas(ctx.projectRoot, ctx.schemasPath);
     const descriptions = {};
     for (const [name, schema] of Object.entries(schemas)) {

package/dist/{chunk-GJIX7MWC.js → chunk-ECPYHIAW.js}

@@ -5,7 +5,12 @@ function createRateLimiter() {
   return /* @__PURE__ */ new Map();
 }
 function getIp(req) {
-  return req.headers.get("x-forwarded-for")?.split(",")[0].trim() ?? req.headers.get("x-real-ip") ?? "unknown";
+  const forwarded = req.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const hops = forwarded.split(",").map((h) => h.trim()).filter(Boolean);
+    if (hops.length > 0) return hops[hops.length - 1];
+  }
+  return req.headers.get("x-real-ip") ?? "unknown";
 }
 function isRateLimited(limiter, ip, now = Date.now()) {
   const bucket = limiter.get(ip);
@@ -51,5 +56,8 @@ async function runAuth(cfg) {
 
 export {
   createRateLimiter,
+  getIp,
+  isRateLimited,
+  recordFailure,
   runAuth
 };

package/dist/{chunk-YGJ3JHXF.js → chunk-QQEUCOXQ.js}

@@ -45,6 +45,17 @@ var defineField = {
   },
   slug: (o) => z.string().regex(/^[a-z0-9-]+$/).meta({ widget: "slug", ...o }),
   image: (o) => z.string().url().meta({ widget: "image", ...o }),
+  /**
+   * An uploaded document — a PDF today.
+   *
+   * Stores a URL exactly as `image` does, because the upload path is the same:
+   * the file goes to the configured store (R2, or public/uploads) and what
+   * comes back is a plain URL. A separate widget rather than reusing `image`
+   * so the editor renders a filename and a download affordance instead of a
+   * thumbnail, and so an `image` field cannot silently accept a PDF and
+   * render a broken <img>.
+   */
+  file: (o) => z.string().url().meta({ widget: "file", ...o }),
   select: (o) => z.enum(o.options).meta({ widget: "select", ...o }),
   /**
    * A repeatable list of a single member type. `member` is any Zod type,

package/dist/{chunk-NVXNJ4YC.js → chunk-R7VA3Z5N.js}

@@ -1,16 +1,33 @@
 import {
-  createJsonFileAdapterV2
-} from "./chunk-2NVZWZPE.js";
+  createJsonFileAdapterV2,
+  createSqliteAdapterV2
+} from "./chunk-S5YLB6P3.js";
 import {
   isDraft
-} from "./chunk-YGJ3JHXF.js";
+} from "./chunk-QQEUCOXQ.js";
+
+// src/loader/index.ts
+import { existsSync } from "fs";
+import { join as join2 } from "path";
+
+// src/storage/resolve.ts
+import { isAbsolute, join } from "path";
+function resolveDbPath(dbPath, projectRoot) {
+  return isAbsolute(dbPath) ? dbPath : join(projectRoot, dbPath);
+}
+function resolveReadStorage(desc, projectRoot) {
+  if (desc?.kind === "sqlite-v2") {
+    const dbPath = desc.dbPath ? resolveDbPath(desc.dbPath, projectRoot) : join(projectRoot, "cancia.db");
+    return createSqliteAdapterV2({ dbPath });
+  }
+  return createJsonFileAdapterV2({ projectRoot });
+}
 
