@cardinali-studio/adminkit 2.2.11 → 2.2.12

package/dist/functions/api/assets.js

@@ -25,7 +25,8 @@ export async function onRequestGet({ request, env }) {
     const subPrefixes = new Set();
     const files = [];
     for (const k of all) {
-      if (k.startsWith("_trash/") || k.startsWith("_pending-media/") || pending.has(k)) continue;
+      if (k.startsWith("_trash/") || k.startsWith("_pending-media/") ||
+          k.startsWith("_adminkit/") || pending.has(k)) continue;
       const rel = k.slice(prefix.length);
       const cut = rel.lastIndexOf("/");
       if (cut >= 0) {
@@ -48,7 +49,7 @@ export async function onRequestGet({ request, env }) {
   // suo `.keep` (vedi assets/folder.js). Chi non ce l'ha mostra lo slug, come sempre.
   const folders = await Promise.all(
     (listed.delimitedPrefixes || [])
-      .filter((p) => p !== "_trash/" && p !== "_pending-media/")
+      .filter((p) => p !== "_trash/" && p !== "_pending-media/" && p !== "_adminkit/")
       .map(async (p) => {
         const keep = await env.MEDIA.head(p + ".keep");
         return {
@@ -66,7 +67,7 @@ export async function onRequestGet({ request, env }) {
   // oggi. È un ripiego, non la strada normale: una volta ricaricate, il ramo non scatta più.
   const raw = (listed.objects || [])
     .filter((o) => o.key !== prefix && !o.key.endsWith("/.keep") && !o.key.endsWith("/") &&
-      !o.key.startsWith("_pending-media/") && !pending.has(o.key));
+      !o.key.startsWith("_pending-media/") && !o.key.startsWith("_adminkit/") && !pending.has(o.key));
 
   const files = await Promise.all(raw.map(async (o) => {
     const cm = o.customMetadata || {};

package/dist/functions/api/site-access.js

@@ -0,0 +1,78 @@
+import { canonicalChecksum } from "../../persistence.js";
+import { createSiteAccessVersion, D1SiteAccessRepository } from "../../site-access.js";
+import { siteAccessId } from "../site.js";
+import { json } from "../_shared/assets.js";
+
+const MAX_BODY_BYTES = 2_000;
+const id = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function response(data, status = 200) {
+  const result = json(data, status);
+  result.headers.set("Cache-Control", "no-store");
+  return result;
+}
+
+function editor(data, env) {
+  const payload = data?.cloudflareAccess?.JWT?.payload;
+  if (payload?.sub) return { subject: String(payload.sub), label: String(payload.email || payload.name || "Admin").slice(0, 200) };
+  if (env.ADMIN_LOCAL === "1") return { subject: "local-preview", label: "Anteprima locale" };
+  throw new Error("unauthenticated");
+}
+
+function required(env) {
+  const siteId = siteAccessId();
+  if (!env.CONTENT_DB || !siteId) throw new Error("site_access_unavailable");
+  return { siteId, repository: new D1SiteAccessRepository(env.CONTENT_DB) };
+}
+
+function publicState(state) {
+  const clean = (value) => value ? { versionId: value.versionId, enabled: value.enabled, formatVersion: value.formatVersion } : null;
+  return { active: clean(state.active), draft: clean(state.draft), effective: clean(state.draft ?? state.active) };
+}
+
+function safeError(error) {
+  const code = error?.message;
+  const status = code === "unauthenticated" ? 401 : code === "invalid_request" || code === "invalid_site_access_password" ? 400
+    : code === "stale_site_access" ? 409 : 503;
+  const message = code === "unauthenticated" ? "Sessione non valida: ricarica la pagina per rientrare."
+    : code === "invalid_site_access_password" ? "La password deve contenere almeno 8 caratteri."
+      : code === "stale_site_access" ? "La protezione è stata modificata altrove: ricarica la pagina."
+        : status === 400 ? "Richiesta non valida." : "La gestione della password non è disponibile.";
+  return response({ ok: false, code: status >= 500 ? "site_access_unavailable" : code, error: message }, status);
+}
+
+export async function onRequestGet({ env, data }) {
+  try {
+    editor(data, env);
+    const { repository } = required(env);
+    await repository.initialize(Date.now());
+    return response({ ok: true, state: publicState(await repository.state()) });
+  } catch (error) { return safeError(error); }
+}
+
+export async function onRequestPost({ request, env, data }) {
+  try {
+    const origin = request.headers.get("Origin");
+    if (!origin || new URL(origin).origin !== new URL(request.url).origin) throw new Error("invalid_request");
+    if (Number(request.headers.get("Content-Length") || 0) > MAX_BODY_BYTES) throw new Error("invalid_request");
+    const raw = await request.text();
+    if (new TextEncoder().encode(raw).byteLength > MAX_BODY_BYTES) throw new Error("invalid_request");
+    const body = JSON.parse(raw);
+    const author = editor(data, env);
+    const { siteId, repository } = required(env);
+    await repository.initialize(Date.now());
+    if (body?.action === "discard") {
+      if (!id.test(body.expectedDraftVersionId || "")) throw new Error("invalid_request");
+      await repository.discard(body.expectedDraftVersionId, Date.now());
+      return response({ ok: true, discarded: true, state: publicState(await repository.state()) });
+    }
+    if (body?.action !== "save" || typeof body.enabled !== "boolean"
+      || (body.expectedDraftVersionId !== null && !id.test(body.expectedDraftVersionId || ""))) throw new Error("invalid_request");
+    const versionId = crypto.randomUUID();
+    const access = await createSiteAccessVersion({ versionId, siteId, enabled: body.enabled, password: body.password, keyring: env.SITE_ACCESS_KEYRING });
+    const requestChecksum = await canonicalChecksum({ action: "site-access.save", versionId, enabled: access.enabled, descriptorChecksum: access.descriptorChecksum });
+    await repository.saveDraft({ access, expectedDraftVersionId: body.expectedDraftVersionId, requestChecksum,
+      authorSubject: author.subject, authorLabel: author.label, now: Date.now() });
+    return response({ ok: true, saved: true, state: publicState(await repository.state()) });
+  } catch (error) { return safeError(error); }
+}

