@easy-cms/core 0.38.0 → 0.39.0

package/dist/index.d.ts

@@ -2705,9 +2705,20 @@ declare function loadConfig(options?: LoadConfigOptions): Promise<ResolvedConfig
 
 /** File types Easy CMS recognizes from their contents (FR-UPL-03). */
 declare const EXTENSIONS: Readonly<Record<string, string>>;
-/** Detects the MIME type from file contents, ignoring the name the client sent. */
-declare function sniffMimeType(data: Uint8Array): string | undefined;
-/** `image/*` style matching. */
+/**
+ * Names for several types at once, usable in `upload.mimeTypes` and an upload field's
+ * `mimeTypes`: `documents` (PDF, Word, Excel, PowerPoint, OpenDocument, CSV, text), `office`
+ * (docx, xlsx, pptx) and `archives` (zip).
+ */
+declare const MIME_GROUPS: Readonly<Record<string, readonly string[]>>;
+/** Patterns with group names (`documents`…) replaced by their types. */
+declare function expandMimeTypes(patterns: readonly string[]): string[];
+/**
+ * Detects the MIME type from file contents, ignoring the type the client sent. The name only
+ * tells CSV from plain text, which have the same contents.
+ */
+declare function sniffMimeType(data: Uint8Array, name?: string): string | undefined;
+/** `image/*` style matching; group names (`documents`…) stand for their types. */
 declare function mimeAllowed(type: string, allowed: readonly string[]): boolean;
 /** Width and height of PNG, GIF, JPEG and WebP images without decoding them. */
 declare function imageDimensions(data: Uint8Array, type: string): {
@@ -2949,6 +2960,11 @@ interface AdminSchema {
     modules: string[];
     /** Files can be uploaded from links (`upload.fromURL`). */
     uploadFromURL: boolean;
+    /** What the media library takes (`upload.maxFileSize`, `upload.mimeTypes` with groups expanded). */
+    upload: {
+        maxFileSize: number;
+        mimeTypes: string[];
+    };
     /**
      * The media library has folders (`upload.folders`); `permissions`: this user may choose which
      * roles use each folder (admins, with `auth.rbac`).
@@ -3089,4 +3105,4 @@ declare function validateConfig(config: Config): ConfigIssue[];
 /** The version of `@easy-cms/core`, set when the package is built. */
 declare const VERSION: string;
 
-export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminSso, type AdminStatus, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, type AuditChange, type AuditConfig, type AuditEntry, AuditLog, type AuditPage, type AuditVerification, Auth, type AuthConfig, type AuthProvider, type AuthProviderProfile, type AuthProviderRequest, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, FOLDER_LEVELS, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, type FolderLevel, type FolderPermissions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MEDIA_FOLDERS, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, MediaFolders, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, SSO_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type SsoOutcome, type SsoProviderRef, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, type UserIdentity, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword, writeBackupFile };
+export { ADMIN_ICONS, API_KEYS, API_KEY_GLOBAL_OPERATIONS, API_KEY_OPERATIONS, type Access, type AccessArgs, type AccessOptions, type AdminAttention, type AdminBackup, type AdminBackups, type AdminBrand, type AdminCollection, type AdminComponent, type AdminComponentRef, type AdminConfig, type AdminDeliveries, type AdminDelivery, type AdminEmail, type AdminEmailDelivery, type AdminField, type AdminGlobal, type AdminIcon, type AdminLocale, type AdminPage, type AdminPageRef, type AdminRole, type AdminRoleChange, type AdminRoleField, type AdminRoleTarget, type AdminRoleView, type AdminRoles, type AdminSchema, type AdminSso, type AdminStatus, type AdminViewAccess, type AdminWebhookDelivery, type AdminWidgetRef, type AfterChangeHook, type AfterDeleteHook, type AfterReadHook, type ApiKeyContext, type ApiKeyGlobalOperation, type