@commonpub/layer 0.8.2 → 0.8.4

package/server/api/admin/federation/retry.post.ts

@@ -1,12 +1,15 @@
 import { activities } from '@commonpub/schema';
 import { eq, and } from 'drizzle-orm';
+import { z } from 'zod';
+
+const retrySchema = z.object({
+  activityId: z.string().uuid().optional(),
+});
 
 /**
  * POST /api/admin/federation/retry
  * Reset failed activities to pending so the delivery worker retries them.
  * Optionally filter by activity ID.
- *
- * Body: { activityId?: string } — if omitted, retries ALL failed activities
  */
 export default defineEventHandler(async (event) => {
   requireAdmin(event);
@@ -16,8 +19,8 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 404, statusMessage: 'Not Found' });
   }
 
-  const body = await readBody(event);
-  const activityId = body?.activityId as string | undefined;
+  const body = await parseBody(event, retrySchema);
+  const activityId = body.activityId;
 
   const db = useDB();
 

package/server/api/admin/reports.get.ts

@@ -3,6 +3,7 @@ import type { PaginatedResponse, ReportListItem } from '@commonpub/server';
 import { z } from 'zod';
 
 const reportsQuerySchema = z.object({
+  status: z.enum(['pending', 'reviewed', 'resolved', 'dismissed']).optional(),
   limit: z.coerce.number().int().positive().max(100).optional(),
   offset: z.coerce.number().int().min(0).optional(),
 });

package/server/api/auth/sign-in-username.post.ts

@@ -0,0 +1,42 @@
+import { resolveIdentityToEmail } from '@commonpub/server';
+import { z } from 'zod';
+
+const signInSchema = z.object({
+  identity: z.string().min(1).max(255),
+  password: z.string().min(1).max(256),
+});
+
+/**
+ * Sign in with username or email + password.
+ * Resolves username → email server-side, then proxies to Better Auth's
+ * email sign-in endpoint. The email is never exposed to the client.
+ */
+export default defineEventHandler(async (event) => {
+  const body = await parseBody(event, signInSchema);
+
+  let email: string;
+  try {
+    email = await resolveIdentityToEmail(useDB(), body.identity);
+  } catch {
+    throw createError({ statusCode: 401, statusMessage: 'Invalid credentials' });
+  }
+
+  // Proxy to Better Auth's email sign-in (internal server-side call)
+  const origin = getRequestURL(event).origin;
+  const response = await $fetch.raw(`${origin}/api/auth/sign-in/email`, {
+    method: 'POST',
+    body: { email, password: body.password },
+    headers: {
+      'Content-Type': 'application/json',
+      Cookie: getRequestHeader(event, 'cookie') ?? '',
+    },
+  });
+
+  // Forward Set-Cookie headers from Better Auth's response
+  const setCookies = response.headers.getSetCookie?.() ?? [];
+  for (const cookie of setCookies) {
+    appendResponseHeader(event, 'Set-Cookie', cookie);
+  }
+
+  return response._data;
+});

package/server/api/content/[id]/products-sync.post.ts

@@ -1,7 +1,12 @@
 import { syncContentProducts } from '@commonpub/server';
 import type { ContentProductItem } from '@commonpub/server';
 import { eq, and } from 'drizzle-orm';
-import { contentItems } from '@commonpub/schema';
+import { contentItems, addContentProductSchema } from '@commonpub/schema';
+import { z } from 'zod';
+
+const productsSyncSchema = z.object({
+  items: z.array(addContentProductSchema),
+});
 
 export default defineEventHandler(async (event): Promise<ContentProductItem[]> => {
   const db = useDB();
@@ -19,11 +24,7 @@ export default defineEventHandler(async (event): Promise<ContentProductItem[]> =
     throw createError({ statusCode: 403, statusMessage: 'Not authorized to modify this content' });
   }
 
