@crowi/api 2.0.0-alpha.0

package/dist/hono/handlers/draft.d.ts

@@ -0,0 +1,136 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type Crowi from '../../crowi';
+import type { CrowiHonoBindings } from '../app';
+export declare const registerDraftRoutes: <E extends OpenAPIHono<CrowiHonoBindings>>(app: E, crowi: Crowi) => OpenAPIHono<CrowiHonoBindings, {
+    "/pages/drafts": {
+        $post: {
+            input: {
+                json: {
+                    path: string;
+                    initialBody?: string | undefined;
+                };
+            };
+            output: {
+                pageId: string;
+            };
+            outputFormat: "json";
+            status: 201;
+        } | {
+            input: {
+                json: {
+                    path: string;
+                    initialBody?: string | undefined;
+                };
+            };
+            output: {
+                error: "invalid_path" | "path_taken";
+                message: string;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    path: string;
+                    initialBody?: string | undefined;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED";
+                    message: "Authentication is required";
+                    redirectTo?: string | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    path: string;
+                    initialBody?: string | undefined;
+                };
+            };
+            output: {
+                error: "path_taken_by_draft";
+                owner: {
+                    id: string;
+                    username: string;
+                    displayName: string;
+                };
+                message: string;
+            };
+            outputFormat: "json";
+            status: 409;
+        };
+    };
+} & {
+    "/pages/drafts": {
+        $get: {
+            input: {};
+            output: {
+                drafts: {
+                    pageId: string;
+                    path: string;
+                    createdAt: string;
+                    updatedAt: string;
+                }[];
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {};
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED";
+                    message: "Authentication is required";
+                    redirectTo?: string | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 401;
+        };
+    };
+} & {
+    "/pages/drafts/:id": {
+        $delete: {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                pageId: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED";
+                    message: "Authentication is required";
+                    redirectTo?: string | undefined;
+                };
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                error: "draft_not_found";
+                message: string;
+            };
+            outputFormat: "json";
+            status: 404;
+        };
+    };
+}, "/">;

package/dist/hono/handlers/draft.js

@@ -0,0 +1,191 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerDraftRoutes = void 0;
+/**
+ * RFC-0006 Phase 4 Batch 6 — `draft` resource Hono port.
+ *
+ * Replaces `packages/api/src/routes/ts-rest/draft.ts`. Three endpoints
+ * (RFC-0004 Phase 3 — drafts):
+ *
+ *   POST   /pages/drafts        — create a draft at a path
+ *   GET    /pages/drafts        — list the caller's own drafts
+ *   DELETE /pages/drafts/:id    — cancel a draft
+ *
+ * Auth is shared with the `page` / `page-preview` / `pageCollab` /
+ * `presence` resources: the `revision` handler already applies
+ * `createJwtAuth(crowi)` broadly to `/pages/*` (see
+ * `packages/api/src/hono/handlers/revision.ts`). This handler relies on
+ * the established register order (`revision -> page -> page-preview ->
+ * pageCollab -> presence -> draft -> ...` in `buildHonoApp`) and does
+ * NOT install jwtAuth itself — Hono does not dedupe middleware by
+ * reference; re-installing would cost a second JWT verify +
+ * `User.findById` per request.
+ *
+ * Wire-format parity:
+ *
+ *  - 201 `{ pageId }` for both fresh creation and the caller's
+ *    idempotent re-POST on their own draft path.
+ *  - 400 `{ error: 'invalid_path' | 'path_taken', message }` for
+ *    uncreatable paths / published-page collisions.
+ *  - 409 `{ error: 'path_taken_by_draft', owner, message }` when
+ *    another user holds the draft.
+ *  - 404 `{ error: 'draft_not_found', message }` collapses "no such
+ *    draft", "not a draft", "not your draft", and malformed id into
+ *    one response (existence leak guard).
