@jant/core 0.6.10 → 0.6.12

package/src/routes/pages/page.tsx

@@ -23,6 +23,7 @@ import {
   toPublicHref,
   toPublicPath,
 } from "../../lib/url.js";
+import { ABOUT_PAGE_SLUG } from "../../services/about-page.js";
 import { isTextAttachment } from "../../services/media.js";
 import type { Post } from "../../types.js";
 import { renderArchivePage } from "./archive.js";
@@ -186,12 +187,30 @@ async function renderPostWithTextPreview(
   });
 }
 
-async function renderPost(c: Context<Env>, post: Post) {
+function canRenderDraftAboutEditor(
+  c: Context<Env>,
+  fullPath: string,
+  post: Post,
+): boolean {
+  return (
+    post.status === "draft" &&
+    fullPath === ABOUT_PAGE_SLUG &&
+    c.req.query("edit") === "1" &&
+    c.var.isAuthenticated
+  );
+}
+
+async function renderPost(
+  c: Context<Env>,
+  post: Post,
+  options: { allowDraft?: boolean } = {},
+) {
   // Start navData fetch immediately — it's independent of thread/media queries
   const navDataPromise = getNavigationData(c);
   const display = await assemblePostPageDisplay(c, post, {
     // Private-post access is validated before renderPost() is called.
     isAuthenticated: true,
+    allowDraft: options.allowDraft,
   });
   if (!display) {
     return c.notFound();
@@ -208,15 +227,25 @@ async function renderPost(c: Context<Env>, post: Post) {
   return renderPublicPage(c, {
     title: buildPageTitle(meta.title, navData.siteName),
     description: meta.description,
-    canonicalHref,
-    socialImageUrl: display.socialImage?.url,
-    socialImageAlt: display.socialImage?.alt,
-    socialImageWidth: display.socialImage?.width,
-    socialImageHeight: display.socialImage?.height,
-    ogType: "article",
-    articlePublishedTime: display.articlePublishedTime,
-    articleModifiedTime: display.articleModifiedTime,
-    jsonLd: buildPostJsonLd(c, display, meta, canonicalHref, navData.siteName),
+    ...(post.status === "published"
+      ? {
+          canonicalHref,
+          socialImageUrl: display.socialImage?.url,
+          socialImageAlt: display.socialImage?.alt,
+          socialImageWidth: display.socialImage?.width,
+          socialImageHeight: display.socialImage?.height,
+          ogType: "article" as const,
+          articlePublishedTime: display.articlePublishedTime,
+          articleModifiedTime: display.articleModifiedTime,
+          jsonLd: buildPostJsonLd(
+            c,
+            display,
+            meta,
+            canonicalHref,
+            navData.siteName,
+          ),
+        }
+      : {}),
     navData,
     content: (
       <PostPage post={display.postView} threadPosts={display.threadPostViews} />
@@ -350,7 +379,10 @@ pageRoutes.get("/*", async (c) => {
 
   if (resolved.postId) {
     const post = await c.var.services.posts.getById(resolved.postId);
-    if (!post || post.status === "draft") return c.notFound();
+    if (!post) return c.notFound();
+
+    const allowDraft = canRenderDraftAboutEditor(c, fullPath, post);
+    if (post.status === "draft" && !allowDraft) return c.notFound();
 
     if (post.visibility === "private") {
       const navData = await getNavigationData(c);
@@ -368,7 +400,7 @@ pageRoutes.get("/*", async (c) => {
       }
     }
 
-    return renderPost(c, post);
+    return renderPost(c, post, { allowDraft });
   }
 