-  const body = await readBody(event);
-
-  if (!Array.isArray(body?.items)) {
-    throw createError({ statusCode: 400, statusMessage: 'items array is required' });
-  }
+  const body = await parseBody(event, productsSyncSchema);
 
   return syncContentProducts(db, id, body.items);
 });

package/server/api/contests/[slug]/entries/[entryId].delete.ts

@@ -0,0 +1,14 @@
+import { withdrawContestEntry } from '@commonpub/server';
+
+export default defineEventHandler(async (event): Promise<{ withdrawn: boolean }> => {
+  requireFeature('contests');
+  const user = requireAuth(event);
+  const db = useDB();
+  const { entryId } = parseParams(event, { entryId: 'uuid' });
+
+  const result = await withdrawContestEntry(db, entryId, user.id);
+  if (!result.withdrawn) {
+    throw createError({ statusCode: 400, message: result.error ?? 'Cannot withdraw entry' });
+  }
+  return { withdrawn: true };
+});

package/server/api/contests/[slug]/entries.get.ts

@@ -5,6 +5,7 @@ import { z } from 'zod';
 const entriesQuerySchema = z.object({
   limit: z.coerce.number().int().min(1).max(100).optional(),
   offset: z.coerce.number().int().min(0).optional(),
+  includeJudgeScores: z.coerce.boolean().optional(),
 });
 
 export default defineEventHandler(async (event): Promise<{ items: ContestEntryItem[]; total: number }> => {
@@ -14,5 +15,9 @@ export default defineEventHandler(async (event): Promise<{ items: ContestEntryIt
   const query = parseQueryParams(event, entriesQuerySchema);
   const contest = await getContestBySlug(db, slug);
   if (!contest) throw createError({ statusCode: 404, statusMessage: 'Contest not found' });
-  return listContestEntries(db, contest.id, query);
+  return listContestEntries(db, contest.id, {
+    limit: query.limit,
+    offset: query.offset,
+    includeJudgeScores: query.includeJudgeScores,
+  });
 });

package/server/api/contests/[slug]/judge.post.ts

@@ -1,12 +1,18 @@
-import { judgeContestEntry } from '@commonpub/server';
+import { judgeContestEntry, getContestBySlug } from '@commonpub/server';
 import { judgeEntrySchema } from '@commonpub/schema';
 
 export default defineEventHandler(async (event): Promise<{ success: boolean }> => {
   requireFeature('contests');
   const user = requireAuth(event);
   const db = useDB();
+  const { slug } = parseParams(event, { slug: 'string' });
   const input = await parseBody(event, judgeEntrySchema);
 
-  await judgeContestEntry(db, input.entryId, input.score, user.id);
+  const contest = await getContestBySlug(db, slug);
+  if (!contest) throw createError({ statusCode: 404, message: 'Contest not found' });
+  const judges = (contest.judges ?? []) as string[];
+  if (!judges.includes(user.id)) throw createError({ statusCode: 403, message: 'Not a judge for this contest' });
+
+  await judgeContestEntry(db, input.entryId, input.score, user.id, input.feedback);
   return { success: true };
 });

package/server/api/docs/[siteSlug]/nav.get.ts

@@ -22,5 +22,5 @@ export default defineEventHandler(async (event) => {
 
   // Return pages directly as nav items
   const pages = await listDocsPages(db, version.id);
-  return pages.map(p => ({ id: p.id, title: p.title, slug: p.slug, sortOrder: p.sortOrder, parentId: p.parentId }));
+  return pages.map(p => ({ id: p.id, title: p.title, sidebarLabel: p.sidebarLabel, slug: p.slug, sortOrder: p.sortOrder, parentId: p.parentId }));
 });

package/server/api/docs/[siteSlug]/pages/[pageId]/duplicate.post.ts

@@ -0,0 +1,16 @@
+import { duplicateDocsPage } from '@commonpub/server';
+
+export default defineEventHandler(async (event) => {
+  const user = requireAuth(event);
+  const db = useDB();
+  const { pageId } = parseParams(event, { pageId: 'uuid' });
+
+  try {
+    return await duplicateDocsPage(db, pageId, user.id);
+  } catch (err: unknown) {
+    if (err instanceof Error && err.message === 'Not authorized') {
+      throw createError({ statusCode: 404, statusMessage: 'Page not found or not owned by you' });
+    }
+    throw err;
+  }
+});

package/server/api/docs/[siteSlug]/pages/reorder.post.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 
 const reorderSchema = z.object({
   pageIds: z.array(z.string().uuid()),
+  version: z.string().max(32).optional(),
 });
 
 export default defineEventHandler(async (event) => {
@@ -14,7 +15,9 @@ export default defineEventHandler(async (event) => {
   const site = await getDocsSiteBySlug(db, siteSlug);
   if (!site) throw createError({ statusCode: 404, statusMessage: 'Docs site not found' });
 
