@growth-labs/cms 0.8.30 → 0.8.33

package/src/routes/foundry-publish.ts

@@ -1,8 +1,9 @@
 import { isCanonicalHost, sha256Hex, verifyFoundryRequest } from '@growth-labs/foundry-signing'
 import { z } from 'zod'
 import { type PublicationReconciler, publishOne } from '../engine/publication.js'
+import { PublicationCurrentSnapshotError } from '../engine/publication-current-guard.js'
 import { PublishContentValidationError } from '../engine/publisher.js'
-import { createRevisionWithDelta } from '../engine/revisions.js'
+import { createRevisionWithDelta, getRevision } from '../engine/revisions.js'
 import { buildContentPath, slugify } from '../engine/slug.js'
 import { type FoundryArticleV2, FoundryArticleV2Schema } from '../foundry-emit.js'
 import { type ContentRouteConfig, createContentRoutes } from './content.js'
@@ -20,6 +21,10 @@ const PutSchema = z
 	})
 	.strict()
 
+const PinnedPublishSchema = z
+	.object({ expected_request_sha256: z.string().regex(/^[a-f0-9]{64}$/) })
+	.strict()
+
 interface FoundryArticleRow {
 	external_id: string
 	content_id: string
@@ -491,6 +496,8 @@ async function bindAdoption(
 }
 
 function publishFailure(id: string, error: unknown): Response {
+	if (error instanceof PublicationCurrentSnapshotError)
+		return json({ error: 'human_edit_pending', external_id: id }, 409)
 	if (error instanceof PublishContentValidationError) {
 		return json({ error: 'publish_validation_failed', external_id: id, errors: error.errors }, 422)
 	}
@@ -545,29 +552,23 @@ async function recordFoundryWrite(
 	}
 }
 
-/** True while the working copy is still exactly what Foundry's last v2 PUT wrote. */
-async function lastFoundryWriteCurrent(
+/** The immutable last PUT snapshot, only while its canonical version is current. */
+async function lastFoundryWriteSnapshot(
 	ctx: RouteContext,
 	row: FoundryArticleRow,
-): Promise<boolean> {
-	const versions = await ctx.db
-		.prepare(
-			`SELECT c.canonical_version AS current_version,
-			        (SELECT json_extract(r.payload_json, '$.item.canonical_version')
-			         FROM content_revisions r
-			         WHERE r.content_id = c.id AND r.created_by = 'foundry' AND r.tag = ?
-			         ORDER BY r.created_at DESC, r.rowid DESC LIMIT 1) AS put_version
-			 FROM content_items c
-			 WHERE c.id = ? AND c.deleted_at IS NULL
-			 LIMIT 1`,
-		)
-		.bind(`${FOUNDRY_PUT_TAG}${row.request_sha256}`, row.content_id)
-		.first<{ current_version: number | null; put_version: number | null }>()
-	return (
-		versions !== null &&
-		versions.put_version !== null &&
-		versions.current_version === versions.put_version
-	)
+): Promise<Record<string, unknown> | null> {
+	const match = await ctx.db
+		.prepare(`SELECT r.id AS revision_id
+  FROM content_items c JOIN content_revisions r ON r.content_id = c.id
+  WHERE c.id = ? AND c.deleted_at IS NULL AND r.created_by = 'foundry' AND r.tag = ?
+    AND c.canonical_version IS NOT NULL
+    AND c.canonical_version = json_extract(r.payload_json, '$.item.canonical_version')
+  ORDER BY r.created_at DESC, r.rowid DESC LIMIT 1`)
+		.bind(row.content_id, `${FOUNDRY_PUT_TAG}${row.request_sha256}`)
+		.first<{ revision_id: string }>()
+	if (!match) return null
+	const revision = await getRevision(ctx.db, row.content_id, match.revision_id)
+	return revision ? { ...revision.payload } : null
 }
 
 /** The v2 receipt: the four v1 fields plus the stored request hash. */
@@ -671,6 +672,7 @@ async function putV2(
 		...(body.desk !== undefined ? { primaryCategory: body.desk } : {}),
 		...(body.tags !== undefined ? { tags: body.tags } : {}),
 		...(body.visibility !== undefined ? { visibility: body.visibility } : {}),
+		...(body.metadata !== undefined ? { metadata: body.metadata } : {}),
 		content: { bodyMarkdown: body.body_html, bodyHtml: body.body_html },
 	}
 
@@ -776,7 +778,8 @@ async function publishV2(
 	// Publish, schedule and resync alike act on the working copy only while it is
 	// still exactly what Foundry's last v2 PUT wrote: a human edit since then (to
 	// a draft or a published item) is never machine-published or machine-scheduled.
-	if (!(await lastFoundryWriteCurrent(ctx, row))) {
+	const expectedSnapshot = await lastFoundryWriteSnapshot(ctx, row)
+	if (!expectedSnapshot) {
 		return json({ error: 'human_edit_pending', external_id: id }, 409)
 	}
 