ApiKeyOperation, type ApiKeyPermissions, type ArrayField, type AuditChange, type AuditConfig, type AuditEntry, AuditLog, type AuditPage, type AuditVerification, Auth, type AuthConfig, type AuthProvider, type AuthProviderProfile, type AuthProviderRequest, type AuthUser, BUILTIN_COLLECTIONS, type BackupState, type BackupsConfig, type BeforeChangeHook, type BeforeDeleteHook, type BeforeValidateHook, type Block, type BlocksField, type BooleanField, type BuiltinApiKeysCollection, type BuiltinMediaCollection, type BuiltinUsersCollection, type BundleHints, CONFIG_FILE_NAMES, CSRF_COOKIE, CSRF_HEADER, type CliCommand, type CollectionAccess, type CollectionAdmin, type CollectionConfig, type CollectionDocument, type CollectionHooks, type CollectionListAdmin, type CollectionSlug, type Config, ConfigError, type ConfigIssue, type ContainerAdmin, type CopyProgress, type CopyResult, type CreateEasyCMSOptions, type CreateInput, type CreateMigrationResult, type CustomField, type CustomFieldTypes, DEFAULT_ADMIN_PATH, DEFAULT_API_PATH, DEFAULT_DEPTH, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_VERSIONS, DEFAULT_PASSWORD_EMAILS, DEFAULT_TOKEN_EXPIRATION, type DashboardWidget, type Database, type DatabaseAdapter, type DatabaseInitArgs, type DatabaseTransfer, type DateField, type DeliveryKind, type DeliveryState, type DepthOptions, type DocumentOf, EXTENSIONS, EasyCMS, EasyCMSError, type EmailAdapter, type EmailCheck, type EmailField, type EmailMessage, type EmailSetting, type Endpoint, type EndpointRequest, FIELD_TYPES, FIELD_TYPE_BASES, FOLDER_LEVELS, type Field, type FieldAccess, type FieldAccessFn, type FieldAdmin, type FieldError, type FieldRule, type FieldType, type FieldTypeBase, type FieldTypeDefinition, type FieldTypeValidateContext, type FieldValidate, type FieldValidateContext, type FieldValue, type FieldsInput, type FieldsValue, type FilterOptions, type FilterOptionsArgs, type FindArgs, type FindOptions, type FolderLevel, type FolderPermissions, ForbiddenError, type GlobalAccess, type GlobalConfig, type GlobalDocument, type GlobalHooks, type GlobalInput, type GlobalSlug, type GroupField, type ID, INTERNAL_COLLECTIONS, type ImageSize, type InferCollection, type InferGlobal, type JsonField, type Label, type LivePreview, type LoadConfigOptions, type LocalStorageOptions, type LocalizationConfig, type Logger, type LoginArgs, MAX_DEPTH, MEDIA, MEDIA_FOLDERS, MIME_GROUPS, MIN_PASSWORD_LENGTH, MIN_SECRET_LENGTH, type MediaDocument, MediaFolders, type MediaSize, type MigrationInfo, NotFoundError, type NumberField, type Operation, type PaginatedDocs, type PasswordEmail, type PasswordEmailArgs, type PasswordEmailFn, type PasswordLinkOptions, PayloadTooLargeError, type Plugin, type PluginInfo, type PluginTypes, type PreviewTarget, type PreviewURL, QueryError, ROLE_OPERATIONS, type RawDocument, type ReadOptions, type RelationshipField, type ResolvedConfig, type RestHandler, type RestHandlerOptions, type RichTextDocument, type RichTextField, type Role, type RoleOperation, type RolePermissions, Roles, type RoutesConfig, SESSION_COOKIE, SSO_COOKIE, type ScheduledJob, SchemaError, type SchemaMode, type SelectField, type SelectOption, type Session, type SlugField, type SlugOf, type SsoOutcome, type SsoProviderRef, type StorageAdapter, type StoredFile, type TextField, type TextareaField, TooManyRequestsError, type TypedPlugin, UnauthorizedError, type UpdateInput, type UpdateOptions, type UploadConfig, type UploadField, type UploadFromURLConfig, type UserIdentity, VERSION, ValidationError, type Version, type VersionSummary, type VersionsConfig, WEBHOOK_EVENTS, type WebhookConfig, type WebhookEvent, type WebhookPayload, type Where, type WhereOperators, anyone, applyDefaults, applyPlugins, configSignature, consoleEmail, consoleLogger, copyDatabase, createEasyCMS, createRestHandler, createRootEndpointHandler, defineConfig, defineFieldType, definePlugin, expandMimeTypes, fillMissing, findConfigFile, generateSlugs, generateTypes, hasRows, hashPassword, imageDimensions, importConfig, isAdmin, isHasMany, isLoggedIn, keyAllows, loadConfig, localStorage, mergeForUpdate, mimeAllowed, mimeAllowedBy, parseId, populate, readCookie, resolveAdminModule, resolveConfig, rowFields, silentLogger, singularize, slugify, sniffMimeType, validateConfig, validateFields, verifyPassword, writeBackupFile };

