@easy-cms/core 0.26.0 → 0.28.0

package/dist/index.d.ts

@@ -879,6 +879,12 @@ declare class EasyCMS<C extends Config = Config> {
         data: Uint8Array;
         name: string;
     }, data?: Record<string, unknown>, options?: DepthOptions): Promise<MediaDocument>;
+    /**
+     * Downloads a file from an `http(s)` link and uploads it like `upload()`. Private network
+     * addresses are refused unless `upload.fromURL.allowPrivate`. Calls on behalf of a user (the
+     * REST API, `overrideAccess: false`) also need `upload.fromURL` and a host in its `allowedHosts`.
+     */
+    uploadFromURL(url: string, data?: Record<string, unknown>, options?: DepthOptions): Promise<MediaDocument>;
     /**
      * Creates an API key (needs `apiKeys: true`) and returns it once: only a hash is stored.
      * With access enforced the key belongs to `user`; trusted calls name the owner in `data.user`.
@@ -1526,7 +1532,7 @@ interface GlobalConfig {
 }
 type AdminLocale = 'en' | 'th';
 /** Icons a collection or global can show in the admin menu ([Lucide](https://lucide.dev) names). */
-declare const ADMIN_ICONS: readonly ["file-text", "newspaper", "book-open", "notebook", "folder", "tag", "tags", "image", "images", "video", "music", "file", "users", "user", "building", "store", "shopping-bag", "shopping-cart", "package", "box", "calendar", "calendar-days", "map-pin", "globe", "house", "layout-grid", "layers", "star", "heart", "message-square", "mail", "phone", "briefcase", "graduation-cap", "utensils", "car", "settings", "sliders-horizontal", "palette", "megaphone", "bell", "link", "quote", "circle-help", "award", "ticket", "camera", "key"];
+declare const ADMIN_ICONS: readonly ["file-text", "newspaper", "book-open", "notebook", "folder", "tag", "tags", "image", "images", "video", "music", "file", "users", "user", "building", "store", "shopping-bag", "shopping-cart", "package", "box", "calendar", "calendar-days", "map-pin", "globe", "house", "layout-grid", "layers", "star", "heart", "message-square", "mail", "phone", "briefcase", "graduation-cap", "utensils", "car", "settings", "sliders-horizontal", "palette", "megaphone", "bell", "link", "quote", "circle-help", "award", "ticket", "camera", "key", "chart-column", "chart-line"];
 type AdminIcon = (typeof ADMIN_ICONS)[number];
 /** Your or your client's brand in the admin UI. */
 interface AdminBrand {
@@ -1537,6 +1543,34 @@ interface AdminBrand {
     /** Main color as `#rrggbb`; lighter and darker shades are derived from it. */
     readonly color?: string;
 }
+/** Who may see an admin page or dashboard widget. Default: every logged-in user. */
+type AdminViewAccess = (args: {
+    readonly user: AuthUser;
+}) => boolean | Promise<boolean>;
+/** A page of its own in the admin, e.g. a plugin's report, at `<admin>/p/<path>`. */
+interface AdminPage {
+    /** Its address under `<admin>/p/`: lowercase letters, digits and `-`, e.g. `forms-overview`. */
+    readonly path: string;
+    /** The page's body: a Web Component from an admin module. The admin draws the header. */
+    readonly component: AdminComponent;
+    /** Its title in the header and the menu. */
+    readonly label: Label;
+    /** Icon in the admin menu. Default `file-text`. */
+    readonly icon?: AdminIcon;
+    /** Listed under Content (default) or Settings in the menu, or not listed (`false`): reached by links. */
+    readonly group?: 'content' | 'settings' | false;
+    /** Who may open it. Pages a user may not open are left out of their admin. */
+    readonly access?: AdminViewAccess;
+}
+/** A panel on the admin's dashboard, after the built-in ones. */
+interface DashboardWidget {
+    /** A Web Component from an admin module. */
+    readonly component: AdminComponent;
+    /** `half` (default): the side column, beside drafts and recent edits; `full`: below both. */
+    readonly width?: 'half' | 'full';
+    /** Who sees it. */
+    readonly access?: AdminViewAccess;
+}
 interface AdminConfig {
     /** Where the admin UI is served. Default `/admin`. */
     readonly path?: string;
@@ -1562,6 +1596,10 @@ interface AdminConfig {
      * module file. Remote URLs are not allowed.
