@jant/core 0.6.14 → 0.6.16

package/src/routes/api/public/__tests__/posts.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, it } from "vitest";
+import { eq } from "drizzle-orm";
 import { createTestApp } from "../../../../__tests__/helpers/app.js";
+import { posts } from "../../../../db/schema.js";
 import { publicPostsApiRoutes } from "../posts.js";
 
 describe("Public Posts API Routes", () => {
@@ -51,6 +53,44 @@ describe("Public Posts API Routes", () => {
       expect(body.posts[0]).not.toHaveProperty("body");
     });
 
+    // Consumers need both axes: `lastActivityAt` answers "when was this
+    // announced", `threadUpdatedAt` answers "when did it actually change".
+    // Exposing only the first left no way to tell a quiet addition happened.
+    it("reports both thread activity timestamps", async () => {
+      const { app, services } = createTestApp({ authenticated: false });
+      app.route("/api/public/posts", publicPostsApiRoutes);
+
+      const root = await services.posts.create({
+        format: "note",
+        title: "Quietly extended",
+        bodyMarkdown: "root",
+        publishedAt: 1000,
+      });
+      await services.posts.create({
+        format: "note",
+        bodyMarkdown: "quiet addendum",
+        replyToId: root.id,
+        publishedAt: 3000,
+        quietReply: true,
+      });
+
+      const res = await app.request("/api/public/posts");
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        posts: {
+          title: string | null;
+          quietReply: boolean;
+          lastActivityAt: number;
+          threadUpdatedAt: number;
+        }[];
+      };
+
+      const entry = body.posts.find((p) => p.title === "Quietly extended");
+      expect(entry?.lastActivityAt).toBe(1000);
+      expect(entry?.threadUpdatedAt).toBe(3000);
+      expect(entry?.quietReply).toBe(false);
+    });
+
     it("supports format and limit filters", async () => {
       const { app, services } = createTestApp({ authenticated: false });
       app.route("/api/public/posts", publicPostsApiRoutes);
@@ -100,6 +140,32 @@ describe("Public Posts API Routes", () => {
       expect(body.posts[0]).not.toHaveProperty("bodyText");
     });
 
+    it("returns canonical v3 HTML when the stored projection is stale", async () => {
+      const { app, services, db } = createTestApp({ authenticated: false });
+      app.route("/api/public/posts", publicPostsApiRoutes);
+      const post = await services.posts.create({
+        format: "note",
+        title: "Footnote API",
+        bodyMarkdown: "API body[^1]\n\n[^1]: API definition",
+      });
+      await db
+        .update(posts)
+        .set({
+          bodyHtml: '<span class="sidenote">legacy</span>',
+          bodyHtmlVersion: 1,
+        })
+        .where(eq(posts.id, post.id));
+
+      const response = await app.request("/api/public/posts");
+      const body = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(body.posts[0].bodyHtml).toContain('role="doc-noteref"');
+      expect(body.posts[0].bodyHtml).toMatch(/id="fn-[a-z0-9]{13}-1"/);
+      expect(body.posts[0].bodyHtml).not.toContain(post.id);
+      expect(body.posts[0].bodyHtml).not.toContain("legacy");
+    });
+
     it("filters posts by a single collection slug", async () => {
       const { app, services } = createTestApp({ authenticated: false });
       app.route("/api/public/posts", publicPostsApiRoutes);
@@ -194,12 +260,20 @@ describe("Public Posts API Routes", () => {
         title: "Older",
         bodyMarkdown: "first",
         collectionIds: [collection.id],
+        publishedAt: 1000,
       });
       const newer = await services.posts.create({
         format: "note",
         title: "Newer",
         bodyMarkdown: "second",
         collectionIds: [collection.id],
+        publishedAt: 2000,
+      });
+      await services.posts.create({
+        format: "note",
+        bodyMarkdown: "Later reply to the older Thread",
+        replyToId: older.id,
+        publishedAt: 3000,
       });
 
       const res = await app.request(
@@ -213,6 +287,145 @@ describe("Public Posts API Routes", () => {
       expect(body.posts[1].id).toBe(newer.id);
     });
 