package/dist/index.js

@@ -917,11 +917,162 @@ var PayloadTooLargeError = class extends EasyCMSError {
   }
 };
 
+// src/media.ts
+var EXTENSIONS = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/gif": "gif",
+  "image/webp": "webp",
+  "image/avif": "avif",
+  "image/svg+xml": "svg",
+  "application/pdf": "pdf",
+  "video/mp4": "mp4",
+  "video/webm": "webm",
+  "video/quicktime": "mov",
+  "audio/mpeg": "mp3",
+  "audio/wav": "wav",
+  "audio/ogg": "ogg",
+  "audio/mp4": "m4a",
+  "text/plain": "txt",
+  "text/csv": "csv",
+  "application/zip": "zip",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document": "docx",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": "xlsx",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation": "pptx",
+  "application/vnd.oasis.opendocument.text": "odt",
+  "application/vnd.oasis.opendocument.spreadsheet": "ods",
+  "application/vnd.oasis.opendocument.presentation": "odp"
+};
+var OFFICE = [
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation"
+];
+var MIME_GROUPS = {
+  office: OFFICE,
+  documents: [
+    "application/pdf",
+    ...OFFICE,
+    "application/vnd.oasis.opendocument.text",
+    "application/vnd.oasis.opendocument.spreadsheet",
+    "application/vnd.oasis.opendocument.presentation",
+    "text/csv",
+    "text/plain"
+  ],
+  archives: ["application/zip"]
+};
+function expandMimeTypes(patterns) {
+  return [...new Set(patterns.flatMap((p) => MIME_GROUPS[p.toLowerCase()] ?? [p]))];
+}
+var startsWith = (data, bytes, offset = 0) => bytes.every((b, i) => data[offset + i] === b);
+var ascii = (data, start, end) => String.fromCharCode(...data.subarray(start, end));
+var contains = (data, text2) => Buffer.from(data.buffer, data.byteOffset, data.byteLength).includes(text2, 0, "latin1");
+function zipType(data) {
+  if (ascii(data, 30, 38) === "mimetype") {
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    const start = 30 + view.getUint16(26, true) + view.getUint16(28, true);
+    const type = ascii(data, start, start + Math.min(view.getUint32(18, true), 80));
+    if (EXTENSIONS[type]?.startsWith("od")) return type;
+  }
+  if (contains(data, "word/document.xml")) return OFFICE[0];
+  if (contains(data, "xl/workbook.xml")) return OFFICE[1];
+  if (contains(data, "ppt/presentation.xml")) return OFFICE[2];
+  return "application/zip";
+}
+function sniffMimeType(data, name = "") {
+  if (startsWith(data, [137, 80, 78, 71, 13, 10, 26, 10])) return "image/png";
+  if (startsWith(data, [255, 216, 255])) return "image/jpeg";
+  if (ascii(data, 0, 6) === "GIF87a" || ascii(data, 0, 6) === "GIF89a") return "image/gif";
+  if (ascii(data, 0, 4) === "RIFF" && ascii(data, 8, 12) === "WEBP") return "image/webp";
+  if (ascii(data, 0, 4) === "RIFF" && ascii(data, 8, 12) === "WAVE") return "audio/wav";
+  if (ascii(data, 4, 8) === "ftyp") {
+    const brand = ascii(data, 8, 12);
+    if (brand === "avif" || brand === "avis") return "image/avif";
+    if (["isom", "iso2", "mp41", "mp42", "avc1", "M4V "].includes(brand)) return "video/mp4";
+    if (brand === "M4A ") return "audio/mp4";
+    if (brand === "qt  ") return "video/quicktime";
+  }
+  if (ascii(data, 0, 5) === "%PDF-") return "application/pdf";
+  if (startsWith(data, [80, 75, 3, 4])) return zipType(data);
+  if (ascii(data, 0, 4) === "OggS") return "audio/ogg";
+  if (startsWith(data, [26, 69, 223, 163]) && ascii(data, 0, 64).includes("webm"))
+    return "video/webm";
+  if (ascii(data, 0, 3) === "ID3" || data[0] === 255 && ((data[1] ?? 0) & 230) === 226)
+    return "audio/mpeg";
+  const head = data.subarray(0, 4096);
+  if (head.includes(0)) return void 0;
+  let text2;