      */
     readonly modules?: readonly string[];
+    /** Pages of their own, e.g. from plugins, at `<admin>/p/<path>`. */
+    readonly pages?: readonly AdminPage[];
+    /** Panels on the dashboard, after the built-in ones. */
+    readonly dashboard?: readonly DashboardWidget[];
 }
 interface ImageSize {
     /** Key in `media.sizes`, e.g. `thumbnail`. */
@@ -1571,6 +1609,22 @@ interface ImageSize {
     /** How to fit when both width and height are set. Default `cover`. */
     readonly fit?: 'cover' | 'contain' | 'inside';
 }
+/**
+ * Uploads from a link: the server downloads the file (`cms.uploadFromURL`, `POST <api>/media`
+ * with `{ url }`, "From a link" in the admin).
+ */
+interface UploadFromURLConfig {
+    /**
+     * Hosts files may come from: `images.example.com`, `*.example.com` (its subdomains, not
+     * `example.com` itself) or `*` for any public host. Checked at every redirect too.
+     */
+    readonly allowedHosts: readonly string[];
+    /**
+     * Also download from private network addresses (`10.x`, `192.168.x`, `localhost`…), e.g. an
+     * intranet. Off by default: links could then reach services that are not meant to be public.
+     */
+    readonly allowPrivate?: boolean;
+}
 interface UploadConfig {
     /** Directory for uploaded files with the default local storage, relative to the project root. Default `uploads`. */
     readonly dir?: string;
@@ -1582,6 +1636,8 @@ interface UploadConfig {
     readonly storage?: StorageAdapter;
     /** Resized copies generated for images when `sharp` is installed. */
     readonly imageSizes?: readonly ImageSize[];
+    /** Lets users upload from a link. Off by default. */
+    readonly fromURL?: UploadFromURLConfig;
 }
 interface RoutesConfig {
     /** Where the REST API is served. Default `/api/cms`. */
@@ -1768,7 +1824,7 @@ interface ResolvedConfig extends Omit<Config, 'cors' | 'localization' | 'routes'
     readonly localization: Required<LocalizationConfig> | null;
     readonly routes: Required<RoutesConfig>;
     readonly admin: Required<AdminConfig>;
-    readonly upload: Required<Omit<UploadConfig, 'storage'>> & Pick<UploadConfig, 'storage'>;
+    readonly upload: Required<Omit<UploadConfig, 'storage' | 'fromURL'>> & Pick<UploadConfig, 'storage' | 'fromURL'>;
     readonly auth: Required<AuthConfig>;
     readonly collections: readonly CollectionConfig[];
     readonly globals: readonly GlobalConfig[];
@@ -2069,6 +2125,20 @@ interface AdminGlobal {
         update: boolean;
     };
 }
+/** A page of its own in the admin (`admin.pages`) that this user may open. */
+interface AdminPageRef {
+    path: string;
+    label: Label;
+    icon?: string;
+    /** Where it is listed in the menu; `false`: not listed. */
+    group: 'content' | 'settings' | false;
+    component: AdminComponentRef;
+}
+/** A dashboard panel (`admin.dashboard`) this user may see. */
+interface AdminWidgetRef {
+    component: AdminComponentRef;
+    width: 'half' | 'full';
+}
 interface AdminSchema {
     locale: AdminLocale;
     /** Admins can email users links to set their password (needs `email` and `serverURL`). */
@@ -2084,6 +2154,12 @@ interface AdminSchema {
     globals: AdminGlobal[];
     /** URLs under the API of the admin modules to load (`admin.modules`). */
     modules: string[];
+    /** Files can be uploaded from links (`upload.fromURL`). */
+    uploadFromURL: boolean;
+    /** Pages this user may open (`admin.pages`). */
+    pages: AdminPageRef[];
+    /** Dashboard panels this user may see (`admin.dashboard`). */
+    dashboard: AdminWidgetRef[];
 }
 
 declare const SESSION_COOKIE = "ecms-session";
@@ -2121,4 +2197,4 @@ declare const BUILTIN_COLLECTIONS: readonly ["users", "media"];
 /** Checks a config and returns every problem found. An empty array means it is valid. */
 declare function validateConfig(config: Config): ConfigIssue[];
 
-export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminSchema, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthUser, BUILTIN_COLLECTIONS, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailField, type EmailMessage, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoutesConfig, SESSION_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword };
