@jant/core 0.3.27 → 0.3.28

package/src/routes/api/pages.ts

@@ -3,25 +3,23 @@
  */
 
 import { Hono } from "hono";
+import { z } from "zod";
 import type { Bindings } from "../../types.js";
-import type { AppVariables } from "../../app.js";
+import type { AppVariables } from "../../types/app-context.js";
 import { requireAuthApi } from "../../middleware/auth.js";
-import { z } from "zod";
-import { StatusSchema } from "../../lib/schemas.js";
+import {
+  CreatePageSchema,
+  StatusSchema,
+  parseValidated,
+} from "../../lib/schemas.js";
+import { assertFound, parseIntParam, NotFoundError } from "../../lib/errors.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
 export const pagesApiRoutes = new Hono<Env>();
 
-const CreatePageSchema = z.object({
-  slug: z.string().min(1),
-  title: z.string().optional(),
-  body: z.string().optional(),
-  status: StatusSchema.optional(),
-});
-
-const UpdatePageSchema = z.object({
-  slug: z.string().min(1).optional(),
+// API update schema extends shared schema with nullable fields for explicit clearing
+const UpdatePageSchema = CreatePageSchema.partial().extend({
   title: z.string().nullable().optional(),
   body: z.string().nullable().optional(),
   status: StatusSchema.optional(),
@@ -35,28 +33,14 @@ pagesApiRoutes.get("/", async (c) => {
 
 // Get single page
 pagesApiRoutes.get("/:id", async (c) => {
-  const id = parseInt(c.req.param("id"), 10);
-  if (isNaN(id)) return c.json({ error: "Invalid ID" }, 400);
-
-  const page = await c.var.services.pages.getById(id);
-  if (!page) return c.json({ error: "Not found" }, 404);
-
+  const id = parseIntParam(c.req.param("id"));
+  const page = assertFound(await c.var.services.pages.getById(id), "Page");
   return c.json(page);
 });
 
 // Create page (requires auth)
 pagesApiRoutes.post("/", requireAuthApi(), async (c) => {
-  const rawBody = await c.req.json();
-
-  const parseResult = CreatePageSchema.safeParse(rawBody);
-  if (!parseResult.success) {
-    return c.json(
-      { error: "Validation failed", details: parseResult.error.flatten() },
-      400,
-    );
-  }
-
-  const body = parseResult.data;
+  const body = parseValidated(CreatePageSchema, await c.req.json());
 
   const page = await c.var.services.pages.create({
     slug: body.slug,
@@ -70,32 +54,20 @@ pagesApiRoutes.post("/", requireAuthApi(), async (c) => {
 
 // Update page (requires auth)
 pagesApiRoutes.put("/:id", requireAuthApi(), async (c) => {
-  const id = parseInt(c.req.param("id"), 10);
-  if (isNaN(id)) return c.json({ error: "Invalid ID" }, 400);
-
-  const rawBody = await c.req.json();
-
-  const parseResult = UpdatePageSchema.safeParse(rawBody);
-  if (!parseResult.success) {
-    return c.json(
-      { error: "Validation failed", details: parseResult.error.flatten() },
-      400,
-    );
-  }
+  const id = parseIntParam(c.req.param("id"));
+  const body = parseValidated(UpdatePageSchema, await c.req.json());
 
-  const page = await c.var.services.pages.update(id, parseResult.data);
-  if (!page) return c.json({ error: "Not found" }, 404);
+  const page = assertFound(await c.var.services.pages.update(id, body), "Page");
 
   return c.json(page);
 });
 
