@cosmicdrift/kumiko-samples 0.393.0 → 0.395.0

package/packages/bundled-features/src/template-resolver/feature.ts

@@ -2,6 +2,7 @@ import {
   type ContentCollectionDefinition,
   createSystemConfig,
   defineFeature,
+  type TreeAction,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { bySlugQuery } from "./handlers/by-slug.query.ts";
 import { byTenantQuery } from "./handlers/by-tenant.query.ts";
@@ -109,6 +110,14 @@ function assertTenantEditableValid(entries: readonly TenantEditableTemplate[]):
   }
 }
 
+function newEntryAction(collectionId: string): TreeAction {
+  return {
+    icon: "plus",
+    label: "template-resolver.editor.newEntry",
+    target: { featureId: "template-resolver", action: "create", args: { collectionId } },
+  };
+}
+
 export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}) {
   const collections = opts.collections ?? [];
   assertCollectionKindsAllowed(collections);
@@ -129,7 +138,7 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
         "Reading is one call — `ctx.templateResolver.resolveTemplate({ tenantId, slug, kind, locale })`. It walks four levels: tenant+locale, system+locale, tenant+fallback-locale, system+fallback-locale. A tenant overrides a system default by simply having its own record; no application code changes. Writing programmatically goes through the `upsertSystem`, `upsertTenant`, `publish` and `archive` write handlers; a SystemAdmin retires or restores a system default with `publishSystem` and `archiveSystem`, and a tenant drops its override with `resetToSystem`. Saving a draft over an active template keeps the active version served and stores the edit beside it (column `draft`); `publish` makes it the served version, `discardDraft` / `discardDraftSystem` throws it away.",
         'Editing templates is for SystemAdmin only. A TenantAdmin edits only the templates the app unlocks at the mount site, `createTemplateResolverFeature({ tenantEditable: [{ kind: "mail", slug: "status-update", access: { roles: ["TenantAdmin"] } }] })`, and every write handler enforces that on the server (override, draft, publish, archive, reset, copy-locale, import, resources, `set`). Each entry carries the `access` roles allowed to edit it, because a bundled feature cannot know the host\'s roles. The same list decides delivery: a tenant override is served (mail, PDF, layouts, text blocks) only while its template is listed in tenantEditable; otherwise the system version is served. A locked override stays stored, a SystemAdmin sees it in the overview marked as not delivered, and listing the template makes it effective again. Tenant rows of a collection mounted with `access` are always served. A collection mounted without `access` is SystemAdmin only.',
         "Text an editor should be able to change belongs in a collection, declared at mount: `createTemplateResolverFeature({ collections: [{ id, kind, access: { roles }, nav }] })`. It appears in the navigation, and `access` is part of the mount because a bundled feature cannot know the host's roles. Each collection gets its own `<id>-list` / `<id>-item` / `<id>-set` handlers, so the dispatcher enforces the separation.",
-        "How a collection is edited follows from `contentFormat`: `plain` gives a text area, `rich` a small WYSIWYG (bold, italic, headings, lists, links), `markdown` a text area that stores markdown text (same insertable chips as `plain`). All three offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
+        "How a collection is edited follows from `contentFormat`: `plain` gives a text area that stores text, `document` a WYSIWYG document editor that stores sanitized HTML (bold, italic, headings, lists, links, variable chips). Both offer the collection's `variableSchema` as insertable chips and a preview rendered with sample data — an editor sees what `{{firstName}}` becomes without sending a mail. An app can register its own editor for a format; the last `clientFeature` that registers a format wins (a conflict logs a warning).",
         'A collection is tenant-wide by default. With `ownership: "user"` every user keeps their own entries — mail signatures being the obvious case. Those rows live in the separate `user-content-entry` entity and count as user data, so mounting one also requires the `template-resolver-user-data` feature and a migration on the app side.',
         "`validate` dry-runs the write pipeline for a draft (sanitizer, layout rules, placeholders) and reports what the template uses and misses. `export-bundle` / `import-bundle` (and `import-bundle-system`) move one template with all locales and resource files between tenants or environments; `copy-locale` starts a translation from an existing locale. Layouts are structured: a mail or PDF layout is `data-header` / `data-content` / `data-signature` / `data-footer` regions, and mjml layout source is system-only.",
         "`preview` renders a draft (or the stored template) with sample values taken from the `example` of each declared variable, through the same gates and the same mail renderer as a real send, and returns subject, html, `displayHtml` (the html with cid images as data URIs for an editor), text, attachments (inline images and files) and `checks` (images resolved, plain text present, size under 10 MiB, required placeholders used); nothing is saved or sent. `send-test` mails that rendering to the calling user's own address only, subject prefixed with `[TEST]`, at most 10 per user and hour; it needs `delivery`, `channel-email` and `renderer-mail-html` to be mounted. `send-test-status` tells an editor beforehand whether that send can work for the caller (`canSend`, else `reason` `no_channel` or `no_address`), never returning the address.",
@@ -198,6 +207,10 @@ export function createTemplateResolverFeature(opts: TemplateResolverOptions = {}
       r.contentCollection({
         ...collection,
         access: collection.access ?? DEFAULT_COLLECTION_ACCESS,
+        nav: {
+          ...collection.nav,
+          createAction: collection.nav.createAction ?? newEntryAction(collection.id),
+        },
       });
       r.queryHandler(makeCollectionListQuery(collection));
       r.queryHandler(makeCollectionItemQuery(collection));

package/packages/bundled-features/src/template-resolver/handlers/collection-item.query.ts

