@jant/core 0.6.14 → 0.6.15

package/src/routes/api/public/posts.ts

@@ -21,11 +21,14 @@ import {
   resolveCollectionSortOrder,
   supportsCollectionRatingSort,
 } from "../../../lib/collection-sort.js";
+import { requirePublicApiEnabled } from "../../../middleware/public-content-access.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
 export const publicPostsApiRoutes = new Hono<Env>();
 
+publicPostsApiRoutes.use("*", requirePublicApiEnabled());
+
 const ListPublicPostsQuerySchema = z.object({
   format: FormatSchema.optional(),
   collection: z.string().optional(),
@@ -97,7 +100,7 @@ function isPublicDetailVisible(post: Post | null): post is Post {
 export function toPublicPost(
   post: Post,
   mediaList: Media[],
-  postCollections: Collection[],
+  threadCollections: Collection[],
   appConfig: AppVariables["appConfig"],
   options?: { content?: "markdown" },
 ): PublicPostResponse {
@@ -159,7 +162,7 @@ export function toPublicPost(
         sitePathPrefix,
       ),
     ),
-    collections: postCollections.map((collection) => ({
+    collections: threadCollections.map((collection) => ({
       id: collection.id,
       slug: collection.slug,
       title: collection.title,
@@ -226,16 +229,19 @@ publicPostsApiRoutes.get("/", async (c) => {
       ? "newest"
       : primaryCollection.sortOrder;
 
-    const ratedPostCount = await c.var.services.posts.countUpTo(
-      {
+    const ratedThreadCount =
+      await c.var.services.posts.countCollectionThreadRootsUpToForCollections(
         collectionIds,
-        status: "published",
-        excludePrivate: true,
-        hasRating: true,
-      },
-      2,
-    );
-    const showRatingSort = supportsCollectionRatingSort(ratedPostCount);
+        {
+          status: "published",
+          excludePrivate: true,
+          excludeLatestHidden: true,
+          rootFormat: format,
+          hasRating: true,
+        },
+        2,
+      );
+    const showRatingSort = supportsCollectionRatingSort(ratedThreadCount);
     const defaultSort = resolveCollectionSortOrder(
       undefined,
       requestedDefaultSort,
@@ -244,17 +250,28 @@ publicPostsApiRoutes.get("/", async (c) => {
     sortOrder = resolveCollectionSortOrder(sort, defaultSort, showRatingSort);
   }
 
-  const posts = await c.var.services.posts.list({
-    format,
-    collectionIds,
-    sortOrder,
-    status: "published",
-    cursor: cursor ?? undefined,
-    limit,
-    excludePrivate: true,
-    excludeLatestHidden: true,
-    excludeReplies: true,
-  });
+  const posts = collectionIds
+    ? await c.var.services.posts.listCollectionThreadRootsForCollections(
+        collectionIds,
+        {
+          status: "published",
+          excludePrivate: true,
+          excludeLatestHidden: true,
+          rootFormat: format,
+          sortOrder,
+          cursor: cursor ?? undefined,
+          limit,
+        },
+      )
+    : await c.var.services.posts.list({
+        format,
+        status: "published",
+        cursor: cursor ?? undefined,
+        limit,
+        excludePrivate: true,
+        excludeLatestHidden: true,
+        excludeReplies: true,
+      });
 
   const postIds = posts.map((post) => post.id);
   const [mediaMap, collectionsMap] = await Promise.all([
@@ -289,13 +306,13 @@ publicPostsApiRoutes.get("/:slug", async (c) => {
     throw new NotFoundError("Post");
   }
 