+export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminSchema, type AdminViewAccess, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthUser, BUILTIN_COLLECTIONS, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailField, type EmailMessage, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoutesConfig, SESSION_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword };

package/dist/index.js

@@ -271,22 +271,22 @@ var FieldAccessChecker = class {
     return allowed2;
   }
 };
-async function stripFields(fields, doc, read) {
+async function stripFields(fields, doc, read2) {
   const result = { ...doc };
   for (const field of fields) {
     if (!(field.name in result)) continue;
-    if (field.hidden || read && !await read.allows(field)) {
+    if (field.hidden || read2 && !await read2.allows(field)) {
       delete result[field.name];
       continue;
     }
     const value = result[field.name];
     if (field.type === "group" && value && typeof value === "object") {
-      result[field.name] = await stripFields(field.fields, value, read);
+      result[field.name] = await stripFields(field.fields, value, read2);
     } else if (hasRows(field) && Array.isArray(value)) {
       result[field.name] = await Promise.all(
         value.map((row) => {
           const fields2 = rowFields(field, row);
-          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read) : row;
+          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read2) : row;
         })
       );
     }
@@ -1138,7 +1138,9 @@ var ADMIN_ICONS = [
   "award",
   "ticket",
   "camera",
-  "key"
+  "key",
+  "chart-column",
+  "chart-line"
 ];
 function definePlugin(plugin) {
   return plugin;
@@ -1742,7 +1744,7 @@ function applyFieldTypes(config) {
     const problem = type.checkOptions?.(own);
     if (problem) issues.push({ path: here, message: problem });
     const ownValidate = own.validate;
-    const check = type.validate;
+    const check2 = type.validate;
     const admin = own.admin ?? {};
     const input = admin.component ?? component(type.admin?.component, own, type.admin?.props);
     const cell = admin.cell ?? component(type.admin?.cell, own, type.admin?.props);
@@ -1750,11 +1752,11 @@ function applyFieldTypes(config) {
       ...own,
       type: type.base,
       customType: type.name,
-      ...check || ownValidate ? {
+      ...check2 || ownValidate ? {
         validate: async (value, ctx) => {
           const empty = value === null || value === void 0 || value === "";
-          if (check && !empty) {
-            const result = await check(value, { ...ctx, field: own });
+          if (check2 && !empty) {
+            const result = await check2(value, { ...ctx, field: own });
             if (result !== true) return result;
           }
           return ownValidate ? ownValidate(value, ctx) : true;
@@ -1994,6 +1996,7 @@ function validateConfig(config) {
     add("db", "is required", "pass a database adapter, e.g. db: sqlite({ url: 'file:./cms.db' })");
   }
   validateAdmin(config, add);
+  validateAdminViews(config, add);
   validateUpload(config, add);
   validateAuth(config, add);
   validateCors(config.cors, add);
@@ -2114,6 +2117,83 @@ function validateAdmin(config, add) {
     add("admin.brand.color", `must be a hex color like "#0f766e" (got ${JSON.stringify(color)})`);
   }
 }
+var PAGE_PATH = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+function validateAdminViews(config, add) {
+  const access = (value, path) => {
+    if (value !== void 0 && typeof value !== "function")
+      add(
+        `${path}.access`,
+        "must be a function",
+        'e.g. access: ({ user }) => user.role === "admin"'
+      );
+  };
+  const pages2 = config.admin?.pages;
+  if (pages2 !== void 0) {
+    if (!Array.isArray(pages2)) {
+      add(
+        "admin.pages",
+        "must be an array",
+        "e.g. pages: [{ path: 'stats', label: 'Stats', component: 'ecms-stats' }]"
