@commonpub/layer 0.1.0

package/plugins/auth.ts

@@ -0,0 +1,23 @@
+// Auth plugin — hydrates session state from SSR context.
+// On the server, reads from event.context.auth (enriched by middleware).
+// On the client, trusts the SSR-hydrated useState values — refreshSession()
+// in the layout's onMounted handles lazy revalidation.
+import type { ClientAuthUser, ClientAuthSession } from '../composables/useAuth';
+
+export default defineNuxtPlugin(() => {
+  const user = useState<ClientAuthUser | null>('auth-user', () => null);
+  const session = useState<ClientAuthSession | null>('auth-session', () => null);
+
+  if (import.meta.server) {
+    const event = useRequestEvent();
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const authCtx = (event?.context as any)?.auth as { user?: ClientAuthUser; session?: ClientAuthSession } | undefined;
+    if (authCtx) {
+      user.value = (authCtx.user as ClientAuthUser) ?? null;
+      session.value = (authCtx.session as ClientAuthSession) ?? null;
+    }
+  }
+
+  // Client: useState already hydrated from SSR payload — no fetch needed here.
+  // refreshSession() in the default layout's onMounted() handles revalidation.
+});

package/server/api/admin/audit.get.ts

@@ -0,0 +1,17 @@
+import { listAuditLogs } from '@commonpub/server';
+import type { PaginatedResponse, AuditLogItem } from '@commonpub/server';
+import { z } from 'zod';
+
+const auditQuerySchema = z.object({
+  limit: z.coerce.number().int().positive().max(100).optional(),
+  offset: z.coerce.number().int().min(0).optional(),
+});
+
+export default defineEventHandler(async (event): Promise<PaginatedResponse<AuditLogItem>> => {
+  requireFeature('admin');
+  requireAdmin(event);
+  const db = useDB();
+  const filters = parseQueryParams(event, auditQuerySchema);
+
+  return listAuditLogs(db, filters);
+});

package/server/api/admin/content/[id].delete.ts

@@ -0,0 +1,15 @@
+import { removeContent, removeFederatedContent } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<void> => {
+  requireFeature('admin');
+  const admin = requireAdmin(event);
+  const db = useDB();
+  const { id } = parseParams(event, { id: 'uuid' });
+
+  try {
+    return await removeContent(db, id, admin.id);
+  } catch {
+    // Content not found in local table — try federated content table
+    return await removeFederatedContent(db, id, admin.id);
+  }
+});

package/server/api/admin/content/[id].patch.ts

@@ -0,0 +1,37 @@
+import { contentItems } from '@commonpub/schema';
+import { eq } from 'drizzle-orm';
+import { z } from 'zod';
+
+/**
+ * PATCH /api/admin/content/[id]
+ * Update admin-managed content fields (featured status, visibility).
+ */
+export default defineEventHandler(async (event) => {
+  requireAdmin(event);
+
+  const contentId = getRouterParam(event, 'id')!;
+  const body = await parseBody(event, z.object({
+    isFeatured: z.boolean().optional(),
+  }));
+
+  const db = useDB();
+
+  const updates: Record<string, unknown> = {};
+  if (body.isFeatured !== undefined) updates.isFeatured = body.isFeatured;
+
+  if (Object.keys(updates).length === 0) {
+    throw createError({ statusCode: 400, statusMessage: 'No fields to update' });
+  }
+
+  const result = await db
+    .update(contentItems)
+    .set(updates)
+    .where(eq(contentItems.id, contentId))
+    .returning({ id: contentItems.id, isFeatured: contentItems.isFeatured });
+
+  if (result.length === 0) {
+    throw createError({ statusCode: 404, statusMessage: 'Content not found' });
+  }
+
+  return result[0];
+});

package/server/api/admin/federation/activity.get.ts

@@ -0,0 +1,31 @@
+import { listFederationActivity } from '@commonpub/server';
+
+const VALID_DIRECTIONS = ['inbound', 'outbound'] as const;
+const VALID_STATUSES = ['pending', 'delivered', 'failed', 'processed'] as const;
+
+export default defineEventHandler(async (event) => {
+  requireFeature('admin');
+  requireAdmin(event);
+  const db = useDB();
+
+  const query = getQuery(event);
+
+  const direction = VALID_DIRECTIONS.includes(query.direction as typeof VALID_DIRECTIONS[number])
+    ? (query.direction as 'inbound' | 'outbound')
+    : undefined;
+
+  const status = VALID_STATUSES.includes(query.status as typeof VALID_STATUSES[number])
+    ? (query.status as 'pending' | 'delivered' | 'failed' | 'processed')
+    : undefined;
+
+  const limit = Math.max(1, Math.min(100, parseInt(query.limit as string, 10) || 50));
+  const offset = Math.max(0, parseInt(query.offset as string, 10) || 0);
+
+  return listFederationActivity(db, {
+    direction,
+    status,
+    type: typeof query.type === 'string' ? query.type : undefined,
+    limit,
+    offset,
+  });
+});