+ */
+const api_contract_1 = require("@crowi/api-contract");
+const debug_1 = __importDefault(require("debug"));
+const page_1 = require("../../models/page");
+const ts_rest_helpers_1 = require("../../util/ts-rest-helpers");
+const require_scope_1 = require("../middleware/require-scope");
+const debug = (0, debug_1.default)('crowi:hono:handlers:draft');
+/** MongoDB duplicate-key error code, raised by the unique `Page.path` index. */
+const isDuplicateKeyError = (err) => typeof err === 'object' && err !== null && err.code === 11000;
+const DRAFT_NOT_FOUND_BODY = {
+    error: 'draft_not_found',
+    message: 'Draft not found.',
+};
+const registerDraftRoutes = (app, crowi) => {
+    const Page = crowi.model('Page');
+    const Revision = crowi.model('Revision');
+    const User = crowi.model('User');
+    // RFC-0010 — drafts are page content (jwtAuth rides on the
+    // revision-owned `/pages/*` apply). Create / cancel mutate, list reads.
+    (0, require_scope_1.applyScope)(app, api_contract_1.createDraftRoute, 'pages:write');
+    (0, require_scope_1.applyScope)(app, api_contract_1.listDraftsRoute, 'pages:read');
+    (0, require_scope_1.applyScope)(app, api_contract_1.cancelDraftRoute, 'pages:write');
+    return (app
+        // --------------------------------------------------------------
+        // POST /pages/drafts
+        // --------------------------------------------------------------
+        //
+        // Create a draft at `path` with the default `GRANT_PUBLIC` grant.
+        // The draft's author-only visibility is enforced entirely by
+        // `status: 'draft'` (RFC-0005 Phase 1) — `findPage*` collapse
+        // non-author access into 404, and listing / search / backlinks
+        // all exclude other users' drafts by status. The grant stays
+        // public so publish-on-save instantly makes the page visible
+        // without a grant flip.
+        .openapi(api_contract_1.createDraftRoute, async (c) => {
+        const user = c.get('user');
+        const body = c.req.valid('json');
+        // The seed revision's `body` is `required` and Mongoose rejects
+        // an empty string. A brand-new draft is conceptually empty, so
+        // seed a single newline — it renders to nothing and gives the
+        // collab editor an effectively blank doc.
+        const initialBody = body.initialBody && body.initialBody.length > 0 ? body.initialBody : '\n';
+        const path = Page.normalizePath(body.path);
+        debug('createDraft called', { path, userId: user._id.toString() });
+        if (!Page.isCreatableName(path)) {
+            return c.json({ error: 'invalid_path', message: `Cannot create a page at this path (${path}).` }, 400);
+        }
+        // Resolve a path already occupied by a page into the right
+        // response — caller's own draft → 201 (idempotent), another
+        // user's draft → 409 with owner info, anything published → 400.
+        // `null` means the path is free.
+        const resolveOccupied = async () => {
+            const existing = (await Page.findOne({ path }));
+            if (!existing)
+                return null;
+            if (existing.status !== page_1.STATUS_DRAFT) {
+                return c.json({ error: 'path_taken', message: `A page already exists at ${path}.` }, 400);
+            }
+            if (existing.isCreator(user)) {
+                return c.json({ pageId: existing._id.toString() }, 201);
+            }
+            const owner = (await User.findById(existing.creator));
+            return c.json({
+                error: 'path_taken_by_draft',
+                owner: owner
+                    ? { id: owner._id.toString(), username: owner.username, displayName: owner.name }
+                    : { id: '', username: 'unknown', displayName: 'unknown' },
+                message: owner ? `This page is being created by @${owner.username}.` : 'This page is being created by another user.',
+            }, 409);
+        };
+        const occupied = await resolveOccupied();
+        if (occupied)
+            return occupied;
+        try {
+            const newPage = await Page.create({
+                path,
+                creator: user,
+                lastUpdateUser: user,
+                createdAt: Date.now(),
+                updatedAt: Date.now(),
+                redirectTo: null,
+                grant: page_1.GRANT_PUBLIC,
+                status: page_1.STATUS_DRAFT,
+                grantedUsers: [user],
+            });
+            // Seed the first revision so the page is loadable / editable
+            // immediately. `pushRevision` wires `revision` + fires the
+            // `Page.create` event so backlinks / search run — both already
+            // exclude other users' drafts (RFC-0004 Phase 2).
