@commonpub/layer 0.1.0

package/server/api/hubs/[slug]/feed.xml.get.ts

@@ -0,0 +1,60 @@
+import { getHubBySlug, listHubGallery } from '@commonpub/server';
+
+function escapeXml(str: string): string {
+  return str
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+export default defineEventHandler(async (event) => {
+  const db = useDB();
+  const config = useRuntimeConfig();
+  const siteUrl = config.public.siteUrl as string;
+  const { slug } = parseParams(event, { slug: 'string' });
+
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  const { items } = await listHubGallery(db, hub.id, { limit: 50 });
+
+  const lastBuildDate = items.length > 0 && items[0].publishedAt
+    ? new Date(items[0].publishedAt).toUTCString()
+    : new Date().toUTCString();
+
+  const rssItems = items.map((item) => {
+    const link = `${siteUrl}/${item.type}/${item.slug}`;
+    const pubDate = item.publishedAt ? new Date(item.publishedAt).toUTCString() : new Date().toUTCString();
+    return `    <item>
+      <title>${escapeXml(item.title)}</title>
+      <link>${escapeXml(link)}</link>
+      <guid isPermaLink="true">${escapeXml(link)}</guid>
+      <pubDate>${pubDate}</pubDate>
+      <description>${escapeXml((item as any).description ?? item.title)}</description>
+      <author>${escapeXml(item.author.displayName ?? item.author.username)}</author>
+      <category>${escapeXml(item.type)}</category>
+    </item>`;
+  });
+
+  const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
+  <channel>
+    <title>${escapeXml(hub.name)} — CommonPub</title>
+    <link>${escapeXml(siteUrl)}/hubs/${escapeXml(slug)}</link>
+    <description>${escapeXml(hub.description ?? `Content from ${hub.name}`)}</description>
+    <language>en</language>
+    <lastBuildDate>${lastBuildDate}</lastBuildDate>
+    <atom:link href="${escapeXml(siteUrl)}/api/hubs/${escapeXml(slug)}/feed.xml" rel="self" type="application/rss+xml"/>
+${rssItems.join('\n')}
+  </channel>
+</rss>`;
+
+  setResponseHeader(event, 'Content-Type', 'application/rss+xml; charset=utf-8');
+  setResponseHeader(event, 'Cache-Control', 'public, max-age=600, stale-while-revalidate=300');
+  return xml;
+});

package/server/api/hubs/[slug]/gallery.get.ts

@@ -0,0 +1,21 @@
+import { getHubBySlug, listHubGallery } from '@commonpub/server';
+import { z } from 'zod';
+
+const galleryQuerySchema = z.object({
+  limit: z.coerce.number().int().positive().max(100).optional(),
+  offset: z.coerce.number().int().min(0).optional(),
+});
+
+export default defineEventHandler(async (event) => {
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const query = parseQueryParams(event, galleryQuerySchema);
+
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  return listHubGallery(db, hub.id, query);
+});

package/server/api/hubs/[slug]/index.delete.ts

@@ -0,0 +1,18 @@
+import { deleteHub, getHubBySlug } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<{ success: boolean }> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+
+  const hub = await getHubBySlug(db, slug, user.id);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  const deleted = await deleteHub(db, hub.id, user.id);
+  if (!deleted) {
+    throw createError({ statusCode: 403, statusMessage: 'Not authorized to delete this hub' });
+  }
+  return { success: true };
+});

package/server/api/hubs/[slug]/index.get.ts

@@ -0,0 +1,14 @@
+import { getHubBySlug } from '@commonpub/server';
+import type { HubDetail } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<HubDetail> => {
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const user = getOptionalUser(event);
+
+  const community = await getHubBySlug(db, slug, user?.id);
+  if (!community) {
+    throw createError({ statusCode: 404, statusMessage: 'Community not found' });
+  }
+  return community;
+});

