@gogitcms/editor 0.23.0

package/app/src/queries.ts

@@ -0,0 +1,591 @@
+import { gql } from "@apollo/client";
+
+export const LOGIN = gql`
+  mutation Login($email: String!, $password: String!) {
+    login(email: $email, password: $password) {
+      accessToken
+      refreshToken
+    }
+  }
+`;
+
+export const WORKSPACES = gql`
+  query Workspaces {
+    workspaces {
+      id
+      name
+      slug
+    }
+  }
+`;
+
+export const REPOSITORIES = gql`
+  query Repositories($workspaceId: ID) {
+    repositories(workspaceId: $workspaceId) {
+      id
+      owner
+      name
+      branches {
+        id
+        name
+        protected
+        requiresChangeRequest
+        writableProjects
+      }
+      defaultBranch
+      projects {
+        name
+        label
+        orphaned
+      }
+    }
+  }
+`;
+
+// ---- changes: this branch vs. the repository's default branch ---------------
+// All three return empty on the default branch (it has no changes against
+// itself), so they are safe to query unconditionally.
+
+export const BRANCH_CHANGE_SUMMARY = gql`
+  query BranchChangeSummary($repositoryId: ID!, $branchId: ID!, $targetBranchId: ID) {
+    branchChangeSummary(repositoryId: $repositoryId, branchId: $branchId, targetBranchId: $targetBranchId) {
+      project
+      collection
+      label
+      singleton
+      count
+      kind
+    }
+  }
+`;
+
+export const BRANCH_MEDIA_CHANGES = gql`
+  query BranchMediaChanges($repositoryId: ID!, $branchId: ID!, $targetBranchId: ID) {
+    branchMediaChanges(repositoryId: $repositoryId, branchId: $branchId, targetBranchId: $targetBranchId) {
+      status
+      set
+      path
+      previousPath
+      before { size mimeType kind width height pending url }
+      after { size mimeType kind width height pending url }
+    }
+  }
+`;
+
+export const BRANCH_CHANGES = gql`
+  query BranchChanges($repositoryId: ID!, $branchId: ID!, $targetBranchId: ID, $collection: String) {
+    branchChanges(repositoryId: $repositoryId, branchId: $branchId, targetBranchId: $targetBranchId, collection: $collection) {
+      project
+      status
+      collection
+      path
+      previousPath
+      label
+      added
+      removed
+      documentId
+    }
+  }
+`;
+
+export const BRANCH_CHANGE = gql`
+  query BranchChange($repositoryId: ID!, $branchId: ID!, $targetBranchId: ID, $path: String!) {
+    branchChange(repositoryId: $repositoryId, branchId: $branchId, targetBranchId: $targetBranchId, path: $path) {
+      path
+      previousPath
+      status
+      collection
+      label
+      added
+      removed
+      bodyBefore
+      bodyAfter
+      fields {
+        name
+        label
+        kind
+        before
+        after
+      }
+    }
+  }
+`;
+
+// The merge run's fields, shared by the mutation, query and subscription so the
+// Apollo cache normalizes them onto one MergeRun by id.
+const MERGE_RUN_FIELDS = gql`
+  fragment MergeRunFields on MergeRun {
+    id
+    status
+    step
+    sourceBranch
+    targetBranch
+    commit
+    filesChanged
+    added
+    removed
+    error
+    escalationFiles
+    conflicts {
+      id
+      path
+      collection
+      field
+      isBody
+      before
+      after
+      resolution
+    }
+  }
+`;
+
+// A change request's fields. The `full` variant (summary page) also pulls the
+// live PR description and comments; the list/open check omits them.