+    it("sorts collection results by Thread activity from Child Posts", async () => {
+      const { app, services } = createTestApp({ authenticated: false });
+      app.route("/api/public/posts", publicPostsApiRoutes);
+
+      const collection = await services.collections.create({
+        slug: "active-threads",
+        title: "Active Threads",
+      });
+      const olderRoot = await services.posts.create({
+        format: "note",
+        title: "Older root",
+        bodyMarkdown: "older",
+        collectionIds: [collection.id],
+        publishedAt: 1000,
+      });
+      const newerRoot = await services.posts.create({
+        format: "note",
+        title: "Newer root",
+        bodyMarkdown: "newer",
+        collectionIds: [collection.id],
+        publishedAt: 2000,
+      });
+      await services.posts.create({
+        format: "note",
+        bodyMarkdown: "new activity",
+        replyToId: olderRoot.id,
+        publishedAt: 3000,
+      });
+
+      const res = await app.request(
+        "/api/public/posts?collection=active-threads&sort=newest",
+      );
+      expect(res.status).toBe(200);
+
+      const body = await res.json();
+      expect(body.posts.map((post: { id: string }) => post.id)).toEqual([
+        olderRoot.id,
+        newerRoot.id,
+      ]);
+    });
+
+    it("sorts and cursor-paginates collection Threads by Child ratings", async () => {
+      const { app, services } = createTestApp({ authenticated: false });
+      app.route("/api/public/posts", publicPostsApiRoutes);
+
+      const collection = await services.collections.create({
+        slug: "rated-threads",
+        title: "Rated Threads",
+        sortOrder: "rating_desc",
+      });
+      const createRatedThread = async (
+        title: string,
+        publishedAt: number,
+        rating: number,
+      ) => {
+        const root = await services.posts.create({
+          format: "note",
+          title,
+          bodyMarkdown: `${title} root`,
+          collectionIds: [collection.id],
+          publishedAt,
+        });
+        await services.posts.create({
+          format: "note",
+          bodyMarkdown: `${title} rated Child`,
+          replyToId: root.id,
+          publishedAt: publishedAt + 100,
+          rating,
+        });
+        return root;
+      };
+
+      const highest = await createRatedThread("Highest", 1000, 5);
+      const middle = await createRatedThread("Middle", 2000, 3);
+      const lowest = await createRatedThread("Lowest", 3000, 1);
+
+      const firstRes = await app.request(
+        "/api/public/posts?collection=rated-threads&limit=1",
+      );
+      expect(firstRes.status).toBe(200);
+      const first = await firstRes.json();
+      expect(first.posts[0].id).toBe(highest.id);
+      expect(first.nextCursor).toBe(highest.id);
+
+      const secondRes = await app.request(
+        `/api/public/posts?collection=rated-threads&limit=1&cursor=${first.nextCursor}`,
+      );
+      expect(secondRes.status).toBe(200);
+      const second = await secondRes.json();
+      expect(second.posts[0].id).toBe(middle.id);
+      expect(second.nextCursor).toBe(middle.id);
+
+      const thirdRes = await app.request(
+        `/api/public/posts?collection=rated-threads&limit=1&cursor=${second.nextCursor}`,
+      );
+      expect(thirdRes.status).toBe(200);
+      const third = await thirdRes.json();
+      expect(third.posts[0].id).toBe(lowest.id);
+    });
+
+    it("keeps root format and Latest visibility filters for Collections", async () => {
+      const { app, services } = createTestApp({ authenticated: false });
+      app.route("/api/public/posts", publicPostsApiRoutes);
+
+      const collection = await services.collections.create({
+        slug: "mixed",
+        title: "Mixed",
+      });
+      const note = await services.posts.create({
+        format: "note",
+        title: "Visible note",
+        bodyMarkdown: "note",
+        collectionIds: [collection.id],
+      });
+      await services.posts.create({
+        format: "link",
+        title: "Visible link",
+        url: "https://example.com",
+        collectionIds: [collection.id],
+      });
+      await services.posts.create({
+        format: "note",
+        title: "Hidden note",
+        bodyMarkdown: "hidden",
+        visibility: "latest_hidden",
+        collectionIds: [collection.id],
+      });
+
+      const res = await app.request(
+        "/api/public/posts?collection=mixed&format=note",
+      );
+      expect(res.status).toBe(200);
+
+      const body = await res.json();
+      expect(body.posts.map((post: { id: string }) => post.id)).toEqual([
+        note.id,
+      ]);
+    });
+
     it("allows overriding collection sort order via sort parameter", async () => {
       const { app, services } = createTestApp({ authenticated: false });
       app.route("/api/public/posts", publicPostsApiRoutes);
@@ -282,6 +495,39 @@ describe("Public Posts API Routes", () => {
       expect(body).not.toHaveProperty("body");
     });
 