package/dist/functions/index.js

@@ -32,6 +32,7 @@ import * as assetsFolders from "./api/assets/folders.js";
 import * as assetsMove from "./api/assets/move.js";
 import * as assetsMedia from "./api/assets/media.js";
 import * as assetsPreview from "./api/assets/preview.js";
+import * as assetsSettings from "./api/assets/settings.js";
 import * as assetsTrash from "./api/assets/trash.js";
 import * as assetsTrashDelete from "./api/assets/trash/delete.js";
 import * as assetsTrashEmpty from "./api/assets/trash/empty.js";
@@ -50,6 +51,7 @@ import * as settings from "./api/settings.js";
 import * as singleton from "./api/singleton.js";
 import * as storage from "./api/storage.js";
 import * as content from "./api/content.js";
+import * as siteAccess from "./api/site-access.js";
 
 export { adminAccess } from "./_middleware.js";
 export { setServerConfig } from "./site.js";
@@ -69,6 +71,7 @@ const ROUTES = {
   "assets/move": { mod: null, h: assetsMove },
   "assets/media": { mod: null, h: assetsMedia },
   "assets/preview": { mod: null, h: assetsPreview },
+  "assets/settings": { mod: null, h: assetsSettings },
   "assets/trash": { mod: null, h: assetsTrash },
   "assets/trash/delete": { mod: null, h: assetsTrashDelete },
   "assets/trash/empty": { mod: null, h: assetsTrashEmpty },
@@ -90,6 +93,7 @@ const ROUTES = {
   "content/document": { mod: null, h: content },
   "content/save": { mod: null, h: content },
   "content/discard": { mod: null, h: content },
+  "content/site-access": { mod: null, h: siteAccess },
 };
 
 const PREFIX = "/admin/api/";

package/dist/functions/site.js

@@ -58,6 +58,10 @@ export function contentPersistenceMode() {
   return current?.contentPersistence === "d1" ? "d1" : "github";
 }
 