   if (resolved.collectionId) {

package/src/services/__tests__/about-page.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, it, beforeEach } from "vitest";
+import {
+  createTestDatabase,
+  DEFAULT_TEST_SITE_ID,
+} from "../../__tests__/helpers/db.js";
+import type { Database } from "../../db/index.js";
+import { createAboutPageService } from "../about-page.js";
+import { createCollectionService } from "../collection.js";
+import { createPathService } from "../path.js";
+import { createPostService } from "../post.js";
+
+const ABOUT_BODY = JSON.stringify({
+  type: "doc",
+  content: [
+    {
+      type: "paragraph",
+      content: [{ type: "text", text: "About this site." }],
+    },
+  ],
+});
+
+describe("AboutPageService", () => {
+  let aboutPage: ReturnType<typeof createAboutPageService>;
+  let posts: ReturnType<typeof createPostService>;
+  let collections: ReturnType<typeof createCollectionService>;
+
+  beforeEach(() => {
+    const testDb = createTestDatabase();
+    const db = testDb.db as unknown as Database;
+    const paths = createPathService(db, DEFAULT_TEST_SITE_ID);
+    posts = createPostService(
+      db,
+      { slugIdLength: 5 },
+      DEFAULT_TEST_SITE_ID,
+      paths,
+    );
+    collections = createCollectionService(db, DEFAULT_TEST_SITE_ID, paths);
+    aboutPage = createAboutPageService({
+      paths,
+      posts,
+      collections,
+    });
+  });
+
+  it("reports a missing About page when /about is unused", async () => {
+    await expect(aboutPage.getStatus()).resolves.toMatchObject({
+      state: "missing",
+      path: "/about",
+    });
+  });
+
+  it("recognizes a post at /about as the About page", async () => {
+    const post = await posts.create({
+      format: "note",
+      title: "About",
+      slug: "about",
+      visibility: "latest_hidden",
+      body: ABOUT_BODY,
+    });
+
+    await expect(aboutPage.getStatus()).resolves.toMatchObject({
+      state: "ready",
+      post: {
+        id: post.id,
+        title: "About",
+        visibility: "latest_hidden",
+      },
+    });
+  });
+
+  it("creates a hidden About page when /about is unused", async () => {
+    const post = await aboutPage.ensurePage();
+    expect(post).toMatchObject({
+      title: "About",
+      status: "published",
+      visibility: "latest_hidden",
+    });
+
+    await expect(aboutPage.getStatus()).resolves.toMatchObject({
+      state: "ready",
+      post: {
+        id: post.id,
+        title: "About",
+        status: "published",
+        visibility: "latest_hidden",
+      },
+    });
+  });
+
+  it("reports a conflict when a collection owns /about", async () => {
+    const collection = await collections.create({
+      title: "About",
+      slug: "about",
+    });
+
+    await expect(aboutPage.getStatus()).resolves.toMatchObject({
+      state: "conflict",
+      conflict: {
+        targetType: "collection",
+        id: collection.id,
+        title: "About",
+      },
+    });
+  });
+
+  it("rejects About creation when another item owns /about", async () => {
+    await collections.create({
+      title: "About",
+      slug: "about",
+    });
+
+    await expect(aboutPage.ensurePage()).rejects.toThrow(
+      "/about is already used.",
+    );
+  });
+});