-  const [mediaList, postCollections] = await Promise.all([
+  const [mediaList, threadCollections] = await Promise.all([
     c.var.services.media.getByPostId(post.id),
     c.var.services.collections.getCollectionsByPostId(post.id),
   ]);
 
   return c.json(
-    toPublicPost(post, mediaList, postCollections, c.var.appConfig, {
+    toPublicPost(post, mediaList, threadCollections, c.var.appConfig, {
       content,
     }),
   );

package/src/routes/api/search.ts

@@ -8,11 +8,14 @@ import type { AppVariables } from "../../types/app-context.js";
 import { ValidationError, ExternalServiceError } from "../../lib/errors.js";
 import { toSearchApiResult } from "../../lib/api-search.js";
 import { rateLimit } from "../../middleware/rate-limit.js";
+import { requirePublicApiAccess } from "../../middleware/public-content-access.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
 export const searchApiRoutes = new Hono<Env>();
 
+searchApiRoutes.use("*", requirePublicApiAccess());
+
 // Per-IP rate limit. The request-time wrapper is needed because the
 // per-minute cap is pulled from `appConfig` which is only available on
 // `c.var`; constructing the middleware once at module load would capture

package/src/routes/api/settings.ts

@@ -13,7 +13,10 @@ import { parseValidated } from "../../lib/schemas.js";
 import { ValidationError } from "../../lib/errors.js";
 import { syncHostedControlPlaneSiteAvatar } from "../../lib/hosted-control-plane-sync.js";
 import {
+  buildConfigEditorFields,
   buildEditableSettingsResponse,
+  demoLockedSettingKeys,
+  isResettableConfigEditorKey,
   partitionEditableSettingUpdates,
   partitionImportableSettingUpdates,
 } from "../../lib/api-settings.js";
@@ -31,6 +34,7 @@ settingsApiRoutes.get("/", requireAuthApi(), async (c) => {
     settings: buildEditableSettingsResponse(
       allSettings,
       c.var.appConfig.demoMode,
+      c.env,
     ),
   });
 });
@@ -61,6 +65,7 @@ settingsApiRoutes.put("/", requireAuthApi(), async (c) => {
     settings: buildEditableSettingsResponse(
       allSettings,
       c.var.appConfig.demoMode,
+      c.env,
     ),
     ...(rejectedKeys.length > 0 && { rejectedKeys }),
   });
@@ -216,3 +221,31 @@ settingsApiRoutes.delete("/avatar", requireAuthApi(), async (c) => {
   }
   return c.json({ success: true });
 });
+
+// Remove one runtime override so the environment/default fallback applies.
+// Registered after the concrete avatar route so `DELETE /avatar` remains
+// unambiguous.
+settingsApiRoutes.delete("/:key", requireAuthApi(), async (c) => {
+  const key = c.req.param("key");
+  const demoMode = c.var.appConfig.demoMode;
+
+  if (
+    !isResettableConfigEditorKey(key) ||
+    (demoMode && demoLockedSettingKeys.has(key))
+  ) {
+    throw new ValidationError("This setting can't be reset.", {
+      rejectedKeys: [key],
+    });
+  }
+
+  await c.var.services.settings.remove(key);
+  const allSettings = await c.var.services.settings.getAll();
+  const setting = buildConfigEditorFields(allSettings, c.env, demoMode).find(
+    (field) => field.key === key,
+  );
+
+  return c.json({
+    settings: buildEditableSettingsResponse(allSettings, demoMode, c.env),
+    setting,
+  });
+});

package/src/routes/auth/__tests__/setup.test.ts

@@ -38,14 +38,13 @@ describe("Setup bootstrap logic", () => {
     };
   });
 
-  it("creates six nav items with the built-in default navigation", async () => {
+  it("creates the five-item default navigation without Latest", async () => {
     await runSetupBootstrap(services);
 
     const navItemsList = await services.db.select().from(navItems);
-    expect(navItemsList).toHaveLength(6);
+    expect(navItemsList).toHaveLength(5);
 
     expect(navItemsList.map((item) => item.systemKey)).toEqual([
-      "latest",
       "featured",
       "collections",
       "archive",
@@ -125,7 +124,11 @@ describe("Setup bootstrap logic", () => {
     const navItemsList = await services.db.select().from(navItems);
     const systemItems = navItemsList.filter((item) => item.type === "system");
 
