@ekrist1/vulse 0.1.6-alpha.3 → 0.1.7-alpha.4

package/src/server/routes/entries.ts

@@ -0,0 +1,255 @@
+import { z } from 'astro/zod'
+import type { VulseDb } from '../../core/db.js'
+import type { Auth } from '../better-auth.js'
+import type { BlueprintRegistry } from '../../core/blueprints/registry.js'
+import { DEFAULT_LOCALE, EntriesRepo } from '../../core/repos/entries.js'
+import { AccessDeniedError, NotFoundError, ValidationError } from '../../core/errors.js'
+import { evaluate } from '../../core/access.js'
+import { parseContent } from '../../core/parse-content.js'
+import { defineHandler } from '../handler.js'
+import { isValidLocaleCode, readLocalesConfig } from '../../core/locales.js'
+
+/**
+ * The URL slug is owned by the entry locale row. If a user schema also declares a
+ * `slug` field (common for templates), it is hidden from the form; we mirror
+ * the canonical slug into content here so schemas that require it still parse.
+ */
+function withCanonicalSlug(content: unknown, slug: string | undefined): unknown {
+  if (slug === undefined) return content
+  if (content === null || typeof content !== 'object' || Array.isArray(content)) return content
+  return { ...(content as Record<string, unknown>), slug }
+}
+
+const paramsByCollection = z.object({ collection: z.string() })
+const paramsById = z.object({ collection: z.string(), id: z.string() })
+
+async function resolveLocaleParam(db: VulseDb, raw: string | null | undefined): Promise<string> {
+  const cfg = await readLocalesConfig(db)
+  if (!raw || raw === DEFAULT_LOCALE) return cfg.defaultLocale
+  if (!isValidLocaleCode(raw)) throw new ValidationError(`Invalid locale code: ${raw}`)
+  if (!cfg.locales.includes(raw)) {
+    throw new ValidationError(`Locale '${raw}' is not enabled for this site.`, {
+      field: 'locale',
+      supported: cfg.locales,
+    })
+  }
+  return raw
+}
+
+export function entriesRoutes(db: VulseDb, auth: Auth, reg: BlueprintRegistry) {
+  const entries = new EntriesRepo(db)
+
+  function blueprintFor(name: string) {
+    const bp = reg.get(name)
+    if (!bp) throw new NotFoundError(`Unknown collection: ${name}`)
+    return bp
+  }
+
+  return {
+    list: defineHandler(auth, { params: paramsByCollection }, async ({ params, url, auth: authCtx }) => {
+      const bp = blueprintFor(params.collection)
+      const locale = await resolveLocaleParam(db, url.searchParams.get('locale'))
+      if (!(await evaluate(bp, 'read', { user: authCtx.user }))) {
+        return await entries.list({ collection: params.collection, locale, status: 'published' })
+      }
+      const parentRaw = url.searchParams.get('parentId')
+      const parentId = parentRaw === 'root' || parentRaw === '' ? null : parentRaw ?? undefined
+      return await entries.list({
+        collection: params.collection,
+        locale,
+        ...(parentId !== undefined ? { parentId } : {}),
+      })
+    }),
+
+    tree: defineHandler(auth, {
+      params: paramsByCollection,
+      requireRole: ['admin', 'editor'],
+    }, async ({ params, url }) => {
+      const bp = blueprintFor(params.collection)
+      if (!bp.tree) throw new ValidationError('Collection does not support tree structure')
+      const locale = await resolveLocaleParam(db, url.searchParams.get('locale'))
+      return await entries.tree(params.collection, locale)
+    }),
+
+    findById: defineHandler(auth, { params: paramsById }, async ({ params, url, auth: authCtx }) => {
+      const bp = blueprintFor(params.collection)
+      const locale = await resolveLocaleParam(db, url.searchParams.get('locale'))
+      const row = await entries.findById(params.id, locale)
+      if (!row) throw new NotFoundError(`Entry ${params.id} (${locale}) not found`)
+      const allowed = await evaluate(bp, 'read', {
+        user: authCtx.user,
+        entry: { id: row.id, status: row.status, createdBy: row.createdBy, content: row.content },
+      })
+      if (!allowed) throw new NotFoundError(`Entry ${params.id} not found`)
+      return row
+    }),
+
+    listLocales: defineHandler(auth, {
+      params: paramsById,
+      requireRole: ['admin', 'editor'],
+    }, async ({ params }) => {
+      blueprintFor(params.collection)
+      return await entries.listLocales(params.id)
+    }),
+
+    create: defineHandler(auth, {
