@growth-labs/cms 0.8.20 → 0.8.23

package/src/routes/content.ts

@@ -66,6 +66,7 @@ import { invalidateMediaCaptureStatements, softDeleteContent } from '../engine/s
 import { normalizeSourceSections } from '../engine/source-sections.js'
 import { TagInputError } from '../engine/taxonomy.js'
 import type { ValidationError } from '../engine/validator/index.js'
+import { VideoSourceNotIngestableError } from '../engine/video-source.js'
 import {
 	isValidTimeZone,
 	PUBLISH_TIMEZONE_FALLBACK,
@@ -79,6 +80,8 @@ import { type ContentAction, canPerformContentAction } from './authz-matrix.js'
 import type { CmsRouteConfig } from './config.js'
 import { resolveConfig } from './config.js'
 import { json, type RouteContext, requireId } from './context.js'
+import type { FoundryPublishOptions } from './foundry-publish.js'
+import { isFoundryMachineContext } from './machine-context.js'
 import type { DispatchWebhookHook } from './webhooks.js'
 
 export type { DispatchWebhookHook }
@@ -146,6 +149,11 @@ function mediaSourceProviderErrorResponse(error: unknown): Response | null {
 	return json({ error: failure.message, reason: failure.code }, failure.status)
 }
 
+function videoSourceNotIngestableResponse(error: unknown): Response | null {
+	if (!(error instanceof VideoSourceNotIngestableError)) return null
+	return json({ error: error.message, reason: 'video_source_not_ingestable' }, 400)
+}
+
 function verifiedMediaDurationConflictResponse(error: unknown): Response | null {
 	if (!(error instanceof VerifiedMediaDurationConflictError)) return null
 	return json(
@@ -231,6 +239,14 @@ export interface ContentRouteConfig extends CmsRouteConfig {
 	videoSourceProductionEnabled?: boolean
 	/** Internal machine-route constraint: atomically update only in this status. */
 	updateStatusConstraint?: ContentStatus
+	/**
+	 * Internal (Foundry machine route, M3-18): replaces ONLY the publish action's
+	 * commit step (publishContent + createRevision) with the caller's — publishOne
+	 * with the publication's live surfaces. Every other step of the native publish
+	 * action (readiness, body guard, dek, tag check, activity log, takeaways, FAQ,
+	 * the content.published webhook) runs unchanged, through the same handler.
+	 */
+	publishCommit?: (ctx: RouteContext, input: { contentId: string; now: number }) => Promise<void>
 	/**
 	 * Optional webhook dispatcher hook (P7 Task 9). Fired at each content
 	 * lifecycle transition (publish, unpublish, schedule, archive, create, etc.).
@@ -245,6 +261,21 @@ export interface ContentRouteConfig extends CmsRouteConfig {
 	 * when absent so callers without a workspace concept still produce a scoped row.
 	 */
 	activeWorkspaceId?: string
+	/**
+	 * Per-publication opt-in for the Foundry machine route's publish transition
+	 * (M3-18). Omitted, or `autoPublish` anything but `true`, keeps that route
+	 * draft-only and byte-identical to the v1 route. Read only by routes/foundry-publish.ts.
+	 */
+	foundryPublish?: FoundryPublishOptions
+	/**
+	 * This publication's canonical host for the Foundry route family, declared
+	 * statically (the integration's `foundryCanonicalHost`, so it reaches every
+	 * request whatever the host's per-request hooks set). Once a host is declared
+	 * here or in `foundryPublish.canonicalHost`, the Foundry route verifies only
+	 * the host-bound `foundry-cms-v2` string and never the legacy dot form.
+	 * Read only by routes/foundry-publish.ts.
+	 */
+	foundryCanonicalHost?: string
 }
 
 type ContentType = 'article' | 'video' | 'podcast' | 'newsletter' | 'page'
@@ -422,6 +453,8 @@ const NEXTCLOUD_SHARE_HOSTS = ['drive.fulcrum-portal.com']
 const NEXTCLOUD_SHARE_PATH_RE = /^\/s\/([A-Za-z0-9_-]+)(?:\/download)?\/?$/
 const NEXTCLOUD_DIRECT_PATH_RE = /^\/public\.php\/dav\/files\/[A-Za-z0-9_-]+$/
 
+const NEXTCLOUD_SHARE_NOISE_PARAMS: ReadonlySet<string> = new Set(['dir', 'editing', 'openfile'])
+
 export function normaliseNextcloudShareUrl(value: string): string {
 	let url: URL
 	try {
@@ -440,13 +473,19 @@ export function normaliseNextcloudShareUrl(value: string): string {
 	) {
 		return value
 	}
-	const onlyDirQuery =
-		url.search === '' || (url.searchParams.get('dir') !== null && url.searchParams.size === 1)
+	// Nextcloud's copy-link output adds page-navigation noise -- `?dir=/` from a
+	// folder listing, `?dir=/&editing=false&openfile=true` from the viewer --
+	// none of which changes the file a share serves. Any other parameter may
+	// select a different resource, so the URL is kept and the publisher's
+	// ingest guard refuses it (HomeFronts 2026-10-01T18:05Z).
+	const onlyNoiseQuery =
+		url.search === '' ||
+		[...url.searchParams.keys()].every((key) => NEXTCLOUD_SHARE_NOISE_PARAMS.has(key))
 	if (NEXTCLOUD_DIRECT_PATH_RE.test(url.pathname)) {
-		return url.search === '' ? value : onlyDirQuery ? `https://${host}${url.pathname}` : value
+		return url.search === '' ? value : onlyNoiseQuery ? `https://${host}${url.pathname}` : value
 	}
 	const share = NEXTCLOUD_SHARE_PATH_RE.exec(url.pathname)
-	if (!share || !onlyDirQuery) return value
+	if (!share || !onlyNoiseQuery) return value
 	return `https://${host}/public.php/dav/files/${share[1]}`
 }
 