+export function siteAccessId() {
+  return typeof current?.siteAccess?.siteId === "string" && current.siteAccess.siteId ? current.siteAccess.siteId : null;
+}
+
 /** D1 owns persistence, never a site's editorial meaning. A site explicitly
  * supplies both functions before its D1 mode can accept a write: one validates
  * (and may normalize) the complete document and the other produces the

package/dist/index.d.ts

@@ -14,3 +14,4 @@ export * from "./conflict.js";
 export * from "./release.js";
 export * from "./deployment.js";
 export * from "./media.js";
+export * from "./site-access.js";

package/dist/index.js

@@ -14,3 +14,4 @@ export * from "./conflict.js";
 export * from "./release.js";
 export * from "./deployment.js";
 export * from "./media.js";
+export * from "./site-access.js";

package/dist/migrations/0004_site_access.sql

@@ -0,0 +1,41 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE site_access_versions (
+  version_id TEXT PRIMARY KEY,
+  state TEXT NOT NULL CHECK (state IN ('draft','active','superseded','expired','erased')),
+  enabled INTEGER NOT NULL CHECK (enabled IN (0, 1)),
+  format_version INTEGER NOT NULL CHECK (format_version = 1),
+  key_id TEXT,
+  nonce TEXT,
+  ciphertext TEXT,
+  request_checksum TEXT NOT NULL UNIQUE CHECK (length(request_checksum) = 64 AND request_checksum NOT GLOB '*[^0-9a-f]*'),
+  created_by_subject TEXT NOT NULL,
+  created_by_label TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  activated_at INTEGER,
+  superseded_at INTEGER,
+  rollback_expires_at INTEGER,
+  erased_at INTEGER,
+  CHECK ((enabled = 0 AND key_id IS NULL AND nonce IS NULL AND ciphertext IS NULL)
+    OR (enabled = 1 AND key_id IS NOT NULL AND nonce IS NOT NULL AND ciphertext IS NOT NULL))
+);
+CREATE UNIQUE INDEX site_access_one_draft ON site_access_versions(state) WHERE state = 'draft';
+CREATE UNIQUE INDEX site_access_one_active ON site_access_versions(state) WHERE state = 'active';
+CREATE TRIGGER site_access_versions_immutable
+BEFORE UPDATE OF version_id, enabled, format_version, key_id, nonce, ciphertext, request_checksum,
+  created_by_subject, created_by_label, created_at ON site_access_versions
+BEGIN SELECT RAISE(ABORT, 'site access version fields are immutable'); END;
+
+CREATE TABLE site_access_state (
+  singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+  active_version_id TEXT REFERENCES site_access_versions(version_id) ON DELETE RESTRICT,
+  draft_version_id TEXT REFERENCES site_access_versions(version_id) ON DELETE RESTRICT,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE content_release_site_access (
+  release_id TEXT PRIMARY KEY REFERENCES content_releases(release_id) ON DELETE RESTRICT,
+  version_id TEXT NOT NULL REFERENCES site_access_versions(version_id) ON DELETE RESTRICT
+);
+CREATE TRIGGER content_release_site_access_immutable BEFORE UPDATE ON content_release_site_access
+BEGIN SELECT RAISE(ABORT, 'release site access binding is immutable'); END;

package/dist/persistence.d.ts

@@ -119,6 +119,7 @@ export type ReleaseInput = {
      * manifest. The SQL guard rejects any candidate still containing a source
      * URL, so a caller cannot make cleanup race a public reference. */
     mediaOperationIds?: readonly string[];
+    siteAccessVersionId?: string | null;
 };
 export type ReleaseDeploymentInput = ReleaseInput & {
     attempt: {