+      params: paramsByCollection,
+      body: z.object({
+        slug: z.string(),
+        content: z.unknown(),
+        status: z.enum(['draft', 'published']).optional(),
+        parentId: z.string().nullable().optional(),
+        locale: z.string().optional(),
+      }),
+    }, async ({ params, body, auth: authCtx }) => {
+      const bp = blueprintFor(params.collection)
+      const allowed = await evaluate(bp, 'create', { user: authCtx.user })
+      if (!allowed) throw new AccessDeniedError('Cannot create')
+      if (!authCtx.user) throw new AccessDeniedError('Authentication required')
+      if (body.parentId && !bp.tree) throw new ValidationError('Collection does not support nesting')
+      const locale = await resolveLocaleParam(db, body.locale)
+      const validated = parseContent(bp.schema, withCanonicalSlug(body.content, body.slug))
+      return await entries.create({
+        collection: params.collection,
+        slug: body.slug,
+        content: validated,
+        locale,
+        ...(body.status !== undefined ? { status: body.status } : {}),
+        ...(body.parentId !== undefined ? { parentId: body.parentId } : {}),
+        draftsEnabled: bp.drafts === true,
+        createdBy: authCtx.user.id,
+      })
+    }),
+
+    createLocale: defineHandler(auth, {
+      params: paramsById,
+      body: z.object({
+        locale: z.string(),
+        slug: z.string(),
+        content: z.unknown(),
+        status: z.enum(['draft', 'published']).optional(),
+      }),
+    }, async ({ params, body, auth: authCtx }) => {
+      const bp = blueprintFor(params.collection)
+      const allowed = await evaluate(bp, 'create', { user: authCtx.user })
+      if (!allowed) throw new AccessDeniedError('Cannot create')
+      if (!authCtx.user) throw new AccessDeniedError('Authentication required')
+      const locale = await resolveLocaleParam(db, body.locale)
+      const validated = parseContent(bp.schema, withCanonicalSlug(body.content, body.slug))
+      return await entries.createLocale(params.id, {
+        locale,
+        slug: body.slug,
+        content: validated,
+        updatedBy: authCtx.user.id,
+        ...(body.status !== undefined ? { status: body.status } : {}),
+        draftsEnabled: bp.drafts === true,
+      })
+    }),
+
+    update: defineHandler(auth, {
+      params: paramsById,
+      body: z.object({
+        slug: z.string().optional(),
+        content: z.unknown().optional(),
+        status: z.enum(['draft', 'published']).optional(),
+        changeSummary: z.string().optional(),
+        publish: z.boolean().optional(),
+        locale: z.string().optional(),
+      }),
+    }, async ({ params, body, auth: authCtx }) => {
+      const bp = blueprintFor(params.collection)
+      const locale = await resolveLocaleParam(db, body.locale)
+      const row = await entries.findById(params.id, locale)
+      if (!row) throw new NotFoundError(`Entry ${params.id} (${locale}) not found`)
+      const allowed = await evaluate(bp, 'update', {
+        user: authCtx.user,
+        entry: { id: row.id, status: row.status, createdBy: row.createdBy, content: row.content },
+      })
+      if (!allowed) throw new AccessDeniedError('Cannot update')
+      if (!authCtx.user) throw new AccessDeniedError('Authentication required')
+      const nextSlug = body.slug ?? row.slug
+      const validated = body.content !== undefined
+        ? parseContent(bp.schema, withCanonicalSlug(body.content, nextSlug))
+        : undefined
+      return await entries.updateWithRevision(params.id, {
+        locale,
+        ...(body.slug !== undefined ? { slug: body.slug } : {}),
+        ...(validated !== undefined ? { content: validated } : {}),
+        ...(body.status !== undefined ? { status: body.status } : {}),
+        ...(body.publish !== undefined ? { publish: body.publish } : {}),
+        draftsEnabled: bp.drafts === true,
+        updatedBy: authCtx.user.id,
+        ...(body.changeSummary !== undefined ? { changeSummary: body.changeSummary } : {}),
+      })
+    }),
+
+    move: defineHandler(auth, {
+      params: paramsById,
+      body: z.object({
+        parentId: z.string().nullable(),
+        sortOrder: z.number().int().positive().optional(),
+      }),
+    }, async ({ params, body, auth: authCtx }) => {