-  const version = site.versions.find((v) => v.isDefault) ?? site.versions[0];
+  const version = body.version
+    ? site.versions.find((v) => v.version === body.version)
+    : site.versions.find((v) => v.isDefault) ?? site.versions[0];
   if (!version) throw createError({ statusCode: 404, statusMessage: 'No version found' });
 
   const result = await reorderDocsPages(db, version.id, user.id, body.pageIds);

package/server/api/docs/migrate-content.post.ts

@@ -16,13 +16,7 @@ import { docsPages } from '@commonpub/schema';
 import { eq } from 'drizzle-orm';
 
 export default defineEventHandler(async (event) => {
-  const user = requireAuth(event);
-
-  // Only allow admins to run migration
-  if (!user.role || user.role !== 'admin') {
-    throw createError({ statusCode: 403, statusMessage: 'Admin only' });
-  }
-
+  requireAdmin(event);
   const db = useDB();
 
   // Fetch all pages

package/server/api/federation/hub-follow-status.get.ts

@@ -1,5 +1,4 @@
-import { userFederatedHubFollows } from '@commonpub/schema';
-import { eq, and } from 'drizzle-orm';
+import { getFederatedHubFollowStatus } from '@commonpub/server';
 import { z } from 'zod';
 
 const querySchema = z.object({
@@ -18,20 +17,5 @@ export default defineEventHandler(async (event): Promise<{ joined: boolean; stat
   const db = useDB();
   const { federatedHubId } = parseQueryParams(event, querySchema);
 
-  const [record] = await db
-    .select({ status: userFederatedHubFollows.status })
-    .from(userFederatedHubFollows)
-    .where(
-      and(
-        eq(userFederatedHubFollows.userId, user.id),
-        eq(userFederatedHubFollows.federatedHubId, federatedHubId),
-      ),
-    )
-    .limit(1);
-
-  if (!record) {
-    return { joined: false, status: null };
-  }
-
-  return { joined: record.status === 'joined', status: record.status };
+  return getFederatedHubFollowStatus(db, federatedHubId, user.id);
 });

package/server/api/federation/hub-follow.post.ts

@@ -1,6 +1,4 @@
-import { sendHubFollow, getFederatedHub } from '@commonpub/server';
-import { userFederatedHubFollows } from '@commonpub/schema';
-import { eq, and } from 'drizzle-orm';
+import { joinFederatedHub } from '@commonpub/server';
 import { z } from 'zod';
 
 const schema = z.object({
@@ -15,29 +13,13 @@ export default defineEventHandler(async (event): Promise<{ success: boolean; sta
   const config = useConfig();
   const { federatedHubId } = await parseBody(event, schema);
 
-  const hub = await getFederatedHub(db, federatedHubId);
-  if (!hub) {
-    throw createError({ statusCode: 404, statusMessage: 'Federated hub not found' });
+  try {
+    const { status } = await joinFederatedHub(db, federatedHubId, user.id, config.instance.domain);
+    return { success: true, status };
+  } catch (err: unknown) {
+    if (err instanceof Error && err.message === 'Federated hub not found') {
+      throw createError({ statusCode: 404, statusMessage: 'Federated hub not found' });
+    }
+    throw err;
   }
-
-  // Create per-user follow record (upsert)
-  const userStatus = hub.followStatus === 'accepted' ? 'joined' : 'pending';
-  await db
-    .insert(userFederatedHubFollows)
-    .values({
-      userId: user.id,
-      federatedHubId,
-      status: userStatus,
-    })
-    .onConflictDoUpdate({
-      target: [userFederatedHubFollows.userId, userFederatedHubFollows.federatedHubId],
-      set: { status: userStatus, joinedAt: new Date() },
-    });
-
-  // Send instance-level Follow if not already accepted
-  if (hub.followStatus !== 'accepted') {
-    await sendHubFollow(db, hub.actorUri, config.instance.domain);
-  }
-
-  return { success: true, status: userStatus };
 });