+            const newRevision = await Revision.prepareRevision(newPage, initialBody, user, { format: 'markdown' });
+            await Page.pushRevision(newPage, newRevision, user);
+            debug('createDraft created draft page', { pageId: newPage._id.toString(), path });
+            return c.json({ pageId: newPage._id.toString() }, 201);
+        }
+        catch (err) {
+            // A concurrent POST can win the unique-`path`-index race
+            // between the pre-check and `create`. Re-resolve so the loser
+            // still gets the proper 400 / 409 instead of `invalid_path`.
+            if (isDuplicateKeyError(err)) {
+                const raced = await resolveOccupied();
+                if (raced)
+                    return raced;
+            }
+            debug('createDraft failed:', err.message);
+            return c.json({ error: 'invalid_path', message: err.message || 'Failed to create draft.' }, 400);
+        }
+    })
+        // --------------------------------------------------------------
+        // GET /pages/drafts
+        // --------------------------------------------------------------
+        .openapi(api_contract_1.listDraftsRoute, async (c) => {
+        const user = c.get('user');
+        debug('listDrafts called', { userId: user._id.toString() });
+        const drafts = (await Page.find({ status: page_1.STATUS_DRAFT, creator: user._id })
+            .sort({ createdAt: -1 })
+            .select('_id path createdAt updatedAt')
+            .lean()
+            .exec());
+        return c.json({
+            drafts: drafts.map((d) => ({
+                pageId: d._id.toString(),
+                path: d.path,
+                createdAt: (0, ts_rest_helpers_1.toISOStringOrNull)(d.createdAt) ?? new Date().toISOString(),
+                updatedAt: (0, ts_rest_helpers_1.toISOStringOrNull)(d.updatedAt) ?? (0, ts_rest_helpers_1.toISOStringOrNull)(d.createdAt) ?? new Date().toISOString(),
+            })),
+        }, 200);
+    })
+        // --------------------------------------------------------------
+        // DELETE /pages/drafts/:id
+        // --------------------------------------------------------------
+        //
+        // "No such draft", "not a draft", and "someone else's draft" all
+        // collapse to the same 404 so draft existence is never leaked.
+        .openapi(api_contract_1.cancelDraftRoute, async (c) => {
+        const user = c.get('user');
+        const { id } = c.req.valid('param');
+        debug('cancelDraft called', { id, userId: user._id.toString() });
+        if (!(0, ts_rest_helpers_1.isValidObjectId)(id)) {
+            return c.json(DRAFT_NOT_FOUND_BODY, 404);
+        }
+        const page = (await Page.findOne({ _id: id, status: page_1.STATUS_DRAFT, creator: user._id }));
+        if (!page) {
+            return c.json(DRAFT_NOT_FOUND_BODY, 404);
+        }
+        // `removePage` physically deletes the Page and its revisions —
+        // the right semantics for "cancel": the path is freed and no
+        // /trash redirect stub is left behind (unlike soft delete).
