@crowi/api 2.0.0-alpha.0

package/dist/hono/handlers/autocomplete.d.ts

@@ -0,0 +1,160 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type Crowi from '../../crowi';
+import type { CrowiHonoBindings } from '../app';
+export declare const registerAutocompleteRoutes: <E extends OpenAPIHono<CrowiHonoBindings>>(app: E, crowi: Crowi) => OpenAPIHono<CrowiHonoBindings, {
+    "/users/autocomplete": {
+        $get: {
+            input: {
+                query: {
+                    q: string;
+                    limit?: unknown;
+                    anchor?: "substring" | "prefix" | undefined;
+                };
+            };
+            output: {
+                results: {
+                    id: string;
+                    label: string;
+                    display: string;
+                    score: number;
+                    avatar?: string | null | undefined;
+                    modifiedAt?: string | null | undefined;
+                }[];
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {
+                query: {
+                    q: string;
+                    limit?: unknown;
+                    anchor?: "substring" | "prefix" | undefined;
+                };
+            };
+            output: {
+                error: {
+                    code: "VALIDATION_ERROR";
+                    message: string;
+                    details?: {
+                        fieldErrors: {
+                            [x: string]: string[];
+                        };
+                        formErrors: string[];
+                    } | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                query: {
+                    q: string;
+                    limit?: unknown;
+                    anchor?: "substring" | "prefix" | undefined;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED";
+                    message: "Authentication is required";
+                    redirectTo?: string | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                query: {
+                    q: string;
+                    limit?: unknown;
+                    anchor?: "substring" | "prefix" | undefined;
+                };
+            };
+            output: {
+                error: "rate_limited";
+                message: string;
+                retryAfterSeconds: number;
+            };
+            outputFormat: "json";
+            status: 429;
+        };
+    };
+} & {
+    "/pages/autocomplete": {
+        $get: {
+            input: {
+                query: {
+                    q: string;
+                    limit?: unknown;
+                    anchor?: "substring" | "prefix" | undefined;
+                };
+            };
+            output: {
+                results: {
+                    id: string;
+                    label: string;
+                    display: string;
+                    score: number;
+                    avatar?: string | null | undefined;
+                    modifiedAt?: string | null | undefined;
+                }[];
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {
+                query: {
+                    q: string;
+                    limit?: unknown;
+                    anchor?: "substring" | "prefix" | undefined;
+                };
+            };
+            output: {
+                error: {
+                    code: "VALIDATION_ERROR";
+                    message: string;
+                    details?: {
+                        fieldErrors: {
+                            [x: string]: string[];
+                        };
+                        formErrors: string[];
+                    } | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                query: {
+                    q: string;
+                    limit?: unknown;
+                    anchor?: "substring" | "prefix" | undefined;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED";
+                    message: "Authentication is required";
+                    redirectTo?: string | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                query: {
+                    q: string;
+                    limit?: unknown;
+                    anchor?: "substring" | "prefix" | undefined;
+                };
+            };
+            output: {
+                error: "rate_limited";
+                message: string;
+                retryAfterSeconds: number;
+            };
+            outputFormat: "json";
+            status: 429;
+        };
+    };
+}, "/">;

package/dist/hono/handlers/autocomplete.js

@@ -0,0 +1,181 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAutocompleteRoutes = void 0;
+/**
+ * RFC-0006 Phase 4 Batch 6 — `autocomplete` resource Hono port.
+ *
+ * Replaces `packages/api/src/routes/ts-rest/autocomplete.ts`. Two
+ * endpoints (RFC-0004 Phase 5):
+ *
+ *   GET /users/autocomplete  — suggest users for an @mention
+ *   GET /pages/autocomplete  — suggest pages for a [[wikilink]]
+ *
+ * Auth split:
+ *  - `/pages/autocomplete` rides the `revision` handler's broad
+ *    `createJwtAuth(crowi)` apply on `/pages/*` (same shared-middleware
+ *    pattern as `page` / `page-preview` / `pageCollab` / `presence` /
+ *    `draft`).
+ *  - `/users/autocomplete` is OUTSIDE that prefix. We install jwtAuth
+ *    on the single literal path here — no other handler owns `/users/*`
+ *    so there is no risk of double-apply.