@@ -832,6 +835,8 @@ async function publishV2(
 				now: input.now,
 				publishedAt,
 				createdBy: 'foundry',
+				expectedFoundryArticleSnapshot: expectedSnapshot,
+				expectedReceiptIdentity: row.request_sha256,
 				surfaces,
 				...(config.foundryPublish?.requiredSurfaceNames
 					? { requiredSurfaceNames: config.foundryPublish.requiredSurfaceNames }
@@ -1059,14 +1064,32 @@ export function createFoundryPublishRoutes(
 			const rawBody = await ctx.request.text()
 			const auth = await verify(ctx, rawBody)
 			if ('error' in auth) return auth.error
-			// POST /publish takes no body: anything sent is refused, never ignored.
-			if (rawBody.length > 0 || !/^0?$/.test(ctx.request.headers.get('Content-Length') ?? '')) {
-				return json({ error: 'invalid_request', detail: 'publish takes no request body' }, 400)
+			// Legacy callers publish the current write. Strategy execution pins the
+			// exact PUT bytes in the signed body; an unrelated replacement is refused.
+			let expectedHash: string | undefined
+			if (rawBody.length > 0) {
+				let value: unknown
+				try {
+					value = JSON.parse(rawBody)
+				} catch {
+					return json({ error: 'invalid_request' }, 400)
+				}
+				const parsed = PinnedPublishSchema.safeParse(value)
+				if (!parsed.success) return json({ error: 'invalid_request' }, 400)
+				expectedHash = parsed.data.expected_request_sha256
+			} else if (!/^0?$/.test(ctx.request.headers.get('Content-Length') ?? '')) {
+				return json(
+					{ error: 'invalid_request', detail: 'empty publish request declares a body' },
+					400,
+				)
 			}
 			const row = await findArticle(ctx, id)
 			if (!row) return json({ error: 'not_found' }, 404)
 			// Without the publication's opt-in the machine route stays draft-only.
 			if (!autoPublishEnabled(config)) return approvalConflict(id, row.status)
+			if (expectedHash !== undefined && expectedHash !== row.request_sha256) {
+				return json({ error: 'article_revision_changed', external_id: id }, 409)
+			}
 			return publishV2(ctx, config, content, id, row)
 		},
 	}

package/src/ui/api/content/insights-ingest.ts

@@ -2,19 +2,26 @@
 // POST /admin/api/content/insights-ingest — machine ingest (replay-safe replace).
 // HMAC-SHA256 (X-Foundry-Signature vs env.INSIGHTS_INGEST_HMAC_SECRET) only —
 // NOT behind requirePublisher. Sibling of foundry-callback under /content/.
+import { env as cloudflareEnv } from 'cloudflare:workers'
+import { config } from 'virtual:growth-labs/cms/config'
 import type { APIContext } from 'astro'
 import { createContentInsightsRoutes } from '../../../routes/content-insights.js'
 import type { RouteContext } from '../../../routes/context.js'
 import { buildSiteAuthz } from '../_authz.js'
+import { toContentConfig } from '../_content-config.js'
 
 function toCtx(c: APIContext): RouteContext {
-	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	const env = cloudflareEnv as Record<string, unknown>
 	return { request: c.request, params: {}, db: env.SITE_DB as RouteContext['db'], env }
 }
 
 function siteId(c: APIContext): string {
-	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
-	return (env.ACTIVE_WORKSPACE_ID as string | undefined) ?? 'default'
+	const env = cloudflareEnv as Record<string, unknown>
+	return (
+		toContentConfig(c).activeWorkspaceId ??
+		(env.ACTIVE_WORKSPACE_ID as string | undefined) ??
+		(config.workspaces?.length === 1 ? config.workspaces[0]!.id : 'default')
+	)
 }
 
 export const POST = (c: APIContext) =>

package/src/ui/api/content/insights-inputs.ts

@@ -5,6 +5,7 @@
 // foundryd's sitebrain.insights.run schedule (W1-07 PR 6). NOT behind
 // requirePublisher. Sibling of insights-ingest under /content/.
 
+import { env as cloudflareEnv } from 'cloudflare:workers'
 import { config } from 'virtual:growth-labs/cms/config'
 import type { APIContext } from 'astro'
 import { createContentInsightsRoutes } from '../../../routes/content-insights.js'
@@ -13,12 +14,12 @@ import { buildSiteAuthz } from '../_authz.js'
 import { toContentConfig } from '../_content-config.js'
 
 function toCtx(c: APIContext): RouteContext {
-	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	const env = cloudflareEnv as Record<string, unknown>
 	return { request: c.request, params: {}, db: env.SITE_DB as RouteContext['db'], env }
 }
 
 function siteId(c: APIContext): string {
-	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	const env = cloudflareEnv as Record<string, unknown>
 	return (
 		toContentConfig(c).activeWorkspaceId ??
 		(env.ACTIVE_WORKSPACE_ID as string | undefined) ??