package/server/api/admin/federation/clients.get.ts

@@ -0,0 +1,9 @@
+import { listOAuthClients } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  requireFeature('federation');
+  requireAdmin(event);
+  const db = useDB();
+
+  return listOAuthClients(db);
+});

package/server/api/admin/federation/clients.post.ts

@@ -0,0 +1,16 @@
+import { registerOAuthClient } from '@commonpub/server';
+import { z } from 'zod';
+
+const registerSchema = z.object({
+  instanceDomain: z.string().min(3).max(255),
+  redirectUris: z.array(z.string().url()).min(1),
+});
+
+export default defineEventHandler(async (event) => {
+  requireFeature('federation');
+  requireAdmin(event);
+  const db = useDB();
+  const { instanceDomain, redirectUris } = await parseBody(event, registerSchema);
+
+  return registerOAuthClient(db, instanceDomain, redirectUris);
+});

package/server/api/admin/federation/hub-mirrors/index.get.ts

@@ -0,0 +1,10 @@
+import { listFederatedHubs } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  requireFeature('federation');
+  requireFeature('federateHubs');
+  requireAdmin(event);
+
+  const db = useDB();
+  return listFederatedHubs(db);
+});

package/server/api/admin/federation/hub-mirrors/index.post.ts

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+import { followRemoteHub, sendHubFollow, resolveRemoteActor } from '@commonpub/server';
+
+const bodySchema = z.object({
+  actorUri: z.string().url(),
+});
+
+export default defineEventHandler(async (event) => {
+  requireFeature('federation');
+  requireFeature('federateHubs');
+  requireAdmin(event);
+
+  const db = useDB();
+  const config = useConfig();
+  const body = await parseBody(event, bodySchema);
+
+  const actor = await resolveRemoteActor(db, body.actorUri);
+  if (!actor) {
+    throw createError({ statusCode: 404, statusMessage: 'Could not resolve remote hub actor' });
+  }
+
+  if (actor.type !== 'Group') {
+    throw createError({ statusCode: 400, statusMessage: 'Actor is not a Group (hub)' });
+  }
+
+  const domain = new URL(body.actorUri).hostname;
+  const slugMatch = body.actorUri.match(/\/hubs\/([^/]+)$/);
+  const remoteSlug = slugMatch?.[1] ?? actor.preferredUsername ?? 'unknown';
+
+  const result = await followRemoteHub(db, body.actorUri, {
+    originDomain: domain,
+    remoteSlug,
+    name: actor.name ?? actor.preferredUsername ?? remoteSlug,
+    description: actor.summary ?? undefined,
+    iconUrl: actor.icon?.url ?? undefined,
+    url: `https://${domain}/hubs/${remoteSlug}`,
+  });
+
+  await sendHubFollow(db, body.actorUri, config.instance.domain);
+
+  return { success: true, hubId: result.id, created: result.created };
+});

package/server/api/admin/federation/mirrors/[id]/backfill.post.ts

@@ -0,0 +1,39 @@
+import { getMirror, backfillFromOutbox } from '@commonpub/server';
+/** Extract clean domain from URL */
+function extractDomain(url: string): string {
+  try { return new URL(url).hostname; }
+  catch { return url.replace(/^https?:\/\//, '').replace(/[:/].*$/, ''); }
+}
+
+/**
+ * POST /api/admin/federation/mirrors/[id]/backfill
+ * Crawl the remote instance's outbox to import historical content.
+ * Admin only.
+ */
+export default defineEventHandler(async (event) => {
+  requireAdmin(event);
+
+  const config = useConfig();
+  if (!config.features.federation) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const mirrorId = getRouterParam(event, 'id')!;
+  const db = useDB();
+
+  const mirror = await getMirror(db, mirrorId);
+  if (!mirror) {
+    throw createError({ statusCode: 404, statusMessage: 'Mirror not found' });
+  }
+
+  const runtimeConfig = useRuntimeConfig();
+  const domain = extractDomain((runtimeConfig.public?.siteUrl as string) || `https://${config.instance.domain}`);
+
+  const result = await backfillFromOutbox(db, mirror.remoteActorUri, domain);
+
+  return {
+    mirrorId: mirror.id,
+    remoteDomain: mirror.remoteDomain,
+    ...result,
+  };
+});