+ *
+ * Rate limiting:
+ *  - 60 req/min/user, name `'autocomplete'`. Same shared
+ *    `createRateLimiter(...)` instance for both endpoints (the limiter
+ *    keys on `userId` so cross-endpoint usage still counts against the
+ *    same budget — matches the ts-rest era).
+ *  - Applied AFTER jwtAuth so `c.get('user')` is populated.
+ *  - 429 envelope: `{ error: 'rate_limited', message,
+ *    retryAfterSeconds }` (`AutocompleteRateLimitErrorSchema`).
+ */
+const api_contract_1 = require("@crowi/api-contract");
+const debug_1 = __importDefault(require("debug"));
+const page_1 = require("../../models/page");
+const autocomplete_match_1 = require("../../util/autocomplete-match");
+const rate_limit_1 = require("../../util/rate-limit");
+const regex_1 = require("../../util/regex");
+const ts_rest_helpers_1 = require("../../util/ts-rest-helpers");
+const auth_1 = require("../middleware/auth");
+const rate_limit_2 = require("../middleware/rate-limit");
+const require_scope_1 = require("../middleware/require-scope");
+const debug = (0, debug_1.default)('crowi:hono:handlers:autocomplete');
+/** Per-user budget for the autocomplete endpoints — RFC §"Rate limit". */
+const RATE_LIMIT = 60;
+const RATE_WINDOW_MS = 60_000;
+/**
+ * Build the case-insensitive matcher for a candidate query. `'prefix'`
+ * anchors at the start (`^…`) so only true prefixes match — the "create
+ * page" modal needs this so cycling through completions of a `/`-rooted
+ * path never surfaces a deep page that merely *contains* the typed text.
+ * `'substring'` (the default) keeps the historical anywhere-in-string
+ * match used by the editor pickers.
+ */
+const buildMatcher = (q, anchor) => {
+    const escaped = (0, regex_1.escapeRegExp)(q);
+    return new RegExp(anchor === 'prefix' ? `^${escaped}` : escaped, 'i');
+};
+/** Last `/`-separated segment of a wiki path — the page's "title". */
+const pathLeaf = (path) => {
+    const trimmed = path.replace(/\/+$/, '');
+    const idx = trimmed.lastIndexOf('/');
+    return idx >= 0 ? trimmed.slice(idx + 1) : trimmed;
+};
+const registerAutocompleteRoutes = (app, crowi) => {
+    const User = crowi.model('User');
+    const Page = crowi.model('Page');
+    // One shared limiter per process. `crowi.redis` is `null` in
+    // single-instance dev, which selects the in-memory fallback.
+    const limiter = (0, rate_limit_1.createRateLimiter)({
+        name: 'autocomplete',
+        limit: RATE_LIMIT,
+        windowMs: RATE_WINDOW_MS,
+        redisClient: crowi.redis ?? null,
+    });
+    const rateLimitMiddleware = (0, rate_limit_2.withRateLimit)({
+        limiter,
+        wireShape: 'autocomplete-envelope',
+        message: () => 'Autocomplete rate limit exceeded. Try again shortly.',
+    });
+    // `/users/autocomplete` is OUTSIDE the revision-owned `/pages/*`
+    // apply — install jwtAuth on the literal path here.
+    app.use('/users/autocomplete', (0, auth_1.createJwtAuth)(crowi));
+    // Rate limit (both endpoints share the bucket; apply per literal
+    // path AFTER jwtAuth so `c.get('user')` is populated).
+    app.use('/users/autocomplete', rateLimitMiddleware);
+    app.use('/pages/autocomplete', rateLimitMiddleware);
+    // RFC-0010 — autocomplete (page + mention pickers) is a page read.
+    (0, require_scope_1.applyScope)(app, api_contract_1.autocompleteUsersRoute, 'pages:read');
+    (0, require_scope_1.applyScope)(app, api_contract_1.autocompletePagesRoute, 'pages:read');
+    return (app
+        // --------------------------------------------------------------
+        // GET /users/autocomplete
+        // --------------------------------------------------------------
+        .openapi(api_contract_1.autocompleteUsersRoute, async (c) => {
+        const user = c.get('user');
+        const { q, limit, anchor } = c.req.valid('query');
+        debug('autocompleteUsers', { q, limit, anchor, userId: user._id.toString() });
+        // Widest cheap filter: case-insensitive substring on any of
+        // the three fields. Fuzzy hits that are *not* substrings are
+        // intentionally not surfaced — username typo tolerance is
+        // low-value and the substring net already covers prefixes.