+const CHANGE_REQUEST_FIELDS = gql`
+  fragment ChangeRequestFields on ChangeRequest {
+    id
+    status
+    sourceBranch
+    targetBranch
+    prNumber
+    prUrl
+    explanation
+    conflictFiles
+    mergeBranch
+    createdAt
+  }
+`;
+
+export const APPLY_CHANGES = gql`
+  ${MERGE_RUN_FIELDS}
+  mutation ApplyChanges($repositoryId: ID!, $sourceBranchId: ID!, $targetBranchId: ID!) {
+    applyChanges(repositoryId: $repositoryId, sourceBranchId: $sourceBranchId, targetBranchId: $targetBranchId) {
+      ...MergeRunFields
+    }
+  }
+`;
+
+export const MERGE_RUN = gql`
+  ${MERGE_RUN_FIELDS}
+  query MergeRun($id: ID!) {
+    mergeRun(id: $id) {
+      ...MergeRunFields
+    }
+  }
+`;
+
+export const MERGE_RUN_PROGRESS = gql`
+  ${MERGE_RUN_FIELDS}
+  subscription MergeRunProgress($id: ID!) {
+    mergeRunProgress(id: $id) {
+      ...MergeRunFields
+    }
+  }
+`;
+
+export const RESOLVE_MERGE_CONFLICT = gql`
+  ${MERGE_RUN_FIELDS}
+  mutation ResolveMergeConflict($runId: ID!, $conflictId: ID!, $choice: String!, $override: Any) {
+    resolveMergeConflict(runId: $runId, conflictId: $conflictId, choice: $choice, override: $override) {
+      ...MergeRunFields
+    }
+  }
+`;
+
+export const OPEN_CHANGE_REQUEST = gql`
+  ${CHANGE_REQUEST_FIELDS}
+  query OpenChangeRequest($repositoryId: ID!, $sourceBranchId: ID!, $targetBranchId: ID!) {
+    openChangeRequest(repositoryId: $repositoryId, sourceBranchId: $sourceBranchId, targetBranchId: $targetBranchId) {
+      ...ChangeRequestFields
+    }
+  }
+`;
+
+export const CHANGE_REQUEST_FOR_BRANCH = gql`
+  ${CHANGE_REQUEST_FIELDS}
+  query ChangeRequestForBranch($repositoryId: ID!, $branchId: ID!) {
+    changeRequestForBranch(repositoryId: $repositoryId, branchId: $branchId) {
+      ...ChangeRequestFields
+    }
+  }
+`;
+
+export const CHANGE_REQUEST = gql`
+  ${CHANGE_REQUEST_FIELDS}
+  query ChangeRequest($id: ID!) {
+    changeRequest(id: $id) {
+      ...ChangeRequestFields
+      description
+      comments {
+        author
+        body
+        createdAt
+      }
+    }
+  }
+`;
+
+export const CREATE_CHANGE_REQUEST = gql`
+  ${CHANGE_REQUEST_FIELDS}
+  mutation CreateChangeRequest($runId: ID!, $explanation: String!) {
+    createChangeRequest(runId: $runId, explanation: $explanation) {
+      ...ChangeRequestFields
+    }
+  }
+`;
+
+export const CREATE_BRANCH = gql`
+  mutation CreateBranch($repositoryId: ID!, $fromBranchId: ID!, $name: String!) {
+    createBranch(repositoryId: $repositoryId, fromBranchId: $fromBranchId, name: $name) {
+      id
+      name
+    }
+  }
+`;
+
+// The scalar (leaf) attributes of a FieldDef. Reused at each nesting depth since
+// GraphQL selections can't self-recurse.
+const FIELD_DEF_BASE = gql`
+  fragment FieldDefBase on FieldDef {
+    name
+    label
+    type
+    required
+    component
+    source
+    format
+    flavor
+    media
+    storeAs
+    of
+    discriminator
+    pattern
+    enumValues
+    min
+    max
+    minItems
+    maxItems
+  }
+`;
+
+// Object/array nesting is expanded to a fixed depth (~3 levels of object fields,
+// ~2 for mixed-list variant fields) — enough for realistic content models.
+export const COLLECTIONS = gql`
+  query Collections($repositoryId: ID!, $branchId: ID!, $project: String) {
+    collections(repositoryId: $repositoryId, branchId: $branchId, project: $project) {
+      name
+      label
+      path
+      singleton
+      documentCount
+      filename
+      canCreate
+      canUpdate
+      canDelete
+      fields {
+        ...FieldDefBase
+        fields {
+          ...FieldDefBase
+          fields {
+            ...FieldDefBase
+          }
+          variants {
+            name
+            label
+            fields {
+              ...FieldDefBase
+            }
+          }
+        }
+        variants {
+          name
+          label
+          fields {
+            ...FieldDefBase
+            fields {
+              ...FieldDefBase
+            }
+          }
+        }
+      }
+    }
+  }
+  ${FIELD_DEF_BASE}
+`;
+
+// The collection list — display fields only. A document's full fields+body are
+// fetched lazily per open tab via DOCUMENT, so browsing a large collection
+// doesn't pull every body into memory.
+export const DOCUMENTS = gql`
+  query Documents(
+    $repositoryId: ID!
+    $branchId: ID!
+    $project: String
+    $collection: String!
+    $limit: Int
+    $offset: Int
+    $search: String
+    $filters: [DocumentFilter!]
+  ) {
+    documents(
+      repositoryId: $repositoryId
+      branchId: $branchId
+      project: $project
+      collection: $collection
+      limit: $limit
+      offset: $offset
+      search: $search
+      filters: $filters
+    ) {
+      id
+      path
+      label
+    }
+  }
+`;
+
+// Count of documents matching a collection's search/filters — drives the
+// filtered result total (pagination) and the faceted panel's optimistic "Show N".