package/dist/persistence.js

@@ -135,20 +135,31 @@ export class D1ContentRepository {
       release.schema_package_version AS schemaPackageVersion, release.materializer_version AS materializerVersion,
       release.manifest_checksum AS manifestChecksum, entry.document_id AS documentId, entry.revision_id AS revisionId,
       document.kind, document.locale, revision.schema_version AS schemaVersion, revision.is_tombstone AS tombstone,
-      revision.payload_json AS payloadJson, revision.payload_checksum AS payloadChecksum
+      revision.payload_json AS payloadJson, revision.payload_checksum AS payloadChecksum,
+      access.version_id AS accessVersionId, access.enabled AS accessEnabled, access.format_version AS accessFormatVersion,
+      access.key_id AS accessKeyId, access.nonce AS accessNonce, access.ciphertext AS accessCiphertext
       FROM content_releases release
       JOIN content_release_entries entry ON entry.release_id = release.release_id
       JOIN content_documents document ON document.document_id = entry.document_id
       JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
+      LEFT JOIN content_release_site_access release_access ON release_access.release_id = release.release_id
+      LEFT JOIN site_access_versions access ON access.version_id = release_access.version_id
       WHERE release.release_id = ? AND release.status IN ('publishing', 'published')
       ORDER BY entry.document_id`).bind(releaseId).all()).results ?? [];
         if (!rows.length)
             return null;
         const [first] = rows;
+        let siteAccess = null;
+        if (first.accessVersionId && first.accessFormatVersion === 1) {
+            const covered = { versionId: first.accessVersionId, enabled: Boolean(first.accessEnabled), formatVersion: 1,
+                keyId: first.accessKeyId, nonce: first.accessNonce, ciphertext: first.accessCiphertext };
+            siteAccess = { ...covered, descriptorChecksum: await canonicalChecksum(covered) };
+        }
         return {
             releaseId: first.releaseId, status: first.status, schemaPackageVersion: first.schemaPackageVersion,
             materializerVersion: first.materializerVersion, manifestChecksum: first.manifestChecksum,
             entries: rows.map(({ documentId, revisionId, kind, locale, schemaVersion, tombstone, payloadJson, payloadChecksum }) => ({ documentId, revisionId, kind, locale, schemaVersion, tombstone: Boolean(tombstone), payloadJson, payloadChecksum })),
+            siteAccess,
         };
     }
     async save(input) {
@@ -320,16 +331,18 @@ export class D1ContentRepository {
         const manifest = new Map(inherited.map((entry) => [entry.document_id, entry.revision_id]));
         const selected = [...input.entries];
         const mediaOperationIds = [...new Set(input.mediaOperationIds ?? [])];
-        if (!selected.length && !mediaOperationIds.length)
+        if (!selected.length && !mediaOperationIds.length && !input.siteAccessVersionId)
             throw new Error("invalid_document");
         for (const entry of selected)
             manifest.set(entry.documentId, entry.revisionId);
         const selectionGuard = selected.length ? selected.map(() => "EXISTS (SELECT 1 FROM content_documents WHERE document_id = ? AND draft_revision_id = ?)").join(" AND ") : "1 = 1";
+        const accessGuard = input.siteAccessVersionId ? `AND EXISTS (SELECT 1 FROM site_access_versions version JOIN site_access_state access_state ON access_state.singleton = 1
+      WHERE version.version_id = ? AND version.state IN ('draft','active') AND version.version_id IN (access_state.draft_version_id, access_state.active_version_id))` : "";
         const candidate = this.db.prepare(`INSERT INTO content_releases (release_id, base_release_id, request_checksum, status, active_slot, manifest_checksum, schema_package_version, materializer_version, created_by_subject, created_at)
       SELECT ?, current_release_id, ?, 'publishing', 1, ?, ?, ?, ?, ? FROM content_site_state
       WHERE singleton = 1 AND current_release_id IS ? AND NOT EXISTS (SELECT 1 FROM content_releases WHERE active_slot = 1)
-        AND NOT EXISTS (SELECT 1 FROM production_deployment_attempts WHERE active_slot = 1) AND ${selectionGuard}`)
-            .bind(input.releaseId, input.requestChecksum, input.manifestChecksum, input.schemaPackageVersion, input.materializerVersion, input.authorSubject, input.now, state.current_release_id, ...selected.flatMap((entry) => [entry.documentId, entry.revisionId]));
+        AND NOT EXISTS (SELECT 1 FROM production_deployment_attempts WHERE active_slot = 1) AND ${selectionGuard} ${accessGuard}`)
+            .bind(input.releaseId, input.requestChecksum, input.manifestChecksum, input.schemaPackageVersion, input.materializerVersion, input.authorSubject, input.now, state.current_release_id, ...selected.flatMap((entry) => [entry.documentId, entry.revisionId]), ...(input.siteAccessVersionId ? [input.siteAccessVersionId] : []));
         const statements = [];
         if (mediaOperationIds.length) {
             const revisionIds = [...manifest.values()];
@@ -352,6 +365,11 @@ export class D1ContentRepository {
         for (const [documentId, revisionId] of manifest)
             statements.push(this.db.prepare("INSERT INTO content_release_entries (release_id, document_id, revision_id) SELECT ?, ?, ? WHERE EXISTS (SELECT 1 FROM content_revisions WHERE document_id = ? AND revision_id = ?)")
                 .bind(input.releaseId, documentId, revisionId, documentId, revisionId));
+        if (input.siteAccessVersionId)
+            statements.push(this.db.prepare(`INSERT INTO content_release_site_access (release_id, version_id)
+      SELECT ?, ? WHERE EXISTS (SELECT 1 FROM site_access_versions version JOIN site_access_state access_state ON access_state.singleton = 1
+        WHERE version.version_id = ? AND version.state IN ('draft','active') AND version.version_id IN (access_state.draft_version_id, access_state.active_version_id))`)
+                .bind(input.releaseId, input.siteAccessVersionId, input.siteAccessVersionId));
         for (const operationId of mediaOperationIds) {
             /* `instr` is intentionally evaluated against the frozen release entries,
              * not drafts or a mutable current pointer. A URL is JSON-escaped neither