+      );
+    } else {
+      const seen = /* @__PURE__ */ new Set();
+      pages2.forEach((page, i) => {
+        const path = `admin.pages[${i}]`;
+        if (typeof page !== "object" || page === null) {
+          add(path, "must be an object");
+          return;
+        }
+        const p = page;
+        if (typeof p.path !== "string" || !PAGE_PATH.test(p.path)) {
+          add(
+            `${path}.path`,
+            `must be lowercase letters, digits and "-" (got ${JSON.stringify(p.path)})`,
+            "e.g. path: 'forms-overview'"
+          );
+        } else if (seen.has(p.path)) {
+          add(`${path}.path`, `"${p.path}" is used by another page`);
+        } else {
+          seen.add(p.path);
+        }
+        validateComponent(p.component, `${path}.component`, add);
+        const label = p.label;
+        if (!(typeof label === "string" && label.trim() !== "") && !(typeof label === "object" && label !== null && !Array.isArray(label)))
+          add(
+            `${path}.label`,
+            "must be a string or { en, th }",
+            "e.g. label: { en: 'Stats', th: '\u0E2A\u0E16\u0E34\u0E15\u0E34' }"
+          );
+        validateIcon(p, path, add);
+        if (p.group !== void 0 && p.group !== "content" && p.group !== "settings" && p.group !== false)
+          add(`${path}.group`, 'must be "content", "settings" or false');
+        access(p.access, path);
+      });
+    }
+  }
+  const widgets2 = config.admin?.dashboard;
+  if (widgets2 !== void 0) {
+    if (!Array.isArray(widgets2)) {
+      add(
+        "admin.dashboard",
+        "must be an array",
+        "e.g. dashboard: [{ component: 'ecms-stats-widget' }]"
+      );
+    } else {
+      widgets2.forEach((widget, i) => {
+        const path = `admin.dashboard[${i}]`;
+        if (typeof widget !== "object" || widget === null) {
+          add(path, "must be an object");
+          return;
+        }
+        const w = widget;
+        validateComponent(w.component, `${path}.component`, add);
+        if (w.width !== void 0 && w.width !== "half" && w.width !== "full")
+          add(`${path}.width`, 'must be "half" or "full"');
+        access(w.access, path);
+      });
+    }
+  }
+}
 function validateIcon(container, path, add) {
   const icon = container.icon;
   if (icon === void 0 || ADMIN_ICONS.includes(icon)) return;
@@ -2308,7 +2388,32 @@ function validateUpload(config, add) {
   if (upload.dir !== void 0 && (typeof upload.dir !== "string" || upload.dir.length === 0)) {
     add("upload.dir", "must be a non-empty string");
   }
+  const fromURL = upload.fromURL;
+  if (fromURL === void 0) return;
+  if (typeof fromURL !== "object" || fromURL === null) {
+    add("upload.fromURL", "must be an object", "e.g. fromURL: { allowedHosts: ['*'] }");
+    return;
+  }
+  const { allowedHosts, allowPrivate } = fromURL;
+  if (!Array.isArray(allowedHosts) || allowedHosts.length === 0) {
+    add(
+      "upload.fromURL.allowedHosts",
+      "must be a non-empty array of host names",
+      "e.g. allowedHosts: ['images.example.com', '*.cdn.example.com'] or ['*'] for any public host"
+    );
+  } else {
+    allowedHosts.forEach((host, i) => {
+      if (typeof host !== "string" || !HOST_PATTERN.test(host))
+        add(
+          `upload.fromURL.allowedHosts[${i}]`,
+          `must be a host name like "images.example.com", "*.example.com" or "*" (got ${JSON.stringify(host)})`
+        );
+    });
+  }
+  if (allowPrivate !== void 0 && typeof allowPrivate !== "boolean")
+    add("upload.fromURL.allowPrivate", "must be true or false");
 }
+var HOST_PATTERN = /^(\*|(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*)$/i;
 function asArray(value, path, add) {
   if (value === void 0) return [];
   if (!Array.isArray(value)) {
@@ -2751,14 +2856,17 @@ async function resolveConfig(input) {
       brand: config.admin?.brand ?? {},
       siteUrl: config.admin?.siteUrl ?? "",
       menu: config.admin?.menu ?? [],
-      modules: config.admin?.modules ?? []
+      modules: config.admin?.modules ?? [],