+    it("returns the shared Thread Collections for a child post", async () => {
+      const { app, services } = createTestApp({ authenticated: false });
+      app.route("/api/public/posts", publicPostsApiRoutes);
+
+      const collection = await services.collections.create({
+        slug: "shared",
+        title: "Shared",
+      });
+      const root = await services.posts.create({
+        format: "note",
+        bodyMarkdown: "root",
+        collectionIds: [collection.id],
+      });
+      const child = await services.posts.create({
+        format: "note",
+        bodyMarkdown: "child",
+        replyToId: root.id,
+      });
+
+      const res = await app.request(`/api/public/posts/${child.slug}`);
+      expect(res.status).toBe(200);
+      await expect(res.json()).resolves.toMatchObject({
+        id: child.id,
+        collections: [
+          {
+            id: collection.id,
+            slug: "shared",
+            title: "Shared",
+          },
+        ],
+      });
+    });
+
     it("returns markdown instead of rendered fields when content=markdown", async () => {
       const { app, services } = createTestApp({ authenticated: false });
       app.route("/api/public/posts", publicPostsApiRoutes);

package/src/routes/api/public/archive.ts

@@ -5,11 +5,14 @@ import type { AppVariables } from "../../../types/app-context.js";
 import { MEDIA_KINDS } from "../../../types.js";
 import { FormatSchema, parseValidated } from "../../../lib/schemas.js";
 import { toPublicPost } from "./posts.js";
+import { requirePublicApiEnabled } from "../../../middleware/public-content-access.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
 export const publicArchiveApiRoutes = new Hono<Env>();
 
+publicArchiveApiRoutes.use("*", requirePublicApiEnabled());
+
 const MediaKindSchema = z.enum(MEDIA_KINDS);
 const MEDIA_KIND_LIST = MEDIA_KINDS.join(", ");
 const INVALID_MEDIA_MESSAGE =
@@ -108,6 +111,7 @@ publicArchiveApiRoutes.get("/", async (c) => {
     hasMedia: mediaPresence ?? hasMedia,
     hasTitle: title ?? hasTitle,
     hasReplies: replies,
+    ignorePinnedSort: true,
   });
 
   const postIds = posts.map((post) => post.id);

package/src/routes/api/public/posts.ts

@@ -21,11 +21,14 @@ import {
   resolveCollectionSortOrder,
   supportsCollectionRatingSort,
 } from "../../../lib/collection-sort.js";
+import { requirePublicApiEnabled } from "../../../middleware/public-content-access.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
 export const publicPostsApiRoutes = new Hono<Env>();
 
+publicPostsApiRoutes.use("*", requirePublicApiEnabled());
+
 const ListPublicPostsQuerySchema = z.object({
   format: FormatSchema.optional(),
   collection: z.string().optional(),
@@ -58,10 +61,15 @@ export type PublicPostBaseResponse = {
   previewImageUrl: string | null;
   replyToId: string | null;
   threadId: string;
+  /** Reply published without announcing its Thread. Always false on roots. */
+  quietReply: boolean;
   pinnedAt: number | null;
   featuredAt: number | null;
   publishedAt: number | null;
+  /** Root only: newest post in the Thread, quiet replies excluded. */
   lastActivityAt: number;
+  /** Root only: newest post in the Thread, quiet replies included. */
+  threadUpdatedAt: number;
   createdAt: number;
   updatedAt: number;
   attachments: ReturnType<typeof toApiAttachment>[];
@@ -97,7 +105,7 @@ function isPublicDetailVisible(post: Post | null): post is Post {
 export function toPublicPost(
   post: Post,
   mediaList: Media[],
-  postCollections: Collection[],
+  threadCollections: Collection[],
   appConfig: AppVariables["appConfig"],
   options?: { content?: "markdown" },
 ): PublicPostResponse {
@@ -143,10 +151,12 @@ export function toPublicPost(
     previewImageUrl,
     replyToId: post.replyToId,
     threadId: post.threadId,
+    quietReply: post.quietReply,
     pinnedAt: post.pinnedAt,
     featuredAt: post.featuredAt,
     publishedAt: post.publishedAt,
     lastActivityAt: post.lastActivityAt,
+    threadUpdatedAt: post.threadUpdatedAt,
     createdAt: post.createdAt,
     updatedAt: post.updatedAt,
     attachments: mediaList.map((media) =>
@@ -159,7 +169,7 @@ export function toPublicPost(
         sitePathPrefix,
       ),
     ),
-    collections: postCollections.map((collection) => ({
+    collections: threadCollections.map((collection) => ({
       id: collection.id,
       slug: collection.slug,
       title: collection.title,
@@ -226,16 +236,19 @@ publicPostsApiRoutes.get("/", async (c) => {
       ? "newest"
       : primaryCollection.sortOrder;
 