+  try {
+    text2 = new TextDecoder("utf-8", { fatal: true }).decode(head);
+  } catch {
+    return void 0;
+  }
+  const trimmed = text2.replace(/^/, "").trimStart();
+  if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*(<!DOCTYPE svg[^>]*>\s*)?<svg[\s>]/i.test(trimmed))
+    return "image/svg+xml";
+  return /\.csv$/i.test(name) ? "text/csv" : "text/plain";
+}
+function mimeAllowed(type, allowed2) {
+  return expandMimeTypes(allowed2).some(
+    (pattern) => pattern.endsWith("/*") ? type.startsWith(pattern.slice(0, -1)) : pattern === type
+  );
+}
+function imageDimensions(data, type) {
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  try {
+    switch (type) {
+      case "image/png":
+        return { width: view.getUint32(16), height: view.getUint32(20) };
+      case "image/gif":
+        return { width: view.getUint16(6, true), height: view.getUint16(8, true) };
+      case "image/webp": {
+        const chunk = ascii(data, 12, 16);
+        if (chunk === "VP8 ")
+          return {
+            width: view.getUint16(26, true) & 16383,
+            height: view.getUint16(28, true) & 16383
+          };
+        if (chunk === "VP8L") {
+          const bits = view.getUint32(21, true);
+          return { width: (bits & 16383) + 1, height: (bits >> 14 & 16383) + 1 };
+        }
+        if (chunk === "VP8X") {
+          const w = view.getUint16(24, true) | view.getUint8(26) << 16;
+          const h = view.getUint16(27, true) | view.getUint8(29) << 16;
+          return { width: w + 1, height: h + 1 };
+        }
+        return void 0;
+      }
+      case "image/jpeg": {
+        let offset = 2;
+        while (offset + 9 < data.length) {
+          if (data[offset] !== 255) return void 0;
+          const marker = data[offset + 1];
+          const length = view.getUint16(offset + 2);
+          if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
+            return { width: view.getUint16(offset + 7), height: view.getUint16(offset + 5) };
+          }
+          offset += 2 + length;
+        }
+        return void 0;
+      }
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+function storageKey(originalName, type, random2) {
+  const name = originalName.split(/[\\/]/).pop() ?? "";
+  const base = name.replace(/(?<=.)\.[^.]*$/, "").normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
+  return `${base}-${random2}.${EXTENSIONS[type] ?? "bin"}`;
+}
+
 // src/fields.ts
 var isHasMany = (field) => (field.type === "select" || field.type === "relationship" || field.type === "upload") && field.hasMany === true;
 function mimeAllowedBy(mimeType, patterns) {
   const type = mimeType.toLowerCase();
-  return patterns.some((pattern) => {
+  return expandMimeTypes(patterns).some((pattern) => {
     const p = pattern.toLowerCase();
     return p.endsWith("/*") ? type.startsWith(p.slice(0, -1)) : type === p;
   });
@@ -4359,6 +4510,13 @@ function validateUpload(config, add) {
   if (upload.dir !== void 0 && (typeof upload.dir !== "string" || upload.dir.length === 0)) {
     add("upload.dir", "must be a non-empty string");
   }
+  const mimeTypes = upload.mimeTypes;
+  if (mimeTypes !== void 0 && (!Array.isArray(mimeTypes) || mimeTypes.length === 0 || !mimeTypes.every((t) => typeof t === "string" && MIME_PATTERN.test(t))))
+    add(
+      "upload.mimeTypes",
+      "must be a list of MIME types or groups (documents, office, archives)",
+      "e.g. mimeTypes: ['image/*', 'documents']"
+    );
   if (upload.folders !== void 0 && typeof upload.folders !== "boolean")
     add("upload.folders", "must be true or false");
   const fromURL = upload.fromURL;
@@ -4386,6 +4544,7 @@ function validateUpload(config, add) {
   if (allowPrivate !== void 0 && typeof allowPrivate !== "boolean")
     add("upload.fromURL.allowPrivate", "must be true or false");
 }
+var MIME_PATTERN = /^([\w.+-]+\/(\*|[\w.+-]+)|documents|office|archives)$/i;
 var HOST_PATTERN = /^(\*|(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*)$/i;