package/dist/release.d.ts

@@ -1,4 +1,5 @@
 import { type JsonValue } from "./persistence.js";
+import type { SiteAccessReleaseDescriptor } from "./site-access.js";
 export type ReleaseExportEntry = {
     documentId: string;
     revisionId: string;
@@ -15,6 +16,7 @@ export type ImmutableReleaseExport = {
     materializerVersion: string;
     manifestChecksum: string;
     entries: readonly ReleaseExportEntry[];
+    siteAccess?: SiteAccessReleaseDescriptor | null;
 };
 /** Raw D1 snapshot. The repository returns this exact release only; converting
  * it to an export revalidates every payload/checksum before a CI consumer sees
@@ -28,6 +30,7 @@ export type StoredReleaseExport = {
     entries: readonly (Omit<ReleaseExportEntry, "payload"> & {
         payloadJson: string | null;
     })[];
+    siteAccess?: SiteAccessReleaseDescriptor | null;
 };
 /** A release export is an immutable, sorted full snapshot. It is never a
  * convenience view of current drafts, so a CI attempt can reproduce exactly

package/dist/release.js

@@ -17,10 +17,16 @@ export async function createReleaseExport(input) {
         if (entry.payloadChecksum !== await canonicalChecksum(entry.payload))
             throw new Error("invalid_release_export");
     }
+    if (input.siteAccess) {
+        const { descriptorChecksum, ...covered } = input.siteAccess;
+        if (descriptorChecksum !== await canonicalChecksum(covered))
+            throw new Error("invalid_release_export");
+    }
     const manifestChecksum = await canonicalChecksum({
         schemaPackageVersion: input.schemaPackageVersion,
         materializerVersion: input.materializerVersion,
         entries: entries.map(({ documentId, revisionId, kind, locale, schemaVersion, tombstone, payloadChecksum }) => ({ documentId, revisionId, kind, locale, schemaVersion, tombstone, payloadChecksum })),
+        siteAccess: input.siteAccess ? { versionId: input.siteAccess.versionId, descriptorChecksum: input.siteAccess.descriptorChecksum } : null,
     });
     return { ...input, entries, manifestChecksum };
 }
@@ -34,6 +40,7 @@ export async function releaseExportFromStored(snapshot) {
             schemaVersion: entry.schemaVersion, tombstone: entry.tombstone,
             payload: entry.payloadJson === null ? null : JSON.parse(entry.payloadJson), payloadChecksum: entry.payloadChecksum,
         })),
+        ...(snapshot.siteAccess ? { siteAccess: snapshot.siteAccess } : {}),
     });
     if (release.manifestChecksum !== snapshot.manifestChecksum)
         throw new Error("invalid_release_export");