package/src/services/__tests__/media.test.ts

@@ -1,5 +1,5 @@
 /* eslint-disable @typescript-eslint/no-non-null-assertion -- Test assertions use ! for readability */
-import { describe, it, expect, beforeEach, vi } from "vitest";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { eq } from "drizzle-orm";
 import {
   createTestDatabase,
@@ -1546,3 +1546,170 @@ describe("MediaService", () => {
     });
   });
 });
+
+/** Minimal valid PNG header (signature + IHDR with width 4, height 6). */
+function createPngBytes(): Uint8Array {
+  return new Uint8Array([
+    0x89,
+    0x50,
+    0x4e,
+    0x47,
+    0x0d,
+    0x0a,
+    0x1a,
+    0x0a, // signature
+    0x00,
+    0x00,
+    0x00,
+    0x0d, // IHDR length (13)
+    0x49,
+    0x48,
+    0x44,
+    0x52, // "IHDR"
+    0x00,
+    0x00,
+    0x00,
+    0x04, // width = 4
+    0x00,
+    0x00,
+    0x00,
+    0x06, // height = 6
+    0x08,
+    0x06,
+    0x00,
+    0x00,
+    0x00, // bit depth, color type, ...
+  ]);
+}
+
+describe("MediaService.ingestFromUrl", () => {
+  let db: Database;
+  let mediaService: ReturnType<typeof createMediaService>;
+
+  beforeEach(() => {
+    const testDb = createTestDatabase();
+    db = testDb.db as unknown as Database;
+    mediaService = createMediaService(db, DEFAULT_TEST_SITE_ID);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  const deps = () => ({
+    storage: createMockStorage(),
+    storageDriver: "local",
+    maxFileSizeMB: 25,
+  });
+
+  it("fetches a remote image, stores it, and creates a media row", async () => {
+    const bytes = createPngBytes();
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(bytes, { headers: { "content-type": "image/png" } }),
+      ),
+    );
+
+    const d = deps();
+    const media = await mediaService.ingestFromUrl(
+      { url: "https://example.com/photo.png", alt: "A photo" },
+      d,
+    );
+
+    expect(media.mimeType).toBe("image/png");
+    expect(media.mediaKind).toBe("image");
+    expect(media.width).toBe(4);
+    expect(media.height).toBe(6);
+    expect(media.alt).toBe("A photo");
+    expect(media.postId).toBeNull();
+
+    const stored = d.storage.files.get(media.storageKey);
+    expect(stored).toBeDefined();
+    expect(stored?.contentType).toBe("image/png");
+    expect(stored?.contentDisposition).toBe("inline");
+  });
+
+  it("stores SVG with attachment disposition (XSS-safe direct navigation)", async () => {
+    const svg = new TextEncoder().encode(
+      '<svg xmlns="http://www.w3.org/2000/svg"></svg>',
+    );
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(svg, {
+            headers: { "content-type": "image/svg+xml" },
+          }),
+      ),
+    );
+
+    const d = deps();
+    const media = await mediaService.ingestFromUrl(
+      { url: "https://example.com/icon.svg" },
+      d,
+    );
+
+    expect(media.mimeType).toBe("image/svg+xml");
+    const stored = d.storage.files.get(media.storageKey);
+    expect(stored?.contentDisposition).toBe("attachment");
+  });
+
+  it("rejects content that isn't a real image (content-type spoofing)", async () => {
+    const html = new TextEncoder().encode(
+      "<!doctype html><script>alert(1)</script>",
+    );
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        // Server lies: claims PNG, returns HTML.
+        async () =>
+          new Response(html, { headers: { "content-type": "image/png" } }),
+      ),
+    );
+
+    await expect(
+      mediaService.ingestFromUrl(
+        { url: "https://example.com/evil.png" },
+        deps(),
+      ),
+    ).rejects.toThrow(/supported image/i);
+  });
+
+  it("rejects an oversize image", async () => {
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new Uint8Array(2 * 1024 * 1024));
+        controller.close();
+      },
+    });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(
+        async () =>
+          new Response(stream, { headers: { "content-type": "image/png" } }),
+      ),
+    );
+
+    await expect(
+      mediaService.ingestFromUrl(
+        { url: "https://example.com/huge.png" },
+        { ...deps(), maxFileSizeMB: 1 },
+      ),
+    ).rejects.toThrow(/too large/i);
+  });
+
+  it("rejects a private/SSRF URL before fetching", async () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(
+      mediaService.ingestFromUrl(
+        { url: "http://169.254.169.254/latest/meta-data" },
+        deps(),
+      ),
+    ).rejects.toThrow(/private address/i);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});

package/src/services/__tests__/navigation.test.ts

@@ -9,11 +9,50 @@ import { now } from "../../lib/time.js";
 
 const TEST_COLLECTION_ID = "col_test00000000000000000000001";
 const TEST_COLLECTION_ID_2 = "col_test00000000000000000000002";
+const TEST_POST_ID = "pst_test00000000000000000000001";
+const TEST_POST_ID_2 = "pst_test00000000000000000000002";
+
+function insertTestPath(
+  sqlite: ReturnType<typeof createTestDatabase>["sqlite"],
+  input: {
+    id: string;
+    path: string;
+    kind: "slug" | "alias" | "redirect" | "archive";
+    postId?: string | null;
+    collectionId?: string | null;
+    redirectToPath?: string | null;
+    redirectType?: 301 | 302 | null;
+    archiveQuery?: string | null;
+  },
+) {
+  const ts = now();
+  sqlite
+    .prepare(
+      `INSERT INTO path_registry (
+        id, site_id, path, kind, post_id, collection_id, redirect_to_path,
+        redirect_type, archive_query, created_at, updated_at
+      )
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    )
+    .run(
+      input.id,
+      DEFAULT_TEST_SITE_ID,
+      input.path,
+      input.kind,
+      input.postId ?? null,
+      input.collectionId ?? null,
+      input.redirectToPath ?? null,
+      input.redirectType ?? null,
+      input.archiveQuery ?? null,
+      ts,
+      ts,
+    );
+}
 
