@jant/core 0.3.6 → 0.3.7

package/src/lib/sse.ts

@@ -299,7 +299,7 @@ export function sse(
  * Use instead of `sse()` when the only action is a redirect.
  *
  * @param url - The URL to redirect to
- * @param options - Optional extra headers (e.g. Set-Cookie for auth)
+ * @param options - Optional extra headers (accepts any `HeadersInit`)
  * @returns Response with text/html content-type
  *
  * @example
@@ -307,21 +307,20 @@ export function sse(
  * return dsRedirect("/dash/posts");
  *
  * // With cookie forwarding (for auth)
- * return dsRedirect("/dash", { headers: { "Set-Cookie": cookie } });
+ * return dsRedirect("/dash", { headers: authResponse.headers });
  * ```
  */
 export function dsRedirect(
   url: string,
-  options?: { headers?: Record<string, string> },
+  options?: { headers?: Headers | Record<string, string> | string[][] },
 ): Response {
-  return new Response(buildRedirectScript(url), {
-    headers: {
-      "Content-Type": "text/html",
-      "Datastar-Mode": "append",
-      "Datastar-Selector": "body",
-      ...options?.headers,
-    },
-  });
+  const headers = options?.headers
+    ? new Headers(options.headers)
+    : new Headers();
+  headers.set("Content-Type", "text/html");
+  headers.set("Datastar-Mode", "append");
+  headers.set("Datastar-Selector", "body");
+  return new Response(buildRedirectScript(url), { headers });
 }
 
 /**

package/src/routes/api/__tests__/posts.test.ts

@@ -35,6 +35,39 @@ describe("Posts API Routes", () => {
       expect(body.posts[0].sqid).toBeTruthy();
     });
 
+    it("includes mediaAttachments in list response", async () => {
+      const { app, services } = createTestApp();
+      app.route("/api/posts", postsApiRoutes);
+
+      const post = await services.posts.create({
+        type: "note",
+        content: "with media",
+        visibility: "featured",
+      });
+
+      const media = await services.media.create({
+        filename: "test.jpg",
+        originalName: "test.jpg",
+        mimeType: "image/jpeg",
+        size: 1024,
+        r2Key: "uploads/test.jpg",
+        width: 800,
+        height: 600,
+      });
+
+      await services.media.attachToPost(post.id, [media.id]);
+
+      const res = await app.request("/api/posts");
+      const body = await res.json();
+
+      expect(body.posts[0].mediaAttachments).toHaveLength(1);
+      expect(body.posts[0].mediaAttachments[0].id).toBe(media.id);
+      expect(body.posts[0].mediaAttachments[0].mimeType).toBe("image/jpeg");
+      expect(body.posts[0].mediaAttachments[0].url).toBeTruthy();
+      expect(body.posts[0].mediaAttachments[0].previewUrl).toBeTruthy();
+      expect(body.posts[0].mediaAttachments[0].position).toBe(0);
+    });
+
     it("filters by visibility", async () => {
       const { app, services } = createTestApp();
       app.route("/api/posts", postsApiRoutes);
@@ -97,6 +130,33 @@ describe("Posts API Routes", () => {
       expect(body.sqid).toBe(id);
     });
 
+    it("includes mediaAttachments in single post response", async () => {
+      const { app, services } = createTestApp();
+      app.route("/api/posts", postsApiRoutes);
+
+      const post = await services.posts.create({
+        type: "note",
+        content: "with media",
+        visibility: "featured",
+      });
+
+      const media = await services.media.create({
+        filename: "test.jpg",
+        originalName: "test.jpg",
+        mimeType: "image/jpeg",
+        size: 1024,
+        r2Key: "uploads/test.jpg",
+      });
+
+      await services.media.attachToPost(post.id, [media.id]);
+
+      const res = await app.request(`/api/posts/${sqid.encode(post.id)}`);
+      const body = await res.json();
+
+      expect(body.mediaAttachments).toHaveLength(1);
+      expect(body.mediaAttachments[0].id).toBe(media.id);
+    });
+
     it("returns 400 for invalid sqid", async () => {
       const { app } = createTestApp();
       app.route("/api/posts", postsApiRoutes);
@@ -151,6 +211,114 @@ describe("Posts API Routes", () => {
       const body = await res.json();
       expect(body.content).toBe("Hello from API");
       expect(body.sqid).toBeTruthy();
+      expect(body.mediaAttachments).toEqual([]);
+    });
+
+    it("creates a post with mediaIds and attaches them", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/posts", postsApiRoutes);
+
+      const m1 = await services.media.create({
+        filename: "a.jpg",
+        originalName: "a.jpg",
+        mimeType: "image/jpeg",
+        size: 1024,
+        r2Key: "uploads/a.jpg",
+      });
+      const m2 = await services.media.create({
+        filename: "b.jpg",
+        originalName: "b.jpg",
+        mimeType: "image/jpeg",
+        size: 2048,
+        r2Key: "uploads/b.jpg",
+      });
+
+      const res = await app.request("/api/posts", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          type: "note",
+          content: "with images",
+          visibility: "quiet",
+          mediaIds: [m1.id, m2.id],
+        }),
+      });
+
+      expect(res.status).toBe(201);
+      const body = await res.json();
+      expect(body.mediaAttachments).toHaveLength(2);
+      expect(body.mediaAttachments[0].id).toBe(m1.id);