+      pages: config.admin?.pages ?? [],
+      dashboard: config.admin?.dashboard ?? []
     },
     upload: {
       dir: config.upload?.dir ?? "uploads",
       maxFileSize: config.upload?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,
       mimeTypes: config.upload?.mimeTypes ?? ["image/*", "application/pdf"],
       imageSizes: config.upload?.imageSizes ?? [],
-      ...config.upload?.storage ? { storage: config.upload.storage } : {}
+      ...config.upload?.storage ? { storage: config.upload.storage } : {},
+      ...config.upload?.fromURL ? { fromURL: config.upload.fromURL } : {}
     },
     auth: {
       roles: config.auth?.roles ?? DEFAULT_ROLES,
@@ -3113,6 +3221,212 @@ function collectSlots(fields, data, bySlug, slots) {
   }
 }
 
+// src/remote-file.ts
+import { lookup as dnsLookup } from "dns";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { BlockList, isIP } from "net";
+var RemoteFileError = class extends Error {
+  /** `413` when the file is too large, otherwise `400`. */
+  status;
+  constructor(message, status = 400) {
+    super(message);
+    this.name = "RemoteFileError";
+    this.status = status;
+  }
+};
+var PRIVATE = new BlockList();
+for (const [net, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+])
+  PRIVATE.addSubnet(net, prefix, "ipv4");
+for (const [net, prefix] of [
+  ["::", 128],
+  ["::1", 128],
+  ["64:ff9b:1::", 48],
+  ["100::", 64],
+  ["2001:db8::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["ff00::", 8]
+])
+  PRIVATE.addSubnet(net, prefix, "ipv6");
+function isPrivateAddress(address) {
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
+  if (mapped?.[1]) return PRIVATE.check(mapped[1], "ipv4");
+  const family = isIP(address);
+  if (family === 4) return PRIVATE.check(address, "ipv4");
+  if (family === 6) return PRIVATE.check(address, "ipv6");
+  return true;
+}
+function hostAllowed(host, allowedHosts) {
+  const name = host.toLowerCase().replace(/\.$/, "");
+  return allowedHosts.some((rule) => {
+    const pattern = rule.toLowerCase();
+    if (pattern === "*") return true;
+    if (pattern.startsWith("*.")) return name.endsWith(pattern.slice(1));
+    return name === pattern;
+  });
+}
+function guardedLookup(allowPrivate) {
+  return (hostname, options, callback) => {
+    dnsLookup(hostname, { ...options, all: true }, (error, addresses) => {
+      if (error) return callback(error, "", 4);
+      const usable = allowPrivate ? addresses : addresses.filter((a) => !isPrivateAddress(a.address));
+      if (usable.length === 0) {
+        const blocked = new Error(`${hostname} points to a private network address`);
+        blocked.code = "ECMS_PRIVATE";
+        return callback(blocked, "", 4);
+      }
+      if (options.all) return callback(null, usable, 4);
+      const first = usable[0];
+      callback(null, first.address, first.family);
+    });
+  };
+}
+function remoteFileName(url, disposition) {
+  if (disposition) {
+    const star = /filename\*\s*=\s*(?:UTF-8|utf-8)''([^;]+)/.exec(disposition);
+    if (star?.[1]) {
+      try {
+        return clean(decodeURIComponent(star[1].trim()));
+      } catch {
+      }
+    }
+    const plain = /filename\s*=\s*"?([^";]+)"?/.exec(disposition);
+    if (plain?.[1]) return clean(plain[1].trim());
+  }
+  const last = url.pathname.split("/").filter(Boolean).pop();
+  if (last) {
+    try {
+      return clean(decodeURIComponent(last));
+    } catch {
+      return clean(last);
+    }
+  }
+  return "download";
+}
+var clean = (name) => name.replace(/[\\/]/g, "_").slice(0, 200) || "download";
+async function fetchRemoteFile(link, options) {
+  let url;
+  try {
+    url = new URL(link);
+  } catch {
+    throw new RemoteFileError("must be an http(s) link");
+  }
+  const deadline = Date.now() + (options.timeout ?? 15e3);
+  const maxRedirects = options.maxRedirects ?? 3;
+  for (let redirects = 0; ; redirects++) {
+    check(url, options);
+    const response = await get(url, options, deadline);
+    const status = response.statusCode ?? 0;
