@commonpub/layer 0.15.7 → 0.15.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/layer",
-  "version": "0.15.7",
+  "version": "0.15.8",
   "type": "module",
   "main": "./nuxt.config.ts",
   "files": [
@@ -53,12 +53,12 @@
     "vue": "^3.4.0",
     "vue-router": "^4.3.0",
     "zod": "^4.3.6",
-    "@commonpub/auth": "0.5.1",
     "@commonpub/config": "0.10.0",
-    "@commonpub/docs": "0.6.2",
+    "@commonpub/auth": "0.5.1",
     "@commonpub/editor": "0.7.9",
     "@commonpub/learning": "0.5.0",
     "@commonpub/protocol": "0.9.9",
+    "@commonpub/docs": "0.6.2",
     "@commonpub/ui": "0.8.5"
   },
   "devDependencies": {

package/server/api/content/index.get.ts

@@ -2,6 +2,11 @@ import { listContent } from '@commonpub/server';
 import type { PaginatedResponse, ContentListItem } from '@commonpub/server';
 import { contentFiltersSchema } from '@commonpub/schema';
 
+// Statuses a non-owner may request. Any other value (draft, scheduled, deleted,
+// etc.) is coerced to 'published' — the old behavior passed the filter through
+// verbatim, so /api/content?status=draft leaked every user's drafts.
+const PUBLIC_STATUSES = new Set(['published', 'archived']);
+
 export default defineEventHandler(async (event): Promise<PaginatedResponse<ContentListItem>> => {
   const db = useDB();
   const user = getOptionalUser(event);
@@ -11,9 +16,13 @@ export default defineEventHandler(async (event): Promise<PaginatedResponse<Conte
 
   const config = useConfig();
 
+  const resolvedStatus = isOwnContent
+    ? filters.status
+    : (filters.status && PUBLIC_STATUSES.has(filters.status) ? filters.status : 'published');
+
   return listContent(db, {
     ...filters,
-    status: isOwnContent ? filters.status : (filters.status ?? 'published'),
+    status: resolvedStatus,
     // Only show public content unless viewing own content
     visibility: isOwnContent ? filters.visibility : 'public',
   }, {

package/server/api/learn/index.get.ts

@@ -2,6 +2,10 @@ import { listPaths } from '@commonpub/server';
 import type { PaginatedResponse, LearningPathListItem } from '@commonpub/server';
 import { learningPathFiltersSchema } from '@commonpub/schema';
 
+// Statuses a non-owner may request. The old behavior passed filters.status
+// through verbatim, so /api/learn?status=draft leaked every author's drafts.
+const PUBLIC_STATUSES = new Set(['published', 'archived']);
+
 export default defineEventHandler(async (event): Promise<PaginatedResponse<LearningPathListItem>> => {
   const db = useDB();
   const user = getOptionalUser(event);
@@ -10,8 +14,12 @@ export default defineEventHandler(async (event): Promise<PaginatedResponse<Learn
   // Allow author to see their own drafts (same pattern as content API)
   const isOwnContent = filters.authorId && user?.id === filters.authorId;
 
+  const resolvedStatus = isOwnContent
+    ? filters.status
+    : (filters.status && PUBLIC_STATUSES.has(filters.status) ? filters.status : 'published');
+
   return listPaths(db, {
     ...filters,
-    status: isOwnContent ? filters.status : (filters.status ?? 'published'),
+    status: resolvedStatus,
   });
 });