@commonpub/layer 0.10.0 → 0.11.0

package/server/api/admin/categories/[id].delete.ts

@@ -9,8 +9,11 @@ export default defineEventHandler(async (event) => {
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 
-  const deleted = await deleteContentCategory(db, id);
-  if (!deleted) {
+  const result = await deleteContentCategory(db, id);
+  if (!result.deleted) {
+    if (result.error === 'system_category') {
+      throw createError({ statusCode: 403, statusMessage: 'System categories cannot be deleted' });
+    }
     throw createError({ statusCode: 404, statusMessage: 'Category not found' });
   }
   return { success: true };

package/server/api/admin/features/index.get.ts

@@ -0,0 +1,32 @@
+import { getInstanceSetting } from '@commonpub/server';
+import type { FeatureFlags } from '@commonpub/config';
+
+/**
+ * GET /api/admin/features
+ * Returns current feature flags with metadata about defaults vs overrides.
+ */
+export default defineEventHandler(async (event) => {
+  requireAdmin(event);
+
+  const db = useDB();
+  const config = useConfig();
+
+  // Get DB overrides (may be null if never set)
+  const raw = await getInstanceSetting(db, 'features.overrides');
+  const overrides: Partial<FeatureFlags> = (raw && typeof raw === 'object' && !Array.isArray(raw))
+    ? raw as Partial<FeatureFlags>
+    : {};
+
+  // Build response with default + effective values for each flag
+  const flags = config.features as unknown as Record<string, boolean>;
+  const result: Record<string, { enabled: boolean; isOverridden: boolean }> = {};
+
+  for (const [key, value] of Object.entries(flags)) {
+    result[key] = {
+      enabled: value,
+      isOverridden: key in overrides,
+    };
+  }
+
+  return { flags: result, overrides };
+});

package/server/api/admin/features/index.put.ts

@@ -0,0 +1,56 @@
+import { setInstanceSetting, getInstanceSetting } from '@commonpub/server';
+import type { FeatureFlags } from '@commonpub/config';
+import { z } from 'zod';
+
+const updateFeaturesSchema = z.object({
+  overrides: z.record(z.string(), z.boolean()).refine(
+    (obj) => Object.keys(obj).length <= 20,
+    'Too many overrides',
+  ),
+});
+
+/**
+ * PUT /api/admin/features
+ * Set feature flag overrides. Pass { overrides: { flagName: true/false } }.
+ * To remove an override, omit the key from overrides.
+ */
+export default defineEventHandler(async (event) => {
+  const user = requireAdmin(event);
+
+  const body = await parseBody(event, updateFeaturesSchema);
+  const db = useDB();
+
+  // Validate that all keys are known feature flags
+  const config = useConfig();
+  const knownFlags = Object.keys(config.features);
+  for (const key of Object.keys(body.overrides)) {
+    if (!knownFlags.includes(key)) {
+      throw createError({ statusCode: 400, statusMessage: `Unknown feature flag: ${key}` });
+    }
+  }
+
+  // Merge with existing overrides (so partial updates work)
+  const raw = await getInstanceSetting(db, 'features.overrides');
+  const existing: Partial<FeatureFlags> = (raw && typeof raw === 'object' && !Array.isArray(raw))
+    ? raw as Partial<FeatureFlags>
+    : {};
+
+  const merged = { ...existing, ...body.overrides };
+
+  // Remove overrides that match the base config default (no point overriding to same value)
+  const base = config.features as unknown as Record<string, boolean>;
+  for (const [key, value] of Object.entries(merged)) {
+    if (base[key] === value) {
+      delete (merged as Record<string, unknown>)[key];
+    }
+  }
+
+  await setInstanceSetting(db, 'features.overrides', merged, user.id, getRequestIP(event) ?? undefined);
+
+  // Invalidate config cache so the change takes effect immediately
+  if (typeof invalidateConfigCache === 'function') {
+    invalidateConfigCache();
+  }
+
+  return { overrides: merged, message: 'Feature flags updated' };
+});

package/server/api/admin/homepage/sections.get.ts

@@ -0,0 +1,11 @@
+import { getHomepageSections } from '@commonpub/server';
+
+/**
+ * GET /api/admin/homepage/sections
+ * Returns homepage sections for admin editing.
+ */
+export default defineEventHandler(async (event) => {
+  requireAdmin(event);
+  const db = useDB();
+  return getHomepageSections(db);
+});

package/server/api/admin/homepage/sections.put.ts

@@ -0,0 +1,52 @@
+import { setHomepageSections } from '@commonpub/server';
+import { z } from 'zod';
+
+const sectionConfigSchema = z.object({
+  contentType: z.string().max(64).optional(),
+  sort: z.enum(['popular', 'recent', 'featured', 'editorial']).optional(),
+  limit: z.number().int().min(1).max(50).optional(),
+  columns: z.union([z.literal(2), z.literal(3), z.literal(4)]).optional(),
+  showEditorial: z.boolean().optional(),
+  categorySlug: z.string().max(64).optional(),
+  featureGate: z.string().max(64).optional(),
+  variant: z.string().max(64).optional(),
+  customTitle: z.string().max(255).optional(),
+  customSubtitle: z.string().max(500).optional(),
+  html: z.string().max(10000).optional(),
+});
+
+const sectionSchema = z.object({
+  id: z.string().min(1).max(64),
+  type: z.enum(['hero', 'editorial', 'content-grid', 'content-carousel', 'contests', 'hubs', 'learning', 'stats', 'custom-html']),
+  title: z.string().max(255).optional(),
+  enabled: z.boolean(),
+  order: z.number().int().min(0),
+  config: sectionConfigSchema,
+});
+
+const updateSectionsSchema = z.object({
+  sections: z.array(sectionSchema).min(1).max(20),
+});
+
+/**
+ * PUT /api/admin/homepage/sections
+ * Save homepage section configuration.
+ */
+export default defineEventHandler(async (event) => {
+  const user = requireAdmin(event);
+  const db = useDB();
+  const body = await parseBody(event, updateSectionsSchema);
+
+  // Validate unique IDs
+  const ids = new Set<string>();
+  for (const section of body.sections) {
+    if (ids.has(section.id)) {
+      throw createError({ statusCode: 400, statusMessage: `Duplicate section ID: ${section.id}` });
+    }
+    ids.add(section.id);
+  }
+
+  await setHomepageSections(db, body.sections, user.id, getRequestIP(event) ?? undefined);
+
+  return { sections: body.sections, message: 'Homepage updated' };
+});

package/server/api/features.get.ts

@@ -0,0 +1,9 @@
+/**
+ * GET /api/features
+ * Returns the current merged feature flags (build-time + env + DB overrides).
+ * Public endpoint — used by client-side useFeatures() for runtime reactivity.
+ */
+export default defineEventHandler(() => {
+  const config = useConfig();
+  return config.features;
+});

package/server/api/homepage/sections.get.ts

@@ -0,0 +1,10 @@
+import { getHomepageSections } from '@commonpub/server';
+
+/**
+ * GET /api/homepage/sections
+ * Returns the homepage section configuration (public).
+ */
+export default defineEventHandler(async () => {
+  const db = useDB();
+  return getHomepageSections(db);
+});