@@ -1182,6 +1221,15 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 	 * — identical guard pattern to dispatchTakeaways / logActivity.
 	 * When no hook is injected this is a no-op (no 501, no error).
 	 */
+	/**
+	 * Only a context the HMAC-verified Foundry route marked is the machine
+	 * (routes/machine-context.ts); a subject or userId string never decides it,
+	 * so no person can act as the machine. Any other actor is a person.
+	 */
+	async function isFoundryActor(ctx: RouteContext): Promise<boolean> {
+		return isFoundryMachineContext(ctx)
+	}
+
 	async function fireWebhook(
 		ctx: RouteContext,
 		eventType: string,
@@ -1425,12 +1473,14 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			if (op === 'topic') {
 				const { topic } = parsed.data
 				for (const id of ids) {
-					await ctx.db
-						.prepare(
-							'UPDATE content_items SET primary_topic = ?, updated_at = unixepoch() WHERE id = ? AND deleted_at IS NULL',
-						)
-						.bind(topic, id)
-						.run()
+					// Through the editor's own save path, so it is a canonical edit; the
+					// existing category is passed through so the save changes nothing else.
+					const existing = await getContentItem(ctx.db, id)
+					if (!existing || (existing as { deleted_at?: number | null }).deleted_at != null) continue
+					await updateContentItem(ctx.db, id, {
+						primaryTopic: topic,
+						primaryCategory: existing.channel,
+					})
 				}
 				return json({ updated: ids })
 			}
@@ -1532,6 +1582,8 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				created = await createContent(ctx.db, parsed.data)
 			} catch (error) {
 				if (error instanceof TagInputError) return tagInputErrorResponse(error)
+				const notIngestable = videoSourceNotIngestableResponse(error)
+				if (notIngestable) return notIngestable
 				const conflict = verifiedMediaDurationConflictResponse(error)
 				if (conflict) return conflict
 				throw error
@@ -1778,6 +1830,8 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				})
 			} catch (error) {
 				if (error instanceof TagInputError) return tagInputErrorResponse(error)
+				const notIngestable = videoSourceNotIngestableResponse(error)
+				if (notIngestable) return notIngestable
 				const conflict = verifiedMediaDurationConflictResponse(error)
 				if (conflict) return conflict
 				throw error
@@ -2034,8 +2088,12 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 					throw error
 				}
 				try {
-					await publishContent(ctx.db, id, publishedAt, now)
-					await createRevision(ctx.db, id, ctx.userId || null)
+					if (config.publishCommit) {
+						await config.publishCommit(ctx, { contentId: id, now })
+					} else {
+						await publishContent(ctx.db, id, publishedAt, now)
+						await createRevision(ctx.db, id, ctx.userId || null)
+					}
 				} catch (error) {
 					if (error instanceof TagInputError) return tagInputErrorResponse(error)
 					throw error
@@ -2127,7 +2185,10 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			}
 
 			if (action === 'unpublish') {
-				await unpublishContent(ctx.db, id)
+				// A person's unpublish sticks: it is a canonical edit, so a machine
+				// publisher cannot put the item back without a new write. The
+				// machine's own unpublish is not, so it can republish its item.
+				await unpublishContent(ctx.db, id, { canonicalEdit: !(await isFoundryActor(ctx)) })
 
 				// Fire content.unpublished webhook.
 				await fireWebhook(ctx, 'content.unpublished', {
@@ -2163,9 +2224,11 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			if (action === 'unschedule') {
 				// publish_tz is NOT NULL (DEFAULT 'Europe/Paris'); reset it to the
 				// default rather than nulling it (a NULL violates the constraint).
+				// A person pulling a scheduled item is a canonical edit (see unpublish).
+				const pulledByPerson = !(await isFoundryActor(ctx))
 				await ctx.db
 					.prepare(
-						"UPDATE content_items SET status = 'draft', publish_at = NULL, publish_tz = 'Europe/Paris', updated_at = unixepoch() WHERE id = ?",
+						`UPDATE content_items SET status = 'draft', publish_at = NULL, publish_tz = 'Europe/Paris', updated_at = unixepoch()${pulledByPerson ? ', canonical_version = canonical_version + 1' : ''} WHERE id = ?`,
 					)
 					.bind(id)
 					.run()
@@ -2204,9 +2267,12 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				// publish_at so a de-scheduled item doesn't carry a phantom publish time.
 				// publish_tz is NOT NULL (DEFAULT 'Europe/Paris'), so it is reset to the
 				// default rather than nulled.
+				// A person moving the item back to draft or review is a canonical
+				// edit (see unpublish); the machine never calls set-status.
+				const movedByPerson = !(await isFoundryActor(ctx))
 				await ctx.db
 					.prepare(
-						"UPDATE content_items SET status = ?, publish_at = NULL, publish_tz = 'Europe/Paris', updated_at = unixepoch() WHERE id = ?",
+						`UPDATE content_items SET status = ?, publish_at = NULL, publish_tz = 'Europe/Paris', updated_at = unixepoch()${movedByPerson ? ', canonical_version = canonical_version + 1' : ''} WHERE id = ?`,
 					)
 					.bind(status, id)
 					.run()