package/server/api/hubs/[slug]/index.put.ts

@@ -0,0 +1,22 @@
+import { updateHub, getHubBySlug } from '@commonpub/server';
+import type { HubDetail } from '@commonpub/server';
+import { updateHubSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<HubDetail> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+
+  const hub = await getHubBySlug(db, slug, user.id);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  const input = await parseBody(event, updateHubSchema);
+
+  const updated = await updateHub(db, hub.id, user.id, input);
+  if (!updated) {
+    throw createError({ statusCode: 403, statusMessage: 'Not authorized to update this hub' });
+  }
+  return updated;
+});

package/server/api/hubs/[slug]/invites.get.ts

@@ -0,0 +1,20 @@
+import { listInvites, getHubBySlug, getMember } from '@commonpub/server';
+import type { HubInviteItem } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<HubInviteItem[]> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  // Only moderators, admins, and owners can view invite lists
+  const member = await getMember(db, hub.id, user.id);
+  if (!member || !['moderator', 'admin', 'owner'].includes(member.role)) {
+    throw createError({ statusCode: 403, statusMessage: 'Insufficient permissions' });
+  }
+
+  return listInvites(db, hub.id);
+});

package/server/api/hubs/[slug]/invites.post.ts

@@ -0,0 +1,27 @@
+import { createInvite, getHubBySlug } from '@commonpub/server';
+import type { HubInviteItem } from '@commonpub/server';
+import { createInviteSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<HubInviteItem> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const input = await parseBody(event, createInviteSchema);
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  const invite = await createInvite(
+    db,
+    user.id,
+    hub.id,
+    input.maxUses,
+    input.expiresAt ? new Date(input.expiresAt) : undefined,
+  );
+  if (!invite) {
+    throw createError({ statusCode: 403, statusMessage: 'Not authorized to create invites' });
+  }
+  return invite;
+});

package/server/api/hubs/[slug]/join.post.ts

@@ -0,0 +1,17 @@
+import { joinHub, getHubBySlug } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<{ joined: boolean; error?: string }> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const community = await getHubBySlug(db, slug);
+  if (!community) {
+    throw createError({ statusCode: 404, statusMessage: 'Community not found' });
+  }
+
+  // Read optional invite token from body (required for non-open hubs)
+  const body = await readBody(event).catch(() => null);
+  const inviteToken = typeof body?.inviteToken === 'string' ? body.inviteToken : undefined;
+
+  return joinHub(db, user.id, community.id, inviteToken);
+});

package/server/api/hubs/[slug]/leave.post.ts

@@ -0,0 +1,13 @@
+import { leaveHub, getHubBySlug } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<{ left: boolean; error?: string }> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const community = await getHubBySlug(db, slug);
+  if (!community) {
+    throw createError({ statusCode: 404, statusMessage: 'Community not found' });
+  }
+
+  return leaveHub(db, user.id, community.id);
+});

package/server/api/hubs/[slug]/members/[userId].delete.ts

@@ -0,0 +1,13 @@
+import { kickMember, getHubBySlug } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<{ kicked: boolean; error?: string }> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug, userId } = parseParams(event, { slug: 'string', userId: 'uuid' });
+  const community = await getHubBySlug(db, slug);
+  if (!community) {
+    throw createError({ statusCode: 404, statusMessage: 'Community not found' });
+  }
+
+  return kickMember(db, user.id, community.id, userId);
+});

package/server/api/hubs/[slug]/members/[userId].put.ts

@@ -0,0 +1,16 @@
+import { changeRole, getHubBySlug } from '@commonpub/server';
+import { changeRoleSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<{ changed: boolean; error?: string }> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug, userId } = parseParams(event, { slug: 'string', userId: 'uuid' });
+  const input = await parseBody(event, changeRoleSchema);
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  return changeRole(db, user.id, hub.id, userId, input.role);
+});