+export const DOCUMENT_COUNT = gql`
+  query DocumentCount($repositoryId: ID!, $branchId: ID!, $project: String, $collection: String!, $search: String, $filters: [DocumentFilter!]) {
+    documentCount(repositoryId: $repositoryId, branchId: $branchId, project: $project, collection: $collection, search: $search, filters: $filters)
+  }
+`;
+
+// One document's full content, loaded when its tab is opened (its own loading
+// cycle). Independent of the active collection, so tabs persist across it.
+export const DOCUMENT = gql`
+  query Document($repositoryId: ID!, $id: ID!) {
+    document(repositoryId: $repositoryId, id: $id) {
+      id
+      path
+      label
+      fields
+      body
+    }
+  }
+`;
+
+// Current user identity, used to label the local participant in collaborative
+// editing (presence outlines/cursors). Cached once per session.
+export const ME = gql`
+  query Me {
+    me {
+      id
+      email
+    }
+  }
+`;
+
+export const NOTIFICATIONS = gql`
+  query Notifications($repositoryId: ID, $limit: Int) {
+    notifications(repositoryId: $repositoryId, limit: $limit) {
+      id
+      title
+      body
+      level
+      read
+      createdAt
+      authorName
+      authorEmail
+    }
+    unreadNotificationCount(repositoryId: $repositoryId)
+  }
+`;
+
+// ---- branch import ---------------------------------------------------------
+// The query answers the editor's opening question (does this branch have content
+// yet?); the subscription keeps answering it for the life of the session, since
+// a push webhook can start an import at any moment. Both select the same fields
+// so the second normalizes over the first in the Apollo cache.
+const BRANCH_IMPORT_FIELDS = gql`
+  fragment BranchImportFields on BranchImport {
+    branchId
+    status
+    running
+    imported
+    error
+    errorCode
+  }
+`;
+
+export const BRANCH_IMPORT = gql`
+  ${BRANCH_IMPORT_FIELDS}
+  query BranchImport($repositoryId: ID!, $branchId: ID!) {
+    branchImport(repositoryId: $repositoryId, branchId: $branchId) {
+      ...BranchImportFields
+    }
+  }
+`;
+
+export const BRANCH_IMPORT_PROGRESS = gql`
+  ${BRANCH_IMPORT_FIELDS}
+  subscription BranchImportProgress($repositoryId: ID!, $branchId: ID!) {
+    branchImportProgress(repositoryId: $repositoryId, branchId: $branchId) {
+      ...BranchImportFields
+    }
+  }
+`;
+
+export const MARK_NOTIFICATIONS_READ = gql`
+  mutation MarkNotificationsRead($repositoryId: ID) {
+    markNotificationsRead(all: true, repositoryId: $repositoryId)
+  }
+`;
+
+export const UPDATE_DOCUMENT = gql`
+  mutation UpdateDocument($repositoryId: ID!, $id: ID!, $fields: JSON!, $body: String) {
+    updateDocument(repositoryId: $repositoryId, id: $id, fields: $fields, body: $body) {
+      id
+      path
+      label
+      fields
+      body
+    }
+  }
+`;
+
+export const CREATE_DOCUMENT = gql`
+  mutation CreateDocument($repositoryId: ID!, $branchId: ID!, $project: String, $collection: String!, $fields: JSON!, $body: String, $filename: String) {
+    createDocument(repositoryId: $repositoryId, branchId: $branchId, project: $project, collection: $collection, fields: $fields, body: $body, filename: $filename) {
+      id
+      path
+      label
+      fields
+      body
+    }
+  }
+`;
+
+export const DELETE_DOCUMENTS = gql`
+  mutation DeleteDocuments($repositoryId: ID!, $ids: [ID!]!) {
+    deleteDocuments(repositoryId: $repositoryId, ids: $ids)
+  }
+`;
+
+export const MOVE_DOCUMENTS = gql`
+  mutation MoveDocuments($repositoryId: ID!, $ids: [ID!]!, $sourceFolder: String, $targetFolder: String!) {
+    moveDocuments(repositoryId: $repositoryId, ids: $ids, sourceFolder: $sourceFolder, targetFolder: $targetFolder)
+  }
+`;
+
+// ---- media ----------------------------------------------------------------
+
+// The scalar attributes of a Media, reused by every media query.