+        const re = buildMatcher(q, anchor);
+        const candidates = (await User.find({
+            status: User.STATUS_ACTIVE,
+            $or: [{ username: re }, { name: re }, { email: re }],
+        })
+            .select('_id username name email image')
+            .limit(200)
+            .lean()
+            .exec());
+        const results = candidates
+            .map((cand) => {
+            const username = cand.username ?? '';
+            const name = cand.name ?? '';
+            const emailLocal = (cand.email ?? '').split('@')[0] ?? '';
+            const score = (0, autocomplete_match_1.scoreCandidate)([
+                { text: username, weight: 30 },
+                { text: name, weight: 20 },
+                { text: emailLocal, weight: 10 },
+            ], q);
+            return { cand, username, name, score };
+        })
+            .filter((entry) => entry.score > 0)
+            .sort((a, b) => b.score - a.score || a.username.localeCompare(b.username))
+            .slice(0, limit)
+            .map((entry) => ({
+            id: entry.cand._id.toString(),
+            label: entry.username,
+            display: entry.name ? `${entry.name} (@${entry.username})` : `@${entry.username}`,
+            avatar: entry.cand.image ?? null,
+            score: entry.score,
+        }));
+        return c.json({ results }, 200);
+    })
+        // --------------------------------------------------------------
+        // GET /pages/autocomplete
+        // --------------------------------------------------------------
+        .openapi(api_contract_1.autocompletePagesRoute, async (c) => {
+        const user = c.get('user');
+        const { q, limit, anchor } = c.req.valid('query');
+        debug('autocompletePages', { q, limit, anchor, userId: user._id.toString() });
+        const re = buildMatcher(q, anchor);
+        const candidates = (await Page.find({
+            redirectTo: null,
+            path: re,
+            // Grant-aware read filter + draft visibility, both shared
+            // with the page listing queries (RFC-0004).
+            $and: [{ $or: (0, page_1.visiblePageGrantOr)(user._id) }, { $or: (0, page_1.visiblePageStatusOr)(user._id) }],
+        })
+            .select('_id path updatedAt')
+            .limit(200)
+            .lean()
+            .exec());
+        const results = candidates
+            .map((cand) => {
+            const leaf = pathLeaf(cand.path);
+            const score = (0, autocomplete_match_1.scoreCandidate)([
+                { text: cand.path, weight: 30 },
+                { text: leaf, weight: 15 },
+            ], q);
+            return { cand, leaf, score };
+        })
+            .filter((entry) => entry.score > 0)
+            .sort((a, b) => b.score - a.score || a.cand.path.localeCompare(b.cand.path))
+            .slice(0, limit)
+            .map((entry) => ({
+            id: entry.cand._id.toString(),
+            label: entry.cand.path,
+            // Show the leaf only when it differs from the full path
+            // (a top-level page's leaf *is* its path).