+      const bp = blueprintFor(params.collection)
+      if (!bp.tree) throw new ValidationError('Collection does not support tree structure')
+      const shell = await entries.findShellById(params.id)
+      if (!shell || shell.collection !== params.collection) throw new NotFoundError(`Entry ${params.id} not found`)
+      const allowed = await evaluate(bp, 'update', {
+        user: authCtx.user,
+        entry: { id: shell.id, status: 'draft', createdBy: shell.createdBy, content: {} },
+      })
+      if (!allowed) throw new AccessDeniedError('Cannot move')
+      return await entries.move(params.collection, params.id, {
+        parentId: body.parentId,
+        ...(body.sortOrder !== undefined ? { sortOrder: body.sortOrder } : {}),
+      })
+    }),
+
+    publish: defineHandler(auth, { params: paramsById }, async ({ params, url, auth: authCtx }) => {
+      const bp = blueprintFor(params.collection)
+      if (!bp.drafts) throw new ValidationError('Drafts not enabled for this collection')
+      const locale = await resolveLocaleParam(db, url.searchParams.get('locale'))
+      const row = await entries.findById(params.id, locale)
+      if (!row) throw new NotFoundError(`Entry ${params.id} (${locale}) not found`)
+      const allowed = await evaluate(bp, 'update', {
+        user: authCtx.user,
+        entry: { id: row.id, status: row.status, createdBy: row.createdBy, content: row.content },
+      })
+      if (!allowed) throw new AccessDeniedError('Cannot publish')
+      if (!authCtx.user) throw new AccessDeniedError('Authentication required')
+      const content = row.draftContent ?? row.content
+      const validated = parseContent(bp.schema, content)
+      return await entries.updateWithRevision(params.id, {
+        locale,
+        content: validated,
+        publish: true,
+        draftsEnabled: true,
+        updatedBy: authCtx.user.id,
+      })
+    }),
+
+    delete: defineHandler(auth, { params: paramsById }, async ({ params, url, auth: authCtx }) => {
+      const bp = blueprintFor(params.collection)
+      const localeParam = url.searchParams.get('locale')
+      const shell = await entries.findShellById(params.id)
+      if (!shell || shell.collection !== params.collection) throw new NotFoundError(`Entry ${params.id} not found`)
+      const allowed = await evaluate(bp, 'delete', {
+        user: authCtx.user,
+        entry: { id: shell.id, status: 'draft', createdBy: shell.createdBy, content: {} },
+      })
+      if (!allowed) throw new AccessDeniedError('Cannot delete')
+      if (localeParam) {
+        const locale = await resolveLocaleParam(db, localeParam)
+        const summaries = await entries.listLocales(params.id)
+        if (summaries.length <= 1) {
+          await entries.delete(params.id)
+          return { deleted: true }
+        }
+        await entries.deleteLocale(params.id, locale)
+        return { deleted: true, locale }
+      }
+      await entries.delete(params.id)
+      return { deleted: true }
+    }),
+  }
+}

package/src/server/routes/form-submit.ts

@@ -0,0 +1,168 @@
+import type { VulseDb } from '../../core/db.js'
+import { FormsRepo, SubmissionsRepo, FormUploadDraftsRepo } from '../../core/repos/forms.js'
+import { compileForm } from '../../core/forms/compile.js'
+import { checkRateLimit, hashIp } from '../../core/forms/rate-limit.js'
+import { insertUniqueValues } from '../../core/forms/unique.js'
+import { NotFoundError, ValidationError } from '../../core/errors.js'
+import { fail, ok } from '../envelope.js'
+import { enqueueFormProcess } from '../forms/queue.js'
+import { runFormAfterSubmitHooks, runFormBeforeSubmitHooks } from '../plugins.js'
+
+export interface FormSubmitRouteOptions {
+  queue?: Queue
+  env?: Record<string, unknown>
+}
+
+export function formSubmitRoutes(db: VulseDb, options: FormSubmitRouteOptions = {}) {
+  const forms = new FormsRepo(db)
+  const submissions = new SubmissionsRepo(db)
+  const drafts = new FormUploadDraftsRepo(db)
+
+  return {
+    public: async (request: Request, rawParams: Record<string, string>): Promise<Response> => {
+      try {
+        const handle = rawParams.handle
+        if (!handle) throw new ValidationError('handle required')
+        const form = await forms.findByHandle(handle)