+        await Page.removePage(page);
+        debug('cancelDraft removed draft', { id, path: page.path });
+        return c.json({ pageId: id }, 200);
+    }));
+};
+exports.registerDraftRoutes = registerDraftRoutes;
+//# sourceMappingURL=draft.js.map

package/dist/hono/handlers/draft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"draft.js","sourceRoot":"","sources":["../../../src/hono/handlers/draft.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,sDAA0F;AAE1F,kDAA0B;AAG1B,0CAAgF;AAEhF,8DAA8E;AAG9E,+DAAyD;AAEzD,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,2BAA2B,CAAC,CAAC;AAEjD,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,CAAC,GAAY,EAAW,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAAyB,CAAC,IAAI,KAAK,KAAK,CAAC;AAE5I,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,iBAA0B;IACjC,OAAO,EAAE,kBAAkB;CAC5B,CAAC;AAEK,MAAM,mBAAmB,GAAG,CAA2C,GAAM,EAAE,KAAY,EAAE,EAAE;IACpG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,2DAA2D;IAC3D,wEAAwE;IACxE,IAAA,0BAAU,EAAC,GAAG,EAAE,+BAAgB,EAAE,aAAa,CAAC,CAAC;IACjD,IAAA,0BAAU,EAAC,GAAG,EAAE,8BAAe,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAA,0BAAU,EAAC,GAAG,EAAE,+BAAgB,EAAE,aAAa,CAAC,CAAC;IAEjD,OAAO,CACL,GAAG;QACD,iEAAiE;QACjE,qBAAqB;QACrB,iEAAiE;QACjE,EAAE;QACF,kEAAkE;QAClE,6DAA6D;QAC7D,8DAA8D;QAC9D,+DAA+D;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,wBAAwB;SACvB,OAAO,CAAC,+BAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,gEAAgE;QAChE,+DAA+D;QAC/D,8DAA8D;QAC9D,0CAA0C;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3C,KAAK,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEnE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAuB,EAAE,OAAO,EAAE,sCAAsC,IAAI,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAClH,CAAC;QAED,2DAA2D;QAC3D,4DAA4D;QAC5D,gEAAgE;QAChE,iCAAiC;QACjC,MAAM,eAAe,GAAG,KAAK,IAAI,EAAE;YACjC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAwB,CAAC;YACvE,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAY,EAAE,CAAC;gBACrC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAqB,EAAE,OAAO,EAAE,4BAA4B,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAwB,CAAC;YAC7E,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,qBAA8B;gBACrC,KAAK,EAAE,KAAK;oBACV,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE;oBACjF,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBAC3D,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,kCAAkC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,6CAA6C;aACrH,EACD,GAAG,CACJ,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI;gBACJ,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,UAAU,EAAE,IAAI;gBAChB,KAAK,EAAE,mBAAY;gBACnB,MAAM,EAAE,mBAAY;gBACpB,YAAY,EAAE,CAAC,IAAI,CAAC;aACrB,CAAC,CAAC;YAEH,6DAA6D;YAC7D,2DAA2D;YAC3D,+DAA+D;YAC/D,kDAAkD;YAClD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACvG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YAEpD,KAAK,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yDAAyD;YACzD,8DAA8D;YAC9D,6DAA6D;YAC7D,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;gBACtC,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;YACD,KAAK,CAAC,qBAAqB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAuB,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,IAAI,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QACvH,CAAC;IACH,CAAC,CAAC;QACF,iEAAiE;QACjE,oBAAoB;QACpB,iEAAiE;SAChE,OAAO,CAAC,8BAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACzE,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