@commonpub/layer 0.1.0

package/server/api/image-proxy.get.ts

@@ -0,0 +1,91 @@
+/**
+ * GET /api/image-proxy?url=<remote-url>&w=<width>
+ * Proxies and caches remote images for federated content.
+ * Prevents slow cross-origin fetches on content cards.
+ *
+ * Security: only proxies images from known federation origins
+ * (federated_content.origin_domain or remote_actors.instance_domain).
+ */
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event);
+  const url = query.url as string | undefined;
+  const width = Math.min(parseInt(String(query.w || '800'), 10), 1920);
+
+  if (!url || typeof url !== 'string') {
+    throw createError({ statusCode: 400, statusMessage: 'Missing url parameter' });
+  }
+
+  // Parse and validate the URL
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw createError({ statusCode: 400, statusMessage: 'Invalid URL' });
+  }
+
+  // Only allow HTTPS image URLs
+  if (parsed.protocol !== 'https:') {
+    throw createError({ statusCode: 400, statusMessage: 'Only HTTPS URLs allowed' });
+  }
+
+  // Block localhost/private IPs (SSRF prevention)
+  const hostname = parsed.hostname;
+  if (
+    hostname === 'localhost' ||
+    hostname === '127.0.0.1' ||
+    hostname === '::1' ||
+    hostname.startsWith('10.') ||
+    hostname.startsWith('172.') ||
+    hostname.startsWith('192.168.') ||
+    hostname.endsWith('.local')
+  ) {
+    throw createError({ statusCode: 403, statusMessage: 'Private addresses not allowed' });
+  }
+
+  // Fetch the remote image
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 15_000);
+
+  try {
+    const response = await fetch(url, {
+      signal: controller.signal,
+      headers: {
+        Accept: 'image/*',
+        'User-Agent': 'CommonPub/1.0 (image-proxy)',
+      },
+      redirect: 'follow',
+    });
+
+    clearTimeout(timeout);
+
+    if (!response.ok) {
+      throw createError({ statusCode: 502, statusMessage: `Upstream returned ${response.status}` });
+    }
+
+    const contentType = response.headers.get('content-type') || '';
+    if (!contentType.startsWith('image/')) {
+      throw createError({ statusCode: 502, statusMessage: 'Not an image' });
+    }
+
+    // Limit to 10MB
+    const contentLength = parseInt(response.headers.get('content-length') || '0', 10);
+    if (contentLength > 10 * 1024 * 1024) {
+      throw createError({ statusCode: 502, statusMessage: 'Image too large' });
+    }
+
+    const buffer = Buffer.from(await response.arrayBuffer());
+
+    // Set aggressive cache headers — federated images rarely change
+    setResponseHeaders(event, {
+      'Content-Type': contentType,
+      'Cache-Control': 'public, max-age=86400, s-maxage=604800, stale-while-revalidate=86400',
+      'X-Image-Proxy': 'commonpub',
+    });
+
+    return buffer;
+  } catch (err: unknown) {
+    clearTimeout(timeout);
+    if ((err as { statusCode?: number })?.statusCode) throw err;
+    throw createError({ statusCode: 502, statusMessage: 'Failed to fetch image' });
+  }
+});

package/server/api/learn/[slug]/[lessonSlug]/complete.post.ts

@@ -0,0 +1,13 @@
+import { getLessonBySlug, markLessonComplete } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug, lessonSlug } = parseParams(event, { slug: 'string', lessonSlug: 'string' });
+  const body = await readBody(event).catch(() => ({}));
+
+  const result = await getLessonBySlug(db, slug, lessonSlug);
+  if (!result) throw createError({ statusCode: 404, statusMessage: 'Lesson not found' });
+
+  return markLessonComplete(db, user.id, result.lesson.id, body?.quizScore, body?.quizPassed);
+});