+            display: entry.leaf && entry.leaf !== entry.cand.path ? `${entry.cand.path} — ${entry.leaf}` : entry.cand.path,
+            modifiedAt: (0, ts_rest_helpers_1.toISOStringOrNull)(entry.cand.updatedAt),
+            score: entry.score,
+        }));
+        return c.json({ results }, 200);
+    }));
+};
+exports.registerAutocompleteRoutes = registerAutocompleteRoutes;
+//# sourceMappingURL=autocomplete.js.map

package/dist/hono/handlers/autocomplete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autocomplete.js","sourceRoot":"","sources":["../../../src/hono/handlers/autocomplete.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,sDAA8G;AAE9G,kDAA0B;AAG1B,0CAA0E;AAC1E,oEAA6D;AAC7D,oDAAwD;AACxD,0CAA8C;AAC9C,8DAA6D;AAG7D,6CAAmD;AACnD,yDAAyD;AACzD,+DAAyD;AAEzD,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,kCAAkC,CAAC,CAAC;AAExD,0EAA0E;AAC1E,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,MAA8B,EAAU,EAAE;IACzE,MAAM,OAAO,GAAG,IAAA,oBAAY,EAAC,CAAC,CAAC,CAAC;IAChC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACrD,CAAC,CAAC;AAEK,MAAM,0BAA0B,GAAG,CAA2C,GAAM,EAAE,KAAY,EAAE,EAAE;IAC3G,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,6DAA6D;IAC7D,6DAA6D;IAC7D,MAAM,OAAO,GAAG,IAAA,8BAAiB,EAAC;QAChC,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;KACjC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,IAAA,0BAAa,EAAC;QACxC,OAAO;QACP,SAAS,EAAE,uBAAuB;QAClC,OAAO,EAAE,GAAG,EAAE,CAAC,sDAAsD;KACtE,CAAC,CAAC;IAEH,iEAAiE;IACjE,oDAAoD;IACpD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAA,oBAAa,EAAC,KAAK,CAAC,CAAC,CAAC;IACrD,iEAAiE;IACjE,uDAAuD;IACvD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;IAEpD,mEAAmE;IACnE,IAAA,0BAAU,EAAC,GAAG,EAAE,qCAAsB,EAAE,YAAY,CAAC,CAAC;IACtD,IAAA,0BAAU,EAAC,GAAG,EAAE,qCAAsB,EAAE,YAAY,CAAC,CAAC;IAEtD,OAAO,CACL,GAAG;QACD,iEAAiE;QACjE,0BAA0B;QAC1B,iEAAiE;SAChE,OAAO,CAAC,qCAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAElD,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE9E,4DAA4D;QAC5D,6DAA6D;QAC7D,0DAA0D;QAC1D,2DAA2D;QAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,IAAI,CAAC,aAAa;YAC1B,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;SACrD,CAAC;aACC,MAAM,CAAC,+BAA+B,CAAC;aACvC,KAAK,CAAC,GAAG,CAAC;aACV,IAAI,EAAE;aACN,IAAI,EAAE,CAAoH,CAAC;QAE9H,MAAM,OAAO,GAAyB,UAAU;aAC7C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAA,mCAAc,EAC1B;gBACE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC9B,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC1B,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE;aACjC,EACD,CAAC,CACF,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzC,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;aACzE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC7B,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE;YACjF,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC,CAAC;QAEN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC;QACF,iEAAiE;QACjE,0BAA0B;QAC1B,iEAAiE;SAChE,OAAO,CAAC,qCAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAElD,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE9E,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC;YAClC,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,EAAE;YACR,0DAA0D;YAC1D,4CAA4C;YAC5C,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,IAAA,yBAAkB,EAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAA,0BAAmB,EAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;SACtF,CAAC;aACC,MAAM,CAAC,oBAAoB,CAAC;aAC5B,KAAK,CAAC,GAAG,CAAC;aACV,IAAI,EAAE;aACN,IAAI,EAAE,CAA2E,CAAC;QAErF,MAAM,OAAO,GAAyB,UAAU;aAC7C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,IAAA,mCAAc,EAC1B;gBACE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC/B,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;aAC3B,EACD,CAAC,CACF,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC3E,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;YACtB,wDAAwD;YACxD,2CAA2C;YAC3C,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI;YAC9G,UAAU,EAAE,IAAA,mCAAiB,EAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YACnD,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC,CAAC;QAEN,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CACL,CAAC;AACJ,CAAC,CAAC;AAtIW,QAAA,0BAA0B,8BAsIrC"}

package/dist/hono/handlers/backlink.d.ts

@@ -0,0 +1,78 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type Crowi from '../../crowi';
+import type { CrowiHonoBindings } from '../app';
+export declare const registerBacklinkRoutes: <E extends OpenAPIHono<CrowiHonoBindings>>(app: E, crowi: Crowi) => OpenAPIHono<CrowiHonoBindings, {
+    "/backlinks": {
+        $get: {
+            input: {
+                query: {
+                    page_id: string;
+                    limit?: unknown;
+                    offset?: unknown;
+                };
+            };
+            output: {
+                backlinks: {
+                    _id: string;