+      expect(body.mediaAttachments[0].position).toBe(0);
+      expect(body.mediaAttachments[1].id).toBe(m2.id);
+      expect(body.mediaAttachments[1].position).toBe(1);
+    });
+
+    it("returns 400 for image type without media", async () => {
+      const { app } = createTestApp({ authenticated: true });
+      app.route("/api/posts", postsApiRoutes);
+
+      const res = await app.request("/api/posts", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          type: "image",
+          content: "should fail",
+          visibility: "quiet",
+          mediaIds: [],
+        }),
+      });
+
+      expect(res.status).toBe(400);
+      const body = await res.json();
+      expect(body.error).toContain("image posts require at least 1");
+    });
+
+    it("returns 400 for page type with media", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/posts", postsApiRoutes);
+
+      const m1 = await services.media.create({
+        filename: "a.jpg",
+        originalName: "a.jpg",
+        mimeType: "image/jpeg",
+        size: 1024,
+        r2Key: "uploads/a.jpg",
+      });
+
+      const res = await app.request("/api/posts", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          type: "page",
+          content: "test",
+          visibility: "quiet",
+          mediaIds: [m1.id],
+        }),
+      });
+
+      expect(res.status).toBe(400);
+      const body = await res.json();
+      expect(body.error).toContain("page posts do not allow");
+    });
+
+    it("returns 400 for invalid media IDs", async () => {
+      const { app } = createTestApp({ authenticated: true });
+      app.route("/api/posts", postsApiRoutes);
+
+      const res = await app.request("/api/posts", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          type: "note",
+          content: "test",
+          visibility: "quiet",
+          mediaIds: ["nonexistent-id"],
+        }),
+      });
+
+      expect(res.status).toBe(400);
+      const body = await res.json();
+      expect(body.error).toContain("media IDs are invalid");
     });
 
     it("returns 400 for invalid body", async () => {
@@ -219,6 +387,77 @@ describe("Posts API Routes", () => {
       expect(res.status).toBe(200);
       const body = await res.json();
       expect(body.content).toBe("updated");
+      expect(body.mediaAttachments).toEqual([]);
+    });
+
+    it("updates post with mediaIds to replace attachments", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/posts", postsApiRoutes);
+
+      const post = await services.posts.create({
+        type: "note",
+        content: "test",
+      });
+
+      const m1 = await services.media.create({
+        filename: "a.jpg",
+        originalName: "a.jpg",
+        mimeType: "image/jpeg",
+        size: 1024,
+        r2Key: "uploads/a.jpg",
+      });
+
+      await services.media.attachToPost(post.id, [m1.id]);
+
+      const m2 = await services.media.create({
+        filename: "b.jpg",
+        originalName: "b.jpg",
+        mimeType: "image/jpeg",
+        size: 2048,
+        r2Key: "uploads/b.jpg",
+      });
+
+      const res = await app.request(`/api/posts/${sqid.encode(post.id)}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ mediaIds: [m2.id] }),
+      });
+
+      expect(res.status).toBe(200);
+      const body = await res.json();
+      expect(body.mediaAttachments).toHaveLength(1);
+      expect(body.mediaAttachments[0].id).toBe(m2.id);
+    });
+
+    it("preserves existing attachments when mediaIds is omitted", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/posts", postsApiRoutes);
+
+      const post = await services.posts.create({
+        type: "note",
+        content: "test",
+      });
+
+      const m1 = await services.media.create({
+        filename: "a.jpg",
+        originalName: "a.jpg",
+        mimeType: "image/jpeg",
+        size: 1024,
+        r2Key: "uploads/a.jpg",
+      });
+
+      await services.media.attachToPost(post.id, [m1.id]);
+
+      const res = await app.request(`/api/posts/${sqid.encode(post.id)}`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ content: "updated content" }),
+      });
+
+      expect(res.status).toBe(200);
+      const body = await res.json();
+      expect(body.mediaAttachments).toHaveLength(1);
+      expect(body.mediaAttachments[0].id).toBe(m1.id);
     });
 
     it("returns 404 for non-existent post", async () => {

package/src/routes/api/posts.ts

@@ -3,16 +3,50 @@
  */
 
 import { Hono } from "hono";
-import type { Bindings, PostType, Visibility } from "../../types.js";
+import type { Bindings, PostType, Visibility, Media } from "../../types.js";
 import type { AppVariables } from "../../app.js";
 import * as sqid from "../../lib/sqid.js";
-import { CreatePostSchema, UpdatePostSchema } from "../../lib/schemas.js";
+import {
+  CreatePostSchema,
+  UpdatePostSchema,
+  validateMediaForPostType,
+} from "../../lib/schemas.js";
 import { requireAuthApi } from "../../middleware/auth.js";
+import { getMediaUrl, getImageUrl } from "../../lib/image.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
 export const postsApiRoutes = new Hono<Env>();
 
+/**
+ * Converts a Media record to a MediaAttachment API response shape.
