@growth-labs/cms 0.1.0

package/src/routes/config.ts

@@ -0,0 +1,99 @@
+// Site configuration for the CMS route handlers (WS7-07). Every Fronts
+// theme-token (inventory §7) that was previously a module-level constant
+// becomes a value the site supplies here, with the documented Fronts default
+// preserved so an unconfigured site behaves exactly as Fronts did.
+
+import type { OgImageRenderer } from '../engine/og-render.js'
+import { nullProviders } from '../providers/null.js'
+import type { CmsProviders, FoundryDispatch, LlmDispatch } from '../providers/types.js'
+import type { Authz } from './context.js'
+
+/**
+ * Taxonomy + theme tokens + binding names + authz the site supplies. All fields
+ * are optional except `authz`: omitting a field uses the verbatim Fronts
+ * default (inventory §7), so the routes are drop-in for Fronts and
+ * parameterized for everyone else.
+ */
+export interface CmsRouteConfig {
+	/** Injected auth/authz — the only required field. */
+	authz: Authz
+
+	/**
+	 * Allowed `primaryCategory` slugs (stored in `content_items.channel`).
+	 * Used to validate the create/update payload. Default: any non-empty string
+	 * (Fronts pins this to its `PRIMARY_CATEGORY_SLUGS`; a generic site that
+	 * does not want an enum leaves it undefined). The default `'analysis'` is
+	 * applied by the engine when the field is omitted on create.
+	 */
+	primaryCategorySlugs?: readonly [string, ...string[]]
+	/** Default primary category for create (Fronts: 'analysis'). */
+	defaultPrimaryCategory?: string
+	/**
+	 * Allowed `primaryTopic` slugs. Default: any non-empty string (Fronts pins
+	 * this to `PRIMARY_LABEL_SLUGS`).
+	 */
+	primaryTopicSlugs?: readonly [string, ...string[]]
+	/** Default primary topic for create (Fronts: 'global'). */
+	defaultPrimaryTopic?: string
+
+	/** R2 binding name recorded on media rows. Fronts default: 'PUBLIC_MEDIA'. */
+	mediaR2Binding?: string
+	/** `media_assets.site_id` value. Fronts default: 'fronts'. */
+	mediaSiteId?: string
+	/** Public media host for `publicUrlFor`. Fronts default: 'media.fronts.co'. */
+	mediaPublicDomain?: string
+	/** Image variant names returned on upload. Fronts default below. */
+	imageVariants?: readonly string[]
+
+	/** Default scheduling/publish timezone. Fronts default: 'Europe/Paris'. */
+	publishTimezone?: string
+
+	/** Render-but-inject providers (spec §3.3). Defaults to nullProviders. */
+	providers?: Partial<CmsProviders>
+	/** Injected dispatch hooks (LLM, Foundry video, OG renderer, webhooks). All optional. */
+	hooks?: {
+		llm?: LlmDispatch
+		foundryVideo?: FoundryDispatch
+		/** OG-image renderer (P4 Task 5). The mechanism (Browser Rendering / Resvg-WASM) is
+		 * supplied by the site at cutover (P8). Absent → generateOgImage returns 501. */
+		ogRenderer?: OgImageRenderer
+	}
+}
+
+export interface ResolvedCmsRouteConfig {
+	authz: Authz
+	primaryCategorySlugs: readonly string[] | null
+	defaultPrimaryCategory: string
+	primaryTopicSlugs: readonly string[] | null
+	defaultPrimaryTopic: string
+	mediaR2Binding: string
+	mediaSiteId: string
+	mediaPublicDomain: string
+	imageVariants: readonly string[]
+	publishTimezone: string
+	providers: CmsProviders
+	hooks: {
+		llm?: LlmDispatch
+		foundryVideo?: FoundryDispatch
+		ogRenderer?: OgImageRenderer
+	}
+}
+
+const FRONTS_DEFAULT_IMAGE_VARIANTS = ['thumbnail', 'card', 'article', 'hero', 'full'] as const
+
+export function resolveConfig(config: CmsRouteConfig): ResolvedCmsRouteConfig {
+	return {
+		authz: config.authz,
+		primaryCategorySlugs: config.primaryCategorySlugs ?? null,
+		defaultPrimaryCategory: config.defaultPrimaryCategory ?? 'analysis',
+		primaryTopicSlugs: config.primaryTopicSlugs ?? null,
+		defaultPrimaryTopic: config.defaultPrimaryTopic ?? 'global',
+		mediaR2Binding: config.mediaR2Binding ?? 'PUBLIC_MEDIA',
+		mediaSiteId: config.mediaSiteId ?? 'fronts',
+		mediaPublicDomain: config.mediaPublicDomain ?? 'media.fronts.co',
+		imageVariants: config.imageVariants ?? FRONTS_DEFAULT_IMAGE_VARIANTS,
+		publishTimezone: config.publishTimezone ?? 'Europe/Paris',
+		providers: { ...nullProviders, ...(config.providers ?? {}) },
+		hooks: config.hooks ?? {},
+	}
+}

