@jant/core 0.6.14 → 0.6.15

package/src/routes/api/__tests__/nav-items.test.ts

@@ -40,6 +40,48 @@ describe("Nav Items API Routes", () => {
     });
   });
 
+  describe("GET /api/nav-items/pages", () => {
+    it("requires authentication", async () => {
+      const { app } = createTestApp({ authenticated: false });
+      app.route("/api/nav-items", navItemsApiRoutes);
+
+      const res = await app.request("/api/nav-items/pages");
+
+      expect(res.status).toBe(401);
+    });
+
+    it("searches eligible page candidates", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/nav-items", navItemsApiRoutes);
+      const page = await services.posts.create({
+        format: "note",
+        title: "About this site",
+        slug: "about-this-site",
+        visibility: "latest_hidden",
+      });
+      await services.posts.create({
+        format: "link",
+        title: "About elsewhere",
+        slug: "about-elsewhere",
+        url: "https://example.com",
+      });
+
+      const res = await app.request("/api/nav-items/pages?q=ABOUT");
+
+      expect(res.status).toBe(200);
+      expect(await res.json()).toEqual({
+        pages: [
+          {
+            id: page.id,
+            title: "About this site",
+            slug: "about-this-site",
+            updatedAt: expect.any(Number),
+          },
+        ],
+      });
+    });
+  });
+
   describe("POST /api/nav-items", () => {
     it("returns 401 when not authenticated", async () => {
       const { app } = createTestApp({ authenticated: false });
@@ -435,6 +477,55 @@ describe("Nav Items API Routes", () => {
     });
   });
 
+  describe("POST /api/nav-items (page)", () => {
+    it("derives the page label and URL from the selected post", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/nav-items", navItemsApiRoutes);
+      const page = await services.posts.create({
+        format: "note",
+        title: "About me",
+        slug: "about-me",
+        visibility: "latest_hidden",
+      });
+
+      const res = await app.request("/api/nav-items", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-Jant-Site-Header": "include",
+        },
+        body: JSON.stringify({ type: "page", postId: page.id }),
+      });
+
+      expect(res.status).toBe(201);
+      expect(await res.json()).toMatchObject({
+        type: "page",
+        postId: page.id,
+        label: "About me",
+        url: "/about-me",
+        headerHtml: expect.stringContaining("About me"),
+      });
+    });
+
+    it("rejects a Link post as a page", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/nav-items", navItemsApiRoutes);
+      const link = await services.posts.create({
+        format: "link",
+        title: "Elsewhere",
+        url: "https://example.com",
+      });
+
+      const res = await app.request("/api/nav-items", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ type: "page", postId: link.id }),
+      });
+
+      expect(res.status).toBe(400);
+    });
+  });
+
   describe("DELETE /api/nav-items/:id", () => {
     it("returns 401 when not authenticated", async () => {
       const { app, services } = createTestApp({ authenticated: false });