-    expect(systemItems).toHaveLength(6);
+    expect(systemItems).toHaveLength(5);
+    expect(systemItems.map((item) => item.systemKey)).not.toContain("latest");
+    expect(
+      systemItems.find((item) => item.systemKey === "collections")?.label,
+    ).toBe("Collections");
   });
 
   it("creates a site shell when setup runs after a factory reset", async () => {

package/src/routes/compose.tsx

@@ -226,8 +226,9 @@ composeRoutes.post("/thread", async (c) => {
             : data.url || undefined,
         quoteText: data.quoteText || undefined,
         rating: data.rating || undefined,
-        collectionIds: index === 0 ? data.collectionIds : [],
+        collectionIds: index === 0 ? data.collectionIds : undefined,
         replyToId: index === 0 ? data.replyToId : undefined,
+        quietReply: data.quietReply,
         publishedAt: index === 0 ? data.publishedAt : undefined,
       },
       attachments: data.attachments,

package/src/routes/dash/settings.tsx

@@ -18,7 +18,7 @@ import { renderPublicPage } from "../../lib/render.js";
 import { getNavigationData } from "../../lib/navigation.js";
 import { buildPageTitle } from "../../lib/page-title.js";
 import { AdminBreadcrumb } from "../../ui/shared/AdminBreadcrumb.js";
-import { TIMEZONES } from "../../lib/timezones.js";
+import { getTimeZoneOptions } from "../../lib/timezones.js";
 import { ValidationError } from "../../lib/errors.js";
 import { SETTINGS_KEYS } from "../../lib/constants.js";
 import { getAvailableThemes } from "../../lib/theme.js";
@@ -39,6 +39,7 @@ import { FontThemeContent } from "../../ui/dash/appearance/FontThemeContent.js";
 import { AdvancedContent } from "../../ui/dash/appearance/AdvancedContent.js";
 import { CodeInjectionContent } from "../../ui/dash/appearance/CodeInjectionContent.js";
 import { ApiTokensContent } from "../../ui/dash/settings/ApiTokensContent.js";
+import { ConfigEditorContent } from "../../ui/dash/settings/ConfigEditorContent.js";
 import { DeleteAccountContent } from "../../ui/dash/settings/DeleteAccountContent.js";
 import {
   GitHubSyncContent,
@@ -78,6 +79,7 @@ import {
   triggerGitHubSyncInline,
 } from "../../lib/github-sync-trigger.js";
 import { buildSyncSiteConfig } from "../../lib/github-sync-site-config.js";
+import { buildConfigEditorFields } from "../../lib/api-settings.js";
 import {
   readGitHubSyncStatus,
   renderStatusCardHtml,
@@ -142,6 +144,7 @@ function breadcrumbLabel(
     | "fontTheme"
     | "customCss"
     | "codeInjection"
+    | "config"
     | "account"
     | "sessions"
     | "password"
@@ -187,6 +190,13 @@ function breadcrumbLabel(
           comment: "@context: Breadcrumb label",
         }),
       );
+    case "config":
+      return i18n._(
+        msg({
+          message: "Config Editor",
+          comment: "@context: Breadcrumb label",
+        }),
+      );
     case "account":
       return i18n._(
         msg({
@@ -366,7 +376,7 @@ settingsRoutes.get("/general", async (c) => {
           showJantBrandingOnHome={appConfig.showJantBrandingOnHome}
           noindex={appConfig.noindex}
           demoMode={appConfig.demoMode}
-          timezones={TIMEZONES}
+          timezones={getTimeZoneOptions(appConfig.timeZone)}
           aboutPage={aboutPage}
           aboutEditUrl={aboutEditPath(c)}
           aboutCreateUrl={publicPath(c, "/settings/general/about-page")}
@@ -808,6 +818,7 @@ settingsRoutes.get("/navigation", async (c) => {
           directoryData={directoryData}
           suggestedLinks={suggestedLinks}
           mainRssFeed={c.var.appConfig.mainRssFeed}
+          rssFeedsEnabled={c.var.appConfig.rssFeedsEnabled}
           siteName={navData.siteName}
           sitePathPrefix={c.var.appConfig.sitePathPrefix}
         />
@@ -1051,6 +1062,38 @@ settingsRoutes.post("/code-injection", async (c) => {
   );
 });
 