package/server/api/hubs/[slug]/members.get.ts

@@ -0,0 +1,20 @@
+import { listMembers, getHubBySlug } from '@commonpub/server';
+import type { HubMemberItem } from '@commonpub/server';
+import { z } from 'zod';
+
+const membersQuerySchema = z.object({
+  limit: z.coerce.number().int().min(1).max(100).optional(),
+  offset: z.coerce.number().int().min(0).optional(),
+});
+
+export default defineEventHandler(async (event): Promise<{ items: HubMemberItem[]; total: number }> => {
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const query = parseQueryParams(event, membersQuerySchema);
+  const community = await getHubBySlug(db, slug);
+  if (!community) {
+    throw createError({ statusCode: 404, statusMessage: 'Community not found' });
+  }
+
+  return listMembers(db, community.id, query);
+});

package/server/api/hubs/[slug]/posts/[postId]/like.post.ts

@@ -0,0 +1,21 @@
+import { likePost, unlikePost, hasLikedPost, getHubBySlug, getPostById } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug, postId } = parseParams(event, { slug: 'string', postId: 'uuid' });
+
+  const community = await getHubBySlug(db, slug);
+  if (!community) throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+
+  const post = await getPostById(db, postId);
+  if (!post || post.hubId !== community.id) throw createError({ statusCode: 404, statusMessage: 'Post not found' });
+
+  const alreadyLiked = await hasLikedPost(db, user.id, postId);
+  if (alreadyLiked) {
+    await unlikePost(db, user.id, postId);
+    return { liked: false };
+  }
+  await likePost(db, user.id, postId);
+  return { liked: true };
+});

package/server/api/hubs/[slug]/posts/[postId]/lock.post.ts

@@ -0,0 +1,17 @@
+import { toggleLockPost, getHubBySlug, getPostById } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug, postId } = parseParams(event, { slug: 'string', postId: 'uuid' });
+
+  const community = await getHubBySlug(db, slug);
+  if (!community) throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+
+  const post = await getPostById(db, postId);
+  if (!post || post.hubId !== community.id) throw createError({ statusCode: 404, statusMessage: 'Post not found' });
+
+  const result = await toggleLockPost(db, postId, user.id, community.id);
+  if (!result) throw createError({ statusCode: 403, statusMessage: 'Not authorized' });
+  return result;
+});

package/server/api/hubs/[slug]/posts/[postId]/pin.post.ts

@@ -0,0 +1,17 @@
+import { togglePinPost, getHubBySlug, getPostById } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug, postId } = parseParams(event, { slug: 'string', postId: 'uuid' });
+
+  const community = await getHubBySlug(db, slug);
+  if (!community) throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+
+  const post = await getPostById(db, postId);
+  if (!post || post.hubId !== community.id) throw createError({ statusCode: 404, statusMessage: 'Post not found' });
+
+  const result = await togglePinPost(db, postId, user.id, community.id);
+  if (!result) throw createError({ statusCode: 403, statusMessage: 'Not authorized' });
+  return result;
+});

package/server/api/hubs/[slug]/posts/[postId]/replies.get.ts

@@ -0,0 +1,16 @@
+import { listReplies } from '@commonpub/server';
+import type { HubReplyItem } from '@commonpub/server';
+import { z } from 'zod';
+
+const repliesQuerySchema = z.object({
+  limit: z.coerce.number().int().min(1).max(100).optional(),
+  offset: z.coerce.number().int().min(0).optional(),
+});
+
+export default defineEventHandler(async (event): Promise<{ items: HubReplyItem[]; total: number }> => {
+  const db = useDB();
+  const { postId } = parseParams(event, { postId: 'uuid' });
+  const query = parseQueryParams(event, repliesQuerySchema);
+
+  return listReplies(db, postId, query);
+});