+const MEDIA_BASE = gql`
+  fragment MediaBase on Media {
+    id
+    set
+    repoPath
+    publicPath
+    cdnPath
+    mimeType
+    extension
+    kind
+    size
+    width
+    height
+    pending
+    url
+  }
+`;
+
+export const MEDIA_SETS = gql`
+  query MediaSets($repositoryId: ID!, $branchId: ID!, $project: String) {
+    mediaSets(repositoryId: $repositoryId, branchId: $branchId, project: $project) {
+      name
+      path
+      mimeTypes
+      publicBase
+      cdnBase
+      count
+    }
+  }
+`;
+
+export const MEDIA = gql`
+  ${MEDIA_BASE}
+  query Media($repositoryId: ID!, $branchId: ID!, $project: String, $set: String, $kinds: [String!], $search: String, $filters: [MediaFilter!], $limit: Int, $offset: Int) {
+    media(repositoryId: $repositoryId, branchId: $branchId, project: $project, set: $set, kinds: $kinds, search: $search, filters: $filters, limit: $limit, offset: $offset) {
+      ...MediaBase
+    }
+  }
+`;
+
+export const MEDIA_COUNT = gql`
+  query MediaCount($repositoryId: ID!, $branchId: ID!, $project: String, $set: String, $kinds: [String!], $search: String, $filters: [MediaFilter!]) {
+    mediaCount(repositoryId: $repositoryId, branchId: $branchId, project: $project, set: $set, kinds: $kinds, search: $search, filters: $filters)
+  }
+`;
+
+export const MEDIA_FACETS = gql`
+  query MediaFacets($repositoryId: ID!, $branchId: ID!, $project: String, $set: String) {
+    mediaFacets(repositoryId: $repositoryId, branchId: $branchId, project: $project, set: $set) {
+      extensions { value count }
+      mimeTypes { value count }
+      kinds { value count }
+      minSize
+      maxSize
+      total
+    }
+  }
+`;
+
+export const MEDIA_BY_ID = gql`
+  ${MEDIA_BASE}
+  query MediaById($repositoryId: ID!, $branchId: ID!, $project: String, $id: ID!) {
+    mediaById(repositoryId: $repositoryId, branchId: $branchId, project: $project, id: $id) {
+      ...MediaBase
+    }
+  }
+`;
+
+// Batched: one round trip resolves every media string in a document.
+export const RESOLVE_MEDIA = gql`
+  ${MEDIA_BASE}
+  query ResolveMedia($repositoryId: ID!, $branchId: ID!, $project: String, $paths: [String!]!, $documentPath: String) {
+    resolveMedia(repositoryId: $repositoryId, branchId: $branchId, project: $project, paths: $paths, documentPath: $documentPath) {
+      input
+      aliasKind
+      ambiguous
+      media {
+        ...MediaBase
+      }
+      candidates {
+        ...MediaBase
+      }
+    }
+  }
+`;
+
+export const CREATE_MEDIA_UPLOAD = gql`
+  mutation CreateMediaUpload($repositoryId: ID!, $branchId: ID!, $project: String, $set: String!, $filename: String!, $contentType: String!, $size: Int!, $folder: String) {
+    createMediaUpload(repositoryId: $repositoryId, branchId: $branchId, project: $project, set: $set, filename: $filename, contentType: $contentType, size: $size, folder: $folder) {
+      uploadId
+      url
+      repoPath
+      expiresIn
+    }
+  }
+`;
+
+export const FINALIZE_MEDIA_UPLOAD = gql`
+  ${MEDIA_BASE}
+  mutation FinalizeMediaUpload($repositoryId: ID!, $branchId: ID!, $project: String, $uploadId: String!) {
+    finalizeMediaUpload(repositoryId: $repositoryId, branchId: $branchId, project: $project, uploadId: $uploadId) {
+      ...MediaBase
+    }
+  }
+`;
+
+export const RENAME_DOCUMENT = gql`
+  mutation RenameDocument($repositoryId: ID!, $id: ID!, $filename: String, $folder: String) {
+    renameDocument(repositoryId: $repositoryId, id: $id, filename: $filename, folder: $folder) {
+      id
+      path
+      label
+      fields
+      body
+    }
+  }
+`;

package/app/src/virtual-cms-plugins.d.ts

@@ -0,0 +1,6 @@
+// Provided by the cms-frontend CLI (bin/cms-frontend.mjs cmsPluginsVite):
+// the plugin entries generated from cms.config.js `plugins`.