+// ===========================================================================
+// Config Editor — explicitly approved runtime settings only.
+// ===========================================================================
+
+settingsRoutes.get("/config", async (c) => {
+  const navData = await getNavigationData(c);
+  const fields = buildConfigEditorFields(
+    c.var.allSettings,
+    c.env,
+    c.var.appConfig.demoMode,
+  );
+
+  return renderPublicPage(c, {
+    title: buildPageTitle("Config Editor", navData.siteName),
+    navData,
+    content: (
+      <>
+        <AdminBreadcrumb
+          parent={breadcrumbLabel(c, "settings")}
+          parentHref={publicPath(c, "/settings")}
+          current={breadcrumbLabel(c, "config")}
+        />
+        <ConfigEditorContent
+          fields={fields}
+          endpoint={publicPath(c, "/api/settings")}
+          sitePathPrefix={c.var.appConfig.sitePathPrefix}
+        />
+      </>
+    ),
+  });
+});
+
 // ===========================================================================
 // Account sub-menu
 // ===========================================================================

package/src/routes/feed/__tests__/feed.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { eq } from "drizzle-orm";
 import { Hono } from "hono";
 import type { Bindings } from "../../../types.js";
@@ -43,6 +43,7 @@ function createFeedTestApp(envOverrides: Partial<Bindings> = {}) {
     const env = {
       SITE_ORIGIN: `http://localhost:${DEFAULT_APP_PORT}`,
       SITE_PATH_PREFIX: "",
+      RSS_PUBLISH_DELAY_SECONDS: 0,
       ...envOverrides,
     } as Bindings;
     c.env = env;
@@ -67,6 +68,10 @@ function createFeedTestApp(envOverrides: Partial<Bindings> = {}) {
   return { app, services, db: db as unknown as Database };
 }
 
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
 describe("Atom Feed Routes", () => {
   describe("/feed — site main feed", () => {
     it("defaults to featured posts", async () => {
@@ -170,9 +175,10 @@ describe("Atom Feed Routes", () => {
       expect(res.headers.get("Content-Type")).toBe(
         "application/atom+xml; charset=utf-8",
       );
+      expect(res.headers.get("Cache-Control")).toBe("public, max-age=60");
     });
 
-    it("orders featured items by featuredAt and preserves original publishedAt", async () => {
+    it("orders Featured Threads by selected Post publication time", async () => {
       const { app, services, db } = createFeedTestApp();
 
       const olderPublished = await services.posts.create({
@@ -203,11 +209,9 @@ describe("Atom Feed Routes", () => {
       expect(res.status).toBe(200);
 