package/dist/site-access.d.ts

@@ -0,0 +1,48 @@
+import { type D1DatabaseLike } from "./persistence.js";
+export declare const siteAccessPbkdf2Iterations = 100000;
+export type SiteAccessReleaseDescriptor = Readonly<{
+    versionId: string;
+    enabled: boolean;
+    formatVersion: 1;
+    keyId: string | null;
+    nonce: string | null;
+    ciphertext: string | null;
+    descriptorChecksum: string;
+}>;
+export type SiteAccessState = Readonly<{
+    active: SiteAccessReleaseDescriptor | null;
+    draft: SiteAccessReleaseDescriptor | null;
+}>;
+export declare function createSiteAccessVersion(input: {
+    versionId: string;
+    siteId: string;
+    enabled: boolean;
+    password?: string;
+    keyring?: unknown;
+}): Promise<SiteAccessReleaseDescriptor>;
+export declare function verifySiteAccessPassword(input: {
+    siteId: string;
+    access: SiteAccessReleaseDescriptor;
+    keyring: unknown;
+    password: string;
+}): Promise<boolean>;
+export declare function siteAccessSessionToken(input: {
+    siteId: string;
+    access: SiteAccessReleaseDescriptor;
+    keyring: unknown;
+}): Promise<string>;
+export declare class D1SiteAccessRepository {
+    private readonly db;
+    constructor(db: D1DatabaseLike);
+    initialize(now: number): Promise<void>;
+    state(): Promise<SiteAccessState>;
+    saveDraft(input: {
+        access: SiteAccessReleaseDescriptor;
+        expectedDraftVersionId: string | null;
+        requestChecksum: string;
+        authorSubject: string;
+        authorLabel: string;
+        now: number;
+    }): Promise<void>;
+    discard(expectedDraftVersionId: string, now: number): Promise<void>;
+}