 // Delete page (requires auth)
 pagesApiRoutes.delete("/:id", requireAuthApi(), async (c) => {
-  const id = parseInt(c.req.param("id"), 10);
-  if (isNaN(id)) return c.json({ error: "Invalid ID" }, 400);
+  const id = parseIntParam(c.req.param("id"));
 
   const success = await c.var.services.pages.delete(id);
-  if (!success) return c.json({ error: "Not found" }, 404);
+  if (!success) throw new NotFoundError("Page");
 
   return c.json({ success: true });
 });

package/src/routes/api/posts.ts

@@ -4,12 +4,13 @@
 
 import { Hono } from "hono";
 import type { Bindings, Format, Status, Media } from "../../types.js";
-import type { AppVariables } from "../../app.js";
+import type { AppVariables } from "../../types/app-context.js";
 import * as sqid from "../../lib/sqid.js";
 import {
   CreatePostSchema,
   UpdatePostSchema,
   validateMediaCount,
+  parseValidated,
 } from "../../lib/schemas.js";
 import { requireAuthApi } from "../../middleware/auth.js";
 import {
@@ -17,6 +18,11 @@ import {
   getImageUrl,
   getPublicUrlForProvider,
 } from "../../lib/image.js";
+import {
+  assertFound,
+  NotFoundError,
+  ValidationError,
+} from "../../lib/errors.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
@@ -57,6 +63,24 @@ function toMediaAttachment(
   };
 }
 
+/**
+ * Validates media IDs: checks count limit and verifies all IDs exist.
+ */
+async function validateMediaIds(
+  mediaIds: string[],
+  getByIds: (ids: string[]) => Promise<Media[]>,
+): Promise<void> {
+  const countError = validateMediaCount(mediaIds);
+  if (countError) throw new ValidationError(countError);
+
+  if (mediaIds.length > 0) {
+    const existing = await getByIds(mediaIds);
+    if (existing.length !== mediaIds.length) {
+      throw new ValidationError("One or more media IDs are invalid");
+    }
+  }
+}
+
 // List posts
 postsApiRoutes.get("/", async (c) => {
   const format = c.req.query("format") as Format | undefined;
@@ -74,9 +98,7 @@ postsApiRoutes.get("/", async (c) => {
   // Batch load media for all posts
   const postIds = posts.map((p) => p.id);
   const mediaMap = await c.var.services.media.getByPostIds(postIds);
-  const r2PublicUrl = c.env.R2_PUBLIC_URL;
-  const imageTransformUrl = c.env.IMAGE_TRANSFORM_URL;
-  const s3PublicUrl = c.env.S3_PUBLIC_URL;
+  const { r2PublicUrl, imageTransformUrl, s3PublicUrl } = c.var.appConfig;
 
   return c.json({
     posts: posts.map((p) => ({
@@ -97,15 +119,12 @@ postsApiRoutes.get("/", async (c) => {
 // Get single post
 postsApiRoutes.get("/:id", async (c) => {
   const id = sqid.decode(c.req.param("id"));
-  if (!id) return c.json({ error: "Invalid ID" }, 400);
+  if (!id) throw new ValidationError("Invalid ID");
 
-  const post = await c.var.services.posts.getById(id);
-  if (!post) return c.json({ error: "Not found" }, 404);
+  const post = assertFound(await c.var.services.posts.getById(id), "Post");
 
   const mediaList = await c.var.services.media.getByPostId(post.id);
-  const r2PublicUrl = c.env.R2_PUBLIC_URL;
-  const imageTransformUrl = c.env.IMAGE_TRANSFORM_URL;
-  const s3PublicUrl = c.env.S3_PUBLIC_URL;
+  const { r2PublicUrl, imageTransformUrl, s3PublicUrl } = c.var.appConfig;
 
   return c.json({
     ...post,
@@ -118,33 +137,13 @@ postsApiRoutes.get("/:id", async (c) => {
 
 // Create post (requires auth)
 postsApiRoutes.post("/", requireAuthApi(), async (c) => {
-  const rawBody = await c.req.json();
-
-  // Validate request body
-  const parseResult = CreatePostSchema.safeParse(rawBody);
-  if (!parseResult.success) {
-    return c.json(
-      { error: "Validation failed", details: parseResult.error.flatten() },
-      400,
-    );
-  }
+  const body = parseValidated(CreatePostSchema, await c.req.json());
 
