@easy-cms/core 0.27.0 → 0.28.0

package/dist/index.d.ts

@@ -879,6 +879,12 @@ declare class EasyCMS<C extends Config = Config> {
         data: Uint8Array;
         name: string;
     }, data?: Record<string, unknown>, options?: DepthOptions): Promise<MediaDocument>;
+    /**
+     * Downloads a file from an `http(s)` link and uploads it like `upload()`. Private network
+     * addresses are refused unless `upload.fromURL.allowPrivate`. Calls on behalf of a user (the
+     * REST API, `overrideAccess: false`) also need `upload.fromURL` and a host in its `allowedHosts`.
+     */
+    uploadFromURL(url: string, data?: Record<string, unknown>, options?: DepthOptions): Promise<MediaDocument>;
     /**
      * Creates an API key (needs `apiKeys: true`) and returns it once: only a hash is stored.
      * With access enforced the key belongs to `user`; trusted calls name the owner in `data.user`.
@@ -1560,7 +1566,7 @@ interface AdminPage {
 interface DashboardWidget {
     /** A Web Component from an admin module. */
     readonly component: AdminComponent;
-    /** Half the dashboard's width (default) or all of it. Full width on phones. */
+    /** `half` (default): the side column, beside drafts and recent edits; `full`: below both. */
     readonly width?: 'half' | 'full';
     /** Who sees it. */
     readonly access?: AdminViewAccess;
@@ -1603,6 +1609,22 @@ interface ImageSize {
     /** How to fit when both width and height are set. Default `cover`. */
     readonly fit?: 'cover' | 'contain' | 'inside';
 }
+/**
+ * Uploads from a link: the server downloads the file (`cms.uploadFromURL`, `POST <api>/media`
+ * with `{ url }`, "From a link" in the admin).
+ */
+interface UploadFromURLConfig {
+    /**
+     * Hosts files may come from: `images.example.com`, `*.example.com` (its subdomains, not
+     * `example.com` itself) or `*` for any public host. Checked at every redirect too.
+     */
+    readonly allowedHosts: readonly string[];
+    /**
+     * Also download from private network addresses (`10.x`, `192.168.x`, `localhost`…), e.g. an
+     * intranet. Off by default: links could then reach services that are not meant to be public.
+     */
+    readonly allowPrivate?: boolean;
+}
 interface UploadConfig {
     /** Directory for uploaded files with the default local storage, relative to the project root. Default `uploads`. */
     readonly dir?: string;
@@ -1614,6 +1636,8 @@ interface UploadConfig {
     readonly storage?: StorageAdapter;
     /** Resized copies generated for images when `sharp` is installed. */
     readonly imageSizes?: readonly ImageSize[];
+    /** Lets users upload from a link. Off by default. */
+    readonly fromURL?: UploadFromURLConfig;
 }
 interface RoutesConfig {
     /** Where the REST API is served. Default `/api/cms`. */
@@ -1800,7 +1824,7 @@ interface ResolvedConfig extends Omit<Config, 'cors' | 'localization' | 'routes'
     readonly localization: Required<LocalizationConfig> | null;
     readonly routes: Required<RoutesConfig>;
     readonly admin: Required<AdminConfig>;
-    readonly upload: Required<Omit<UploadConfig, 'storage'>> & Pick<UploadConfig, 'storage'>;
+    readonly upload: Required<Omit<UploadConfig, 'storage' | 'fromURL'>> & Pick<UploadConfig, 'storage' | 'fromURL'>;
     readonly auth: Required<AuthConfig>;
     readonly collections: readonly CollectionConfig[];
     readonly globals: readonly GlobalConfig[];
@@ -2130,6 +2154,8 @@ interface AdminSchema {
     globals: AdminGlobal[];
     /** URLs under the API of the admin modules to load (`admin.modules`). */
     modules: string[];
+    /** Files can be uploaded from links (`upload.fromURL`). */
+    uploadFromURL: boolean;
     /** Pages this user may open (`admin.pages`). */
     pages: AdminPageRef[];
     /** Dashboard panels this user may see (`admin.dashboard`). */
@@ -2171,4 +2197,4 @@ declare const BUILTIN_COLLECTIONS: readonly ["users", "media"];
 /** Checks a config and returns every problem found. An empty array means it is valid. */
 declare function validateConfig(config: Config): ConfigIssue[];
 