package/src/routes/content-insights.ts

@@ -0,0 +1,159 @@
+import { z } from 'zod'
+import {
+	dismissInsight,
+	isMissingInsightsTable,
+	listInsightBoard,
+	replaceInsightsBoard,
+	undismissInsight,
+} from '../engine/content-insights.js'
+import { verifyHmac } from '../engine/foundry-dispatch.js'
+import { InsightsIngestPayloadSchema } from '../schema/insights-ingest.js'
+import type { CmsRouteConfig } from './config.js'
+import { resolveConfig } from './config.js'
+import { json, type RouteContext } from './context.js'
+
+const DismissSchema = z.object({ intentKey: z.string().min(1) })
+
+/** Resolve YYYY-MM-DD; defaults to the current UTC date when no ?runDate is given. */
+function resolveRunDate(ctx: RouteContext): string {
+	const url = new URL(ctx.request.url)
+	const q = url.searchParams.get('runDate')
+	if (q && /^\d{4}-\d{2}-\d{2}$/.test(q)) return q
+	return new Date().toISOString().slice(0, 10)
+}
+
+/**
+ * Resolve the HMAC secret from ctx.env.INSIGHTS_INGEST_HMAC_SECRET.
+ * Supports both:
+ *   - plain string (test injection: env: { INSIGHTS_INGEST_HMAC_SECRET: 'test-...' })
+ *   - Secrets Store binding object { get(): Promise<string> } (production Workers binding)
+ * Returns null → 500 "not configured".
+ */
+async function resolveIngestSecret(
+	env: Record<string, unknown> | undefined,
+): Promise<string | null> {
+	const raw = env?.INSIGHTS_INGEST_HMAC_SECRET
+	if (typeof raw === 'string') return raw
+	if (
+		raw !== null &&
+		typeof raw === 'object' &&
+		typeof (raw as { get?: unknown }).get === 'function'
+	) {
+		try {
+			const val = await (raw as { get(): Promise<string> }).get()
+			if (typeof val === 'string' && val.length > 0) return val
+		} catch {
+			return null
+		}
+	}
+	return null
+}
+
+export interface ContentInsightsRouteConfig extends CmsRouteConfig {
+	/** The site/workspace id whose board this surface reads. Defaults to 'default'. */
+	activeWorkspaceId?: string
+}
+
+export interface ContentInsightsRouteHandlers {
+	/** GET /content/insights?runDate= — the current board, dismissed intents filtered out. */
+	board(ctx: RouteContext): Promise<Response>
+	/** POST /content/insights/dismiss { intentKey } — persist a dismissal. */
+	dismiss(ctx: RouteContext): Promise<Response>
+	/** POST /content/insights/undismiss { intentKey } — clear a dismissal. */
+	undismiss(ctx: RouteContext): Promise<Response>
+	/** POST /content/insights-ingest — HMAC machine ingest (replay-safe replace). */
+	ingest(ctx: RouteContext): Promise<Response>
+}
+
+export function createContentInsightsRoutes(
+	config: ContentInsightsRouteConfig,
+): ContentInsightsRouteHandlers {
+	const resolved = resolveConfig(config)
+	const siteId = config.activeWorkspaceId ?? 'default'
+
+	return {
+		async board(ctx) {
+			const denied = await resolved.authz.requirePublisher(ctx)
+			if (denied) return denied
+			const runDate = resolveRunDate(ctx)
+			try {
+				const insights = await listInsightBoard(ctx.db, siteId, runDate)
+				return json({ insights, runDate, siteId })
+			} catch (error) {
+				if (isMissingInsightsTable(error)) return json({ error: 'schema_not_ready' }, 409)
+				throw error
+			}
+		},
+
+		async dismiss(ctx) {
+			const denied = await resolved.authz.requirePublisher(ctx)
+			if (denied) return denied
+			const parsed = DismissSchema.safeParse(await ctx.request.json().catch(() => null))
+			if (!parsed.success)
+				return json({ error: 'Invalid request', details: parsed.error.flatten() }, 400)
+			try {
+				await dismissInsight(ctx.db, siteId, parsed.data.intentKey, ctx.userId ?? null)
+				return json({ dismissed: true })
+			} catch (error) {
+				if (isMissingInsightsTable(error)) return json({ error: 'schema_not_ready' }, 409)
+				throw error
+			}
+		},
+
+		async undismiss(ctx) {
+			const denied = await resolved.authz.requirePublisher(ctx)
+			if (denied) return denied
+			const parsed = DismissSchema.safeParse(await ctx.request.json().catch(() => null))
+			if (!parsed.success)
+				return json({ error: 'Invalid request', details: parsed.error.flatten() }, 400)
+			try {
+				await undismissInsight(ctx.db, siteId, parsed.data.intentKey)
+				return json({ undismissed: true })
+			} catch (error) {
+				if (isMissingInsightsTable(error)) return json({ error: 'schema_not_ready' }, 409)
+				throw error
+			}
+		},
+
+		// HMAC-guarded machine ingest — NOT behind requirePublisher (sibling of foundryCallback).
+		async ingest(ctx) {
+			const hmacSecret = await resolveIngestSecret(ctx.env)
+			if (!hmacSecret) return json({ error: 'INSIGHTS_INGEST_HMAC_SECRET is not configured' }, 500)
+
+			let rawBody: string
+			try {
+				rawBody = await ctx.request.text()
+			} catch {
+				return json({ error: 'Failed to read request body' }, 400)
+			}
+
+			const signature = ctx.request.headers.get('X-Foundry-Signature') ?? ''
+			const valid = await verifyHmac(hmacSecret, rawBody, signature)
+			if (!valid) return json({ error: 'Invalid signature' }, 401)
+
+			let raw: unknown
+			try {
+				raw = JSON.parse(rawBody)
+			} catch {
+				return json({ error: 'Invalid JSON body' }, 400)
+			}
+
+			const parsed = InsightsIngestPayloadSchema.safeParse(raw)
+			if (!parsed.success) {
+				return json({ error: 'Invalid payload', details: parsed.error.flatten() }, 400)
+			}
+
+			try {
+				const result = await replaceInsightsBoard(ctx.db, parsed.data)
+				return json({
+					ok: true,
+					outcome: result.outcome,
+					landedRunAttempt: result.landedRunAttempt,
+				})
+			} catch (error) {
+				if (isMissingInsightsTable(error)) return json({ error: 'schema_not_ready' }, 409)
+				throw error
+			}
+		},
+	}
+}