+ */
+function toMediaAttachment(
+  m: Media,
+  r2PublicUrl?: string,
+  imageTransformUrl?: string,
+) {
+  const url = getMediaUrl(m.id, m.r2Key, r2PublicUrl);
+  const previewUrl = getImageUrl(url, imageTransformUrl, {
+    width: 400,
+    quality: 80,
+    format: "auto",
+    fit: "cover",
+  });
+
+  return {
+    id: m.id,
+    url,
+    previewUrl,
+    alt: m.alt,
+    blurhash: m.blurhash,
+    width: m.width,
+    height: m.height,
+    position: m.position,
+    mimeType: m.mimeType,
+  };
+}
+
 // List posts
 postsApiRoutes.get("/", async (c) => {
   const type = c.req.query("type") as PostType | undefined;
@@ -27,10 +61,19 @@ postsApiRoutes.get("/", async (c) => {
     limit,
   });
 
+  // Batch load media for all posts
+  const postIds = posts.map((p) => p.id);
+  const mediaMap = await c.var.services.media.getByPostIds(postIds);
+  const r2PublicUrl = c.env.R2_PUBLIC_URL;
+  const imageTransformUrl = c.env.IMAGE_TRANSFORM_URL;
+
   return c.json({
     posts: posts.map((p) => ({
       ...p,
       sqid: sqid.encode(p.id),
+      mediaAttachments: (mediaMap.get(p.id) ?? []).map((m) =>
+        toMediaAttachment(m, r2PublicUrl, imageTransformUrl),
+      ),
     })),
 
     nextCursor:
@@ -48,7 +91,17 @@ postsApiRoutes.get("/:id", async (c) => {
   const post = await c.var.services.posts.getById(id);
   if (!post) return c.json({ error: "Not found" }, 404);
 
-  return c.json({ ...post, sqid: sqid.encode(post.id) });
+  const mediaList = await c.var.services.media.getByPostId(post.id);
+  const r2PublicUrl = c.env.R2_PUBLIC_URL;
+  const imageTransformUrl = c.env.IMAGE_TRANSFORM_URL;
+
+  return c.json({
+    ...post,
+    sqid: sqid.encode(post.id),
+    mediaAttachments: mediaList.map((m) =>
+      toMediaAttachment(m, r2PublicUrl, imageTransformUrl),
+    ),
+  });
 });
 
 // Create post (requires auth)
@@ -66,6 +119,22 @@ postsApiRoutes.post("/", requireAuthApi(), async (c) => {
 
   const body = parseResult.data;
 
+  // Validate media for post type
+  if (body.mediaIds) {
+    const mediaError = validateMediaForPostType(body.type, body.mediaIds);
+    if (mediaError) {
+      return c.json({ error: mediaError }, 400);
+    }
+
+    // Verify all media IDs exist
+    if (body.mediaIds.length > 0) {
+      const existing = await c.var.services.media.getByIds(body.mediaIds);
+      if (existing.length !== body.mediaIds.length) {
+        return c.json({ error: "One or more media IDs are invalid" }, 400);
+      }
+    }
+  }
+
   const post = await c.var.services.posts.create({
     type: body.type,
     title: body.title,
@@ -80,7 +149,25 @@ postsApiRoutes.post("/", requireAuthApi(), async (c) => {
     publishedAt: body.publishedAt,
   });
 
-  return c.json({ ...post, sqid: sqid.encode(post.id) }, 201);
+  // Attach media
+  if (body.mediaIds && body.mediaIds.length > 0) {
+    await c.var.services.media.attachToPost(post.id, body.mediaIds);
+  }
+
+  const mediaList = await c.var.services.media.getByPostId(post.id);
+  const r2PublicUrl = c.env.R2_PUBLIC_URL;
+  const imageTransformUrl = c.env.IMAGE_TRANSFORM_URL;
+
+  return c.json(
+    {
+      ...post,
+      sqid: sqid.encode(post.id),
+      mediaAttachments: mediaList.map((m) =>
+        toMediaAttachment(m, r2PublicUrl, imageTransformUrl),
+      ),
+    },
+    201,
+  );
 });
 
 // Update post (requires auth)
@@ -101,6 +188,30 @@ postsApiRoutes.put("/:id", requireAuthApi(), async (c) => {
 
   const body = parseResult.data;
 
+  // Validate media for post type if mediaIds is provided
+  if (body.mediaIds !== undefined) {
+    // Need the post type — use the new type if provided, else fetch existing
+    let postType = body.type;
+    if (!postType) {
+      const existing = await c.var.services.posts.getById(id);
+      if (!existing) return c.json({ error: "Not found" }, 404);