-export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminSchema, type AdminViewAccess, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthUser, BUILTIN_COLLECTIONS, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailField, type EmailMessage, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoutesConfig, SESSION_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword };
+export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminSchema, type AdminViewAccess, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, Auth, type AuthConfig, type AuthUser, BUILTIN_COLLECTIONS, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailField, type EmailMessage, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoutesConfig, SESSION_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword };

package/dist/index.js

@@ -271,22 +271,22 @@ var FieldAccessChecker = class {
     return allowed2;
   }
 };
-async function stripFields(fields, doc, read) {
+async function stripFields(fields, doc, read2) {
   const result = { ...doc };
   for (const field of fields) {
     if (!(field.name in result)) continue;
-    if (field.hidden || read && !await read.allows(field)) {
+    if (field.hidden || read2 && !await read2.allows(field)) {
       delete result[field.name];
       continue;
     }
     const value = result[field.name];
     if (field.type === "group" && value && typeof value === "object") {
-      result[field.name] = await stripFields(field.fields, value, read);
+      result[field.name] = await stripFields(field.fields, value, read2);
     } else if (hasRows(field) && Array.isArray(value)) {
       result[field.name] = await Promise.all(
         value.map((row) => {
           const fields2 = rowFields(field, row);
-          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read) : row;
+          return fields2 && row && typeof row === "object" ? stripFields(fields2, row, read2) : row;
         })
       );
     }
@@ -1744,7 +1744,7 @@ function applyFieldTypes(config) {
     const problem = type.checkOptions?.(own);
     if (problem) issues.push({ path: here, message: problem });
     const ownValidate = own.validate;
-    const check = type.validate;
+    const check2 = type.validate;
     const admin = own.admin ?? {};
     const input = admin.component ?? component(type.admin?.component, own, type.admin?.props);
     const cell = admin.cell ?? component(type.admin?.cell, own, type.admin?.props);
@@ -1752,11 +1752,11 @@ function applyFieldTypes(config) {
       ...own,
       type: type.base,
       customType: type.name,
-      ...check || ownValidate ? {
+      ...check2 || ownValidate ? {
         validate: async (value, ctx) => {
           const empty = value === null || value === void 0 || value === "";
-          if (check && !empty) {
-            const result = await check(value, { ...ctx, field: own });
+          if (check2 && !empty) {
+            const result = await check2(value, { ...ctx, field: own });
             if (result !== true) return result;
           }
           return ownValidate ? ownValidate(value, ctx) : true;
@@ -2388,7 +2388,32 @@ function validateUpload(config, add) {
   if (upload.dir !== void 0 && (typeof upload.dir !== "string" || upload.dir.length === 0)) {
     add("upload.dir", "must be a non-empty string");
   }
+  const fromURL = upload.fromURL;
+  if (fromURL === void 0) return;
+  if (typeof fromURL !== "object" || fromURL === null) {
+    add("upload.fromURL", "must be an object", "e.g. fromURL: { allowedHosts: ['*'] }");
+    return;
+  }
+  const { allowedHosts, allowPrivate } = fromURL;
+  if (!Array.isArray(allowedHosts) || allowedHosts.length === 0) {
+    add(
+      "upload.fromURL.allowedHosts",
+      "must be a non-empty array of host names",
+      "e.g. allowedHosts: ['images.example.com', '*.cdn.example.com'] or ['*'] for any public host"
+    );
+  } else {
+    allowedHosts.forEach((host, i) => {
+      if (typeof host !== "string" || !HOST_PATTERN.test(host))
+        add(
+          `upload.fromURL.allowedHosts[${i}]`,
+          `must be a host name like "images.example.com", "*.example.com" or "*" (got ${JSON.stringify(host)})`
+        );
+    });
+  }
+  if (allowPrivate !== void 0 && typeof allowPrivate !== "boolean")