;aACvB,MAAM,CAAC,8BAA8B,CAAC;aACtC,IAAI,EAAE;aACN,IAAI,EAAE,CAA6F,CAAC;QAEvG,OAAO,CAAC,CAAC,IAAI,CACX;YACE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,IAAA,mCAAiB,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrE,SAAS,EAAE,IAAA,mCAAiB,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAA,mCAAiB,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACxG,CAAC,CAAC;SACJ,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC;QACF,iEAAiE;QACjE,2BAA2B;QAC3B,iEAAiE;QACjE,EAAE;QACF,iEAAiE;QACjE,+DAA+D;SAC9D,OAAO,CAAC,+BAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,KAAK,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAA,iCAAe,EAAC,EAAE,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,mBAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAwB,CAAC;QAC/G,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,+DAA+D;QAC/D,6DAA6D;QAC7D,4DAA4D;QAC5D,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE5B,KAAK,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CACL,CAAC;AACJ,CAAC,CAAC;AA7JW,QAAA,mBAAmB,uBA6J9B"}

package/dist/hono/handlers/emailChange.d.ts

@@ -0,0 +1,124 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type Crowi from '../../crowi';
+import type { CrowiHonoBindings } from '../app';
+export declare const registerEmailChangeRoutes: <E extends OpenAPIHono<CrowiHonoBindings>>(app: E, crowi: Crowi) => OpenAPIHono<CrowiHonoBindings, {
+    "/auth/confirm-email-change": {
+        $get: {
+            input: {
+                query: {
+                    token: string;
+                };
+            };
+            output: {
+                ok: true;
+                email: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {
+                query: {
+                    token: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED" | "ADMIN_REQUIRED" | "USER_REGISTERED" | "USER_SUSPENDED" | "USER_INVITED" | "INTERNAL_ERROR" | "THIRD_PARTY_AUTH_REQUIRED" | "USER_NOT_ACTIVE" | "EMAIL_NOT_CONFIRMED" | "VALIDATION_ERROR" | "INVALID_REQUEST" | "NOT_FOUND" | "CONFLICT" | "SERVICE_UNAVAILABLE" | "APPLICATION_NOT_INSTALLED" | "INVALID_PAGE_ID" | "PAGE_NOT_FOUND" | "PAGE_NOT_GRANTED" | "PAGE_REVISION_ERROR" | "INVALID_GRANT" | "COMMENT_NOT_FOUND" | "NOTIFICATION_NOT_FOUND" | "USER_NOT_FOUND" | "USER_EXISTS" | "USERNAME_TAKEN" | "EMAIL_TAKEN" | "EMAIL_NOT_ALLOWED" | "INVALID_ACTIVATION_TOKEN" | "INVALID_INVITE_TOKEN" | "INVITE_ALREADY_ACCEPTED" | "INVALID_RESET_TOKEN" | "INVALID_EMAIL_CHANGE_TOKEN" | "INVALID_CREDENTIALS" | "REFRESH_TOKEN_REQUIRED" | "REGISTRATION_CLOSED" | "ENCRYPTION_NOT_CONFIGURED" | "MAIL_TEST_FAILED" | "PLUGIN_NOT_FOUND" | "PLUGIN_CONFIG_VALIDATION_FAILED";
+                    message: string;
+                    details?: any;
+                };
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                query: {
+                    token: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "INTERNAL_ERROR";
+                    message: "Internal server error";
+                };
+            };
+            outputFormat: "json";
+            status: 500;
+        };
+    };
+} & {
+    "/auth/confirm-email-change": {
+        $post: {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                ok: true;