+        if (!form || !form.enabled) throw new NotFoundError('form not found')
+
+        const def = form.definition
+        const honeypot = def.settings.honeypotField ?? '_hp'
+        const publicFields = def.fields
+          .filter((f) => f.ui.kind !== 'honeypot')
+          .map((f) => ({
+            name: f.name,
+            label: f.label,
+            ui: f.ui,
+            optional: f.optional,
+            validation: f.validation,
+          }))
+
+        return ok({
+          handle: form.handle,
+          label: form.label,
+          fields: publicFields,
+          successMessage: def.settings.successMessage,
+          redirectTo: def.settings.redirectTo,
+          honeypotField: honeypot,
+        })
+      } catch (err) {
+        return fail(err)
+      }
+    },
+
+    submit: async (request: Request, rawParams: Record<string, string>): Promise<Response> => {
+      try {
+        const handle = rawParams.handle
+        if (!handle) throw new ValidationError('handle required')
+        const form = await forms.findByHandle(handle)
+        if (!form || !form.enabled || !form.definition.settings.enabled) {
+          throw new NotFoundError('form not found')
+        }
+
+        const def = form.definition
+        const honeypot = def.settings.honeypotField ?? '_hp'
+        let body = await request.json().catch(() => ({})) as Record<string, unknown>
+        const ip = request.headers.get('cf-connecting-ip')
+          ?? request.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
+          ?? '0.0.0.0'
+
+        const beforeSubmit = await runFormBeforeSubmitHooks({
+          request,
+          form: def,
+          payload: body,
+          ip,
+          headers: request.headers,
+        }, options.env)
+        if (beforeSubmit.action === 'drop') {
+          return ok({
+            ok: true,
+            message: def.settings.successMessage ?? 'Thank you!',
+          })
+        }
+        body = beforeSubmit.payload
+
+        const hp = body[honeypot]
+        if (hp !== undefined && hp !== null && String(hp).length > 0) {
+          return ok({
+            ok: true,
+            message: def.settings.successMessage ?? 'Thank you!',
+          })
+        }
+
+        const rate = def.settings.rateLimit ?? { maxPerIp: 10, windowSec: 3600 }
+        const rl = await checkRateLimit(db, handle, await hashIp(ip), rate)
+        if (!rl.allowed) {
+          return new Response(JSON.stringify({
+            ok: false,
+            error: { code: 'RATE_LIMIT', message: 'Too many submissions' },
+          }), {
+            status: 429,
+            headers: {
+              'content-type': 'application/json',
+              ...(rl.retryAfterSec ? { 'retry-after': String(rl.retryAfterSec) } : {}),
+            },
+          })
+        }
+
+        const { schema, uniqueFields, inputFields } = compileForm(def)
+        const parsed = schema.safeParse(body)
+        if (!parsed.success) {
+          throw new ValidationError('Invalid submission', { issues: parsed.error.issues })
+        }
+
+        const payload = parsed.data as Record<string, unknown>
+        const fileRefs: Array<{ field: string; mediaId: string }> = []
+
+        for (const field of inputFields) {
+          if (field.ui.kind !== 'file') continue
+          const mediaId = payload[field.name]
+          if (typeof mediaId !== 'string') continue
+          const draft = await drafts.findValid(handle, field.name, mediaId)
+          if (!draft) throw new ValidationError(`Invalid or expired file for field "${field.name}"`)
+          fileRefs.push({ field: field.name, mediaId })
+          await drafts.attachToSubmission(draft.id)
+        }
+
+        const submission = await submissions.create({
+          formHandle: handle,
+          payload,
+          fileRefs,
+          meta: {
+            ip,
+            ...(request.headers.get('user-agent') ? { userAgent: request.headers.get('user-agent')! } : {}),
+            ...(request.headers.get('referer') ? { referer: request.headers.get('referer')! } : {}),
+          },
+        })
+
+        try {
+          await insertUniqueValues(db, handle, submission.id, payload, uniqueFields)
+        } catch (err) {
+          await submissions.delete(submission.id)
+          throw err
+        }