+    add("upload.fromURL.allowPrivate", "must be true or false");
 }
+var HOST_PATTERN = /^(\*|(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*)$/i;
 function asArray(value, path, add) {
   if (value === void 0) return [];
   if (!Array.isArray(value)) {
@@ -2840,7 +2865,8 @@ async function resolveConfig(input) {
       maxFileSize: config.upload?.maxFileSize ?? DEFAULT_MAX_FILE_SIZE,
       mimeTypes: config.upload?.mimeTypes ?? ["image/*", "application/pdf"],
       imageSizes: config.upload?.imageSizes ?? [],
-      ...config.upload?.storage ? { storage: config.upload.storage } : {}
+      ...config.upload?.storage ? { storage: config.upload.storage } : {},
+      ...config.upload?.fromURL ? { fromURL: config.upload.fromURL } : {}
     },
     auth: {
       roles: config.auth?.roles ?? DEFAULT_ROLES,
@@ -3195,6 +3221,212 @@ function collectSlots(fields, data, bySlug, slots) {
   }
 }
 
+// src/remote-file.ts
+import { lookup as dnsLookup } from "dns";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { BlockList, isIP } from "net";
+var RemoteFileError = class extends Error {
+  /** `413` when the file is too large, otherwise `400`. */
+  status;
+  constructor(message, status = 400) {
+    super(message);
+    this.name = "RemoteFileError";
+    this.status = status;
+  }
+};
+var PRIVATE = new BlockList();
+for (const [net, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+])
+  PRIVATE.addSubnet(net, prefix, "ipv4");
+for (const [net, prefix] of [
+  ["::", 128],
+  ["::1", 128],
+  ["64:ff9b:1::", 48],
+  ["100::", 64],
+  ["2001:db8::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["ff00::", 8]
+])
+  PRIVATE.addSubnet(net, prefix, "ipv6");
+function isPrivateAddress(address) {
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
+  if (mapped?.[1]) return PRIVATE.check(mapped[1], "ipv4");
+  const family = isIP(address);
+  if (family === 4) return PRIVATE.check(address, "ipv4");
+  if (family === 6) return PRIVATE.check(address, "ipv6");
+  return true;
+}
+function hostAllowed(host, allowedHosts) {
+  const name = host.toLowerCase().replace(/\.$/, "");
+  return allowedHosts.some((rule) => {
+    const pattern = rule.toLowerCase();
+    if (pattern === "*") return true;
+    if (pattern.startsWith("*.")) return name.endsWith(pattern.slice(1));
+    return name === pattern;
+  });
+}
+function guardedLookup(allowPrivate) {
+  return (hostname, options, callback) => {
+    dnsLookup(hostname, { ...options, all: true }, (error, addresses) => {
+      if (error) return callback(error, "", 4);
+      const usable = allowPrivate ? addresses : addresses.filter((a) => !isPrivateAddress(a.address));
+      if (usable.length === 0) {
+        const blocked = new Error(`${hostname} points to a private network address`);
+        blocked.code = "ECMS_PRIVATE";
+        return callback(blocked, "", 4);
+      }
+      if (options.all) return callback(null, usable, 4);
+      const first = usable[0];
+      callback(null, first.address, first.family);
+    });
+  };
+}
+function remoteFileName(url, disposition) {
+  if (disposition) {
+    const star = /filename\*\s*=\s*(?:UTF-8|utf-8)''([^;]+)/.exec(disposition);
+    if (star?.[1]) {
+      try {
+        return clean(decodeURIComponent(star[1].trim()));
+      } catch {
+      }
+    }
+    const plain = /filename\s*=\s*"?([^";]+)"?/.exec(disposition);
+    if (plain?.[1]) return clean(plain[1].trim());
+  }
+  const last = url.pathname.split("/").filter(Boolean).pop();
+  if (last) {
+    try {
+      return clean(decodeURIComponent(last));
+    } catch {
+      return clean(last);
+    }
+  }
+  return "download";
+}
+var clean = (name) => name.replace(/[\\/]/g, "_").slice(0, 200) || "download";
+async function fetchRemoteFile(link, options) {
+  let url;
+  try {
+    url = new URL(link);
+  } catch {
+    throw new RemoteFileError("must be an http(s) link");
+  }
+  const deadline = Date.now() + (options.timeout ?? 15e3);
+  const maxRedirects = options.maxRedirects ?? 3;
+  for (let redirects = 0; ; redirects++) {
+    check(url, options);
+    const response = await get(url, options, deadline);