       const xml = await res.text();
-      // Older published should appear first because it has a later featuredAt
-      expect(xml.indexOf("Older published")).toBeLessThan(
-        xml.indexOf("Newer published"),
+      expect(xml.indexOf("Newer published")).toBeLessThan(
+        xml.indexOf("Older published"),
       );
-      // <published> should reflect original publishedAt, not featuredAt
       expect(xml).toContain("<published>1970-01-01T00:16:40.000Z</published>");
       expect(xml).toContain("<published>1970-01-01T00:33:20.000Z</published>");
     });
@@ -352,6 +356,45 @@ describe("Atom Feed Routes", () => {
       expect(xml).toContain("Featured Post");
       expect(xml).not.toContain("Regular Post");
     });
+
+    it("deduplicates by Thread and orders from a Featured Child publication", async () => {
+      const { app, services } = createFeedTestApp();
+
+      const olderRoot = await services.posts.create({
+        format: "note",
+        title: "Older Thread Root",
+        bodyMarkdown: "Older root body",
+        status: "published",
+        publishedAt: 1000,
+      });
+      await services.posts.create({
+        format: "note",
+        title: "Featured Child",
+        bodyMarkdown: "Selected child body",
+        status: "published",
+        replyToId: olderRoot.id,
+        featured: true,
+        publishedAt: 3000,
+      });
+      await services.posts.create({
+        format: "note",
+        title: "Newer Root",
+        bodyMarkdown: "Newer root body",
+        status: "published",
+        featured: true,
+        publishedAt: 2000,
+      });
+
+      const res = await app.request("/featured/feed");
+      expect(res.status).toBe(200);
+
+      const xml = await res.text();
+      expect(xml.match(/<entry>/g)).toHaveLength(2);
+      expect(xml).toContain("Selected child body");
+      expect(xml.indexOf("Older Thread Root")).toBeLessThan(
+        xml.indexOf("Newer Root"),
+      );
+    });
   });
 
   describe("legacy feed path redirects", () => {
@@ -432,6 +475,33 @@ describe("Atom Feed Routes", () => {
     });
   });
 
+  it("emits canonical v3 footnotes from a stale stored projection", async () => {
+    const { app, services, db } = createFeedTestApp();
+    const post = await services.posts.create({
+      format: "note",
+      title: "Footnote feed",
+      bodyMarkdown: "Feed body[^1]\n\n[^1]: Feed definition",
+      status: "published",
+    });
+    await db
+      .update(postTable)
+      .set({
+        bodyHtml: '<span class="sidenote">legacy</span>',
+        bodyHtmlVersion: 1,
+      })
+      .where(eq(postTable.id, post.id));
+
+    const response = await app.request("/latest/feed");
+    const xml = await response.text();
+
+    expect(response.status).toBe(200);
+    expect(xml).toContain('role="doc-noteref"');
+    expect(xml).toContain('role="doc-endnotes"');
+    expect(xml).toMatch(/id="fn-[a-z0-9]{13}-1"/);
+    expect(xml).not.toContain(`fn-${post.id}`);
+    expect(xml).not.toContain("legacy");
+  });
+
   describe("RSS_FEED_LIMIT env var", () => {
     it("defaults to 50 when RSS_FEED_LIMIT is not set", async () => {
       const { app, services } = createFeedTestApp();
@@ -527,6 +597,85 @@ describe("Atom Feed Routes", () => {
     });
   });
 