+      postType = existing.type;
+    }
+
+    const mediaError = validateMediaForPostType(postType, body.mediaIds);
+    if (mediaError) {
+      return c.json({ error: mediaError }, 400);
+    }
+
+    // Verify all media IDs exist
+    if (body.mediaIds.length > 0) {
+      const existing = await c.var.services.media.getByIds(body.mediaIds);
+      if (existing.length !== body.mediaIds.length) {
+        return c.json({ error: "One or more media IDs are invalid" }, 400);
+      }
+    }
+  }
+
   const post = await c.var.services.posts.update(id, {
     type: body.type,
     title: body.title,
@@ -114,7 +225,22 @@ postsApiRoutes.put("/:id", requireAuthApi(), async (c) => {
 
   if (!post) return c.json({ error: "Not found" }, 404);
 
-  return c.json({ ...post, sqid: sqid.encode(post.id) });
+  // Update media attachments if provided (including empty array to clear)
+  if (body.mediaIds !== undefined) {
+    await c.var.services.media.attachToPost(post.id, body.mediaIds);
+  }
+
+  const mediaList = await c.var.services.media.getByPostId(post.id);
+  const r2PublicUrl = c.env.R2_PUBLIC_URL;
+  const imageTransformUrl = c.env.IMAGE_TRANSFORM_URL;
+
+  return c.json({
+    ...post,
+    sqid: sqid.encode(post.id),
+    mediaAttachments: mediaList.map((m) =>
+      toMediaAttachment(m, r2PublicUrl, imageTransformUrl),
+    ),
+  });
 });
 
 // Delete post (requires auth)
@@ -122,6 +248,9 @@ postsApiRoutes.delete("/:id", requireAuthApi(), async (c) => {
   const id = sqid.decode(c.req.param("id"));
   if (!id) return c.json({ error: "Invalid ID" }, 400);
 
+  // Detach media before deleting
+  await c.var.services.media.detachFromPost(id);
+
   const success = await c.var.services.posts.delete(id);
   if (!success) return c.json({ error: "Not found" }, 404);
 

package/src/routes/dash/media.tsx

@@ -418,6 +418,56 @@ mediaRoutes.get("/", async (c) => {
   );
 });
 
+// Media picker (returns HTML fragment for PostForm dialog)
+// Must be defined before /:id to avoid "picker" matching as an ID
+mediaRoutes.get("/picker", async (c) => {
+  const mediaList = await c.var.services.media.list(100);
+  const r2PublicUrl = c.env.R2_PUBLIC_URL;
+  const imageTransformUrl = c.env.IMAGE_TRANSFORM_URL;
+
+  if (mediaList.length === 0) {
+    return c.html(
+      <p class="text-muted-foreground text-sm col-span-4">
+        No media uploaded yet. Upload media from the Media page first.
+      </p>,
+    );
+  }
+
+  return c.html(
+    <>
+      {mediaList
+        .filter((m) => m.mimeType.startsWith("image/"))
+        .map((m) => {
+          const url = getMediaUrl(m.id, m.r2Key, r2PublicUrl);
+          const thumbUrl = getImageUrl(url, imageTransformUrl, {
+            width: 150,
+            quality: 80,
+            format: "auto",
+            fit: "cover",
+          });
+          return (
+            <button
+              key={m.id}
+              type="button"
+              class="aspect-square rounded-lg overflow-hidden border-2 hover:border-primary cursor-pointer transition-colors"
+              data-on:click={`$mediaIds.includes('${m.id}') ? ($mediaIds = $mediaIds.filter(id => id !== '${m.id}')) : ($mediaIds = [...$mediaIds, '${m.id}'])`}
+              data-class:border-primary={`$mediaIds.includes('${m.id}')`}
+              data-class:ring-2={`$mediaIds.includes('${m.id}')`}
+              data-class:ring-primary={`$mediaIds.includes('${m.id}')`}
+            >
+              <img
+                src={thumbUrl}
+                alt={m.alt || m.originalName}
+                class="w-full h-full object-cover"
+                loading="lazy"
+              />
+            </button>
+          );
+        })}
+    </>,
+  );
+});
+
 // View single media
 mediaRoutes.get("/:id", async (c) => {
   const id = c.req.param("id");