-  const body = parseResult.data;
-
-  // Validate media count
+  // Validate media IDs
   if (body.mediaIds) {
-    const mediaError = validateMediaCount(body.mediaIds);
-    if (mediaError) {
-      return c.json({ error: mediaError }, 400);
-    }
-
-    // Verify all media IDs exist
-    if (body.mediaIds.length > 0) {
-      const existing = await c.var.services.media.getByIds(body.mediaIds);
-      if (existing.length !== body.mediaIds.length) {
-        return c.json({ error: "One or more media IDs are invalid" }, 400);
-      }
-    }
+    await validateMediaIds(body.mediaIds, (ids) =>
+      c.var.services.media.getByIds(ids),
+    );
   }
 
   const post = await c.var.services.posts.create({
@@ -158,7 +157,7 @@ postsApiRoutes.post("/", requireAuthApi(), async (c) => {
     url: body.url || undefined,
     quoteText: body.quoteText,
     rating: body.rating || undefined,
-    collectionId: body.collectionId || undefined,
+    collectionIds: body.collectionIds?.length ? body.collectionIds : undefined,
     replyToId: body.replyToId
       ? (sqid.decode(body.replyToId) ?? undefined)
       : undefined,
@@ -171,9 +170,7 @@ postsApiRoutes.post("/", requireAuthApi(), async (c) => {
   }
 
   const mediaList = await c.var.services.media.getByPostId(post.id);
-  const r2PublicUrl = c.env.R2_PUBLIC_URL;
-  const imageTransformUrl = c.env.IMAGE_TRANSFORM_URL;
-  const s3PublicUrl = c.env.S3_PUBLIC_URL;
+  const { r2PublicUrl, imageTransformUrl, s3PublicUrl } = c.var.appConfig;
 
   return c.json(
     {
@@ -190,53 +187,36 @@ postsApiRoutes.post("/", requireAuthApi(), async (c) => {
 // Update post (requires auth)
 postsApiRoutes.put("/:id", requireAuthApi(), async (c) => {
   const id = sqid.decode(c.req.param("id"));
-  if (!id) return c.json({ error: "Invalid ID" }, 400);
-
-  const rawBody = await c.req.json();
-
-  // Validate request body
-  const parseResult = UpdatePostSchema.safeParse(rawBody);
-  if (!parseResult.success) {
-    return c.json(
-      { error: "Validation failed", details: parseResult.error.flatten() },
-      400,
-    );
-  }
+  if (!id) throw new ValidationError("Invalid ID");
 
-  const body = parseResult.data;
+  const body = parseValidated(UpdatePostSchema, await c.req.json());
 
-  // Validate media count if mediaIds is provided
+  // Validate media IDs if provided
   if (body.mediaIds !== undefined) {
-    const mediaError = validateMediaCount(body.mediaIds);
-    if (mediaError) {
-      return c.json({ error: mediaError }, 400);
-    }
-
-    // Verify all media IDs exist
-    if (body.mediaIds.length > 0) {
-      const existing = await c.var.services.media.getByIds(body.mediaIds);
-      if (existing.length !== body.mediaIds.length) {
-        return c.json({ error: "One or more media IDs are invalid" }, 400);
-      }
-    }
+    await validateMediaIds(body.mediaIds, (ids) =>
+      c.var.services.media.getByIds(ids),
+    );
   }
 
-  const post = await c.var.services.posts.update(id, {
-    format: body.format,
-    title: body.title,
-    body: body.body,
-    path: body.path,
-    status: body.status,
-    featured: body.featured,
-    pinned: body.pinned,
-    url: body.url,
-    quoteText: body.quoteText,
-    rating: body.rating || undefined,
-    collectionId: body.collectionId || undefined,
-    publishedAt: body.publishedAt,
-  });
-
-  if (!post) return c.json({ error: "Not found" }, 404);
+  const post = assertFound(
+    await c.var.services.posts.update(id, {
+      format: body.format,
+      title: body.title,
+      body: body.body,
+      path: body.path,
+      status: body.status,
+      featured: body.featured,
+      pinned: body.pinned,
+      url: body.url,
+      quoteText: body.quoteText,
+      rating: body.rating || undefined,
+      collectionIds: body.collectionIds?.length
+        ? body.collectionIds
+        : undefined,
+      publishedAt: body.publishedAt,
+    }),
+    "Post",
+  );
 