+    const status = response.statusCode ?? 0;
+    if (status >= 300 && status < 400 && response.headers.location) {
+      response.resume();
+      if (redirects >= maxRedirects) throw new RemoteFileError("redirects too many times");
+      url = new URL(response.headers.location, url);
+      continue;
+    }
+    if (status < 200 || status >= 300) {
+      response.resume();
+      throw new RemoteFileError(`could not be downloaded (HTTP ${status})`);
+    }
+    const data = await read(response, options.maxBytes, deadline);
+    const contentType = response.headers["content-type"];
+    return {
+      data,
+      name: remoteFileName(url, response.headers["content-disposition"]),
+      ...contentType ? { contentType } : {}
+    };
+  }
+}
+function check(url, options) {
+  if (url.protocol !== "http:" && url.protocol !== "https:")
+    throw new RemoteFileError("must be an http(s) link");
+  if (url.username || url.password) throw new RemoteFileError("must not contain a password");
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  if (options.allowedHosts && !hostAllowed(host, options.allowedHosts))
+    throw new RemoteFileError(`${host} is not an allowed host`);
+  if (!options.allowPrivate && isIP(host) && isPrivateAddress(host))
+    throw new RemoteFileError(`${host} is a private network address`);
+}
+function get(url, options, deadline) {
+  const request = url.protocol === "https:" ? httpsRequest : httpRequest;
+  return new Promise((resolve3, reject) => {
+    const req = request(url, {
+      method: "GET",
+      lookup: guardedLookup(options.allowPrivate === true),
+      headers: {
+        "user-agent": options.userAgent ?? "EasyCMS",
+        accept: "*/*"
+      }
+    });
+    const timer = setTimeout(
+      () => req.destroy(new RemoteFileError("took too long to download")),
+      Math.max(0, deadline - Date.now())
+    );
+    req.on("response", (response) => {
+      clearTimeout(timer);
+      resolve3(response);
+    });
+    req.on("error", (error) => {
+      clearTimeout(timer);
+      if (error instanceof RemoteFileError) reject(error);
+      else if (error.code === "ECMS_PRIVATE")
+        reject(new RemoteFileError(`${url.hostname} points to a private network address`));
+      else if (error.code === "ENOTFOUND" || error.code === "EAI_AGAIN")
+        reject(new RemoteFileError(`${url.hostname} was not found`));
+      else reject(new RemoteFileError("could not be downloaded"));
+    });
+    req.end();
+  });
+}
+function read(response, maxBytes, deadline) {
+  const declared = Number(response.headers["content-length"]);
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    response.destroy();
+    return Promise.reject(new RemoteFileError(`is larger than ${maxBytes} bytes`, 413));
+  }
+  return new Promise((resolve3, reject) => {
+    const chunks = [];
+    let size = 0;
+    const timer = setTimeout(
+      () => response.destroy(new RemoteFileError("took too long to download")),
+      Math.max(0, deadline - Date.now())
+    );
+    response.on("data", (chunk) => {
+      size += chunk.byteLength;
+      if (size > maxBytes) {
+        response.destroy(new RemoteFileError(`is larger than ${maxBytes} bytes`, 413));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    response.on("end", () => {
+      clearTimeout(timer);
+      resolve3(new Uint8Array(Buffer.concat(chunks)));
+    });
+    response.on("error", (error) => {
+      clearTimeout(timer);
+      reject(
+        error instanceof RemoteFileError ? error : new RemoteFileError("could not be downloaded")
+      );
+    });
+  });
+}
+
 // src/storage.ts
 import { mkdir, readFile, rm, stat, writeFile } from "fs/promises";
 import { dirname, isAbsolute, join, normalize, resolve as resolve2, sep } from "path";
@@ -3557,6 +3789,39 @@ var EasyCMS = class {
       throw error;
     }
   }
+  /**
+   * Downloads a file from an `http(s)` link and uploads it like `upload()`. Private network
+   * addresses are refused unless `upload.fromURL.allowPrivate`. Calls on behalf of a user (the
+   * REST API, `overrideAccess: false`) also need `upload.fromURL` and a host in its `allowedHosts`.