package/src/routes/api/__tests__/public-access.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, it } from "vitest";
+import { createTestApp } from "../../../__tests__/helpers/app.js";
+import { collectionsApiRoutes } from "../collections.js";
+import { navItemsApiRoutes } from "../nav-items.js";
+import { publicArchiveApiRoutes } from "../public/archive.js";
+import { publicPostsApiRoutes } from "../public/posts.js";
+import { searchApiRoutes } from "../search.js";
+
+function mountPublicReadRoutes(authenticated = false) {
+  const testApp = createTestApp({ authenticated, fts: true });
+  testApp.app.route("/api/public/posts", publicPostsApiRoutes);
+  testApp.app.route("/api/public/archive", publicArchiveApiRoutes);
+  testApp.app.route("/api/search", searchApiRoutes);
+  testApp.app.route("/api/collections", collectionsApiRoutes);
+  testApp.app.route("/api/nav-items", navItemsApiRoutes);
+  return testApp;
+}
+
+describe("public API access setting", () => {
+  it.each([
+    "/api/public/posts",
+    "/api/public/posts/missing",
+    "/api/public/archive",
+  ])("returns 404 for %s when the public API is off", async (path) => {
+    const { app, services } = mountPublicReadRoutes();
+    await services.settings.set("PUBLIC_API_ENABLED", "false");
+
+    const response = await app.request(path);
+
+    expect(response.status).toBe(404);
+  });
+
+  it("does not let an authenticated session bypass the public API switch", async () => {
+    const { app, services } = mountPublicReadRoutes(true);
+    await services.settings.set("PUBLIC_API_ENABLED", "false");
+
+    expect((await app.request("/api/public/posts")).status).toBe(404);
+    expect((await app.request("/api/public/archive")).status).toBe(404);
+  });
+
+  it("does not let a Bearer token bypass the public API switch", async () => {
+    const { app, services } = mountPublicReadRoutes();
+    await services.settings.set("PUBLIC_API_ENABLED", "false");
+    const { plaintext } = await services.apiTokens.create("Test client");
+
+    const response = await app.request("/api/public/posts", {
+      headers: { Authorization: `Bearer ${plaintext}` },
+    });
+
+    expect(response.status).toBe(404);
+  });
+
+  it.each([
+    "/api/search",
+    "/api/collections",
+    "/api/collections/not-a-typeid",
+    "/api/nav-items",
+  ])(
+    "requires authentication for %s when anonymous reads are off",
+    async (path) => {
+      const { app, services } = mountPublicReadRoutes();
+      await services.settings.set("PUBLIC_API_ENABLED", "false");
+
+      const response = await app.request(path);
+
+      expect(response.status).toBe(401);
+    },
+  );
+
+  it.each(["/api/search?q=missing", "/api/collections", "/api/nav-items"])(
+    "preserves authenticated access to shared read endpoint %s",
+    async (path) => {
+      const { app, services } = mountPublicReadRoutes(true);
+      await services.settings.set("PUBLIC_API_ENABLED", "false");
+
+      const response = await app.request(path);
+
+      expect(response.status).toBe(200);
+    },
+  );
+});

package/src/routes/api/__tests__/settings.test.ts

@@ -38,6 +38,10 @@ describe("Settings API Routes", () => {
       expect(body.settings.SITE_NAME).toBe("Jant");
       expect(body.settings.SITE_DESCRIPTION).toBe("");
       expect(body.settings.SITE_LANGUAGE).toBe("en");
+      expect(body.settings.PAGE_SIZE).toBe("50");
+      expect(body.settings.SEARCH_PAGE_SIZE).toBe("50");
+      expect(body.settings.ARCHIVE_PAGE_SIZE).toBe("50");
+      expect(body.settings.RSS_PUBLISH_DELAY_SECONDS).toBe("0");
     });
 
     it("returns stored settings overriding defaults", async () => {
@@ -246,6 +250,94 @@ describe("Settings API Routes", () => {
       expect(res.status).toBe(400);
     });
 