   // Update media attachments if provided (including empty array to clear)
   if (body.mediaIds !== undefined) {
@@ -244,9 +224,7 @@ postsApiRoutes.put("/:id", requireAuthApi(), async (c) => {
   }
 
   const mediaList = await c.var.services.media.getByPostId(post.id);
-  const r2PublicUrl = c.env.R2_PUBLIC_URL;
-  const imageTransformUrl = c.env.IMAGE_TRANSFORM_URL;
-  const s3PublicUrl = c.env.S3_PUBLIC_URL;
+  const { r2PublicUrl, imageTransformUrl, s3PublicUrl } = c.var.appConfig;
 
   return c.json({
     ...post,
@@ -260,13 +238,13 @@ postsApiRoutes.put("/:id", requireAuthApi(), async (c) => {
 // Delete post (requires auth)
 postsApiRoutes.delete("/:id", requireAuthApi(), async (c) => {
   const id = sqid.decode(c.req.param("id"));
-  if (!id) return c.json({ error: "Invalid ID" }, 400);
+  if (!id) throw new ValidationError("Invalid ID");
 
   // Detach media before deleting
   await c.var.services.media.detachFromPost(id);
 
   const success = await c.var.services.posts.delete(id);
-  if (!success) return c.json({ error: "Not found" }, 404);
+  if (!success) throw new NotFoundError("Post");
 
   return c.json({ success: true });
 });

package/src/routes/api/search.ts

@@ -4,8 +4,9 @@
 
 import { Hono } from "hono";
 import type { Bindings } from "../../types.js";
-import type { AppVariables } from "../../app.js";
+import type { AppVariables } from "../../types/app-context.js";
 import * as sqid from "../../lib/sqid.js";
+import { ValidationError, ExternalServiceError } from "../../lib/errors.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
@@ -16,11 +17,11 @@ searchApiRoutes.get("/", async (c) => {
   const query = c.req.query("q");
 
   if (!query || query.trim().length === 0) {
-    return c.json({ error: "Query parameter 'q' is required" }, 400);
+    throw new ValidationError("Query parameter 'q' is required");
   }
 
   if (query.length > 200) {
-    return c.json({ error: "Query too long" }, 400);
+    throw new ValidationError("Query too long");
   }
 
   const limitParam = c.req.query("limit");
@@ -46,8 +47,9 @@ searchApiRoutes.get("/", async (c) => {
       count: results.length,
     });
   } catch (err) {
+    if (err instanceof ValidationError) throw err;
     // eslint-disable-next-line no-console -- Error logging is intentional
     console.error("Search error:", err);
-    return c.json({ error: "Search failed" }, 500);
+    throw new ExternalServiceError("Search failed");
   }
 });

package/src/routes/api/settings.ts

@@ -4,10 +4,12 @@
 
 import { Hono } from "hono";
 import type { Bindings } from "../../types.js";
-import type { AppVariables } from "../../app.js";
+import type { AppVariables } from "../../types/app-context.js";
 import { requireAuthApi } from "../../middleware/auth.js";
 import { CONFIG_FIELDS, type ConfigKey } from "../../types.js";
 import { z } from "zod";
+import { parseValidated } from "../../lib/schemas.js";
+import { ValidationError } from "../../lib/errors.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
@@ -35,17 +37,7 @@ settingsApiRoutes.get("/", requireAuthApi(), async (c) => {
 
 // Update settings (requires auth)
 settingsApiRoutes.put("/", requireAuthApi(), async (c) => {
-  const rawBody = await c.req.json();
-
-  const parseResult = UpdateSettingsSchema.safeParse(rawBody);
-  if (!parseResult.success) {
-    return c.json(
-      { error: "Validation failed", details: parseResult.error.flatten() },
-      400,
-    );
-  }
-
-  const updates = parseResult.data;
+  const updates = parseValidated(UpdateSettingsSchema, await c.req.json());
 