package/server/api/federation/hub-post-like.post.ts

@@ -1,7 +1,4 @@
-import { likeFederatedHubPost, unlikeFederatedHubPost } from '@commonpub/server';
-import { federatedHubPosts, federatedHubPostLikes, activities, remoteActors } from '@commonpub/schema';
-import { eq, and } from 'drizzle-orm';
-import { AP_CONTEXT, AP_PUBLIC } from '@commonpub/protocol';
+import { toggleFederatedHubPostLike } from '@commonpub/server';
 import { z } from 'zod';
 
 const schema = z.object({
@@ -15,101 +12,15 @@ export default defineEventHandler(async (event): Promise<{ success: boolean; lik
   const config = useConfig();
   const { federatedHubPostId } = await parseBody(event, schema);
 
-  // Get the post's objectUri (the remote Note's AP URI) and author
-  const [post] = await db
-    .select({
-      objectUri: federatedHubPosts.objectUri,
-      actorUri: federatedHubPosts.actorUri,
-    })
-    .from(federatedHubPosts)
-    .where(eq(federatedHubPosts.id, federatedHubPostId))
-    .limit(1);
-
-  if (!post) {
-    throw createError({ statusCode: 404, statusMessage: 'Post not found' });
-  }
-
-  // Check if user already liked this post
-  const [existing] = await db
-    .select({ id: federatedHubPostLikes.id })
-    .from(federatedHubPostLikes)
-    .where(and(
-      eq(federatedHubPostLikes.postId, federatedHubPostId),
-      eq(federatedHubPostLikes.userId, user.id),
-    ))
-    .limit(1);
-
   const localActorUri = `https://${config.instance.domain}/users/${user.username}`;
 
-  if (existing) {
-    // Unlike: remove like record, decrement counter, send Undo(Like)
-    await db.delete(federatedHubPostLikes).where(eq(federatedHubPostLikes.id, existing.id));
-    await unlikeFederatedHubPost(db, federatedHubPostId);
-
-    // Find the original Like activity to reference in Undo
-    const [likeAct] = await db
-      .select({ id: activities.id, payload: activities.payload })
-      .from(activities)
-      .where(and(
-        eq(activities.type, 'Like'),
-        eq(activities.actorUri, localActorUri),
-        eq(activities.objectUri, post.objectUri),
-        eq(activities.direction, 'outbound'),
-      ))
-      .limit(1);
-
-    const undoActivity = {
-      '@context': AP_CONTEXT,
-      type: 'Undo',
-      id: `${localActorUri}/undo/${crypto.randomUUID()}`,
-      actor: localActorUri,
-      object: likeAct?.payload ?? {
-        type: 'Like',
-        actor: localActorUri,
-        object: post.objectUri,
-      },
-      to: [post.actorUri],
-      cc: [AP_PUBLIC],
-    };
-
-    await db.insert(activities).values({
-      type: 'Undo',
-      actorUri: localActorUri,
-      objectUri: post.objectUri,
-      payload: undoActivity,
-      direction: 'outbound',
-      status: 'pending',
-    });
-
-    return { success: true, liked: false };
+  try {
+    const { liked } = await toggleFederatedHubPostLike(db, federatedHubPostId, user.id, localActorUri);
+    return { success: true, liked };
+  } catch (err: unknown) {
+    if (err instanceof Error && err.message === 'Post not found') {
+      throw createError({ statusCode: 404, statusMessage: 'Post not found' });
+    }
+    throw err;
   }
-
-  // Like: insert like record, increment counter, send Like
-  await db.insert(federatedHubPostLikes).values({
-    postId: federatedHubPostId,
-    userId: user.id,
-  }).onConflictDoNothing();
-
-  await likeFederatedHubPost(db, federatedHubPostId);
-
-  const likeActivity = {
-    '@context': AP_CONTEXT,
-    type: 'Like',
-    id: `${localActorUri}/likes/${crypto.randomUUID()}`,
-    actor: localActorUri,
-    object: post.objectUri,
-    to: [post.actorUri],
-    cc: [AP_PUBLIC],
-  };
-
-  await db.insert(activities).values({
-    type: 'Like',
-    actorUri: localActorUri,
-    objectUri: post.objectUri,
-    payload: likeActivity,
-    direction: 'outbound',
-    status: 'pending',
-  });
-
-  return { success: true, liked: true };
 });