+    it("rejects invalid boolean and enum values", async () => {
+      const { app } = createTestApp({ authenticated: true });
+      app.route("/api/settings", settingsApiRoutes);
+
+      const booleanResponse = await app.request("/api/settings", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ SHOW_JANT_BRANDING_ON_HOME: "yes" }),
+      });
+      expect(booleanResponse.status).toBe(400);
+      expect((await booleanResponse.json()).error).toContain("true or false");
+
+      const enumResponse = await app.request("/api/settings", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ MAIN_RSS_FEED: "popular" }),
+      });
+      expect(enumResponse.status).toBe(400);
+      expect((await enumResponse.json()).error).toContain("available options");
+    });
+
+    it("validates and canonicalizes bounded integer settings", async () => {
+      const { app } = createTestApp({ authenticated: true });
+      app.route("/api/settings", settingsApiRoutes);
+
+      const validResponse = await app.request("/api/settings", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          PAGE_SIZE: "80",
+          SUMMARY_MAX_PARAGRAPHS: "20",
+          SUMMARY_MAX_CHARS: "1200",
+          RSS_FEED_LIMIT: "150",
+          RSS_PUBLISH_DELAY_SECONDS: "0",
+        }),
+      });
+      expect(validResponse.status).toBe(200);
+      await expect(validResponse.json()).resolves.toMatchObject({
+        settings: {
+          PAGE_SIZE: "80",
+          SEARCH_PAGE_SIZE: "80",
+          ARCHIVE_PAGE_SIZE: "80",
+          SUMMARY_MAX_PARAGRAPHS: "20",
+          SUMMARY_MAX_CHARS: "1200",
+          RSS_FEED_LIMIT: "150",
+          RSS_PUBLISH_DELAY_SECONDS: "0",
+        },
+      });
+
+      for (const [key, value] of [
+        ["PAGE_SIZE", "101"],
+        ["SEARCH_PAGE_SIZE", "1.5"],
+        ["SUMMARY_MAX_PARAGRAPHS", "51"],
+        ["SUMMARY_MAX_CHARS", "1501"],
+        ["RSS_FEED_LIMIT", "201"],
+        ["RSS_PUBLISH_DELAY_SECONDS", "7201"],
+      ]) {
+        const response = await app.request("/api/settings", {
+          method: "PUT",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ [key]: value }),
+        });
+        expect(response.status).toBe(400);
+      }
+    });
+
+    it("validates and canonicalizes content language tags", async () => {
+      const { app } = createTestApp({ authenticated: true });
+      app.route("/api/settings", settingsApiRoutes);
+
+      const validResponse = await app.request("/api/settings", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ SITE_LANGUAGE: "zh-hans" }),
+      });
+      expect(validResponse.status).toBe(200);
+      expect((await validResponse.json()).settings.SITE_LANGUAGE).toBe(
+        "zh-Hans",
+      );
+
+      const invalidResponse = await app.request("/api/settings", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ SITE_LANGUAGE: "not_a_language" }),
+      });
+      expect(invalidResponse.status).toBe(400);
+    });
+
     it("rejects NOINDEX updates in demo mode", async () => {
       const { app } = createTestApp({ authenticated: true, demoMode: true });
       app.route("/api/settings", settingsApiRoutes);
@@ -282,6 +374,131 @@ describe("Settings API Routes", () => {
     });
   });
 