package/server/api/admin/federation/mirrors/[id].delete.ts

@@ -0,0 +1,11 @@
+import { cancelMirror } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  requireFeature('federation');
+  requireAdmin(event);
+  const db = useDB();
+  const { id } = parseParams(event, { id: 'uuid' });
+
+  await cancelMirror(db, id);
+  return { success: true };
+});

package/server/api/admin/federation/mirrors/[id].get.ts

@@ -0,0 +1,15 @@
+import { getMirror } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  requireFeature('federation');
+  requireAdmin(event);
+  const db = useDB();
+  const { id } = parseParams(event, { id: 'uuid' });
+
+  const mirror = await getMirror(db, id);
+  if (!mirror) {
+    throw createError({ statusCode: 404, statusMessage: 'Mirror not found' });
+  }
+
+  return mirror;
+});

package/server/api/admin/federation/mirrors/[id].put.ts

@@ -0,0 +1,22 @@
+import { pauseMirror, resumeMirror } from '@commonpub/server';
+import { z } from 'zod';
+
+const updateMirrorSchema = z.object({
+  action: z.enum(['pause', 'resume']),
+});
+
+export default defineEventHandler(async (event) => {
+  requireFeature('federation');
+  requireAdmin(event);
+  const db = useDB();
+  const { id } = parseParams(event, { id: 'uuid' });
+  const { action } = await parseBody(event, updateMirrorSchema);
+
+  if (action === 'pause') {
+    await pauseMirror(db, id);
+  } else {
+    await resumeMirror(db, id);
+  }
+
+  return { success: true };
+});

package/server/api/admin/federation/mirrors/index.get.ts

@@ -0,0 +1,9 @@
+import { listMirrors } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  requireFeature('federation');
+  requireAdmin(event);
+  const db = useDB();
+
+  return listMirrors(db);
+});

package/server/api/admin/federation/mirrors/index.post.ts

@@ -0,0 +1,30 @@
+import { createMirror } from '@commonpub/server';
+import { z } from 'zod';
+
+const createMirrorSchema = z.object({
+  remoteDomain: z.string().min(3).max(255),
+  remoteActorUri: z.string().url(),
+  direction: z.enum(['pull', 'push']),
+  filterContentTypes: z.array(z.string()).nullable().optional(),
+  filterTags: z.array(z.string()).nullable().optional(),
+});
+
+export default defineEventHandler(async (event) => {
+  requireFeature('federation');
+  requireAdmin(event);
+  const db = useDB();
+  const input = await parseBody(event, createMirrorSchema);
+
+  const config = useConfig();
+  return createMirror(
+    db,
+    input.remoteDomain,
+    input.remoteActorUri,
+    input.direction,
+    config.instance.domain,
+    {
+      contentTypes: input.filterContentTypes ?? undefined,
+      tags: input.filterTags ?? undefined,
+    },
+  );
+});

package/server/api/admin/federation/pending.get.ts

@@ -0,0 +1,22 @@
+import { eq, and, desc } from 'drizzle-orm';
+import { activities } from '@commonpub/schema';
+
+/**
+ * GET /api/admin/federation/pending
+ * Lists pending outbound activities for diagnostic purposes.
+ * Helps debug delivery issues (stuck Delete activities, etc.)
+ */
+export default defineEventHandler(async (event) => {
+  requireFeature('admin');
+  requireAdmin(event);
+  const db = useDB();
+
+  const pending = await db
+    .select()
+    .from(activities)
+    .where(and(eq(activities.direction, 'outbound'), eq(activities.status, 'pending')))
+    .orderBy(desc(activities.createdAt))
+    .limit(50);
+
+  return { count: pending.length, activities: pending };
+});