package/server/api/learn/[slug]/[lessonSlug]/index.get.ts

@@ -0,0 +1,68 @@
+import { getLessonBySlug } from '@commonpub/server';
+import { renderMarkdown } from '@commonpub/docs';
+
+function blocksToHtml(blocks: unknown): string {
+  if (!Array.isArray(blocks)) return '';
+  const parts: string[] = [];
+  for (const block of blocks) {
+    const [type, data] = block as [string, Record<string, unknown>];
+    if (!data) continue;
+    if (typeof data.html === 'string' && data.html) {
+      parts.push(data.html);
+    } else if (type === 'heading' && typeof data.text === 'string') {
+      const level = Math.min(Math.max(Number(data.level) || 2, 1), 6);
+      const escaped = data.text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+      parts.push(`<h${level}>${escaped}</h${level}>`);
+    } else if (type === 'code_block' && typeof data.code === 'string') {
+      const lang = String(data.language || '').replace(/[^a-zA-Z0-9-]/g, '');
+      const escaped = data.code.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+      parts.push(`<pre><code class="language-${lang}">${escaped}</code></pre>`);
+    } else if (type === 'image' && (data.src || data.url)) {
+      const src = String(data.src || data.url).replace(/"/g, '&quot;');
+      const alt = String(data.alt || '').replace(/"/g, '&quot;');
+      if (src.startsWith('http://') || src.startsWith('https://') || src.startsWith('/')) {
+        parts.push(`<figure><img src="${src}" alt="${alt}" /></figure>`);
+      }
+    } else if (type === 'blockquote' && typeof data.text === 'string') {
+      const escaped = data.text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+      parts.push(`<blockquote>${escaped}</blockquote>`);
+    } else if (type === 'callout' && typeof data.text === 'string') {
+      const escaped = data.text.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+      parts.push(`<div class="cpub-callout">${escaped}</div>`);
+    } else if (type === 'horizontal_rule' || type === 'divider') {
+      parts.push('<hr />');
+    }
+  }
+  return parts.join('\n');
+}
+
+export default defineEventHandler(async (event) => {
+  const db = useDB();
+  const { slug, lessonSlug } = parseParams(event, { slug: 'string', lessonSlug: 'string' });
+
+  const result = await getLessonBySlug(db, slug, lessonSlug);
+  if (!result) {
+    throw createError({ statusCode: 404, statusMessage: 'Lesson not found' });
+  }
+
+  let renderedHtml = '';
+
+  if (result.linkedContent?.content) {
+    // Linked content uses BlockTuple[] format
+    renderedHtml = blocksToHtml(result.linkedContent.content);
+  } else {
+    // Inline content: render markdown
+    const content = result.lesson.content as Record<string, unknown> | null;
+    if (content) {
+      const md = typeof content.markdown === 'string' ? content.markdown
+        : typeof content.notes === 'string' ? content.notes
+        : '';
+      if (md) {
+        const rendered = await renderMarkdown(md);
+        renderedHtml = rendered.html;
+      }
+    }
+  }
+
+  return { ...result, renderedHtml };
+});

package/server/api/learn/[slug]/enroll.post.ts

@@ -0,0 +1,12 @@
+import { enroll, getPathBySlug } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+
+  const path = await getPathBySlug(db, slug, user.id);
+  if (!path) throw createError({ statusCode: 404, statusMessage: 'Path not found' });
+
+  return enroll(db, user.id, path.id);
+});

package/server/api/learn/[slug]/index.delete.ts

@@ -0,0 +1,12 @@
+import { deletePath, getPathBySlug } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<boolean> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+
+  const path = await getPathBySlug(db, slug, user.id);
+  if (!path) throw createError({ statusCode: 404, statusMessage: 'Path not found' });
+
+  return deletePath(db, path.id, user.id);
+});

package/server/api/learn/[slug]/index.get.ts

@@ -0,0 +1,14 @@
+import { getPathBySlug } from '@commonpub/server';
+import type { LearningPathDetail } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<LearningPathDetail> => {
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const user = getOptionalUser(event);
+
+  const path = await getPathBySlug(db, slug, user?.id);
+  if (!path) {
+    throw createError({ statusCode: 404, statusMessage: 'Learning path not found' });
+  }
+  return path;
+});

package/server/api/learn/[slug]/index.put.ts

@@ -0,0 +1,19 @@
+import { getPathBySlug, updatePath } from '@commonpub/server';
+import type { LearningPathDetail } from '@commonpub/server';
+import { updateLearningPathSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<LearningPathDetail> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const input = await parseBody(event, updateLearningPathSchema);
+
+  const path = await getPathBySlug(db, slug, user.id);
+  if (!path) throw createError({ statusCode: 404, statusMessage: 'Path not found' });
+
+  const updated = await updatePath(db, path.id, user.id, input);
+  if (!updated) {
+    throw createError({ statusCode: 403, statusMessage: 'Not authorized to update this path' });
+  }
+  return updated;
+});