+
+        await enqueueFormProcess(options.queue, submission.id)
+        await runFormAfterSubmitHooks({
+          request,
+          form: def,
+          payload,
+          submission,
+          ip,
+          headers: request.headers,
+        }, options.env)
+
+        if (def.settings.redirectTo) {
+          return ok({ ok: true, redirect: def.settings.redirectTo })
+        }
+        return ok({
+          ok: true,
+          message: def.settings.successMessage ?? 'Thank you!',
+          submissionId: submission.id,
+        })
+      } catch (err) {
+        return fail(err)
+      }
+    },
+  }
+}

package/src/server/routes/form-upload.ts

@@ -0,0 +1,100 @@
+import type { VulseDb } from '../../core/db.js'
+import { FormsRepo, FormUploadDraftsRepo } from '../../core/repos/forms.js'
+import { MediaRepo } from '../../core/repos/media.js'
+import { NotFoundError, ValidationError } from '../../core/errors.js'
+import { fail, ok } from '../envelope.js'
+import { putToR2 } from '../r2.js'
+
+const DEFAULT_MAX_BYTES = 10 * 1024 * 1024
+const BLOCKED_MIME = new Set([
+  'application/x-msdownload',
+  'application/x-executable',
+  'application/vnd.microsoft.portable-executable',
+])
+
+export interface FormUploadEnv {
+  bucket: R2Bucket
+}
+
+export function formUploadRoutes(db: VulseDb, mediaEnv: FormUploadEnv) {
+  const forms = new FormsRepo(db)
+  const drafts = new FormUploadDraftsRepo(db)
+  const media = new MediaRepo(db)
+
+  return {
+    upload: async (request: Request, rawParams: Record<string, string>): Promise<Response> => {
+      try {
+        const handle = rawParams.handle
+        if (!handle) throw new ValidationError('handle required')
+        const form = await forms.findByHandle(handle)
+        if (!form || !form.enabled) throw new NotFoundError('form not found')
+
+        const formData = await request.formData()
+        const field = formData.get('field')
+        const fileEntry = formData.get('file')
+        if (typeof field !== 'string' || !field) throw new ValidationError('field required')
+        if (!fileEntry || typeof fileEntry === 'string') throw new ValidationError('file required')
+
+        const file = fileEntry as File
+        const fieldDef = form.definition.fields.find((f) => f.name === field)
+        if (!fieldDef || fieldDef.ui.kind !== 'file') {
+          throw new ValidationError(`Unknown file field "${field}"`)
+        }
+
+        const maxBytes = fieldDef.ui.maxBytes ?? DEFAULT_MAX_BYTES
+        if (file.size > maxBytes) throw new ValidationError(`File too large (max ${maxBytes} bytes)`)
+        if (BLOCKED_MIME.has(file.type)) throw new ValidationError(`File type not allowed: ${file.type}`)
+
+        if (fieldDef.ui.accept?.length) {
+          const okMime = fieldDef.ui.accept.some((a) =>
+            a.endsWith('/*') ? file.type.startsWith(a.slice(0, -1)) : file.type === a,
+          )
+          if (!okMime) throw new ValidationError(`File type not allowed: ${file.type}`)
+        }
+
+        const buf = await file.arrayBuffer()
+        const { key } = await putToR2({ bucket: mediaEnv.bucket }, buf, file.type || 'application/octet-stream')
+        const row = await media.create({
+          r2Key: key,
+          mime: file.type || 'application/octet-stream',
+          size: file.size,
+          uploadedBy: null,
+        })
+
+        const ttlHours = form.definition.settings.uploadDraftTtlHours ?? 24
+        const expiresAt = new Date(Date.now() + ttlHours * 3600_000)
+        const draft = await drafts.create({
+          formHandle: handle,
+          fieldName: field,
+          mediaId: row.id,
+          expiresAt,
+        })
+
+        return ok({ mediaId: row.id, draftId: draft.id, expiresAt: expiresAt.toISOString() })
+      } catch (err) {
+        return fail(err)
+      }
+    },
+  }
+}
+
+export async function purgeExpiredFormUploadDrafts(
+  db: VulseDb,
+  bucket: R2Bucket,
+): Promise<{ purged: number }> {
+  const drafts = new FormUploadDraftsRepo(db)
+  const media = new MediaRepo(db)
+  const { deleteFromR2 } = await import('../r2.js')
+  const expired = await drafts.listExpired(new Date())
+  let purged = 0
+  for (const draft of expired) {
+    const row = await media.findById(draft.mediaId)
+    if (row) {