package/server/api/admin/federation/refederate.post.ts

@@ -0,0 +1,92 @@
+import { contentItems, hubs, hubPosts } from '@commonpub/schema';
+import { federateContent, federateHubPost, federateHubActor } from '@commonpub/server';
+import { eq, isNull } from 'drizzle-orm';
+import { extractDomain } from '../../../utils/inbox';
+
+/**
+ * POST /api/admin/federation/refederate
+ * Queue all published content AND hub posts for federation delivery.
+ * Useful after establishing new mirrors or enabling federation.
+ *
+ * Body: { contentId?: string, hubsOnly?: boolean } — if omitted, re-federates ALL
+ */
+export default defineEventHandler(async (event) => {
+  requireAdmin(event);
+
+  const config = useConfig();
+  if (!config.features.federation) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const body = await readBody(event);
+  const contentId = body?.contentId as string | undefined;
+  const hubsOnly = body?.hubsOnly === true;
+
+  const db = useDB();
+  const runtimeConfig = useRuntimeConfig();
+  const domain = extractDomain((runtimeConfig.public?.siteUrl as string) || `https://${config.instance.domain}`);
+
+  if (contentId) {
+    await federateContent(db, contentId, domain);
+    return { queued: 1 };
+  }
+
+  let contentQueued = 0;
+  let hubsQueued = 0;
+  let hubPostsQueued = 0;
+
+  // Re-federate published content (unless hubsOnly)
+  if (!hubsOnly) {
+    const published = await db
+      .select({ id: contentItems.id })
+      .from(contentItems)
+      .where(eq(contentItems.status, 'published'));
+
+    for (const item of published) {
+      try {
+        await federateContent(db, item.id, domain);
+        contentQueued++;
+      } catch {
+        // Skip items that fail
+      }
+    }
+  }
+
+  // Re-federate hubs: announce each hub's Group actor + all hub posts
+  if (config.features.federateHubs) {
+    const allHubs = await db
+      .select({ id: hubs.id })
+      .from(hubs)
+      .where(isNull(hubs.deletedAt));
+
+    for (const hub of allHubs) {
+      try {
+        await federateHubActor(db, hub.id, domain);
+        hubsQueued++;
+      } catch {
+        // Skip hubs that fail
+      }
+
+      const posts = await db
+        .select({ id: hubPosts.id })
+        .from(hubPosts)
+        .where(eq(hubPosts.hubId, hub.id));
+
+      for (const post of posts) {
+        try {
+          await federateHubPost(db, post.id, hub.id, domain);
+          hubPostsQueued++;
+        } catch {
+          // Skip posts that fail
+        }
+      }
+    }
+  }
+
+  return {
+    queued: contentQueued + hubsQueued + hubPostsQueued,
+    content: contentQueued,
+    hubs: hubsQueued,
+    hubPosts: hubPostsQueued,
+  };
+});

package/server/api/admin/federation/repair-types.post.ts

@@ -0,0 +1,57 @@
+import { eq, and, isNull } from 'drizzle-orm';
+import { federatedContent } from '@commonpub/schema';
+
+/**
+ * POST /api/admin/federation/repair-types
+ * Re-fetches source objects for federated content with missing cpubType
+ * and updates them based on the cpub:type extension field.
+ */
+export default defineEventHandler(async (event) => {
+  requireFeature('admin');
+  requireAdmin(event);
+  const db = useDB();
+
+  const rows = await db
+    .select({
+      id: federatedContent.id,
+      objectUri: federatedContent.objectUri,
+    })
+    .from(federatedContent)
+    .where(and(
+      isNull(federatedContent.cpubType),
+      isNull(federatedContent.deletedAt),
+    ))
+    .limit(500);
+
+  let updated = 0;
+  let errors = 0;
+
+  for (const row of rows) {
+    try {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 15_000);
+      const response = await fetch(row.objectUri, {
+        headers: { Accept: 'application/activity+json, application/ld+json' },
+        signal: controller.signal,
+      });
+      clearTimeout(timeout);
+
+      if (!response.ok) { errors++; continue; }
+
+      const object = await response.json() as Record<string, unknown>;
+      const cpubType = typeof object['cpub:type'] === 'string' ? object['cpub:type'] : null;
+
+      if (cpubType) {
+        await db
+          .update(federatedContent)
+          .set({ cpubType, updatedAt: new Date() })
+          .where(eq(federatedContent.id, row.id));
+        updated++;
+      }
+    } catch {
+      errors++;
+    }
+  }
+
+  return { total: rows.length, updated, errors };
+});

package/server/api/admin/federation/retry.post.ts

@@ -0,0 +1,41 @@
+import { activities } from '@commonpub/schema';
+import { eq, and } from 'drizzle-orm';
+
+/**
+ * POST /api/admin/federation/retry
+ * Reset failed activities to pending so the delivery worker retries them.
+ * Optionally filter by activity ID.
+ *
+ * Body: { activityId?: string } — if omitted, retries ALL failed activities
+ */
+export default defineEventHandler(async (event) => {
+  requireAdmin(event);
+
+  const config = useConfig();
+  if (!config.features.federation) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' });
+  }
+
+  const body = await readBody(event);
+  const activityId = body?.activityId as string | undefined;
+
+  const db = useDB();
+
+  if (activityId) {
+    const result = await db
+      .update(activities)
+      .set({ status: 'pending', attempts: 0, error: null, updatedAt: new Date() })
+      .where(and(eq(activities.id, activityId), eq(activities.status, 'failed')))
+      .returning({ id: activities.id });
+
+    return { retried: result.length };
+  }
+
+  const result = await db
+    .update(activities)
+    .set({ status: 'pending', attempts: 0, error: null, updatedAt: new Date() })
+    .where(eq(activities.status, 'failed'))
+    .returning({ id: activities.id });
+
+  return { retried: result.length };
+});