 // src/loader/index.ts
-import { join } from "path";
 function makeId(locale, entryId) {
   return `${locale}/${entryId}`;
 }
-async function syncOnce(ctx, lists, list, site, schema, includeDrafts) {
+async function syncOnce(ctx, lists, list, site, schema, includeDrafts, usingJsonFile = false, projectRoot = "") {
   ctx.store.clear();
   const all = await lists.list(site, list);
   const drafts = schema?.draftField && !includeDrafts ? all.filter((e) => isDraft(schema, e.data)) : [];
@@ -30,6 +47,11 @@ async function syncOnce(ctx, lists, list, site, schema, includeDrafts) {
       digest: entry._rev
     });
   }
+  if (entries.length === 0 && usingJsonFile && existsSync(join2(projectRoot, "cancia.db"))) {
+    ctx.logger.warn(
+      `cancia: list "${list}" is empty, but a cancia.db exists at the project root and this loader is reading JSON files. Pass db: { kind: "sqlite" } to canciaLoader() to match your integration's db option \u2014 otherwise every entry the client saves is invisible to the build.`
+    );
+  }
   const skipped = drafts.length ? ` (${drafts.length} draft${drafts.length === 1 ? "" : "s"} skipped)` : "";
   ctx.logger.info(
     `cancia: loaded ${entries.length} entr${entries.length === 1 ? "y" : "ies"} from list "${list}"${skipped}`
@@ -44,15 +66,33 @@ function canciaLoader(opts) {
     name: `@cancia/astro/loader[${opts.list}]`,
     async load(ctx) {
       latestCtx = ctx;
-      const storage = opts.storage ?? createJsonFileAdapterV2({
-        projectRoot: opts.projectRoot ?? process.cwd()
-      });
+      const projectRoot = opts.projectRoot ?? process.cwd();
+      const detectedDb = !opts.storage && !opts.db && existsSync(join2(projectRoot, "cancia.db"));
+      const storage = opts.storage ?? resolveReadStorage(
+        opts.db ? { kind: opts.db.kind === "sqlite" ? "sqlite-v2" : "json-file", dbPath: opts.db.path } : detectedDb ? { kind: "sqlite-v2" } : void 0,
+        projectRoot
+      );
       const { lists } = storage;
-      await syncOnce(ctx, lists, opts.list, opts.site, opts.schema, opts.includeDrafts);
+      if (detectedDb) {
+        ctx.logger.info(
+          `cancia: reading list "${opts.list}" from cancia.db (detected). Pass db: { kind: "json-file" } if that is not what you want.`
+        );
+      }
+      const usingJsonFile = !opts.storage && opts.db?.kind !== "sqlite" && !detectedDb;
+      await syncOnce(
+        ctx,
+        lists,
+        opts.list,
+        opts.site,
+        opts.schema,
+        opts.includeDrafts,
+        usingJsonFile,
+        projectRoot
+      );
       if (ctx.watcher && !watcherAttached) {
         watcherAttached = true;
         const root = opts.projectRoot ?? process.cwd();
-        const watchDir = join(root, ".cancia", "lists", opts.list, opts.site);
+        const watchDir = join2(root, ".cancia", "lists", opts.list, opts.site);
         ctx.watcher.add(watchDir);
         const scheduleSync = () => {
           if (pendingTimer) clearTimeout(pendingTimer);
@@ -66,7 +106,9 @@ function canciaLoader(opts) {
                 opts.list,
                 opts.site,
                 opts.schema,
-                opts.includeDrafts
+                opts.includeDrafts,
+                usingJsonFile,
+                projectRoot
               ).catch((err) => {
                 latestCtx.logger.error(`cancia: resync failed \u2014 ${err.message}`);
               })

package/dist/{chunk-5IPHDIC6.js → chunk-RHFTQW4W.js}

@@ -3,6 +3,15 @@ var SITE_RE = /^[a-z0-9][a-z0-9._-]*$/i;
 function isValidSite(site) {
   return SITE_RE.test(site);
 }
+function detectFileType(buf) {
+  if ([37, 80, 68, 70, 45].every((b, i) => buf[i] === b)) {
+    return { mime: "application/pdf", ext: "pdf" };
+  }
+  return null;
+}
+function detectUploadType(buf) {
+  return detectImageType(buf) ?? detectFileType(buf);
+}
 function detectImageType(buf) {
   const startsWith = (sig, offset = 0) => sig.every((b, i) => buf[offset + i] === b);
   if (startsWith([255, 216, 255])) return { mime: "image/jpeg", ext: "jpg" };
@@ -15,5 +24,5 @@ function detectImageType(buf) {
 
 export {
   isValidSite,
-  detectImageType
+  detectUploadType
 };