+                email: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED" | "ADMIN_REQUIRED" | "USER_REGISTERED" | "USER_SUSPENDED" | "USER_INVITED" | "INTERNAL_ERROR" | "THIRD_PARTY_AUTH_REQUIRED" | "USER_NOT_ACTIVE" | "EMAIL_NOT_CONFIRMED" | "VALIDATION_ERROR" | "INVALID_REQUEST" | "NOT_FOUND" | "CONFLICT" | "SERVICE_UNAVAILABLE" | "APPLICATION_NOT_INSTALLED" | "INVALID_PAGE_ID" | "PAGE_NOT_FOUND" | "PAGE_NOT_GRANTED" | "PAGE_REVISION_ERROR" | "INVALID_GRANT" | "COMMENT_NOT_FOUND" | "NOTIFICATION_NOT_FOUND" | "USER_NOT_FOUND" | "USER_EXISTS" | "USERNAME_TAKEN" | "EMAIL_TAKEN" | "EMAIL_NOT_ALLOWED" | "INVALID_ACTIVATION_TOKEN" | "INVALID_INVITE_TOKEN" | "INVITE_ALREADY_ACCEPTED" | "INVALID_RESET_TOKEN" | "INVALID_EMAIL_CHANGE_TOKEN" | "INVALID_CREDENTIALS" | "REFRESH_TOKEN_REQUIRED" | "REGISTRATION_CLOSED" | "ENCRYPTION_NOT_CONFIGURED" | "MAIL_TEST_FAILED" | "PLUGIN_NOT_FOUND" | "PLUGIN_CONFIG_VALIDATION_FAILED";
+                    message: string;
+                    details?: any;
+                };
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED" | "ADMIN_REQUIRED" | "USER_REGISTERED" | "USER_SUSPENDED" | "USER_INVITED" | "INTERNAL_ERROR" | "THIRD_PARTY_AUTH_REQUIRED" | "USER_NOT_ACTIVE" | "EMAIL_NOT_CONFIRMED" | "VALIDATION_ERROR" | "INVALID_REQUEST" | "NOT_FOUND" | "CONFLICT" | "SERVICE_UNAVAILABLE" | "APPLICATION_NOT_INSTALLED" | "INVALID_PAGE_ID" | "PAGE_NOT_FOUND" | "PAGE_NOT_GRANTED" | "PAGE_REVISION_ERROR" | "INVALID_GRANT" | "COMMENT_NOT_FOUND" | "NOTIFICATION_NOT_FOUND" | "USER_NOT_FOUND" | "USER_EXISTS" | "USERNAME_TAKEN" | "EMAIL_TAKEN" | "EMAIL_NOT_ALLOWED" | "INVALID_ACTIVATION_TOKEN" | "INVALID_INVITE_TOKEN" | "INVITE_ALREADY_ACCEPTED" | "INVALID_RESET_TOKEN" | "INVALID_EMAIL_CHANGE_TOKEN" | "INVALID_CREDENTIALS" | "REFRESH_TOKEN_REQUIRED" | "REGISTRATION_CLOSED" | "ENCRYPTION_NOT_CONFIGURED" | "MAIL_TEST_FAILED" | "PLUGIN_NOT_FOUND" | "PLUGIN_CONFIG_VALIDATION_FAILED";
+                    message: string;
+                    details?: any;
+                };
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "AUTHENTICATION_REQUIRED" | "ADMIN_REQUIRED" | "USER_REGISTERED" | "USER_SUSPENDED" | "USER_INVITED" | "INTERNAL_ERROR" | "THIRD_PARTY_AUTH_REQUIRED" | "USER_NOT_ACTIVE" | "EMAIL_NOT_CONFIRMED" | "VALIDATION_ERROR" | "INVALID_REQUEST" | "NOT_FOUND" | "CONFLICT" | "SERVICE_UNAVAILABLE" | "APPLICATION_NOT_INSTALLED" | "INVALID_PAGE_ID" | "PAGE_NOT_FOUND" | "PAGE_NOT_GRANTED" | "PAGE_REVISION_ERROR" | "INVALID_GRANT" | "COMMENT_NOT_FOUND" | "NOTIFICATION_NOT_FOUND" | "USER_NOT_FOUND" | "USER_EXISTS" | "USERNAME_TAKEN" | "EMAIL_TAKEN" | "EMAIL_NOT_ALLOWED" | "INVALID_ACTIVATION_TOKEN" | "INVALID_INVITE_TOKEN" | "INVITE_ALREADY_ACCEPTED" | "INVALID_RESET_TOKEN" | "INVALID_EMAIL_CHANGE_TOKEN" | "INVALID_CREDENTIALS" | "REFRESH_TOKEN_REQUIRED" | "REGISTRATION_CLOSED" | "ENCRYPTION_NOT_CONFIGURED" | "MAIL_TEST_FAILED" | "PLUGIN_NOT_FOUND" | "PLUGIN_CONFIG_VALIDATION_FAILED";
+                    message: string;
+                    details?: any;
+                };
+            };
+            outputFormat: "json";
+            status: 409;
+        } | {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                error: {
+                    code: "INTERNAL_ERROR";
+                    message: "Internal server error";
+                };
+            };
+            outputFormat: "json";
+            status: 500;
+        };
+    };
+}, "/">;

package/dist/hono/handlers/emailChange.js

@@ -0,0 +1,79 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerEmailChangeRoutes = void 0;
+/**
+ * Public email-change confirmation handler.