+  describe("DELETE /api/settings/:key", () => {
+    it("returns 401 when not authenticated", async () => {
+      const { app } = createTestApp({ authenticated: false });
+      app.route("/api/settings", settingsApiRoutes);
+
+      const res = await app.request("/api/settings/SITE_NAME", {
+        method: "DELETE",
+      });
+
+      expect(res.status).toBe(401);
+    });
+
+    it("removes an override and returns the fallback value", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/settings", settingsApiRoutes);
+      await services.settings.set("SITE_NAME", "Custom name");
+
+      const res = await app.request("/api/settings/SITE_NAME", {
+        method: "DELETE",
+      });
+
+      expect(res.status).toBe(200);
+      expect(await services.settings.get("SITE_NAME")).toBeNull();
+      const body = await res.json();
+      expect(body.settings.SITE_NAME).toBe("Jant");
+      expect(body.setting).toMatchObject({
+        key: "SITE_NAME",
+        value: "Jant",
+        modified: false,
+      });
+    });
+
+    it("resets search page size to the current page-size setting", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/settings", settingsApiRoutes);
+      await services.settings.set("PAGE_SIZE", "80");
+      await services.settings.set("SEARCH_PAGE_SIZE", "25");
+
+      const res = await app.request("/api/settings/SEARCH_PAGE_SIZE", {
+        method: "DELETE",
+      });
+
+      expect(res.status).toBe(200);
+      expect(await services.settings.get("SEARCH_PAGE_SIZE")).toBeNull();
+      const body = await res.json();
+      expect(body.settings.SEARCH_PAGE_SIZE).toBe("80");
+      expect(body.setting).toMatchObject({
+        key: "SEARCH_PAGE_SIZE",
+        value: "80",
+        fallbackValue: "80",
+        modified: false,
+      });
+    });
+
+    it("removes a safe linked scalar override and returns its fallback", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/settings", settingsApiRoutes);
+      await services.settings.set("THEME", "paper");
+
+      const res = await app.request("/api/settings/THEME", {
+        method: "DELETE",
+      });
+
+      expect(res.status).toBe(200);
+      expect(await services.settings.get("THEME")).toBeNull();
+      const body = await res.json();
+      expect(body.settings.THEME).toBeUndefined();
+      expect(body.setting).toMatchObject({
+        key: "THEME",
+        mode: "link",
+        value: "tufte",
+        modified: false,
+        resettable: true,
+      });
+    });
+
+    it("resets an API-editable textarea setting through its linked editor state", async () => {
+      const { app, services } = createTestApp({ authenticated: true });
+      app.route("/api/settings", settingsApiRoutes);
+      await services.settings.set("SITE_DESCRIPTION", "A longer introduction");
+
+      const res = await app.request("/api/settings/SITE_DESCRIPTION", {
+        method: "DELETE",
+      });
+
+      expect(res.status).toBe(200);
+      expect(await services.settings.get("SITE_DESCRIPTION")).toBeNull();
+      const body = await res.json();
+      expect(body.settings.SITE_DESCRIPTION).toBe("");
+      expect(body.setting).toMatchObject({
+        key: "SITE_DESCRIPTION",
+        mode: "link",
+        value: "false",
+        modified: false,
+        resettable: true,
+        settingsPath: "/settings/general",
+      });
+    });
+
+    it("rejects unsafe, specialized, and demo-locked keys", async () => {
+      const standard = createTestApp({ authenticated: true });
+      standard.app.route("/api/settings", settingsApiRoutes);
+
+      for (const key of [
+        "AUTH_SECRET",
+        "GITHUB_SYNC_TOKEN",
+        "CUSTOM_CSS",
+        "SITE_AVATAR",
+      ]) {
+        const res = await standard.app.request(`/api/settings/${key}`, {
+          method: "DELETE",
+        });
+        expect(res.status).toBe(400);
+        expect((await res.json()).details.rejectedKeys).toContain(key);
+      }
+
+      const demo = createTestApp({ authenticated: true, demoMode: true });
+      demo.app.route("/api/settings", settingsApiRoutes);
+      const demoResponse = await demo.app.request("/api/settings/NOINDEX", {
+        method: "DELETE",
+      });
+      expect(demoResponse.status).toBe(400);
+    });
+  });
+
   describe("PUT /api/settings/import", () => {
     it("returns 401 when not authenticated", async () => {
       const { app } = createTestApp({ authenticated: false });

package/src/routes/api/collections.ts

@@ -7,6 +7,7 @@ import { z } from "zod";
 import type { Bindings, CollectionSortOrder } from "../../types.js";
 import type { AppVariables } from "../../types/app-context.js";
 import { requireAuthApi } from "../../middleware/auth.js";
+import { requirePublicApiAccess } from "../../middleware/public-content-access.js";
 import {
   CollectionDirectoryItemIdSchema,
   CollectionDescriptionValueSchema,
@@ -30,8 +31,8 @@ const UpdateCollectionSchema = CreateCollectionSchema.partial().extend({
   sortOrder: CollectionSortOrderSchema.optional(),
 });
 
-const PostAssignSchema = z.object({
-  postId: PostIdSchema,
+const ThreadAssignSchema = z.object({
+  threadId: PostIdSchema,
 });
 
 const MoveSchema = z.object({
@@ -43,8 +44,8 @@ const ListCollectionsQuerySchema = z.object({
   view: z.enum(["compose"]).optional(),
 });
 
-// List collections (includes post counts and directory items)
-collectionsApiRoutes.get("/", async (c) => {
+// List collections (includes Thread counts and directory items)
+collectionsApiRoutes.get("/", requirePublicApiAccess(), async (c) => {
   const query = parseValidated(ListCollectionsQuerySchema, c.req.query());
 
   if (query.view === "compose") {
@@ -135,7 +136,7 @@ collectionsApiRoutes.delete(
 );
 