+   */
+  async uploadFromURL(url, data = {}, options = {}) {
+    const config = this.collection(MEDIA);
+    const guard = guardOf(options);
+    const fromURL = this.config.upload.fromURL;
+    if (guard.enforce) {
+      this.checkKey(guard, { collection: MEDIA }, "create");
+      const allowed2 = await evaluateAccess(config.access?.create, { user: guard.user, data });
+      if (allowed2 !== true) throw deny(guard.user);
+      if (!fromURL)
+        throw new ValidationError(MEDIA, [
+          { field: "url", message: "uploads from links are off (upload.fromURL)" }
+        ]);
+    }
+    let file;
+    try {
+      file = await fetchRemoteFile(url, {
+        allowedHosts: guard.enforce ? fromURL?.allowedHosts : void 0,
+        allowPrivate: fromURL?.allowPrivate === true,
+        maxBytes: this.config.upload.maxFileSize,
+        userAgent: "EasyCMS (+https://github.com/maritonx/easy-cms)"
+      });
+    } catch (error) {
+      if (!(error instanceof RemoteFileError)) throw error;
+      if (error.status === 413) throw new PayloadTooLargeError(`File ${error.message}`);
+      throw new ValidationError(MEDIA, [{ field: "url", message: error.message }]);
+    }
+    return this.upload(file, data, options);
+  }
   /**
    * Creates an API key (needs `apiKeys: true`) and returns it once: only a hash is stored.
    * With access enforced the key belongs to `user`; trusted calls name the owner in `data.user`.
@@ -3766,7 +4031,7 @@ var EasyCMS = class {
   /** Coerces preview input like a save would, keeping values that would fail validation. */
   async previewDoc(config, data, system2, options = {}) {
     const locale = this.localeOf(options);
-    const { data: clean } = await validateFields(config.fields, data, {
+    const { data: clean2 } = await validateFields(config.fields, data, {
       operation: "update",
       root: data,
       skipRequired: true,
@@ -3775,7 +4040,7 @@ var EasyCMS = class {
     });
     return {
       ...data,
-      ...clean,
+      ...clean2,
       ...config.drafts ? { status: data.status } : {},
       ...system2,
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -4064,14 +4329,14 @@ var EasyCMS = class {
     const parsed = parseId(id);
     if (parsed === void 0) return { update: false, delete: false };
     const guard = { enforce: true, user };
-    const check = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
+    const check2 = (operation) => this.checkDocumentAccess(config, operation, guard, parsed, void 0).then(
       () => true,
       (error) => {
         if (error instanceof ForbiddenError || error instanceof UnauthorizedError) return false;
         throw error;
       }
     );
-    return { update: await check("update"), delete: await check("delete") };
+    return { update: await check2("update"), delete: await check2("delete") };
   }
   /** Closes the database connection. */
   /**
@@ -4445,7 +4710,7 @@ var EasyCMS = class {
   }
   /** Runs afterRead hooks, populates relationships and removes what the caller may not see. */
   async output(config, docs, guard, options) {
-    const read = this.fieldChecker("read", guard, void 0, void 0);
+    const read2 = this.fieldChecker("read", guard, void 0, void 0);
     const finish = async (target, doc) => {
       const hooked = await this.transform(
         target.hooks?.afterRead,
@@ -4453,7 +4718,7 @@ var EasyCMS = class {
         this.hookArgs(target, guard),
         doc
       );