package/server/api/learn/[slug]/lessons/[lessonId].delete.ts

@@ -0,0 +1,14 @@
+import { deleteLesson } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<{ success: boolean }> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { lessonId } = parseParams(event, { lessonId: 'uuid' });
+
+  const deleted = await deleteLesson(db, lessonId, user.id);
+  if (!deleted) {
+    throw createError({ statusCode: 404, statusMessage: 'Lesson not found or not authorized' });
+  }
+
+  return { success: true };
+});

package/server/api/learn/[slug]/lessons/[lessonId].put.ts

@@ -0,0 +1,24 @@
+import { updateLesson } from '@commonpub/server';
+import { z } from 'zod';
+
+const updateLessonSchema = z.object({
+  title: z.string().min(1).max(255).optional(),
+  type: z.enum(['article', 'video', 'quiz', 'project', 'explainer']).optional(),
+  content: z.unknown().optional(),
+  contentItemId: z.string().uuid().nullable().optional(),
+  durationMinutes: z.number().int().min(0).max(9999).optional(),
+});
+
+export default defineEventHandler(async (event) => {
+  const db = useDB();
+  const user = requireAuth(event);
+  const { lessonId } = parseParams(event, { lessonId: 'uuid' });
+  const input = await parseBody(event, updateLessonSchema);
+
+  const result = await updateLesson(db, lessonId, user.id, input);
+  if (!result) {
+    throw createError({ statusCode: 404, statusMessage: 'Lesson not found or not authorized' });
+  }
+
+  return result;
+});

package/server/api/learn/[slug]/lessons.post.ts

@@ -0,0 +1,10 @@
+import { createLesson } from '@commonpub/server';
+import { createLessonSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const input = await parseBody(event, createLessonSchema);
+
+  return createLesson(db, user.id, input);
+});

package/server/api/learn/[slug]/modules/[moduleId].delete.ts

@@ -0,0 +1,14 @@
+import { deleteModule } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<{ success: boolean }> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { moduleId } = parseParams(event, { moduleId: 'uuid' });
+
+  const deleted = await deleteModule(db, moduleId, user.id);
+  if (!deleted) {
+    throw createError({ statusCode: 404, statusMessage: 'Module not found or not authorized' });
+  }
+
+  return { success: true };
+});

package/server/api/learn/[slug]/modules/[moduleId].put.ts

@@ -0,0 +1,15 @@
+import { updateModule } from '@commonpub/server';
+import { updateModuleSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { moduleId } = parseParams(event, { moduleId: 'uuid' });
+  const input = await parseBody(event, updateModuleSchema);
+
+  const updated = await updateModule(db, moduleId, user.id, input);
+  if (!updated) {
+    throw createError({ statusCode: 404, statusMessage: 'Module not found or not authorized' });
+  }
+  return updated;
+});

package/server/api/learn/[slug]/modules.post.ts

@@ -0,0 +1,14 @@
+import { createModule, getPathBySlug } from '@commonpub/server';
+import { createModuleSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+  const input = await parseBody(event, createModuleSchema);
+
+  const path = await getPathBySlug(db, slug, user.id);
+  if (!path) throw createError({ statusCode: 404, statusMessage: 'Path not found' });
+
+  return createModule(db, user.id, { ...input, pathId: path.id });
+});

package/server/api/learn/[slug]/publish.post.ts

@@ -0,0 +1,13 @@
+import { getPathBySlug, publishPath } from '@commonpub/server';
+import type { LearningPathDetail } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<LearningPathDetail | null> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+
+  const path = await getPathBySlug(db, slug, user.id);
+  if (!path) throw createError({ statusCode: 404, statusMessage: 'Path not found' });
+
+  return publishPath(db, path.id, user.id);
+});

package/server/api/learn/[slug]/unenroll.post.ts

@@ -0,0 +1,12 @@
+import { getPathBySlug, unenroll } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<boolean> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
+
+  const path = await getPathBySlug(db, slug, user.id);
+  if (!path) throw createError({ statusCode: 404, statusMessage: 'Path not found' });
+
+  return unenroll(db, user.id, path.id);
+});