+    if (status >= 300 && status < 400 && response.headers.location) {
+      response.resume();
+      if (redirects >= maxRedirects) throw new RemoteFileError("redirects too many times");
+      url = new URL(response.headers.location, url);
+      continue;
+    }
+    if (status < 200 || status >= 300) {
+      response.resume();
+      throw new RemoteFileError(`could not be downloaded (HTTP ${status})`);
+    }
+    const data = await read(response, options.maxBytes, deadline);
+    const contentType = response.headers["content-type"];
+    return {
+      data,
+      name: remoteFileName(url, response.headers["content-disposition"]),
+      ...contentType ? { contentType } : {}
+    };
+  }
+}
+function check(url, options) {
+  if (url.protocol !== "http:" && url.protocol !== "https:")
+    throw new RemoteFileError("must be an http(s) link");
+  if (url.username || url.password) throw new RemoteFileError("must not contain a password");
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  if (options.allowedHosts && !hostAllowed(host, options.allowedHosts))
+    throw new RemoteFileError(`${host} is not an allowed host`);
+  if (!options.allowPrivate && isIP(host) && isPrivateAddress(host))
+    throw new RemoteFileError(`${host} is a private network address`);
+}
+function get(url, options, deadline) {
+  const request = url.protocol === "https:" ? httpsRequest : httpRequest;
+  return new Promise((resolve3, reject) => {
+    const req = request(url, {
+      method: "GET",
+      lookup: guardedLookup(options.allowPrivate === true),
+      headers: {
+        "user-agent": options.userAgent ?? "EasyCMS",
+        accept: "*/*"
+      }
+    });
+    const timer = setTimeout(
+      () => req.destroy(new RemoteFileError("took too long to download")),
+      Math.max(0, deadline - Date.now())
+    );
+    req.on("response", (response) => {
+      clearTimeout(timer);
+      resolve3(response);
+    });
+    req.on("error", (error) => {
+      clearTimeout(timer);
+      if (error instanceof RemoteFileError) reject(error);
+      else if (error.code === "ECMS_PRIVATE")
+        reject(new RemoteFileError(`${url.hostname} points to a private network address`));
+      else if (error.code === "ENOTFOUND" || error.code === "EAI_AGAIN")
+        reject(new RemoteFileError(`${url.hostname} was not found`));
+      else reject(new RemoteFileError("could not be downloaded"));
+    });
+    req.end();
+  });
+}
+function read(response, maxBytes, deadline) {
+  const declared = Number(response.headers["content-length"]);
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    response.destroy();
+    return Promise.reject(new RemoteFileError(`is larger than ${maxBytes} bytes`, 413));
+  }
+  return new Promise((resolve3, reject) => {
+    const chunks = [];
+    let size = 0;
+    const timer = setTimeout(
+      () => response.destroy(new RemoteFileError("took too long to download")),
+      Math.max(0, deadline - Date.now())
+    );
+    response.on("data", (chunk) => {
+      size += chunk.byteLength;
+      if (size > maxBytes) {
+        response.destroy(new RemoteFileError(`is larger than ${maxBytes} bytes`, 413));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    response.on("end", () => {
+      clearTimeout(timer);
+      resolve3(new Uint8Array(Buffer.concat(chunks)));
+    });
+    response.on("error", (error) => {
+      clearTimeout(timer);
+      reject(
+        error instanceof RemoteFileError ? error : new RemoteFileError("could not be downloaded")
+      );
+    });
+  });
+}
+
 // src/storage.ts
 import { mkdir, readFile, rm, stat, writeFile } from "fs/promises";
 import { dirname, isAbsolute, join, normalize, resolve as resolve2, sep } from "path";
@@ -3475,6 +3789,39 @@ var EasyCMS = class {
       throw error;
     }
   }
+  /**
+   * Downloads a file from an `http(s)` link and uploads it like `upload()`. Private network
+   * addresses are refused unless `upload.fromURL.allowPrivate`. Calls on behalf of a user (the
+   * REST API, `overrideAccess: false`) also need `upload.fromURL` and a host in its `allowedHosts`.