package/server/api/admin/federation/stats.get.ts

@@ -0,0 +1,26 @@
+import { sql, eq } from 'drizzle-orm';
+import { activities, followRelationships } from '@commonpub/schema';
+
+export default defineEventHandler(async (event) => {
+  requireFeature('admin');
+  requireAdmin(event);
+  const db = useDB();
+
+  const [inbound, outbound, pending, failed, followers, following] = await Promise.all([
+    db.select({ count: sql<number>`count(*)::int` }).from(activities).where(eq(activities.direction, 'inbound')),
+    db.select({ count: sql<number>`count(*)::int` }).from(activities).where(eq(activities.direction, 'outbound')),
+    db.select({ count: sql<number>`count(*)::int` }).from(activities).where(eq(activities.status, 'pending')),
+    db.select({ count: sql<number>`count(*)::int` }).from(activities).where(eq(activities.status, 'failed')),
+    db.select({ count: sql<number>`count(*)::int` }).from(followRelationships).where(eq(followRelationships.status, 'accepted')),
+    db.select({ count: sql<number>`count(*)::int` }).from(followRelationships),
+  ]);
+
+  return {
+    inbound: inbound[0]?.count ?? 0,
+    outbound: outbound[0]?.count ?? 0,
+    pending: pending[0]?.count ?? 0,
+    failed: failed[0]?.count ?? 0,
+    followers: followers[0]?.count ?? 0,
+    following: following[0]?.count ?? 0,
+  };
+});

package/server/api/admin/reports/[id]/resolve.post.ts

@@ -0,0 +1,12 @@
+import { resolveReport } from '@commonpub/server';
+import { resolveReportSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<void> => {
+  requireFeature('admin');
+  const admin = requireAdmin(event);
+  const db = useDB();
+  const { id } = parseParams(event, { id: 'uuid' });
+  const input = await parseBody(event, resolveReportSchema);
+
+  return resolveReport(db, id, input.resolution, input.status ?? 'resolved', admin.id);
+});

package/server/api/admin/reports.get.ts

@@ -0,0 +1,17 @@
+import { listReports } from '@commonpub/server';
+import type { PaginatedResponse, ReportListItem } from '@commonpub/server';
+import { z } from 'zod';
+
+const reportsQuerySchema = z.object({
+  limit: z.coerce.number().int().positive().max(100).optional(),
+  offset: z.coerce.number().int().min(0).optional(),
+});
+
+export default defineEventHandler(async (event): Promise<PaginatedResponse<ReportListItem>> => {
+  requireFeature('admin');
+  requireAdmin(event);
+  const db = useDB();
+  const filters = parseQueryParams(event, reportsQuerySchema);
+
+  return listReports(db, filters);
+});

package/server/api/admin/settings.get.ts

@@ -0,0 +1,22 @@
+import { getInstanceSettings } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  requireFeature('admin');
+  requireAdmin(event);
+  const db = useDB();
+  const config = useConfig();
+
+  // Get DB-stored settings
+  const dbSettings = await getInstanceSettings(db);
+
+  // Merge with running config defaults so the UI shows actual values
+  const defaults: Record<string, string> = {
+    'instance.name': config.instance.name,
+    'instance.description': config.instance.description,
+    'instance.registrationOpen': 'true',
+    'instance.maxUploadSize': String(config.instance.maxUploadSize ?? 10485760),
+    'instance.contactEmail': config.instance.contactEmail ?? '',
+  };
+
+  return { ...defaults, ...dbSettings };
+});

package/server/api/admin/settings.put.ts

@@ -0,0 +1,11 @@
+import { setInstanceSetting } from '@commonpub/server';
+import { adminSettingSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<void> => {
+  requireFeature('admin');
+  const admin = requireAdmin(event);
+  const db = useDB();
+  const input = await parseBody(event, adminSettingSchema);
+
+  return setInstanceSetting(db, input.key, input.value, admin.id);
+});

package/server/api/admin/stats.get.ts

@@ -0,0 +1,9 @@
+import { getPlatformStats } from '@commonpub/server';
+import type { PlatformStats } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<PlatformStats> => {
+  requireFeature('admin');
+  requireAdmin(event);
+  const db = useDB();
+  return getPlatformStats(db);
+});