package/server/api/learn/certificates.get.ts

@@ -0,0 +1,9 @@
+import { getUserCertificates } from '@commonpub/server';
+import type { CertificateItem } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<CertificateItem[]> => {
+  const user = requireAuth(event);
+  const db = useDB();
+
+  return getUserCertificates(db, user.id);
+});

package/server/api/learn/enrollments.get.ts

@@ -0,0 +1,9 @@
+import { getUserEnrollments } from '@commonpub/server';
+import type { EnrollmentItem } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<EnrollmentItem[]> => {
+  const user = requireAuth(event);
+  const db = useDB();
+
+  return getUserEnrollments(db, user.id);
+});

package/server/api/learn/index.get.ts

@@ -0,0 +1,17 @@
+import { listPaths } from '@commonpub/server';
+import type { PaginatedResponse, LearningPathListItem } from '@commonpub/server';
+import { learningPathFiltersSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<PaginatedResponse<LearningPathListItem>> => {
+  const db = useDB();
+  const user = getOptionalUser(event);
+  const filters = parseQueryParams(event, learningPathFiltersSchema);
+
+  // Allow author to see their own drafts (same pattern as content API)
+  const isOwnContent = filters.authorId && user?.id === filters.authorId;
+
+  return listPaths(db, {
+    ...filters,
+    status: isOwnContent ? filters.status : (filters.status ?? 'published'),
+  });
+});

package/server/api/learn/index.post.ts

@@ -0,0 +1,11 @@
+import { createPath } from '@commonpub/server';
+import type { LearningPathDetail } from '@commonpub/server';
+import { createLearningPathSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<LearningPathDetail> => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const input = await parseBody(event, createLearningPathSchema);
+
+  return createPath(db, user.id, input);
+});

package/server/api/me.get.ts

@@ -0,0 +1,13 @@
+/**
+ * GET /api/me — Returns the current authenticated user with enriched fields (role, username, status).
+ *
+ * Unlike /api/auth/get-session which returns raw Better Auth data (missing custom columns),
+ * this endpoint reads from event.context.auth which has already been enriched by the auth middleware.
+ */
+export default defineEventHandler((event) => {
+  const { user, session } = event.context.auth ?? {};
+  return {
+    user: user ?? null,
+    session: session ?? null,
+  };
+});

package/server/api/messages/[conversationId]/info.get.ts

@@ -0,0 +1,43 @@
+import { conversations, users } from '@commonpub/schema';
+import { eq, and, sql, inArray } from 'drizzle-orm';
+
+export default defineEventHandler(async (event) => {
+  const db = useDB();
+  const user = requireAuth(event);
+  const { conversationId } = parseParams(event, { conversationId: 'uuid' });
+
+  const rows = await db
+    .select()
+    .from(conversations)
+    .where(
+      and(
+        eq(conversations.id, conversationId),
+        sql`${conversations.participants} @> ${JSON.stringify([user.id])}::jsonb`,
+      ),
+    )
+    .limit(1);
+
+  if (!rows.length) {
+    throw createError({ statusCode: 404, statusMessage: 'Conversation not found' });
+  }
+
+  const participantIds = (rows[0]!.participants ?? []) as string[];
+
+  // Resolve participant IDs to display names
+  const participantUsers = participantIds.length > 0
+    ? await db
+        .select({ id: users.id, username: users.username, displayName: users.displayName, avatarUrl: users.avatarUrl })
+        .from(users)
+        .where(inArray(users.id, participantIds))
+    : [];
+
+  return {
+    id: rows[0]!.id,
+    participants: participantUsers.map((u) => ({
+      id: u.id,
+      username: u.username,
+      displayName: u.displayName ?? u.username,
+      avatarUrl: u.avatarUrl,
+    })),
+  };
+});