+   */
+  async uploadFromURL(url, data = {}, options = {}) {
+    const config = this.collection(MEDIA);
+    const guard = guardOf(options);
+    const fromURL = this.config.upload.fromURL;
+    if (guard.enforce) {
+      this.checkKey(guard, { collection: MEDIA }, "create");
+      const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
+      if (allowed2 !== true) throw deny(guard.user);
+      if (!fromURL)
+        throw new ValidationError(MEDIA, [
+          { field: "url", message: "uploads from links are off (upload.fromURL)" }
+        ]);
+    }
+    let file;
+    try {
+      file = await fetchRemoteFile(url, {
+        allowedHosts: guard.enforce ? fromURL?.allowedHosts : void 0,
+        allowPrivate: fromURL?.allowPrivate === true,
+        maxBytes: this.config.upload.maxFileSize,
+        userAgent: "EasyCMS (+https://github.com/maritonx/easy-cms)"
+      });
+    } catch (error) {
+      if (!(error instanceof RemoteFileError)) throw error;
+      if (error.status === 413) throw new PayloadTooLargeError(`File ${error.message}`);
+      throw new ValidationError(MEDIA, [{ field: "url", message: error.message }]);
+    }
+    return this.upload(file, data, options);
+  }
   /**
    * Creates an API key (needs `apiKeys: true`) and returns it once: only a hash is stored.
    * With access enforced the key belongs to `user`; trusted calls name the owner in `data.user`.
@@ -3684,7 +4031,7 @@ var EasyCMS = class {
   /** Coerces preview input like a save would, keeping values that would fail validation. */
   async previewDoc(config, data, system2, options = {}) {
     const locale = this.localeOf(options);
-    const { data: clean } = await validateFields(config.fields, data, {
+    const { data: clean2 } = await validateFields(config.fields, data, {
       operation: "update",
       root: data,
       skipRequired: true,
@@ -3693,7 +4040,7 @@ var EasyCMS = class {
     });
     return {
       ...data,
-      ...clean,
+      ...clean2,
       ...config.drafts ? { status: data.status } : {},
       ...system2,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -3982,14 +4329,14 @@ var EasyCMS = class {
     const parsed = parseId(id);
     if (parsed === void 0) return { update: false, delete: false };
     const guard = { enforce: true, user };
-    const check = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
+    const check2 = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
       () => true,
       (error) => {
         if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return false;
         throw error;
       }
     );
-    return { update: await check("update"), delete: await check("delete") };
+    return { update: await check2("update"), delete: await check2("delete") };
   }
   /** Closes the database connection. */
   /**
@@ -4363,7 +4710,7 @@ var EasyCMS = class {
   }
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
   async output(config, docs, guard, options) {
-    const read = this.fieldChecker("read", guard, void 0, void 0);
+    const read2 = this.fieldChecker("read", guard, void 0, void 0);
     const finish = async (target, doc) => {
       const hooked = await this.transform(
         target.hooks?.afterRead,
@@ -4371,7 +4718,7 @@ var EasyCMS = class {
         this.hookArgs(target, guard),
         doc
       );
-      return await stripFields(target.fields, hooked, read);
+      return await stripFields(target.fields, hooked, read2);
     };
     const load = async (target, ids) => {
       const where = await this.readWhere(target, guard, { id: { in: [...ids] } }).catch((error) => {
@@ -4614,24 +4961,24 @@ var EasyCMS = class {
       ...locale !== void 0 && locale !== ALL_LOCALES ? { locale } : {}
     });
     const errors = [...result.errors];
-    const clean = { ...result.data };
+    const clean2 = { ...result.data };
     if (config.drafts) {
       const status = data.status ?? "draft";