+ *
+ *   GET  /auth/confirm-email-change?token= — preflight (token valid?)
+ *   POST /auth/confirm-email-change        — apply the new email address
+ *
+ * The user requests the change via `PUT /me` (which does not apply it);
+ * the signed token (purpose `'email-change'`, payload `email` = new
+ * address) is the credential here, so both routes are public.
+ */
+const api_contract_1 = require("@crowi/api-contract");
+const debug_1 = __importDefault(require("debug"));
+const mail_token_1 = require("../../util/mail-token");
+const map_duplicate_key_error_1 = require("../../util/map-duplicate-key-error");
+const errors_1 = require("./_helpers/errors");
+const debug = (0, debug_1.default)('crowi:hono:handlers:emailChange');
+const INVALID_TOKEN_BODY = {
+    error: { code: 'INVALID_EMAIL_CHANGE_TOKEN', message: 'Email-change link is invalid or expired' },
+};
+const registerEmailChangeRoutes = (app, crowi) => {
+    const User = crowi.model('User');
+    const mailTokenUtil = (0, mail_token_1.createMailTokenUtil)();
+    return app
+        .openapi(api_contract_1.emailChangeRoutes.validateEmailChangeTokenRoute, async (c) => {
+        const { token } = c.req.valid('query');
+        const payload = mailTokenUtil.verifyMailToken(token, 'email-change');
+        if (!payload) {
+            return c.json(INVALID_TOKEN_BODY, 401);
+        }
+        return c.json({ ok: true, email: payload.email }, 200);
+    })
+        .openapi(api_contract_1.emailChangeRoutes.confirmEmailChangeRoute, async (c) => {
+        const { token } = c.req.valid('json');
+        try {
+            const payload = mailTokenUtil.verifyMailToken(token, 'email-change');
+            if (!payload) {
+                return c.json(INVALID_TOKEN_BODY, 401);
+            }
+            const user = await User.findById(payload.userId);
+            if (!user) {
+                return c.json({ error: { code: 'USER_NOT_FOUND', message: 'User no longer exists' } }, 404);
+            }
+            // Single-use binding: the token carries the account's email at
+            // issue time. If the address has since changed (already confirmed
+            // once, or a newer request was made), this token is stale —
+            // reject it so an old link cannot revert the address.
+            if (payload.fromEmail && payload.fromEmail !== user.email) {
+                return c.json(INVALID_TOKEN_BODY, 401);
+            }
+            // The new address may have been claimed by someone else between
+            // the request and the confirmation.
+            const clash = await User.findOne({ email: payload.email });
+            if (clash && clash._id.toString() !== user._id.toString()) {
+                return c.json({ error: { code: 'EMAIL_TAKEN', message: 'That email address is already in use' } }, 409);
+            }
+            user.email = payload.email;
+            await user.save();
+            return c.json({ ok: true, email: user.email }, 200);
+        }
+        catch (error) {
+            // The email findOne pre-check can be raced; the unique index is the
+            // final defence. Map its E11000 to the same 409 the pre-check returns.