   // Filter to only editable keys
   const filteredUpdates: Partial<Record<ConfigKey, string>> = {};
@@ -60,21 +52,13 @@ settingsApiRoutes.put("/", requireAuthApi(), async (c) => {
   }
 
   if (rejectedKeys.length > 0 && Object.keys(filteredUpdates).length === 0) {
-    return c.json(
-      {
-        error: "None of the provided keys are editable",
-        rejectedKeys,
-      },
-      400,
-    );
+    throw new ValidationError("None of the provided keys are editable", {
+      rejectedKeys,
+    });
   }
 
   if (Object.keys(filteredUpdates).length > 0) {
-    // Settings service expects SettingsKey, but our ConfigKeys that are
-    // editable (SITE_NAME, SITE_DESCRIPTION, SITE_LANGUAGE) are valid SettingsKeys
-    for (const [key, value] of Object.entries(filteredUpdates)) {
-      await c.var.services.settings.set(key as never, value as string);
-    }
+    await c.var.services.settings.setMany(filteredUpdates as never);
   }
 
   // Return updated state

package/src/routes/api/upload.ts

@@ -7,9 +7,9 @@
 
 import { Hono, type Context } from "hono";
 import { html } from "hono/html";
-import { uuidv7 } from "uuidv7";
+import { msg } from "@lingui/core/macro";
 import type { Bindings } from "../../types.js";
-import type { AppVariables } from "../../app.js";
+import type { AppVariables } from "../../types/app-context.js";
 import { requireAuthApi } from "../../middleware/auth.js";
 import {
   getMediaUrl,
@@ -17,6 +17,9 @@ import {
   getPublicUrlForProvider,
 } from "../../lib/image.js";
 import { sse } from "../../lib/sse.js";
+import { validateUploadFile, generateStorageKey } from "../../lib/upload.js";
+import { assertFound } from "../../lib/errors.js";
+import { getI18n } from "../../i18n/index.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
@@ -130,56 +133,48 @@ function sseUploadError(c: Context<Env>, message: string): Response {
 
 // Upload a file
 uploadApiRoutes.post("/", async (c) => {
+  const i18n = getI18n(c);
   const storage = c.var.storage;
   if (!storage) {
+    const errorText = i18n._(
+      msg({
+        message: "Storage not configured",
+        comment: "@context: Error when file storage is not set up",
+      }),
+    );
     if (wantsSSE(c)) {
-      return sseUploadError(c, "Storage not configured");
+      return sseUploadError(c, errorText);
     }
-    return c.json({ error: "Storage not configured" }, 500);
+    return c.json({ error: errorText }, 500);
   }
 
   const formData = await c.req.formData();
   const file = formData.get("file") as File | null;
 
   if (!file) {
+    const errorText = i18n._(
+      msg({
+        message: "No file provided",
+        comment: "@context: Error when no file was selected for upload",
+      }),
+    );
     if (wantsSSE(c)) {
-      return sseUploadError(c, "No file provided");
-    }
-    return c.json({ error: "No file provided" }, 400);
-  }
-
-  // Validate file type
-  const allowedTypes = [
-    "image/jpeg",
-    "image/png",
-    "image/gif",
-    "image/webp",
-    "image/svg+xml",
-  ];
-  if (!allowedTypes.includes(file.type)) {
-    if (wantsSSE(c)) {
-      return sseUploadError(c, "File type not allowed");
+      return sseUploadError(c, errorText);
     }
-    return c.json({ error: "File type not allowed" }, 400);
+    return c.json({ error: errorText }, 400);
   }
 
-  // Validate file size (max 10MB)
-  const maxSize = 10 * 1024 * 1024;
-  if (file.size > maxSize) {
+  // Validate file type and size
+  const uploadError = validateUploadFile(file);
+  if (uploadError) {
     if (wantsSSE(c)) {
-      return sseUploadError(c, "File too large (max 10MB)");
+      return sseUploadError(c, uploadError);
     }
-    return c.json({ error: "File too large (max 10MB)" }, 400);
+    return c.json({ error: uploadError }, 400);
   }
 