+declare module "virtual:cms-plugins" {
+  import type { PluginLoadEntry } from "@gogitcms/plugin-sdk";
+  export const plugins: PluginLoadEntry[];
+}

package/app/vendor/analytics/src/__tests__/config.test.ts

@@ -0,0 +1,91 @@
+import {
+  DEFAULT_API_HOST,
+  isAnalyticsEnabled,
+  posthogOptions,
+  resolveAnalyticsConfig,
+} from "../config";
+
+// Analytics being off unless it is deliberately switched on is the property
+// that matters most here: a self-hosted CMS must not phone home.
+describe("resolveAnalyticsConfig", () => {
+  it("is disabled with no configuration at all", () => {
+    for (const raw of [undefined, null, {}]) {
+      expect(isAnalyticsEnabled(resolveAnalyticsConfig(raw))).toBe(false);
+    }
+  });
+
+  it("is disabled when the key is blank or whitespace", () => {
+    for (const POSTHOG_API_KEY of ["", "   "]) {
+      expect(isAnalyticsEnabled(resolveAnalyticsConfig({ POSTHOG_API_KEY }))).toBe(false);
+    }
+  });
+
+  it("is enabled by an API key alone, defaulting the host", () => {
+    const cfg = resolveAnalyticsConfig({ POSTHOG_API_KEY: "phc_abc" });
+    expect(isAnalyticsEnabled(cfg)).toBe(true);
+    expect(cfg.apiHost).toBe(DEFAULT_API_HOST);
+  });
+
+  it("trims values, so a stray newline from a build arg can't break the host", () => {
+    const cfg = resolveAnalyticsConfig({
+      POSTHOG_API_KEY: "  phc_abc\n",
+      POSTHOG_API_HOST: " https://eu.i.posthog.com ",
+    });
+    expect(cfg.apiKey).toBe("phc_abc");
+    expect(cfg.apiHost).toBe("https://eu.i.posthog.com");
+  });
+
+  it("keeps session recording off unless explicitly opted in", () => {
+    const off = ["", "false", "1", "yes", undefined];
+    for (const POSTHOG_SESSION_RECORDING of off) {
+      const cfg = resolveAnalyticsConfig({ POSTHOG_API_KEY: "phc_abc", POSTHOG_SESSION_RECORDING });
+      expect(cfg.sessionRecording).toBe(false);
+    }
+    const on = resolveAnalyticsConfig({ POSTHOG_API_KEY: "phc_abc", POSTHOG_SESSION_RECORDING: "true" });
+    expect(on.sessionRecording).toBe(true);
+  });
+
+  it("leaves optional fields undefined rather than empty strings", () => {
+    const cfg = resolveAnalyticsConfig({ POSTHOG_API_KEY: "phc_abc", POSTHOG_UI_HOST: "", POSTHOG_ENVIRONMENT: "  " });
+    expect(cfg.uiHost).toBeUndefined();
+    expect(cfg.environment).toBeUndefined();
+  });
+});
+
+describe("posthogOptions", () => {
+  const cfg = resolveAnalyticsConfig({ POSTHOG_API_KEY: "phc_abc" });
+
+  it("defaults to privacy-preserving settings for a content editor", () => {
+    const opts = posthogOptions(cfg);
+    // The CMS renders unpublished customer content; replay must be opt-in.
+    expect(opts.disable_session_recording).toBe(true);
+    expect(opts.mask_all_text).toBe(true);
+    expect(opts.session_recording).toEqual({ maskAllInputs: true });
+    // Anonymous visitors shouldn't create person records.
+    expect(opts.person_profiles).toBe("identified_only");
+  });
+
+  it("enables recording only when opted in, still masked", () => {
+    const opts = posthogOptions(
+      resolveAnalyticsConfig({ POSTHOG_API_KEY: "phc_abc", POSTHOG_SESSION_RECORDING: "true" }),
+    );
+    expect(opts.disable_session_recording).toBe(false);
+    expect(opts.mask_all_text).toBe(true);
+  });
+
+  // Left undefined, posthog-js defers to the project's remote config, which is
+  // how error tracking silently stayed off everywhere. Assert the explicit opt-in.
+  it("turns on exception autocapture rather than leaving it to remote config", () => {
+    expect(posthogOptions(cfg).capture_exceptions).toBe(true);
+  });
+
+  it("pins posthog-js defaults so an upgrade can't change what is captured", () => {
+    expect(posthogOptions(cfg).defaults).toBe("2025-05-24");
+  });
+
+  it("omits ui_host unless one is configured", () => {
+    expect("ui_host" in posthogOptions(cfg)).toBe(false);
+    const withUi = posthogOptions(resolveAnalyticsConfig({ POSTHOG_API_KEY: "k", POSTHOG_UI_HOST: "https://eu.posthog.com" }));
+    expect(withUi.ui_host).toBe("https://eu.posthog.com");
+  });
+});