package/server/api/hubs/[slug]/posts/[postId]/replies.post.ts

@@ -0,0 +1,21 @@
+import { createReply } from '@commonpub/server';
+import type { HubReplyItem } from '@commonpub/server';
+import { createReplySchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<HubReplyItem> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { postId } = parseParams(event, { postId: 'uuid' });
+  const body = await readBody(event);
+
+  const parsed = createReplySchema.safeParse({ ...body, postId });
+  if (!parsed.success) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Validation failed',
+      data: { errors: parsed.error.flatten().fieldErrors },
+    });
+  }
+
+  return createReply(db, user.id, parsed.data);
+});

package/server/api/hubs/[slug]/posts/[postId].delete.ts

@@ -0,0 +1,23 @@
+import { deletePost, getHubBySlug, federateHubPostDelete } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<boolean> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const config = useConfig();
+  const { slug, postId } = parseParams(event, { slug: 'string', postId: 'uuid' });
+  const community = await getHubBySlug(db, slug);
+  if (!community) {
+    throw createError({ statusCode: 404, statusMessage: 'Community not found' });
+  }
+
+  const deleted = await deletePost(db, postId, user.id, community.id);
+
+  // Federate deletion as Delete(Tombstone) from the hub Group actor
+  if (deleted && config.features.federation && config.features.federateHubs) {
+    federateHubPostDelete(db, postId, slug, config.instance.domain).catch((err) => {
+      console.error('[hub-federation] Failed to federate post deletion:', err);
+    });
+  }
+
+  return deleted;
+});

package/server/api/hubs/[slug]/posts/[postId].get.ts

@@ -0,0 +1,16 @@
+import { getPostById, getHubBySlug, hasLikedPost } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  const db = useDB();
+  const user = getOptionalUser(event);
+  const { slug, postId } = parseParams(event, { slug: 'string', postId: 'uuid' });
+
+  const community = await getHubBySlug(db, slug);
+  if (!community) throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+
+  const post = await getPostById(db, postId);
+  if (!post || post.hubId !== community.id) throw createError({ statusCode: 404, statusMessage: 'Post not found' });
+
+  const liked = user ? await hasLikedPost(db, user.id, postId) : false;
+  return { ...post, isLiked: liked };
+});

package/server/api/hubs/[slug]/posts/index.get.ts

@@ -0,0 +1,16 @@
+import { listPosts, getHubBySlug } from '@commonpub/server';
+import type { PaginatedResponse, HubPostItem } from '@commonpub/server';
+import { hubPostFiltersSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<PaginatedResponse<HubPostItem>> => {
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const filters = parseQueryParams(event, hubPostFiltersSchema);
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  return listPosts(db, hub.id, filters);
+});

package/server/api/hubs/[slug]/posts/index.post.ts

@@ -0,0 +1,36 @@
+import { createPost, getHubBySlug, federateHubPost } from '@commonpub/server';
+import type { HubPostItem } from '@commonpub/server';
+import { createPostSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<HubPostItem> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const config = useConfig();
+  const { slug } = parseParams(event, { slug: 'string' });
+
+  const community = await getHubBySlug(db, slug);
+  if (!community) {
+    throw createError({ statusCode: 404, statusMessage: 'Community not found' });
+  }
+
+  const body = await readBody(event);
+  const parsed = createPostSchema.safeParse({ ...body, hubId: community.id });
+  if (!parsed.success) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Validation failed',
+      data: { errors: parsed.error.flatten().fieldErrors },
+    });
+  }
+
+  const post = await createPost(db, user.id, { hubId: community.id, type: parsed.data.type, content: parsed.data.content });
+
+  // Federate hub post as Announce from Group actor (fire-and-forget)
+  if (config.features.federation && config.features.federateHubs) {
+    federateHubPost(db, post.id, community.id, config.instance.domain).catch((err) => {
+      console.error('[hub-federation] Failed to federate post:', err);
+    });
+  }
+
+  return post;
+});