+            const duplicateCode = (0, map_duplicate_key_error_1.mapDuplicateKeyError)(error);
+            if (duplicateCode === 'EMAIL_TAKEN') {
+                return c.json({ error: { code: 'EMAIL_TAKEN', message: 'That email address is already in use' } }, 409);
+            }
+            debug('email-change confirmation error:', error);
+            return c.json(errors_1.INTERNAL_ERROR_BODY, 500);
+        }
+    });
+};
+exports.registerEmailChangeRoutes = registerEmailChangeRoutes;
+//# sourceMappingURL=emailChange.js.map

package/dist/hono/handlers/emailChange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailChange.js","sourceRoot":"","sources":["../../../src/hono/handlers/emailChange.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;;GASG;AACH,sDAAwD;AAExD,kDAA0B;AAG1B,oDAA0D;AAC1D,8EAAwE;AAIxE,8CAAwD;AAExD,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,iCAAiC,CAAC,CAAC;AAEvD,MAAM,kBAAkB,GAAG;IACzB,KAAK,EAAE,EAAE,IAAI,EAAE,4BAAqC,EAAE,OAAO,EAAE,yCAAkD,EAAE;CACpH,CAAC;AAEK,MAAM,yBAAyB,GAAG,CAA2C,GAAM,EAAE,KAAY,EAAE,EAAE;IAC1G,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,IAAA,gCAAmB,GAAE,CAAC;IAE5C,OAAO,GAAG;SACP,OAAO,CAAC,gCAAiB,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,aAAa,CAAC,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC,CAAC;SACD,OAAO,CAAC,gCAAiB,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAyB,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACvG,CAAC;YAED,+DAA+D;YAC/D,kEAAkE;YAClE,4DAA4D;YAC5D,sDAAsD;YACtD,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YAED,gEAAgE;YAChE,oCAAoC;YACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3D,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAsB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACnH,CAAC;YAED,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAElB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,uEAAuE;YACvE,MAAM,aAAa,GAAG,IAAA,8CAAoB,EAAC,KAAK,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;gBACpC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAsB,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACnH,CAAC;YACD,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,4BAAmB,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AAzDW,QAAA,yBAAyB,6BAyDpC"}

package/dist/hono/handlers/installer.d.ts

@@ -0,0 +1,94 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type Crowi from '../../crowi';
+import type { ConfigModel } from '../../models/config';
+import type { CrowiHonoBindings } from '../app';
+/**
+ * The ConfigService keeps a boot-time snapshot of all Config docs in
+ * memory, but `Config.applicationInstall()` writes new docs without
+ * refreshing it — so `crowi.getConfig().crowi` is unreliable as an
+ * installed-state oracle. Always count from the DB instead, and
+ * refresh the cache after a successful install so other request paths
+ * see the new values without a server restart.
+ */
+export declare const isAppInstalled: (Config: ConfigModel) => Promise<boolean>;
+export declare const registerInstallerRoutes: <E extends OpenAPIHono<CrowiHonoBindings>>(app: E, crowi: Crowi) => OpenAPIHono<CrowiHonoBindings, {
+    "/installer": {
+        $get: {
+            input: {};
+            output: {
+                status: "installer_required" | "already_installed";
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {};
+            output: {
+                error: {
+                    code: "INTERNAL_ERROR";
+                    message: "Internal server error";
+                };
+            };
+            outputFormat: "json";
+            status: 500;
+        };
+    };
+} & {
+    "/installer/createAdmin": {
+        $post: {
+            input: {
+                json: {
+                    registerForm: {
+                        username: string;
+                        name: string;
+                        email: string;
+                        password: string;
+                    };
+                };
+            };
+            output: {
+                status: "error" | "ok";
+                message?: string | undefined;
+                errors?: string[] | undefined;
+            };
+            outputFormat: "json";
+            status: 200;
+        } | {
+            input: {
+                json: {
+                    registerForm: {
+                        username: string;
+                        name: string;
+                        email: string;
+                        password: string;
+                    };
+                };
+            };
+            output: {
+                status: "error" | "ok";
+                message?: string | undefined;
+                errors?: string[] | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    registerForm: {
+                        username: string;
+                        name: string;
+                        email: string;
+                        password: string;
+                    };
+                };
+            };
+            output: {
+                error: {
+                    code: "INTERNAL_ERROR";
+                    message: "Internal server error";
+                };
+            };
+            outputFormat: "json";
+            status: 500;
+        };
+    };
+}, "/">;