package/server/api/federation/hub-post-likes.get.ts

@@ -1,5 +1,4 @@
-import { federatedHubPostLikes } from '@commonpub/schema';
-import { eq, and, inArray } from 'drizzle-orm';
+import { getLikedFederatedHubPostIds } from '@commonpub/server';
 import { z } from 'zod';
 
 export default defineEventHandler(async (event): Promise<{ likedPostIds: string[] }> => {
@@ -10,15 +9,6 @@ export default defineEventHandler(async (event): Promise<{ likedPostIds: string[
   const query = getQuery(event);
   const postIds = z.string().parse(query.postIds ?? '').split(',').filter(Boolean);
 
-  if (postIds.length === 0) return { likedPostIds: [] };
-
-  const liked = await db
-    .select({ postId: federatedHubPostLikes.postId })
-    .from(federatedHubPostLikes)
-    .where(and(
-      eq(federatedHubPostLikes.userId, user.id),
-      inArray(federatedHubPostLikes.postId, postIds),
-    ));
-
-  return { likedPostIds: liked.map(l => l.postId) };
+  const likedPostIds = await getLikedFederatedHubPostIds(db, user.id, postIds);
+  return { likedPostIds };
 });

package/server/api/notifications/read.post.ts

@@ -1,9 +1,14 @@
 import { markNotificationRead, markAllNotificationsRead } from '@commonpub/server';
+import { z } from 'zod';
+
+const markReadSchema = z.object({
+  notificationId: z.string().uuid().optional(),
+});
 
 export default defineEventHandler(async (event): Promise<{ success: boolean }> => {
   const user = requireAuth(event);
   const db = useDB();
-  const body = await readBody(event);
+  const body = await parseBody(event, markReadSchema);
 
   if (body.notificationId) {
     await markNotificationRead(db, body.notificationId, user.id);

package/server/api/search/index.get.ts

@@ -1,7 +1,7 @@
 import { searchContent, listHubs, escapeLike } from '@commonpub/server';
 import type { ContentSearchOptions, MeiliClient } from '@commonpub/server';
 import { users, follows, hubs } from '@commonpub/schema';
-import { sql, desc, ilike, or, and, isNull, eq } from 'drizzle-orm';
+import { sql, desc, ilike, or, and, isNull, eq, inArray } from 'drizzle-orm';
 import { z } from 'zod';
 
 const searchQuerySchema = z.object({
@@ -82,7 +82,7 @@ export default defineEventHandler(async (event): Promise<{ items: unknown[]; tot
       const counts = await db
         .select({ followingId: follows.followingId, count: sql<number>`count(*)::int` })
         .from(follows)
-        .where(sql`${follows.followingId} = ANY(ARRAY[${sql.join(userIds.map((id) => sql`${id}::uuid`), sql`, `)}])`)
+        .where(inArray(follows.followingId, userIds))
         .groupBy(follows.followingId);
       for (const c of counts) followerCounts[c.followingId] = c.count;
     }

package/server/api/search/trending.get.ts

@@ -1,4 +1,4 @@
-import { sql } from 'drizzle-orm';
+import { eq, desc } from 'drizzle-orm';
 import { contentItems } from '@commonpub/schema';
 
 export default defineEventHandler(async (): Promise<Array<{ query: string; trend: number }>> => {
@@ -11,8 +11,8 @@ export default defineEventHandler(async (): Promise<Array<{ query: string; trend
       viewCount: contentItems.viewCount,
     })
     .from(contentItems)
-    .where(sql`${contentItems.status} = 'published'`)
-    .orderBy(sql`${contentItems.viewCount} DESC`)
+    .where(eq(contentItems.status, 'published'))
+    .orderBy(desc(contentItems.viewCount))
     .limit(8);
 
   return rows.map((r) => ({

package/server/api/users/index.get.ts

@@ -1,11 +1,12 @@
 import { users, follows } from '@commonpub/schema';
-import { sql, desc, ilike, or, and, isNull } from 'drizzle-orm';
+import { sql, desc, ilike, or, and, isNull, inArray } from 'drizzle-orm';
 import { z } from 'zod';
 import { escapeLike } from '@commonpub/server';
 