+                    page: string;
+                    fromPage: {
+                        _id: string;
+                        path: string;
+                    };
+                    fromRevision: {
+                        _id: string;
+                        author?: {
+                            _id: string;
+                            username: string;
+                            name: string;
+                            email: string;
+                            createdAt: string;
+                            id?: string | undefined;
+                            image?: string | null | undefined;
+                            introduction?: string | undefined;
+                            admin?: boolean | undefined;
+                            status?: 1 | 2 | 3 | 4 | 5 | undefined;
+                        } | null | undefined;
+                    };
+                    updatedAt: string;
+                }[];
+                hasNext: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {
+                query: {
+                    page_id: string;
+                    limit?: unknown;
+                    offset?: unknown;
+                };
+            };
+            output: {
+                error: {
+                    code: "INVALID_PAGE_ID";
+                    message: string;
+                };
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                query: {
+                    page_id: string;
+                    limit?: unknown;
+                    offset?: unknown;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED";
+                    message: "Authentication is required";
+                    redirectTo?: string | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 401;
+        };
+    };
+}, "/">;

package/dist/hono/handlers/backlink.js

@@ -0,0 +1,93 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerBacklinkRoutes = void 0;
+/**
+ * RFC-0006 Phase 4 Batch 3 — `backlink` resource Hono port.
+ *
+ * Replaces `packages/api/src/routes/ts-rest/backlink.ts`. Single endpoint:
+ *
+ *   GET /backlinks — list backlinks targeting a page
+ *
+ * Behind `createJwtAuth(crowi)` applied broadly to `/backlinks/*`.
+ * Wire-format parity is preserved: the response trims to `limit` after
+ * filtering out dangling / hidden-draft rows, and `hasNext` is derived
+ * from an over-fetch of `limit + 1` records. The grant policy on
+ * `fromPage` mirrors the legacy `/_api/backlink.list` semantics (no
+ * grant filter) but RFC-0004 hidden-draft pages are dropped from
+ * another user's view.
+ */
+const api_contract_1 = require("@crowi/api-contract");
+const debug_1 = __importDefault(require("debug"));
+const mongoose_1 = require("mongoose");
+const page_1 = require("../../models/page");
+const ts_rest_helpers_1 = require("../../util/ts-rest-helpers");
+const auth_1 = require("../middleware/auth");
+const require_scope_1 = require("../middleware/require-scope");
+const errors_1 = require("./_helpers/errors");
+const debug = (0, debug_1.default)('crowi:hono:handlers:backlink');
+const isPopulatedFromPage = (value) => {
+    return !!value && typeof value === 'object' && '_id' in value && 'path' in value;
+};
+/**
+ * RFC-0004: a draft `fromPage` is visible only to its author. Drop the
+ * backlink so a draft can never leak its existence / path through
+ * another user's backlink view.
+ */
+const isHiddenDraftFromPage = (fromPage, viewerId) => {
+    if (fromPage.status !== page_1.STATUS_DRAFT)
+        return false;
+    return fromPage.creator?.toString() !== viewerId;
+};
+const isPopulatedFromRevision = (value) => {
+    return !!value && typeof value === 'object' && '_id' in value;
+};
+const toBacklinkResponse = (raw, pageId, viewerId) => {
+    const { fromPage, fromRevision } = raw;
+    if (!isPopulatedFromPage(fromPage) || typeof fromPage.path !== 'string')
+        return null;
+    if (isHiddenDraftFromPage(fromPage, viewerId))
+        return null;
+    if (!isPopulatedFromRevision(fromRevision))
+        return null;
+    return {
+        _id: (0, ts_rest_helpers_1.toStringId)(raw._id),
+        page: pageId,
+        fromPage: { _id: (0, ts_rest_helpers_1.toStringId)(fromPage._id), path: fromPage.path },
+        fromRevision: {
+            _id: (0, ts_rest_helpers_1.toStringId)(fromRevision._id),
+            author: (0, ts_rest_helpers_1.isPopulatedUser)(fromRevision.author) ? (0, ts_rest_helpers_1.toUserPublic)(fromRevision.author) : null,
+        },
+        updatedAt: (0, ts_rest_helpers_1.toISOStringOrNull)(raw.updatedAt) ?? new Date(0).toISOString(),
+    };
+};
+const registerBacklinkRoutes = (app, crowi) => {
+    const Backlink = crowi.model('Backlink');
+    app.use('/backlinks/*', (0, auth_1.createJwtAuth)(crowi));
+    app.use('/backlinks', (0, auth_1.createJwtAuth)(crowi));
+    // RFC-0010 — backlinks are a page-graph read.