       if (status !== "draft" && status !== "published") {
         errors.push({ field: "status", message: 'must be "draft" or "published"' });
       }
-      clean.status = status;
+      clean2.status = status;
     }
     const isCollection = this.config.collections.includes(config);
     if (isCollection && errors.length === 0) {
-      await this.makeSlugsUnique(config, clean, selfId);
-      errors.push(...await this.checkUnique(config, clean, selfId));
+      await this.makeSlugsUnique(config, clean2, selfId);
+      errors.push(...await this.checkUnique(config, clean2, selfId));
     }
     errors.push(...await this.checkReferences(result.references));
     if (errors.length === 0)
       errors.push(...await this.checkFilterOptions(result.references, selfId, user));
     if (errors.length > 0) throw new ValidationError(config.slug, errors);
-    return clean;
+    return clean2;
   }
   /** Refuses changes that would leave no active admin (and lock everyone out). */
   async guardLastAdmin(id, before, after) {
@@ -5001,9 +5348,42 @@ async function adminSchema(cms, user, origin) {
     localization: localization ? { locales: [...localization.locales], defaultLocale: localization.defaultLocale } : null,
     collections: await Promise.all(collections.map((c) => collection(c, user, localized))),
     globals: await Promise.all(cms.config.globals.map((g) => global(g, user, localized))),
-    modules: adminModuleUrls(cms)
+    modules: adminModuleUrls(cms),
+    uploadFromURL: cms.config.upload.fromURL !== void 0,
+    pages: await pages(cms, user),
+    dashboard: await widgets(cms, user)
   };
 }
+async function shown(access, user) {
+  if (!access) return true;
+  try {
+    return await access({ user }) === true;
+  } catch {
+    return false;
+  }
+}
+async function pages(cms, user) {
+  const out = [];
+  for (const page of cms.config.admin.pages) {
+    if (!await shown(page.access, user)) continue;
+    out.push({
+      path: page.path,
+      label: page.label,
+      ...page.icon ? { icon: page.icon } : {},
+      group: page.group ?? "content",
+      component: componentRef(page.component)
+    });
+  }
+  return out;
+}
+async function widgets(cms, user) {
+  const out = [];
+  for (const widget of cms.config.admin.dashboard) {
+    if (!await shown(widget.access, user)) continue;
+    out.push({ component: componentRef(widget.component), width: widget.width ?? "half" });
+  }
+  return out;
+}
 
 // src/rest/filter-options.ts
 function fieldAt(fields, path) {
@@ -5431,6 +5811,15 @@ async function route(cms, ctx, method, segments, options) {
     return { body: await serveFile(cms, third, method === "HEAD") };
   }
   if (first === MEDIA && second === void 0 && method === "POST") {
+    if ((ctx.request.headers.get("content-type") ?? "").toLowerCase().startsWith("application/json")) {
+      const { url, ...data2 } = await readJson(ctx.request);
+      if (typeof url !== "string" || url === "")
+        throw new ValidationError(MEDIA, [{ field: "url", message: "is required" }]);
+      return {
+        status: 201,
+        body: await cms.uploadFromURL(url, data2, { ...access, ...parseDepth(ctx.url) })
+      };
+    }
     const { file, data } = await readUpload(ctx.request, cms.config.upload.maxFileSize);
     return {
       status: 201,
@@ -5707,7 +6096,10 @@ async function serveFile(cms, key2, head) {
 async function readUpload(request, maxFileSize) {
   const type = request.headers.get("content-type") ?? "";
   if (!type.toLowerCase().startsWith("multipart/form-data")) {
-    throw new HttpError('Uploads must be multipart/form-data with a "file" field', 415);
+    throw new HttpError(
+      'Uploads must be multipart/form-data with a "file" field, or JSON with a "url"',
+      415
+    );
   }
   const declared = Number(request.headers.get("content-length") ?? 0);
   if (declared > maxFileSize + 64 * 1024)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",