@@ -8,7 +8,7 @@ import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.ts";
 import {
   type CollectionEntryRow,
   collectionStore,
-  toCollectionEntry,
+  readableCollectionEntry,
 } from "./collection-shared.ts";
 
 // Single entry of one collection, for the editor behind a tree node. Same
@@ -40,7 +40,7 @@ export function makeCollectionItemQuery(collection: ContentCollectionDefinition)
       });
 
       if (!row) return null;
-      return toCollectionEntry(row);
+      return readableCollectionEntry(row, store, `${collection.id}-item`);
     },
   });
 }

package/packages/bundled-features/src/template-resolver/handlers/collection-list.query.ts

@@ -8,7 +8,7 @@ import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.ts";
 import {
   type CollectionEntryRow,
   collectionStore,
-  toCollectionEntry,
+  readableCollectionEntry,
 } from "./collection-shared.ts";
 
 // One list handler per declared collection: `kind`, `ownership` and `access`
@@ -42,7 +42,11 @@ export function makeCollectionListQuery(collection: ContentCollectionDefinition)
           ...store.scopeOf(query.user),
         }),
       );
-      return { blocks: rows.map(toCollectionEntry) };
+      return {
+        blocks: await Promise.all(
+          rows.map((row) => readableCollectionEntry(row, store, `${collection.id}-list`)),
+        ),
+      };
     },
   });
 }

package/packages/bundled-features/src/template-resolver/handlers/collection-set.write.ts

@@ -11,8 +11,8 @@ import { systemTemplateExists } from "../api.ts";
 import { documentViolationsToFieldIssues, sanitizeTemplateBody } from "../document-sanitizer.ts";
 import { refuseTemplateEdit, type TemplateEditPolicy } from "../template-edit-policy.ts";
 import { DEFAULT_COLLECTION_ACCESS, isCollectionRefusedKind } from "../web/constants.ts";
-import { type CollectionEntryRow, collectionStore } from "./collection-shared.ts";
-import { contentFormatSchema, folderSchema, localeSchema, slugSchema } from "./shared.ts";
+import { type CollectionEntryRow, collectionStore, storageFormatOf } from "./collection-shared.ts";
+import { folderSchema, localeSchema, slugSchema } from "./shared.ts";
 
 // Upsert inside one collection. Mirrors set.write for text-blocks, but the
 // kind comes from the declaration and the access rule is the collection's own,
@@ -26,6 +26,7 @@ export function makeCollectionSetWrite(
   editPolicy: TemplateEditPolicy,
 ) {
   const store = collectionStore(collection);
+  const contentFormat = storageFormatOf(collection);
   return defineWriteHandler({
     name: `${collection.id}-set`,
     schema: z.object({
@@ -33,8 +34,9 @@ export function makeCollectionSetWrite(
       locale: localeSchema,
       title: z.string().min(1).max(200),
       content: z.string().max(200_000).nullable(),
-      contentFormat: contentFormatSchema.default("markdown"),
       folder: folderSchema.nullable().optional(),
+      /** The create form sets it so a taken slug is reported instead of overwritten. */
+      createOnly: z.boolean().optional(),
       /** Optional cross-tenant write — SystemAdmin only. */
       tenantIdOverride: z.string().min(1).optional(),
     }),
@@ -71,8 +73,9 @@ export function makeCollectionSetWrite(
 
       const body = sanitizeTemplateBody({
         kind: collection.kind,
-        contentFormat: event.payload.contentFormat,
+        contentFormat,
         content: event.payload.content,
+        alwaysSanitizeHtml: collection.contentFormat === "document",
       });
       if (!body.ok) {
         return writeFailure(
@@ -100,6 +103,21 @@ export function makeCollectionSetWrite(
         ...owner,
       });
 
+      if (existing && event.payload.createOnly === true) {
+        return writeFailure(
+          new ValidationError({
+            fields: [
+              {
+                path: "slug",
+                code: "slug_exists",
+                i18nKey: "templateResolver.errors.collection.slugExists",
+                params: { detail: event.payload.slug },
+              },
+            ],
+          }),
+        );
+      }
+
       if (existing) {
         const result = await store.executor.update(
           {
@@ -111,7 +129,7 @@ export function makeCollectionSetWrite(
             changes: {
               title: event.payload.title,
               content: body.content,
-              contentFormat: event.payload.contentFormat,
+              contentFormat,
               folder: event.payload.folder ?? null,
             },
           },
@@ -134,7 +152,7 @@ export function makeCollectionSetWrite(
           locale: event.payload.locale,
           title: event.payload.title,
           content: body.content,
-          contentFormat: event.payload.contentFormat,
+          contentFormat,
           folder: event.payload.folder ?? null,
           ...store.createDefaults(tenantId),
           ...owner,

package/packages/bundled-features/src/template-resolver/handlers/collection-shared.ts