+    (0, require_scope_1.applyScope)(app, api_contract_1.getBacklinksRoute, 'pages:read');
+    return app.openapi(api_contract_1.getBacklinksRoute, async (c) => {
+        const user = c.get('user');
+        const { page_id, limit, offset } = c.req.valid('query');
+        const viewerId = user._id.toString();
+        debug('getBacklinks called with:', { page_id, limit, offset, viewerId });
+        // Zod's regex already enforces 24-hex, but guard defensively for
+        // call paths that bypass the contract validator (e.g. direct
+        // handler invocation in unit tests).
+        if (!(0, ts_rest_helpers_1.isValidObjectId)(page_id)) {
+            return c.json(errors_1.INVALID_PAGE_ID_BODY, 400);
+        }
+        const pageObjectId = new mongoose_1.Types.ObjectId(page_id);
+        const fetchLimit = limit + 1;
+        const rawBacklinks = (await Backlink.findByPageId(pageObjectId, fetchLimit, offset));
+        const resolved = rawBacklinks.map((raw) => toBacklinkResponse(raw, page_id, viewerId)).filter((b) => b !== null);
+        const hasNext = resolved.length > limit;
+        const backlinks = hasNext ? resolved.slice(0, limit) : resolved;
+        return c.json({ backlinks, hasNext }, 200);
+    });
+};
+exports.registerBacklinkRoutes = registerBacklinkRoutes;
+//# sourceMappingURL=backlink.js.map

package/dist/hono/handlers/backlink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlink.js","sourceRoot":"","sources":["../../../src/hono/handlers/backlink.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;;GAcG;AACH,sDAA2F;AAE3F,kDAA0B;AAC1B,uCAAiC;AAGjC,0CAA+C;AAC/C,8DAAyH;AAGzH,6CAAmD;AACnD,+DAAyD;AAEzD,8CAAyD;AAEzD,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,8BAA8B,CAAC,CAAC;AAUpD,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAgH,EAAE;IAC3J,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACnF,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,CAAC,QAAgE,EAAE,QAAgB,EAAW,EAAE;IAC5H,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAY;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,QAAQ,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAA+D,EAAE;IAC9G,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,GAAgB,EAAE,MAAc,EAAE,QAAgB,EAA2B,EAAE;IACzG,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;IACvC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAExD,OAAO;QACL,GAAG,EAAE,IAAA,4BAAU,EAAC,GAAG,CAAC,GAAG,CAAC;QACxB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAA,4BAAU,EAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;QAChE,YAAY,EAAE;YACZ,GAAG,EAAE,IAAA,4BAAU,EAAC,YAAY,CAAC,GAAG,CAAC;YACjC,MAAM,EAAE,IAAA,iCAAe,EAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,8BAAY,EAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SACxF;QACD,SAAS,EAAE,IAAA,mCAAiB,EAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACzE,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,sBAAsB,GAAG,CAA2C,GAAM,EAAE,KAAY,EAAE,EAAE;IACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEzC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,IAAA,oBAAa,EAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,oBAAa,EAAC,KAAK,CAAC,CAAC,CAAC;IAE5C,8CAA8C;IAC9C,IAAA,0BAAU,EAAC,GAAG,EAAE,gCAAiB,EAAE,YAAY,CAAC,CAAC;IAEjD,OAAO,GAAG,CAAC,OAAO,CAAC,gCAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAErC,KAAK,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,iEAAiE;QACjE,6DAA6D;QAC7D,qCAAqC;QACrC,IAAI,CAAC,IAAA,iCAAe,EAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,6BAAoB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,gBAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAA6B,CAAC;QAEjH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAExI,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC;QACxC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEhE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAlCW,QAAA,sBAAsB,0BAkCjC"}