 const usersQuerySchema = z.object({
   q: z.string().max(200).optional(),
   search: z.string().max(200).optional(),
+  ids: z.string().max(2000).optional(),
   limit: z.coerce.number().int().positive().max(50).optional(),
   offset: z.coerce.number().int().min(0).optional(),
 });
@@ -19,6 +20,12 @@ export default defineEventHandler(async (event) => {
   const search = query.q || query.search;
 
   const conditions = [isNull(users.deletedAt)];
+  if (query.ids) {
+    const idList = query.ids.split(',').filter(Boolean).slice(0, 50);
+    if (idList.length > 0) {
+      conditions.push(inArray(users.id, idList));
+    }
+  }
   if (search) {
     const term = `%${escapeLike(search)}%`;
     conditions.push(or(ilike(users.username, term), ilike(users.displayName, term))!);
@@ -52,7 +59,7 @@ export default defineEventHandler(async (event) => {
         count: sql<number>`count(*)::int`,
       })
       .from(follows)
-      .where(sql`${follows.followingId} = ANY(ARRAY[${sql.join(userIds.map((id) => sql`${id}::uuid`), sql`, `)}])`)
+      .where(inArray(follows.followingId, userIds))
       .groupBy(follows.followingId);
 
     for (const c of counts) {

package/server/middleware/content-ap.ts

@@ -1,6 +1,6 @@
 import { contentToArticle } from '@commonpub/protocol';
 import { contentItems, users } from '@commonpub/schema';
-import { eq, and, isNull, sql } from 'drizzle-orm';
+import { eq, and, isNull, inArray } from 'drizzle-orm';
 
 /**
  * Middleware: serve ActivityPub Article JSON-LD for content URIs.
@@ -35,7 +35,7 @@ export default defineEventHandler(async (event) => {
 
   // For blog type, also match 'article' in DB (transition: pre-migration rows still have type='article')
   const typeFilter = type === 'blog'
-    ? sql`${contentItems.type} IN ('blog', 'article')`
+    ? inArray(contentItems.type, ['blog', 'article'])
     : eq(contentItems.type, type as 'project' | 'explainer');
 
   const [row] = await db

package/server/routes/.well-known/webfinger.ts

@@ -44,7 +44,7 @@ export default defineEventHandler(async (event) => {
       username: instanceDomain,
       domain: instanceDomain,
       actorUri,
-      oauthEndpoint: `https://${instanceDomain}/api/auth/oauth2/authorize`,
+      oauthEndpoint: `https://${instanceDomain}/auth/oauth/authorize`,
     });
   }
 
@@ -81,6 +81,6 @@ export default defineEventHandler(async (event) => {
     username: parsed.username,
     domain: instanceDomain,
     actorUri,
-    oauthEndpoint: `https://${instanceDomain}/api/auth/oauth2/authorize`,
+    oauthEndpoint: `https://${instanceDomain}/auth/oauth/authorize`,
   });
 });

package/theme/base.css

@@ -86,6 +86,29 @@
   --pink-bg: rgba(236, 72, 153, 0.08);
   --pink-border: rgba(236, 72, 153, 0.25);
 
+  /* Rank colors (contests) */
+  --gold: #fbbf24;
+  --silver: #94a3b8;
+  --bronze: #a0724a;
+
+  --color-text-inverse: #ffffff;
+
+  /* Code block tokens (GitHub Dark defaults — overridable by themes) */
+  --code-bg: #0d1117;
+  --code-text: #e6edf3;
+  --code-header-bg: #161b22;
+  --code-border: #30363d;
+  --code-muted: #8b949e;
+  --code-green: #7ee787;
+  --hljs-comment: #8b949e;
+  --hljs-keyword: #ff7b72;
+  --hljs-literal: #79c0ff;
+  --hljs-string: #a5d6ff;
+  --hljs-deletion: #ffa198;
+  --hljs-meta: #d2a8ff;
+  --hljs-name: #7ee787;
+  --hljs-variable: #ffa657;
+
   --color-success: var(--green);
   --color-warning: var(--yellow);
   --color-error: var(--red);