+      await deleteFromR2({ bucket }, row.r2Key)
+      await media.hardDelete(row.id)
+    }
+    await drafts.delete(draft.id)
+    purged++
+  }
+  return { purged }
+}

package/src/server/routes/forms.ts

@@ -0,0 +1,88 @@
+import { z } from 'astro/zod'
+import type { Auth } from '../better-auth.js'
+import type { VulseDb } from '../../core/db.js'
+import { FormsRepo, SubmissionsRepo } from '../../core/repos/forms.js'
+import { FormDefinitionSchema } from '../../core/forms/definition.js'
+import { NotFoundError } from '../../core/errors.js'
+import { defineHandler } from '../handler.js'
+
+const paramsHandle = z.object({ handle: z.string() })
+const paramsHandleId = z.object({ handle: z.string(), id: z.string() })
+
+export function formsRoutes(db: VulseDb, auth: Auth) {
+  const forms = new FormsRepo(db)
+  const submissions = new SubmissionsRepo(db)
+
+  return {
+    list: defineHandler(auth, { requireRole: ['admin', 'editor'] }, async () => forms.list()),
+
+    create: defineHandler(auth, {
+      body: FormDefinitionSchema,
+      requireRole: ['admin'],
+    }, async ({ body }) => forms.create(body)),
+
+    get: defineHandler(auth, {
+      params: paramsHandle,
+      requireRole: ['admin', 'editor'],
+    }, async ({ params }) => {
+      const row = await forms.findByHandle(params.handle)
+      if (!row) throw new NotFoundError('form not found')
+      return row
+    }),
+
+    update: defineHandler(auth, {
+      params: paramsHandle,
+      body: FormDefinitionSchema,
+      requireRole: ['admin'],
+    }, async ({ params, body }) => forms.update(params.handle, body)),
+
+    delete: defineHandler(auth, {
+      params: paramsHandle,
+      requireRole: ['admin'],
+    }, async ({ params }) => {
+      await forms.delete(params.handle)
+      return null
+    }),
+
+    listSubmissions: defineHandler(auth, {
+      params: paramsHandle,
+      requireRole: ['admin', 'editor'],
+    }, async ({ params, url }) => {
+      const limit = Number(url.searchParams.get('limit') ?? '50')
+      const offset = Number(url.searchParams.get('offset') ?? '0')
+      return submissions.list({
+        formHandle: params.handle,
+        limit: Number.isFinite(limit) ? limit : 50,
+        offset: Number.isFinite(offset) ? offset : 0,
+      })
+    }),
+
+    getSubmission: defineHandler(auth, {
+      params: paramsHandleId,
+      requireRole: ['admin', 'editor'],
+    }, async ({ params }) => {
+      const row = await submissions.findById(params.id)
+      if (!row || row.formHandle !== params.handle) throw new NotFoundError('submission not found')
+      return row
+    }),
+
+    deleteSubmission: defineHandler(auth, {
+      params: paramsHandleId,
+      requireRole: ['admin', 'editor'],
+    }, async ({ params }) => {
+      const row = await submissions.findById(params.id)
+      if (!row || row.formHandle !== params.handle) throw new NotFoundError('submission not found')
+      await submissions.delete(params.id)
+      return null
+    }),
+
+    bulkDeleteSubmissions: defineHandler(auth, {
+      params: paramsHandle,
+      body: z.object({ ids: z.array(z.string()).min(1) }),
+      requireRole: ['admin', 'editor'],
+    }, async ({ params, body }) => {
+      const deleted = await submissions.deleteMany(body.ids)
+      return { deleted }
+    }),
+  }
+}

package/src/server/routes/globals-public.ts

@@ -0,0 +1,30 @@
+import type { VulseDb } from '../../core/db.js'
+import { GlobalsRepo } from '../../core/repos/globals.js'
+import { NotFoundError } from '../../core/errors.js'
+import { fail, ok } from '../envelope.js'
+
+export function globalsPublicRoutes(db: VulseDb) {
+  const globals = new GlobalsRepo(db)
+
+  return {
+    list: async (): Promise<Response> => {
+      try {
+        return ok(await globals.publicValues())
+      } catch (err) {
+        return fail(err)
+      }
+    },
+
+    get: async (_request: Request, rawParams: Record<string, string>): Promise<Response> => {
+      try {
+        const handle = rawParams.handle
+        if (!handle) throw new NotFoundError('global set not found')
+        const content = await globals.publicValue(handle)
+        if (content === null) throw new NotFoundError('global set not found')
+        return ok(content)
+      } catch (err) {
+        return fail(err)
+      }
+    },
+  }
+}