package/dist/site-access.js

@@ -0,0 +1,180 @@
+import { canonicalChecksum, canonicalJson } from "./persistence.js";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const keyIdPattern = /^[A-Za-z0-9._-]{1,80}$/;
+export const siteAccessPbkdf2Iterations = 100_000;
+function asBuffer(bytes) {
+    return Uint8Array.from(bytes).buffer;
+}
+function bytesToBase64url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/g, "");
+}
+function base64urlToBytes(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value || ""))
+        throw new Error("site_access_unavailable");
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - value.length % 4) % 4);
+    try {
+        const binary = atob(padded);
+        return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    }
+    catch {
+        throw new Error("site_access_unavailable");
+    }
+}
+function parseKeyring(raw) {
+    let parsed;
+    try {
+        parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+    }
+    catch {
+        throw new Error("site_access_unavailable");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error("site_access_unavailable");
+    const value = parsed;
+    if (typeof value.current !== "string" || !keyIdPattern.test(value.current) || !value.keys || typeof value.keys !== "object" || Array.isArray(value.keys)) {
+        throw new Error("site_access_unavailable");
+    }
+    const keys = {};
+    for (const [keyId, encoded] of Object.entries(value.keys)) {
+        if (!keyIdPattern.test(keyId) || typeof encoded !== "string")
+            throw new Error("site_access_unavailable");
+        const bytes = base64urlToBytes(encoded);
+        if (bytes.byteLength !== 32)
+            throw new Error("site_access_unavailable");
+        keys[keyId] = bytes;
+    }
+    if (!keys[value.current])
+        throw new Error("site_access_unavailable");
+    return { current: value.current, keys };
+}
+async function hkdfKey(root, siteId, keyId, purpose, algorithm, usages) {
+    const material = await crypto.subtle.importKey("raw", asBuffer(root), "HKDF", false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({
+        name: "HKDF", hash: "SHA-256",
+        salt: encoder.encode("adminkit.site-access.v1"),
+        info: encoder.encode(`${purpose}|${siteId}|${keyId}`),
+    }, material, algorithm, false, usages);
+}
+function aad(siteId, versionId) {
+    return encoder.encode(`adminkit.site-access.v1|${siteId}|${versionId}`);
+}
+async function descriptor(input) {
+    if (!uuid.test(input.versionId) || input.formatVersion !== 1)
+        throw new Error("invalid_site_access");
+    if (input.enabled !== Boolean(input.keyId && input.nonce && input.ciphertext))
+        throw new Error("invalid_site_access");
+    const descriptorChecksum = await canonicalChecksum(input);
+    return { ...input, descriptorChecksum };
+}
+export async function createSiteAccessVersion(input) {
+    if (!input.enabled)
+        return descriptor({ versionId: input.versionId, enabled: false, formatVersion: 1, keyId: null, nonce: null, ciphertext: null });
+    if (typeof input.password !== "string" || input.password.length < 8 || input.password.length > 200)
+        throw new Error("invalid_site_access_password");
+    const keyring = parseKeyring(input.keyring);
+    const salt = crypto.getRandomValues(new Uint8Array(16));
+    const passwordKey = await crypto.subtle.importKey("raw", encoder.encode(input.password), "PBKDF2", false, ["deriveBits"]);
+    const hash = new Uint8Array(await crypto.subtle.deriveBits({ name: "PBKDF2", hash: "SHA-256", salt: asBuffer(salt), iterations: siteAccessPbkdf2Iterations }, passwordKey, 256));
+    const plaintext = encoder.encode(canonicalJson({ version: 1, kdf: "PBKDF2-SHA256", iterations: siteAccessPbkdf2Iterations, salt: bytesToBase64url(salt), hash: bytesToBase64url(hash) }));
+    const nonce = crypto.getRandomValues(new Uint8Array(12));
+    const encryptionKey = await hkdfKey(keyring.keys[keyring.current], input.siteId, keyring.current, "verifier", { name: "AES-GCM", length: 256 }, ["encrypt"]);
+    const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv: asBuffer(nonce), additionalData: asBuffer(aad(input.siteId, input.versionId)), tagLength: 128 }, encryptionKey, plaintext));
+    return descriptor({ versionId: input.versionId, enabled: true, formatVersion: 1, keyId: keyring.current, nonce: bytesToBase64url(nonce), ciphertext: bytesToBase64url(ciphertext) });
+}
+async function decryptVerifier(input) {
+    const keyring = parseKeyring(input.keyring);
+    const keyId = input.access.keyId || "";
+    const root = keyring.keys[keyId];
+    if (!root || !input.access.nonce || !input.access.ciphertext)
+        throw new Error("site_access_unavailable");
+    try {
+        const key = await hkdfKey(root, input.siteId, keyId, "verifier", { name: "AES-GCM", length: 256 }, ["decrypt"]);
+        const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: asBuffer(base64urlToBytes(input.access.nonce)), additionalData: asBuffer(aad(input.siteId, input.access.versionId)), tagLength: 128 }, key, asBuffer(base64urlToBytes(input.access.ciphertext)));
+        const value = JSON.parse(decoder.decode(plaintext));
+        if (value?.version !== 1 || value?.kdf !== "PBKDF2-SHA256" || value?.iterations !== siteAccessPbkdf2Iterations)
+            throw new Error("site_access_unavailable");
+        return { salt: base64urlToBytes(value.salt), hash: base64urlToBytes(value.hash), keyring, keyId };
+    }
+    catch {
+        throw new Error("site_access_unavailable");
+    }
+}
+function constantTimeBytes(left, right) {
+    let difference = left.byteLength ^ right.byteLength;
+    for (let index = 0; index < Math.max(left.byteLength, right.byteLength); index += 1)
+        difference |= (left[index] || 0) ^ (right[index] || 0);
+    return difference === 0;
+}
+export async function verifySiteAccessPassword(input) {
+    if (!input.access.enabled)
+        return false;
+    const verifier = await decryptVerifier(input);
+    const passwordKey = await crypto.subtle.importKey("raw", encoder.encode(input.password), "PBKDF2", false, ["deriveBits"]);
+    const candidate = new Uint8Array(await crypto.subtle.deriveBits({ name: "PBKDF2", hash: "SHA-256", salt: asBuffer(verifier.salt), iterations: siteAccessPbkdf2Iterations }, passwordKey, 256));
+    return constantTimeBytes(candidate, verifier.hash);
+}
+export async function siteAccessSessionToken(input) {
+    if (!input.access.enabled || !input.access.keyId)
+        throw new Error("site_access_unavailable");
+    const keyring = parseKeyring(input.keyring);
+    const root = keyring.keys[input.access.keyId];
+    if (!root)
+        throw new Error("site_access_unavailable");
+    const key = await hkdfKey(root, input.siteId, input.access.keyId, "session", { name: "HMAC", hash: "SHA-256" }, ["sign"]);
+    const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(`session|${input.access.versionId}`)));
+    return `${input.access.versionId}.${bytesToBase64url(signature)}`;
+}
+async function rowDescriptor(row) {
+    return row ? descriptor({ versionId: row.versionId, enabled: Boolean(row.enabled), formatVersion: row.formatVersion, keyId: row.keyId, nonce: row.nonce, ciphertext: row.ciphertext }) : null;
+}
+export class D1SiteAccessRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async initialize(now) {
+        await this.db.prepare("INSERT INTO site_access_state (singleton, active_version_id, draft_version_id, updated_at) VALUES (1, NULL, NULL, ?) ON CONFLICT(singleton) DO NOTHING").bind(now).run();
+    }
+    async state() {
+        const rows = (await this.db.prepare(`SELECT version.version_id AS versionId, version.enabled, version.format_version AS formatVersion,
+      version.key_id AS keyId, version.nonce, version.ciphertext, version.state
+      FROM site_access_versions version JOIN site_access_state state ON state.singleton = 1
+      WHERE version.version_id IN (state.active_version_id, state.draft_version_id)`).all()).results ?? [];
+        return {
+            active: await rowDescriptor(rows.find((row) => row.state === "active") ?? null),
+            draft: await rowDescriptor(rows.find((row) => row.state === "draft") ?? null),
+        };
+    }
+    async saveDraft(input) {
+        const current = await this.db.prepare("SELECT draft_version_id AS draftVersionId FROM site_access_state WHERE singleton = 1").first();
+        if (!current || current.draftVersionId !== input.expectedDraftVersionId)
+            throw new Error("stale_site_access");
+        const statements = [];
+        if (input.expectedDraftVersionId)
+            statements.push(this.db.prepare(`UPDATE site_access_versions SET state = 'erased', erased_at = ?
+      WHERE version_id = ? AND state = 'draft'`).bind(input.now, input.expectedDraftVersionId));
+        statements.push(this.db.prepare(`INSERT INTO site_access_versions
+      (version_id, state, enabled, format_version, key_id, nonce, ciphertext, request_checksum, created_by_subject, created_by_label, created_at)
+      SELECT ?, 'draft', ?, ?, ?, ?, ?, ?, ?, ?, ? FROM site_access_state
+      WHERE singleton = 1 AND draft_version_id IS ?`)
+            .bind(input.access.versionId, Number(input.access.enabled), input.access.formatVersion, input.access.keyId, input.access.nonce, input.access.ciphertext, input.requestChecksum, input.authorSubject, input.authorLabel, input.now, input.expectedDraftVersionId));
+        statements.push(this.db.prepare("UPDATE site_access_state SET draft_version_id = ?, updated_at = ? WHERE singleton = 1 AND draft_version_id IS ?")
+            .bind(input.access.versionId, input.now, input.expectedDraftVersionId));
+        const results = await this.db.batch(statements);
+        if (results.at(-2)?.meta?.changes !== 1 || results.at(-1)?.meta?.changes !== 1)
+            throw new Error("stale_site_access");
+    }
+    async discard(expectedDraftVersionId, now) {
+        const results = await this.db.batch([
+            this.db.prepare("UPDATE site_access_versions SET state = 'erased', erased_at = ? WHERE version_id = ? AND state = 'draft'").bind(now, expectedDraftVersionId),
+            this.db.prepare("UPDATE site_access_state SET draft_version_id = NULL, updated_at = ? WHERE singleton = 1 AND draft_version_id = ?").bind(now, expectedDraftVersionId),
+        ]);
+        if (results[0]?.meta?.changes !== 1 || results[1]?.meta?.changes !== 1)
+            throw new Error("stale_site_access");
+    }
+}