   // Generate unique filename using UUIDv7
-  const ext = file.name.split(".").pop() || "bin";
-  const id = uuidv7();
-  const date = new Date();
-  const year = date.getUTCFullYear();
-  const month = String(date.getUTCMonth() + 1).padStart(2, "0");
-  const filename = `${id}.${ext}`;
-  const storageKey = `media/${year}/${month}/${filename}`;
+  const { id, filename, storageKey } = generateStorageKey(file.name);
 
   try {
     // Upload to storage
@@ -195,21 +190,20 @@ uploadApiRoutes.post("/", async (c) => {
       mimeType: file.type,
       size: file.size,
       storageKey,
-      provider: c.env.STORAGE_DRIVER || "r2",
+      provider: c.var.appConfig.storageDriver,
     });
 
     // SSE response for Datastar
     if (wantsSSE(c)) {
-      const provider = c.env.STORAGE_DRIVER || "r2";
       const mediaPublicUrl = getPublicUrlForProvider(
-        provider,
-        c.env.R2_PUBLIC_URL,
-        c.env.S3_PUBLIC_URL,
+        c.var.appConfig.storageDriver,
+        c.var.appConfig.r2PublicUrl,
+        c.var.appConfig.s3PublicUrl,
       );
       const cardHtml = renderMediaCard(
         media,
         mediaPublicUrl,
-        c.env.IMAGE_TRANSFORM_URL,
+        c.var.appConfig.imageTransformUrl,
       );
 
       return sse(c, async (stream) => {
@@ -218,16 +212,22 @@ uploadApiRoutes.post("/", async (c) => {
           mode: "outer",
           selector: "#upload-placeholder",
         });
-        await stream.toast("Upload successful!");
+        await stream.toast(
+          i18n._(
+            msg({
+              message: "Upload successful!",
+              comment: "@context: Toast after successful file upload",
+            }),
+          ),
+        );
       });
     }
 
     // JSON response for API clients
-    const provider = c.env.STORAGE_DRIVER || "r2";
     const mediaPublicUrl = getPublicUrlForProvider(
-      provider,
-      c.env.R2_PUBLIC_URL,
-      c.env.S3_PUBLIC_URL,
+      c.var.appConfig.storageDriver,
+      c.var.appConfig.r2PublicUrl,
+      c.var.appConfig.s3PublicUrl,
     );
     const publicUrl = getMediaUrl(storageKey, mediaPublicUrl);
     return c.json({
@@ -241,22 +241,27 @@ uploadApiRoutes.post("/", async (c) => {
     // eslint-disable-next-line no-console -- Error logging is intentional
     console.error("Upload error:", err);
 
+    const errorText = i18n._(
+      msg({
+        message: "Upload failed. Please try again.",
+        comment: "@context: Error when file upload fails",
+      }),
+    );
     if (wantsSSE(c)) {
       return sse(c, async (stream) => {
         await stream.remove("#upload-placeholder");
-        await stream.toast("Upload failed. Please try again.", "error");
+        await stream.toast(errorText, "error");
       });
     }
-    return c.json({ error: "Upload failed" }, 500);
+    return c.json({ error: errorText }, 500);
   }
 });
 
 // List uploaded files (JSON only)
 uploadApiRoutes.get("/", async (c) => {
   const limit = parseInt(c.req.query("limit") ?? "50", 10);
-  const mediaList = await c.var.services.media.list(limit);
-  const r2PublicUrl = c.env.R2_PUBLIC_URL;
-  const s3PublicUrl = c.env.S3_PUBLIC_URL;
+  const mediaList = await c.var.services.media.list({ limit });
+  const { r2PublicUrl, s3PublicUrl } = c.var.appConfig;
 
   return c.json({
     media: mediaList.map((m) => ({
@@ -276,10 +281,7 @@ uploadApiRoutes.get("/", async (c) => {
 // Delete a file
 uploadApiRoutes.delete("/:id", async (c) => {
   const id = c.req.param("id");
-  const media = await c.var.services.media.getById(id);
-  if (!media) {
-    return c.json({ error: "Not found" }, 404);
-  }
+  const media = assertFound(await c.var.services.media.getById(id), "Media");
 
   // Delete from storage
   const storage = c.var.storage;