-    const ratedPostCount = await c.var.services.posts.countUpTo(
-      {
+    const ratedThreadCount =
+      await c.var.services.posts.countCollectionThreadRootsUpToForCollections(
         collectionIds,
-        status: "published",
-        excludePrivate: true,
-        hasRating: true,
-      },
-      2,
-    );
-    const showRatingSort = supportsCollectionRatingSort(ratedPostCount);
+        {
+          status: "published",
+          excludePrivate: true,
+          excludeLatestHidden: true,
+          rootFormat: format,
+          hasRating: true,
+        },
+        2,
+      );
+    const showRatingSort = supportsCollectionRatingSort(ratedThreadCount);
     const defaultSort = resolveCollectionSortOrder(
       undefined,
       requestedDefaultSort,
@@ -244,17 +257,28 @@ publicPostsApiRoutes.get("/", async (c) => {
     sortOrder = resolveCollectionSortOrder(sort, defaultSort, showRatingSort);
   }
 
-  const posts = await c.var.services.posts.list({
-    format,
-    collectionIds,
-    sortOrder,
-    status: "published",
-    cursor: cursor ?? undefined,
-    limit,
-    excludePrivate: true,
-    excludeLatestHidden: true,
-    excludeReplies: true,
-  });
+  const posts = collectionIds
+    ? await c.var.services.posts.listCollectionThreadRootsForCollections(
+        collectionIds,
+        {
+          status: "published",
+          excludePrivate: true,
+          excludeLatestHidden: true,
+          rootFormat: format,
+          sortOrder,
+          cursor: cursor ?? undefined,
+          limit,
+        },
+      )
+    : await c.var.services.posts.list({
+        format,
+        status: "published",
+        cursor: cursor ?? undefined,
+        limit,
+        excludePrivate: true,
+        excludeLatestHidden: true,
+        excludeReplies: true,
+      });
 
   const postIds = posts.map((post) => post.id);
   const [mediaMap, collectionsMap] = await Promise.all([
@@ -289,13 +313,13 @@ publicPostsApiRoutes.get("/:slug", async (c) => {
     throw new NotFoundError("Post");
   }
 
-  const [mediaList, postCollections] = await Promise.all([
+  const [mediaList, threadCollections] = await Promise.all([
     c.var.services.media.getByPostId(post.id),
     c.var.services.collections.getCollectionsByPostId(post.id),
   ]);
 
   return c.json(
-    toPublicPost(post, mediaList, postCollections, c.var.appConfig, {
+    toPublicPost(post, mediaList, threadCollections, c.var.appConfig, {
       content,
     }),
   );

package/src/routes/api/search.ts

@@ -8,11 +8,14 @@ import type { AppVariables } from "../../types/app-context.js";
 import { ValidationError, ExternalServiceError } from "../../lib/errors.js";
 import { toSearchApiResult } from "../../lib/api-search.js";
 import { rateLimit } from "../../middleware/rate-limit.js";
+import { requirePublicApiAccess } from "../../middleware/public-content-access.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
 export const searchApiRoutes = new Hono<Env>();
 