+  describe("RSS_PUBLISH_DELAY_SECONDS env var", () => {
+    it("includes the exact 300-second boundary and excludes newer Posts", async () => {
+      const currentTime = 2_000_000;
+      vi.spyOn(Date, "now").mockReturnValue(currentTime * 1000);
+      const { app, services } = createFeedTestApp({
+        RSS_PUBLISH_DELAY_SECONDS: 300,
+      });
+
+      await services.posts.create({
+        format: "note",
+        title: "Boundary Post",
+        bodyMarkdown: "Eligible at exactly five minutes",
+        status: "published",
+        publishedAt: currentTime - 300,
+      });
+      await services.posts.create({
+        format: "note",
+        title: "Recent Post",
+        bodyMarkdown: "Still inside the edit window",
+        status: "published",
+        publishedAt: currentTime - 299,
+      });
+
+      const xml = await (await app.request("/latest/feed")).text();
+
+      expect(xml).toContain("Boundary Post");
+      expect(xml).not.toContain("Recent Post");
+    });
+
+    it("applies the delay to Featured Posts", async () => {
+      const currentTime = 2_000_000;
+      vi.spyOn(Date, "now").mockReturnValue(currentTime * 1000);
+      const { app, services } = createFeedTestApp({
+        RSS_PUBLISH_DELAY_SECONDS: 300,
+      });
+
+      await services.posts.create({
+        format: "note",
+        title: "Eligible Featured Post",
+        bodyMarkdown: "Old enough",
+        status: "published",
+        featured: true,
+        publishedAt: currentTime - 300,
+      });
+      await services.posts.create({
+        format: "note",
+        title: "Recent Featured Post",
+        bodyMarkdown: "Too new",
+        status: "published",
+        featured: true,
+        publishedAt: currentTime,
+      });
+
+      const xml = await (await app.request("/featured/feed")).text();
+
+      expect(xml).toContain("Eligible Featured Post");
+      expect(xml).not.toContain("Recent Featured Post");
+    });
+
+    it("lets zero disable the delay", async () => {
+      const currentTime = 2_000_000;
+      vi.spyOn(Date, "now").mockReturnValue(currentTime * 1000);
+      const { app, services } = createFeedTestApp({
+        RSS_PUBLISH_DELAY_SECONDS: 0,
+      });
+      await services.posts.create({
+        format: "note",
+        title: "Immediate Post",
+        bodyMarkdown: "No edit window",
+        status: "published",
+        publishedAt: currentTime,
+      });
+
+      const xml = await (await app.request("/latest/feed")).text();
+
+      expect(xml).toContain("Immediate Post");
+    });
+  });
+
   describe("thread content in feed", () => {
     it("includes thread replies inline with hr separators", async () => {
       const { app, services } = createFeedTestApp();
@@ -552,5 +701,60 @@ describe("Atom Feed Routes", () => {
       expect(xml).toContain("Reply content");
       expect(xml).toContain("<hr/>");
     });
+
+    it("delays new replies inside an already eligible Thread", async () => {
+      const currentTime = 2_000_000;
+      const dateNow = vi.spyOn(Date, "now").mockReturnValue(currentTime * 1000);
+      const { app, services } = createFeedTestApp({
+        RSS_PUBLISH_DELAY_SECONDS: 300,
+      });
+      const root = await services.posts.create({
+        format: "note",
+        title: "Eligible Thread Root",
+        bodyMarkdown: "Root content",
+        status: "published",
+        publishedAt: currentTime - 600,
+      });
+      await services.posts.create({
+        format: "note",
+        bodyMarkdown: "Recent reply content",
+        status: "published",
+        replyToId: root.id,
+        publishedAt: currentTime,
+      });
+
+      const beforeDelay = await (await app.request("/latest/feed")).text();
+      expect(beforeDelay).toContain("Root content");
+      expect(beforeDelay).not.toContain("Recent reply content");
+
+      dateNow.mockReturnValue((currentTime + 300) * 1000);
+      const afterDelay = await (await app.request("/latest/feed")).text();
+      expect(afterDelay).toContain("Recent reply content");
+    });
+
+    it("reflects eligible content edits in the Atom entry updated timestamp", async () => {
+      const currentTime = 2_000_000;
+      vi.spyOn(Date, "now").mockReturnValue(currentTime * 1000);
+      const { app, services } = createFeedTestApp({
+        RSS_PUBLISH_DELAY_SECONDS: 300,
+      });
+      const root = await services.posts.create({
+        format: "note",
+        title: "Edited Post",
+        bodyMarkdown: "Original copy",
+        status: "published",
+        publishedAt: currentTime - 300,
+      });
+      await services.posts.update(root.id, {
+        bodyMarkdown: "Corrected copy",
+      });
+
+      const xml = await (await app.request("/latest/feed")).text();
+      const entry = xml.match(/<entry>[\s\S]*?<\/entry>/)?.[0];
+
+      expect(entry).toContain("Corrected copy");
+      expect(entry).not.toContain("Original copy");
+      expect(entry).toContain("<updated>1970-01-24T03:33:20.000Z</updated>");
+    });
   });
 });