@crombolo/api-delivery 0.13.2 → 0.14.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/api-delivery",
-  "version": "0.13.2",
+  "version": "0.14.1",
   "description": "Umbraco's Content Delivery API for crombolo: published content and media as JSON, served from the published cache.",
   "license": "MIT",
   "author": "Crombolo",
@@ -28,8 +28,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/core": "0.13.2",
-    "@crombolo/contracts": "0.13.2",
-    "@crombolo/render": "0.13.2"
+    "@crombolo/core": "0.14.1",
+    "@crombolo/contracts": "0.14.1",
+    "@crombolo/render": "0.14.1"
   }
 }

package/src/handler.ts

@@ -4,8 +4,14 @@
  * Every answer is read from memory, so it scales with the nodes that render.
  * docs/delivery-api.md.
  */
-import type { PublishedCache, PublishedContent, PublishedMedia } from '@crombolo/render'
-import { isRightToLeft } from '@crombolo/render'
+import { branchAccess } from '@crombolo/core'
+import type {
+  PublishedCache,
+  PublishedContent,
+  PublishedMedia,
+  SearchableText,
+} from '@crombolo/render'
+import { excerpt, excerptHtml, isRightToLeft } from '@crombolo/render'
 import {
   ALL_FIELDS,
   type ExpansionNode,
@@ -46,6 +52,20 @@ export interface DeliveryApiPorts {
   member(token: string): Promise<DeliveryMember | undefined>
   /** The member sign-in endpoints under `v1/security/member/`, when built. */
   security?(request: Request, action: string): Promise<Response | undefined>
+  /**
+   * Site search over published pages (story 140), behind `v2/search`: a
+   * Crombolo addition, which Umbraco's Delivery API has no equivalent of.
+   */
+  search?(
+    term: string,
+    options: {
+      culture: string
+      types: readonly string[]
+      skip: number
+      take: number
+      access: { denied: readonly number[]; allowed: readonly number[] }
+    },
+  ): Promise<{ total: number; items: Array<{ key: string; score: number; text: SearchableText }> }>
 }
 
 export interface DeliveryApi {
@@ -258,6 +278,7 @@ export function createDeliveryApi(ports: DeliveryApiPorts): DeliveryApi {
       nav,
       roots,
       member,
+      rules: [...loadedRules.values()],
       ctx,
       byPath,
       startItem,
@@ -451,6 +472,44 @@ export function createDeliveryApi(ports: DeliveryApiPorts): DeliveryApi {
     })
   }
 
+  /**
+   * `v2/search?term=&contentType=&skip=&take=`: published pages matching every
+   * word, best first, as content items with `score` and an `excerpt` in HTML.
+   * A members-only page is left out, and not counted, for a caller who cannot
+   * open it.
+   */
+  async function contentSearch(r: ContentRequest, url: URL) {
+    if (!ports.search) return bare(404)
+    const skip = intParam(url, 'skip', 0)
+    if (skip instanceof Response) return skip
+    const take = intParam(url, 'take', 10)
+    if (take instanceof Response) return take
+    const term = url.searchParams.get('term')?.trim() ?? ''
+    if (!term || !r.known) return json({ total: 0, items: [] })
+    // A member who may not sign in now opens nothing a visitor could not.
+    const member =
+      r.member?.approved && !r.member.lockedOut
+        ? { username: r.member.userName, groups: r.member.groups }
+        : undefined
+    const hits = await ports.search(term, {
+      culture: r.culture ?? '',
+      types: url.searchParams.getAll('contentType').filter(Boolean),
+      skip,
+      take: Math.min(take, 100),
+      access: branchAccess(r.rules, member),
+    })
+    const items = []
+    for (const hit of hits.items) {
+      const content = r.servable(r.nav.byKey(hit.key))
+      if (!content || r.ctx.access(content) !== 'allowed') continue
+      const body = await r.respond(content, url)
+      if (body instanceof Response) return body
+      if (body)
+        items.push({ ...body, score: hit.score, excerpt: excerptHtml(excerpt(hit.text, term)) })
+    }
+    return json({ total: hits.total, items })
+  }
+
   return {
     async handle(request) {
       const url = new URL(request.url)
@@ -460,6 +519,12 @@ export function createDeliveryApi(ports: DeliveryApiPorts): DeliveryApi {
       const security = /^v1\/security\/member\/(.+)$/.exec(rest)
       if (security) return ports.security?.(request, security[1] as string)
 
+      if (/^v2\/search\/?$/.test(rest)) {
+        if (request.method !== 'GET' && request.method !== 'HEAD') return bare(405)
+        if (!contentAccess(settings, request)) return bare(401)
+        return contentSearch(await contentRequest(request), url)
+      }
+
       const match = /^v2\/(content|media)(?:\/(.*))?$/.exec(rest)
       if (!match) return undefined
       if (request.method !== 'GET' && request.method !== 'HEAD') return bare(405)

package/src/protection.ts

@@ -1,8 +1,10 @@
 /**
  * Members-only content: the nearest protected ancestor governs, as on the
- * site, and a member is let in by name or by one of their groups. Umbraco's
- * `PublicAccessChecker`, over rules read once per request.
+ * site, and a member is let in by name or by one of their groups
+ * (`memberMayOpen`, shared with the site). Umbraco's `PublicAccessChecker`,
+ * over rules read once per request.
  */
+import { memberMayOpen } from '@crombolo/core'
 
 export interface ProtectionRule {
   /** The protected node's id: its own, or the ancestor whose rule covers it. */
@@ -35,7 +37,7 @@ export function ruleFor(
   return undefined
 }
 
-/** What a caller may do with a node: a user name matches in any case, a group exactly. Pure. */
+/** What a caller may do with a node: a user name and a group both match in any case. Pure. */
 export function accessTo(
   path: string,
   rules: ReadonlyMap<number, ProtectionRule>,
@@ -44,8 +46,7 @@ export function accessTo(
   const rule = ruleFor(path, rules)
   if (!rule) return 'allowed'
   if (!member?.approved || member.lockedOut) return 'unauthorized'
-  const name = member.userName.toLowerCase()
-  if (rule.memberUserNames.some((n) => n.toLowerCase() === name)) return 'allowed'
-  if (rule.memberGroupNames.some((g) => member.groups.includes(g))) return 'allowed'
-  return 'forbidden'
+  return memberMayOpen(rule, { username: member.userName, groups: member.groups })
+    ? 'allowed'
+    : 'forbidden'
 }