 function insertTestCollection(
   sqlite: ReturnType<typeof createTestDatabase>["sqlite"],
   id: string,
-  _slug: string,
+  slug: string,
   title: string,
 ) {
   const ts = now();
@@ -23,6 +62,51 @@ function insertTestCollection(
        VALUES (?, ?, ?, 'newest', ?, ?)`,
     )
     .run(id, DEFAULT_TEST_SITE_ID, title, ts, ts);
+  insertTestPath(sqlite, {
+    id: `pth_col_${id.slice(4)}`,
+    path: slug,
+    kind: "slug",
+    collectionId: id,
+  });
+}
+
+function insertTestPost(
+  sqlite: ReturnType<typeof createTestDatabase>["sqlite"],
+  input: {
+    id: string;
+    slug: string;
+    title: string | null;
+    status?: "draft" | "published";
+    visibility?: "public" | "latest_hidden" | "private";
+  },
+) {
+  const ts = now();
+  sqlite
+    .prepare(
+      `INSERT INTO post (
+        id, site_id, format, status, visibility, title, thread_id,
+        published_at, last_activity_at, created_at, updated_at
+      )
+       VALUES (?, ?, 'note', ?, ?, ?, ?, ?, ?, ?, ?)`,
+    )
+    .run(
+      input.id,
+      DEFAULT_TEST_SITE_ID,
+      input.status ?? "published",
+      input.visibility ?? "latest_hidden",
+      input.title,
+      input.id,
+      ts,
+      ts,
+      ts,
+      ts,
+    );
+  insertTestPath(sqlite, {
+    id: `pth_pst_${input.id.slice(4)}`,
+    path: input.slug,
+    kind: "slug",
+    postId: input.id,
+  });
 }
 
 describe("NavItemService", () => {
@@ -277,6 +361,111 @@ describe("NavItemService", () => {
     });
   });
 
+  describe("listSuggestedLinks", () => {
+    it("suggests a published /about page as a normal link", async () => {
+      insertTestPost(sqlite, {
+        id: TEST_POST_ID,
+        slug: "about",
+        title: "About me",
+      });
+
+      const suggestions = await navItemService.listSuggestedLinks();
+
+      expect(suggestions).toEqual([
+        {
+          key: "about",
+          label: "About me",
+          url: "/about",
+          targetType: "page",
+          navItemType: "link",
+        },
+      ]);
+    });
+
+    it("suggests a canonical /now collection as a collection nav item", async () => {
+      insertTestCollection(sqlite, TEST_COLLECTION_ID, "now", "Now");
+
+      const suggestions = await navItemService.listSuggestedLinks();
+
+      expect(suggestions).toEqual([
+        {
+          key: "now",
+          label: "Now",
+          url: "/now",
+          targetType: "collection",
+          navItemType: "collection",
+          collectionId: TEST_COLLECTION_ID,
+        },
+      ]);
+    });
+
+    it("suggests a /now collection alias as a normal link to preserve the path", async () => {
+      insertTestCollection(sqlite, TEST_COLLECTION_ID, "updates", "Updates");
+      insertTestPath(sqlite, {
+        id: "pth_now_alias",
+        path: "now",
+        kind: "alias",
+        collectionId: TEST_COLLECTION_ID,
+      });
+
+      const suggestions = await navItemService.listSuggestedLinks();
+
+      expect(suggestions).toEqual([
+        {
+          key: "now",
+          label: "Updates",
+          url: "/now",
+          targetType: "collection",
+          navItemType: "link",
+        },
+      ]);
+    });
+
+    it("hides suggestions already represented by path or collection id", async () => {
+      insertTestPost(sqlite, {
+        id: TEST_POST_ID,
+        slug: "about",
+        title: "About",
+      });
+      insertTestCollection(sqlite, TEST_COLLECTION_ID, "now", "Now");
+
+      await navItemService.create({
+        type: "link",
+        label: "About",
+        url: "/about/",
+      });
+      await navItemService.create({
+        type: "collection",
+        collectionId: TEST_COLLECTION_ID,
+        label: "Now",
+        url: "/now",
+      });
+
+      const suggestions = await navItemService.listSuggestedLinks();
+
+      expect(suggestions).toEqual([]);
+    });
+
+    it("does not suggest draft or private posts", async () => {
+      insertTestPost(sqlite, {
+        id: TEST_POST_ID,
+        slug: "about",
+        title: "About",
+        status: "draft",
+      });
+      insertTestPost(sqlite, {
+        id: TEST_POST_ID_2,
+        slug: "now",
+        title: "Now",
+        visibility: "private",
+      });
+
+      const suggestions = await navItemService.listSuggestedLinks();
+
+      expect(suggestions).toEqual([]);
+    });
+  });
+
   describe("update", () => {
     it("updates a nav item's label", async () => {
       const created = await navItemService.create({