@@ -1,3 +1,8 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import type {
@@ -9,6 +14,7 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { templateResourceEntity, templateResourcesTable } from "../table.ts";
 import { userContentEntriesTable, userContentEntryEntity } from "../user-content-table.ts";
+import type { ContentFormat } from "../web/constants.ts";
 
 const templateExecutor = createEventStoreExecutor(templateResourcesTable, templateResourceEntity, {
   entityName: "template-resource",
@@ -41,6 +47,8 @@ export type CollectionStore = {
   scopeOf(user: SessionUser): Readonly<Record<string, unknown>>;
   /** Columns a create needs beyond the editable ones the payload carries. */
   createDefaults(tenantId: TenantId): Readonly<Record<string, unknown>>;
+  /** True when `content` is stored as PII ciphertext and must be decrypted on read. */
+  readonly contentIsPii: boolean;
 };
 
 // `ownership: "user"` means every user keeps their own entries (signatures);
@@ -55,6 +63,7 @@ export function collectionStore(collection: ContentCollectionDefinition): Collec
       executor: userContentExecutor,
       scopeOf: (user) => ({ ownerId: user.id }),
       createDefaults: () => ({}),
+      contentIsPii: true,
     };
   }
   return {
@@ -68,9 +77,26 @@ export function collectionStore(collection: ContentCollectionDefinition): Collec
       parentTemplateId: null,
       status: "active",
     }),
+    contentIsPii: false,
   };
 }
 
+// Raw reads return the stored column, which is ciphertext for a user-owned entry while a KMS
+// is configured; the API's leak guard rejects any response that still carries it.
+export async function readableCollectionEntry(
+  row: CollectionEntryRow,
+  store: CollectionStore,
+  fallbackRequestId: string,
+) {
+  const kms = configuredPiiSubjectKms();
+  if (!store.contentIsPii || !kms || row.content === null) return toCollectionEntry(row);
+  const decrypted = await decryptPiiFieldValues({ content: row.content }, ["content"], kms, {
+    requestId: requestContext.get()?.requestId ?? fallbackRequestId,
+  });
+  const content = decrypted["content"];
+  return toCollectionEntry({ ...row, content: typeof content === "string" ? content : null });
+}
+
 export function toCollectionEntry(row: CollectionEntryRow) {
   return {
     slug: row.slug,
@@ -82,3 +108,9 @@ export function toCollectionEntry(row: CollectionEntryRow) {
     modifiedAt: row.modifiedAt,
   };
 }
+
+// The client never names the storage format: the declared editor decides it, so a
+// stale or tampered client cannot stamp a "plain" collection with html or the reverse.
+export function storageFormatOf(collection: ContentCollectionDefinition): ContentFormat {
+  return collection.contentFormat === "document" ? "html" : "plain";
+}

package/packages/bundled-features/src/template-resolver/handlers/set.write.ts

@@ -48,6 +48,7 @@ export function makeSetWrite(policy: TemplateEditPolicy) {
       kind: z.enum(TEMPLATE_KINDS).optional(),
       title: z.string().min(1).max(200),
       content: z.string().max(200_000).nullable(),
+      // Provisioning callers omit it and rely on markdown.
       contentFormat: contentFormatSchema.default("markdown"),
       /** Folder path for the content tree. Optional + null = root node. */
       folder: folderSchema.nullable().optional(),

package/packages/bundled-features/src/template-resolver/handlers/shared.ts

@@ -2,7 +2,13 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import * as z from "zod";
 import { templateResourceEntity, templateResourcesTable } from "../table.ts";
 import { templateSlugSchema } from "../template-meta.ts";
-import { CONTENT_FORMATS, TEMPLATE_STATUSES, UPSERT_KINDS } from "../web/constants.ts";
+import {
+  CONTENT_FORMATS,
+  SLUG_MAX_LENGTH,
+  SLUG_PATTERN,
+  TEMPLATE_STATUSES,
+  UPSERT_KINDS,
+} from "../web/constants.ts";
 
 // One executor per bundle, shared by all four handlers for create/update via
 // event store + optimistic lock.
@@ -14,8 +20,8 @@ export const executor = createEventStoreExecutor(templateResourcesTable, templat
 export const slugSchema = z
   .string()
   .min(1)
-  .max(80)
-  .regex(/^[a-z0-9][a-z0-9-]*$/, "slug must be kebab-case (lowercase, digits, dashes)");
+  .max(SLUG_MAX_LENGTH)
+  .regex(SLUG_PATTERN, "slug must be kebab-case (lowercase, digits, dashes)");
 
 export { templateSlugSchema };