 function validateAudit(config, add) {
   const audit = config.audit;
@@ -4635,8 +4794,12 @@ function validateField(field, path, siblings, collectionSlugs, add) {
       validateManyRange(field, path, add);
       if (field.mimeTypes !== void 0) {
         const types = field.mimeTypes;
-        if (!Array.isArray(types) || types.length === 0 || !types.every((t) => typeof t === "string" && /^[\w.+-]+\/(\*|[\w.+-]+)$/.test(t))) {
-          add(`${path}.mimeTypes`, "must be a list of MIME types", "e.g. mimeTypes: ['image/*']");
+        if (!Array.isArray(types) || types.length === 0 || !types.every((t) => typeof t === "string" && MIME_PATTERN.test(t))) {
+          add(
+            `${path}.mimeTypes`,
+            "must be a list of MIME types or groups (documents, office, archives)",
+            "e.g. mimeTypes: ['image/*', 'documents']"
+          );
         }
       }
       break;
@@ -5119,100 +5282,6 @@ var silentLogger = { info() {
 }, error() {
 } };
 
-// src/media.ts
-var EXTENSIONS = {
-  "image/png": "png",
-  "image/jpeg": "jpg",
-  "image/gif": "gif",
-  "image/webp": "webp",
-  "image/avif": "avif",
-  "image/svg+xml": "svg",
-  "application/pdf": "pdf",
-  "video/mp4": "mp4",
-  "text/plain": "txt"
-};
-var startsWith = (data, bytes, offset = 0) => bytes.every((b, i) => data[offset + i] === b);
-var ascii = (data, start, end) => String.fromCharCode(...data.subarray(start, end));
-function sniffMimeType(data) {
-  if (startsWith(data, [137, 80, 78, 71, 13, 10, 26, 10])) return "image/png";
-  if (startsWith(data, [255, 216, 255])) return "image/jpeg";
-  if (ascii(data, 0, 6) === "GIF87a" || ascii(data, 0, 6) === "GIF89a") return "image/gif";
-  if (ascii(data, 0, 4) === "RIFF" && ascii(data, 8, 12) === "WEBP") return "image/webp";
-  if (ascii(data, 4, 8) === "ftyp") {
-    const brand = ascii(data, 8, 12);
-    if (brand === "avif" || brand === "avis") return "image/avif";
-    if (["isom", "iso2", "mp41", "mp42", "avc1", "M4V "].includes(brand)) return "video/mp4";
-  }
-  if (ascii(data, 0, 5) === "%PDF-") return "application/pdf";
-  const head = data.subarray(0, 4096);
-  if (head.includes(0)) return void 0;
-  let text2;
-  try {
-    text2 = new TextDecoder("utf-8", { fatal: true }).decode(head);
-  } catch {
-    return void 0;
-  }
-  const trimmed = text2.replace(/^/, "").trimStart();
-  if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*(<!DOCTYPE svg[^>]*>\s*)?<svg[\s>]/i.test(trimmed))
-    return "image/svg+xml";
-  return "text/plain";
-}
-function mimeAllowed(type, allowed2) {
-  return allowed2.some(
-    (pattern) => pattern.endsWith("/*") ? type.startsWith(pattern.slice(0, -1)) : pattern === type
-  );
-}
-function imageDimensions(data, type) {
-  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
-  try {
-    switch (type) {
-      case "image/png":
-        return { width: view.getUint32(16), height: view.getUint32(20) };
-      case "image/gif":
-        return { width: view.getUint16(6, true), height: view.getUint16(8, true) };
-      case "image/webp": {
-        const chunk = ascii(data, 12, 16);
-        if (chunk === "VP8 ")
-          return {
-            width: view.getUint16(26, true) & 16383,
-            height: view.getUint16(28, true) & 16383
-          };
-        if (chunk === "VP8L") {
-          const bits = view.getUint32(21, true);
-          return { width: (bits & 16383) + 1, height: (bits >> 14 & 16383) + 1 };
-        }
-        if (chunk === "VP8X") {
-          const w = view.getUint16(24, true) | view.getUint8(26) << 16;
-          const h = view.getUint16(27, true) | view.getUint8(29) << 16;
-          return { width: w + 1, height: h + 1 };
-        }
-        return void 0;
-      }
-      case "image/jpeg": {
-        let offset = 2;
-        while (offset + 9 < data.length) {
-          if (data[offset] !== 255) return void 0;
-          const marker = data[offset + 1];
-          const length = view.getUint16(offset + 2);