package/dist/theme.css

@@ -291,6 +291,7 @@ a.ak-btn { text-decoration: none; display: inline-flex; align-items: center; }
 .mf-root-drop.is-over { border-color: var(--ak-accent); color: var(--ak-accent); background: var(--ak-panel); }
 /* Il cestino chiude la colonna, staccato: è un posto dove si va, non una cartella fra le altre. */
 .mf-tail { margin-top: 14px; padding-top: 12px; border-top: 1px solid var(--ak-line); }
+.mf-settings-tail { margin-top: 8px; }
 .mf-ico { flex: none; color: var(--ak-ink-quiet); }
 .mf-item.is-on .mf-ico { color: var(--ak-accent); }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardinali-studio/adminkit",
-  "version": "2.2.11",
+  "version": "2.2.12",
   "type": "module",
   "description": "Motore riusabile di un pannello di amministrazione per siti Hugo su Cloudflare Pages: codec del front matter guidato dallo schema, form React, libreria media su R2. NIENTE di specifico di un sito qui dentro.",
   "license": "UNLICENSED",
@@ -99,5 +99,8 @@
     "typescript": "^5.9.3",
     "wrangler": "4.114.0",
     "zod": "^4.4.3"
+  },
+  "dependencies": {
+    "heic-to": "^1.3.0"
   }
 }