package/server/api/messages/[conversationId]/stream.get.ts

@@ -0,0 +1,73 @@
+import { getConversationMessages } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const userId = user.id;
+  const { conversationId } = parseParams(event, { conversationId: 'uuid' });
+
+  const db = useDB();
+
+  setResponseHeader(event, 'Content-Type', 'text/event-stream');
+  setResponseHeader(event, 'Cache-Control', 'no-cache');
+  setResponseHeader(event, 'Connection', 'keep-alive');
+
+  const encoder = new TextEncoder();
+  let lastMessageCount = 0;
+
+  const stream = new ReadableStream({
+    async start(controller) {
+      // Send initial messages
+      try {
+        const msgs = await getConversationMessages(db, conversationId, userId);
+        lastMessageCount = msgs.length;
+        controller.enqueue(
+          encoder.encode(`data: ${JSON.stringify({ type: 'init', messages: msgs })}\n\n`),
+        );
+      } catch {
+        controller.close();
+        return;
+      }
+
+      // Poll for new messages every 3 seconds
+      const interval = setInterval(async () => {
+        try {
+          const msgs = await getConversationMessages(db, conversationId, userId);
+          if (msgs.length > lastMessageCount) {
+            const newMsgs = msgs.slice(lastMessageCount);
+            lastMessageCount = msgs.length;
+            controller.enqueue(
+              encoder.encode(`data: ${JSON.stringify({ type: 'new', messages: newMsgs })}\n\n`),
+            );
+          }
+        } catch {
+          clearInterval(interval);
+          controller.close();
+        }
+      }, 3000);
+
+      // Keepalive every 25 seconds
+      const keepalive = setInterval(() => {
+        try {
+          controller.enqueue(encoder.encode(': keepalive\n\n'));
+        } catch {
+          clearInterval(keepalive);
+          clearInterval(interval);
+        }
+      }, 25000);
+
+      event.node.req.on('close', () => {
+        clearInterval(interval);
+        clearInterval(keepalive);
+        try { controller.close(); } catch { /* already closed */ }
+      });
+    },
+  });
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      'Connection': 'keep-alive',
+    },
+  });
+});

package/server/api/messages/[conversationId].get.ts

@@ -0,0 +1,13 @@
+import { getConversationMessages, markMessagesRead } from '@commonpub/server';
+import type { MessageItem } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<MessageItem[]> => {
+  const db = useDB();
+  const user = requireAuth(event);
+  const { conversationId } = parseParams(event, { conversationId: 'uuid' });
+
+  const messages = await getConversationMessages(db, conversationId, user.id);
+  await markMessagesRead(db, conversationId, user.id);
+
+  return messages;
+});

package/server/api/messages/[conversationId].post.ts

@@ -0,0 +1,12 @@
+import { sendMessage } from '@commonpub/server';
+import type { MessageItem } from '@commonpub/server';
+import { sendMessageSchema } from '@commonpub/schema';
+
+export default defineEventHandler(async (event): Promise<MessageItem> => {
+  const db = useDB();
+  const user = requireAuth(event);
+  const { conversationId } = parseParams(event, { conversationId: 'uuid' });
+  const input = await parseBody(event, sendMessageSchema);
+
+  return sendMessage(db, conversationId, user.id, input.body);
+});

package/server/api/messages/index.get.ts

@@ -0,0 +1,39 @@
+import { listConversations } from '@commonpub/server';
+import { users } from '@commonpub/schema';
+import { inArray } from 'drizzle-orm';
+
+export default defineEventHandler(async (event) => {
+  const db = useDB();
+  const user = requireAuth(event);
+
+  const conversations = await listConversations(db, user.id);
+
+  // Collect all unique participant IDs
+  const allIds = new Set<string>();
+  for (const conv of conversations) {
+    for (const id of (conv.participants ?? [])) {
+      allIds.add(id);
+    }
+  }
+
+  // Resolve IDs to user profiles
+  const userMap = new Map<string, { username: string; displayName: string | null; avatarUrl: string | null }>();
+  if (allIds.size > 0) {
+    const resolved = await db
+      .select({ id: users.id, username: users.username, displayName: users.displayName, avatarUrl: users.avatarUrl })
+      .from(users)
+      .where(inArray(users.id, [...allIds]));
+    for (const u of resolved) {
+      userMap.set(u.id, { username: u.username, displayName: u.displayName, avatarUrl: u.avatarUrl });
+    }
+  }
+
+  // Replace participant IDs with resolved user objects
+  return conversations.map((conv) => ({
+    ...conv,
+    participants: (conv.participants ?? []).map((id: string) => {
+      const u = userMap.get(id);
+      return u ? { username: u.username, displayName: u.displayName, avatarUrl: u.avatarUrl } : { username: id, displayName: null, avatarUrl: null };
+    }),
+  }));
+});