-          if (marker >= 192 && marker <= 207 && ![196, 200, 204].includes(marker)) {
-            return { width: view.getUint16(offset + 7), height: view.getUint16(offset + 5) };
-          }
-          offset += 2 + length;
-        }
-        return void 0;
-      }
-    }
-  } catch {
-    return void 0;
-  }
-  return void 0;
-}
-function storageKey(originalName, type, random2) {
-  const name = originalName.split(/[\\/]/).pop() ?? "";
-  const base = name.replace(/(?<=.)\.[^.]*$/, "").normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
-  return `${base}-${random2}.${EXTENSIONS[type] ?? "bin"}`;
-}
-
 // src/media-folders.ts
 var FOLDER_LEVELS = ["view", "edit", "manage"];
 var RANK = { none: 0, view: 1, edit: 2, manage: 3 };
@@ -5816,7 +5885,7 @@ var EasyCMS = class {
     }
     if (file.data.byteLength === 0)
       throw new ValidationError(MEDIA, [{ field: "file", message: "is empty" }]);
-    const mimeType = sniffMimeType(file.data);
+    const mimeType = sniffMimeType(file.data, file.name);
     if (!mimeType || !mimeAllowed(mimeType, mimeTypes)) {
       throw new ValidationError(MEDIA, [
         {
@@ -7718,7 +7787,7 @@ async function serializeFields(fields, checks, localized) {
         if (field.hasMany) f.hasMany = true;
         if (field.minRows !== void 0) f.minRows = field.minRows;
         if (field.maxRows !== void 0) f.maxRows = field.maxRows;
-        if (field.mimeTypes) f.mimeTypes = [...field.mimeTypes];
+        if (field.mimeTypes) f.mimeTypes = expandMimeTypes(field.mimeTypes);
         break;
       case "array":
         if (field.minRows !== void 0) f.minRows = field.minRows;
@@ -7842,6 +7911,10 @@ async function adminSchema(cms, user, origin) {
     globals: await Promise.all(cms.config.globals.map((g) => global(cms, g, user, localized))),
     modules: adminModuleUrls(cms),
     uploadFromURL: cms.config.upload.fromURL !== void 0,
+    upload: {
+      maxFileSize: cms.config.upload.maxFileSize,
+      mimeTypes: expandMimeTypes(cms.config.upload.mimeTypes)
+    },
     ...cms.folders.enabled ? { folders: { permissions: admin && cms.roles.enabled } } : {},
     views,
     rbac: cms.roles.enabled,
@@ -7891,7 +7964,7 @@ async function widgets(cms, user) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.38.0" : "0.0.0-dev";
+var VERSION = true ? "0.39.0" : "0.0.0-dev";
 
 // src/rest/admin-status.ts
 var DAY2 = 864e5;
@@ -8886,16 +8959,20 @@ async function serveFile(cms, key2, head) {
   const file = await cms.storage.get(key2);
   if (!file) throw new HttpError("Not found", 404);
   const extension = key2.slice(key2.lastIndexOf(".") + 1);
+  const type = TYPE_BY_EXTENSION[extension] ?? "application/octet-stream";
   return new Response(
     head ? null : file.body,
     {
       status: 200,
       headers: {
-        "content-type": TYPE_BY_EXTENSION[extension] ?? "application/octet-stream",
+        "content-type": type,
         "content-length": String(file.size),
         "cache-control": "public, max-age=31536000, immutable",
         "x-content-type-options": "nosniff",
-        "content-security-policy": "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox",
+        // Browsers won't show a PDF in a sandbox; their PDF viewers run apart from the site.
+        ...type === "application/pdf" ? {} : {
+          "content-security-policy": "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox"
+        },
         "cross-origin-resource-policy": "cross-origin"
       }
     }
@@ -9245,6 +9322,7 @@ export {
   MAX_DEPTH,
   MEDIA,
   MEDIA_FOLDERS,
+  MIME_GROUPS,
   MIN_PASSWORD_LENGTH,
   MIN_SECRET_LENGTH,
   MediaFolders,
@@ -9274,6 +9352,7 @@ export {
   defineConfig,
   defineFieldType,
   definePlugin,
+  expandMimeTypes,
   fillMissing,
   findConfigFile,
   generateSlugs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easy-cms/core",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Embedded, code-first headless CMS for Nuxt and Next.js",
   "license": "MIT",
   "type": "module",