 // Get single collection
-collectionsApiRoutes.get("/:id", async (c) => {
+collectionsApiRoutes.get("/:id", requirePublicApiAccess(), async (c) => {
   const id = parseIdParam(c.req.param("id"), ID_PREFIX.collection);
   const collection = assertFound(
     await c.var.services.collections.getById(id),
@@ -181,56 +182,51 @@ collectionsApiRoutes.delete("/:id", requireAuthApi(), async (c) => {
   return c.json({ success: true });
 });
 
-// Add a post to a collection (requires auth)
-collectionsApiRoutes.post("/:id/posts", requireAuthApi(), async (c) => {
+// Add a thread to a collection (requires auth)
+collectionsApiRoutes.post("/:id/threads", requireAuthApi(), async (c) => {
   const id = parseIdParam(c.req.param("id"), ID_PREFIX.collection);
   assertFound(await c.var.services.collections.getById(id), "Collection");
 
-  const body = parseValidated(PostAssignSchema, await c.req.json());
-  assertFound(await c.var.services.posts.getById(body.postId), "Post");
-
-  await c.var.services.collections.addPost(id, body.postId);
+  const body = parseValidated(ThreadAssignSchema, await c.req.json());
+  await c.var.services.collections.addThread(id, body.threadId);
 
   return c.json({ success: true }, 201);
 });
 
-// Remove a post from a collection (requires auth)
+// Remove a thread from a collection (requires auth)
 collectionsApiRoutes.delete(
-  "/:id/posts/:postId",
+  "/:id/threads/:threadId",
   requireAuthApi(),
   async (c) => {
     const id = parseIdParam(c.req.param("id"), ID_PREFIX.collection);
-    const postId = parseIdParam(c.req.param("postId"), ID_PREFIX.post);
-
-    await c.var.services.collections.removePost(id, postId);
+    const threadId = parseIdParam(c.req.param("threadId"), ID_PREFIX.post);
+    await c.var.services.collections.removeThread(id, threadId);
 
     return c.json({ success: true });
   },
 );
 
-// Pin a post within a collection (requires auth)
+// Pin a thread within a collection (requires auth)
 collectionsApiRoutes.put(
-  "/:id/posts/:postId/pin",
+  "/:id/threads/:threadId/pin",
   requireAuthApi(),
   async (c) => {
     const id = parseIdParam(c.req.param("id"), ID_PREFIX.collection);
-    const postId = parseIdParam(c.req.param("postId"), ID_PREFIX.post);
-
-    await c.var.services.collections.pinPost(id, postId);
+    const threadId = parseIdParam(c.req.param("threadId"), ID_PREFIX.post);
+    await c.var.services.collections.pinThread(id, threadId);
 
     return c.json({ success: true });
   },
 );
 
-// Unpin a post within a collection (requires auth)
+// Unpin a thread within a collection (requires auth)
 collectionsApiRoutes.delete(
-  "/:id/posts/:postId/pin",
+  "/:id/threads/:threadId/pin",
   requireAuthApi(),
   async (c) => {
     const id = parseIdParam(c.req.param("id"), ID_PREFIX.collection);
-    const postId = parseIdParam(c.req.param("postId"), ID_PREFIX.post);
-
-    await c.var.services.collections.unpinPost(id, postId);
+    const threadId = parseIdParam(c.req.param("threadId"), ID_PREFIX.post);
+    await c.var.services.collections.unpinThread(id, threadId);
 
     return c.json({ success: true });
   },

package/src/routes/api/export.ts

@@ -24,6 +24,8 @@ exportApiRoutes.post("/hugo", requireAuthApi(), async (c) => {
       siteDescription: appConfig.siteDescription,
       siteLanguage: appConfig.siteLanguage,
       showJantBrandingOnHome: appConfig.showJantBrandingOnHome,
+      publicApiEnabled: appConfig.publicApiEnabled,
+      rssFeedsEnabled: appConfig.rssFeedsEnabled,
       mainRssFeed: appConfig.mainRssFeed,
       siteFooter: appConfig.siteFooter,
       showHeaderAvatar: appConfig.showHeaderAvatar,