package/server/api/hubs/[slug]/products.get.ts

@@ -0,0 +1,26 @@
+import { getHubBySlug, listHubProducts } from '@commonpub/server';
+import type { PaginatedResponse, ProductListItem } from '@commonpub/server';
+import { z } from 'zod';
+import { productStatusSchema, productCategorySchema } from '@commonpub/schema';
+
+const productQuerySchema = z.object({
+  search: z.string().max(200).optional(),
+  category: productCategorySchema.optional(),
+  status: productStatusSchema.optional(),
+  limit: z.coerce.number().int().positive().max(100).optional(),
+  offset: z.coerce.number().int().min(0).optional(),
+});
+
+export default defineEventHandler(async (event): Promise<PaginatedResponse<ProductListItem>> => {
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const filters = parseQueryParams(event, productQuerySchema);
+
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  return listHubProducts(db, hub.id, filters);
+});

package/server/api/hubs/[slug]/products.post.ts

@@ -0,0 +1,18 @@
+import { getHubBySlug, createProduct } from '@commonpub/server';
+import type { ProductDetail } from '@commonpub/server';
+import { createProductSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<ProductDetail> => {
+  const db = useDB();
+  const user = requireAuth(event);
+  const { slug } = parseParams(event, { slug: 'string' });
+
+  const hub = await getHubBySlug(db, slug, user.id);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  const input = await parseBody(event, createProductSchema);
+
+  return createProduct(db, user.id, hub.id, input);
+});

package/server/api/hubs/[slug]/share.post.ts

@@ -0,0 +1,39 @@
+import { shareContent, getHubBySlug, federateHubShare, getContentSlugById, buildContentUri } from '@commonpub/server';
+import type { HubPostItem } from '@commonpub/server';
+import { z } from 'zod';
+
+const shareContentSchema = z.object({
+  contentId: z.string().uuid(),
+});
+
+export default defineEventHandler(async (event): Promise<HubPostItem> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const config = useConfig();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const input = await parseBody(event, shareContentSchema);
+
+  const hub = await getHubBySlug(db, slug);
+  if (!hub) {
+    throw createError({ statusCode: 404, statusMessage: 'Hub not found' });
+  }
+
+  const post = await shareContent(db, user.id, hub.id, input.contentId);
+  if (!post) {
+    throw createError({ statusCode: 400, statusMessage: 'Cannot share. You must be a hub member and the content must exist.' });
+  }
+
+  // Federate the shared content as Announce from the hub Group actor
+  if (config.features.federation && config.features.federateHubs) {
+    getContentSlugById(db, input.contentId).then((contentSlug) => {
+      if (contentSlug) {
+        const contentUri = buildContentUri(config.instance.domain, contentSlug);
+        return federateHubShare(db, contentUri, hub.id, config.instance.domain);
+      }
+    }).catch((err) => {
+      console.error('[hub-federation] Failed to federate share:', err);
+    });
+  }
+
+  return post;
+});

package/server/api/hubs/index.get.ts

@@ -0,0 +1,15 @@
+import { listHubs } from '@commonpub/server';
+import type { HubListItem, FederatedHubListItem } from '@commonpub/server';
+import { hubFiltersSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<{ items: (HubListItem | FederatedHubListItem)[]; total: number }> => {
+  const db = useDB();
+  const config = useConfig();
+  const filters = parseQueryParams(event, hubFiltersSchema);
+
+  // seamlessFederation controls display of mirrored content (including hubs from other instances)
+  // federateHubs controls outbound hub federation (sending our hubs) — not needed for display
+  const includeFederated = !!config.features.seamlessFederation;
+
+  return listHubs(db, filters, { includeFederated });
+});

package/server/api/hubs/index.post.ts

@@ -0,0 +1,11 @@
+import { createHub } from '@commonpub/server';
+import type { HubDetail } from '@commonpub/server';
+import { createHubSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<HubDetail> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const input = await parseBody(event, createHubSchema);
+
+  return createHub(db, user.id, input);
+});