-      return await stripFields(target.fields, hooked, read);
+      return await stripFields(target.fields, hooked, read2);
     };
     const load = async (target, ids) => {
       const where = await this.readWhere(target, guard, { id: { in: [...ids] } }).catch((error) => {
@@ -4696,24 +4961,24 @@ var EasyCMS = class {
       ...locale !== void 0 && locale !== ALL_LOCALES ? { locale } : {}
     });
     const errors = [...result.errors];
-    const clean = { ...result.data };
+    const clean2 = { ...result.data };
     if (config.drafts) {
       const status = data.status ?? "draft";
       if (status !== "draft" && status !== "published") {
         errors.push({ field: "status", message: 'must be "draft" or "published"' });
       }
-      clean.status = status;
+      clean2.status = status;
     }
     const isCollection = this.config.collections.includes(config);
     if (isCollection && errors.length === 0) {
-      await this.makeSlugsUnique(config, clean, selfId);
-      errors.push(...await this.checkUnique(config, clean, selfId));
+      await this.makeSlugsUnique(config, clean2, selfId);
+      errors.push(...await this.checkUnique(config, clean2, selfId));
     }
     errors.push(...await this.checkReferences(result.references));
     if (errors.length === 0)
       errors.push(...await this.checkFilterOptions(result.references, selfId, user));
     if (errors.length > 0) throw new ValidationError(config.slug, errors);
-    return clean;
+    return clean2;
   }
   /** Refuses changes that would leave no active admin (and lock everyone out). */
   async guardLastAdmin(id, before, after) {
@@ -5084,6 +5349,7 @@ async function adminSchema(cms, user, origin) {
     collections: await Promise.all(collections.map((c) => collection(c, user, localized))),
     globals: await Promise.all(cms.config.globals.map((g) => global(g, user, localized))),
     modules: adminModuleUrls(cms),
+    uploadFromURL: cms.config.upload.fromURL !== void 0,
     pages: await pages(cms, user),
     dashboard: await widgets(cms, user)
   };
@@ -5545,6 +5811,15 @@ async function route(cms, ctx, method, segments, options) {
     return { body: await serveFile(cms, third, method === "HEAD") };
   }
   if (first === MEDIA && second === void 0 && method === "POST") {
+    if ((ctx.request.headers.get("content-type") ?? "").toLowerCase().startsWith("application/json")) {
+      const { url, ...data2 } = await readJson(ctx.request);
+      if (typeof url !== "string" || url === "")
+        throw new ValidationError(MEDIA, [{ field: "url", message: "is required" }]);
+      return {
+        status: 201,
+        body: await cms.uploadFromURL(url, data2, { ...access, ...parseDepth(ctx.url) })
+      };
+    }
     const { file, data } = await readUpload(ctx.request, cms.config.upload.maxFileSize);
     return {
       status: 201,
@@ -5821,7 +6096,10 @@ async function serveFile(cms, key2, head) {
 async function readUpload(request, maxFileSize) {
   const type = request.headers.get("content-type") ?? "";
   if (!type.toLowerCase().startsWith("multipart/form-data")) {
-    throw new HttpError('Uploads must be multipart/form-data with a "file" field', 415);
+    throw new HttpError(
+      'Uploads must be multipart/form-data with a "file" field, or JSON with a "url"',
+      415
+    );
   }
   const declared = Number(request.headers.get("content-length") ?? 0);
   if (declared > maxFileSize + 64 * 1024)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",