+searchApiRoutes.use("*", requirePublicApiAccess());
+
 // Per-IP rate limit. The request-time wrapper is needed because the
 // per-minute cap is pulled from `appConfig` which is only available on
 // `c.var`; constructing the middleware once at module load would capture

package/src/routes/api/settings.ts

@@ -13,7 +13,10 @@ import { parseValidated } from "../../lib/schemas.js";
 import { ValidationError } from "../../lib/errors.js";
 import { syncHostedControlPlaneSiteAvatar } from "../../lib/hosted-control-plane-sync.js";
 import {
+  buildConfigEditorFields,
   buildEditableSettingsResponse,
+  demoLockedSettingKeys,
+  isResettableConfigEditorKey,
   partitionEditableSettingUpdates,
   partitionImportableSettingUpdates,
 } from "../../lib/api-settings.js";
@@ -31,6 +34,7 @@ settingsApiRoutes.get("/", requireAuthApi(), async (c) => {
     settings: buildEditableSettingsResponse(
       allSettings,
       c.var.appConfig.demoMode,
+      c.env,
     ),
   });
 });
@@ -61,6 +65,7 @@ settingsApiRoutes.put("/", requireAuthApi(), async (c) => {
     settings: buildEditableSettingsResponse(
       allSettings,
       c.var.appConfig.demoMode,
+      c.env,
     ),
     ...(rejectedKeys.length > 0 && { rejectedKeys }),
   });
@@ -216,3 +221,31 @@ settingsApiRoutes.delete("/avatar", requireAuthApi(), async (c) => {
   }
   return c.json({ success: true });
 });
+
+// Remove one runtime override so the environment/default fallback applies.
+// Registered after the concrete avatar route so `DELETE /avatar` remains
+// unambiguous.
+settingsApiRoutes.delete("/:key", requireAuthApi(), async (c) => {
+  const key = c.req.param("key");
+  const demoMode = c.var.appConfig.demoMode;
+
+  if (
+    !isResettableConfigEditorKey(key) ||
+    (demoMode && demoLockedSettingKeys.has(key))
+  ) {
+    throw new ValidationError("This setting can't be reset.", {
+      rejectedKeys: [key],
+    });
+  }
+
+  await c.var.services.settings.remove(key);
+  const allSettings = await c.var.services.settings.getAll();
+  const setting = buildConfigEditorFields(allSettings, c.env, demoMode).find(
+    (field) => field.key === key,
+  );
+
+  return c.json({
+    settings: buildEditableSettingsResponse(allSettings, demoMode, c.env),
+    setting,
+  });
+});

package/src/routes/auth/__tests__/setup.test.ts

@@ -38,14 +38,13 @@ describe("Setup bootstrap logic", () => {
     };
   });
 
-  it("creates six nav items with the built-in default navigation", async () => {
+  it("creates the five-item default navigation without Latest", async () => {
     await runSetupBootstrap(services);
 
     const navItemsList = await services.db.select().from(navItems);
-    expect(navItemsList).toHaveLength(6);
+    expect(navItemsList).toHaveLength(5);
 
     expect(navItemsList.map((item) => item.systemKey)).toEqual([
-      "latest",
       "featured",
       "collections",
       "archive",
@@ -125,7 +124,11 @@ describe("Setup bootstrap logic", () => {
     const navItemsList = await services.db.select().from(navItems);
     const systemItems = navItemsList.filter((item) => item.type === "system");
 
-    expect(systemItems).toHaveLength(6);
+    expect(systemItems).toHaveLength(5);
+    expect(systemItems.map((item) => item.systemKey)).not.toContain("latest");
+    expect(
+      systemItems.find((item) => item.systemKey === "collections")?.label,
+    ).toBe("Collections");
   });
 
   it("creates a site shell when setup runs after a factory reset", async () => {

package/src/routes/compose.tsx

@@ -211,7 +211,9 @@ composeRoutes.post("/thread", async (c) => {
     postSchemas.map((data, index) => ({
       data: {
         format: data.format,
-        slug: index === 0 ? data.slug || undefined : undefined,
+        // Every post may carry its own permalink; blank means the service
+        // generates one (title-derived for the root, random id for replies).
+        slug: data.slug || undefined,
         title:
           data.format === "quote"
             ? data.sourceName || undefined
@@ -226,9 +228,12 @@ composeRoutes.post("/thread", async (c) => {
             : data.url || undefined,
         quoteText: data.quoteText || undefined,
         rating: data.rating || undefined,
-        collectionIds: index === 0 ? data.collectionIds : [],
+        collectionIds: index === 0 ? data.collectionIds : undefined,
         replyToId: index === 0 ? data.replyToId : undefined,
-        publishedAt: index === 0 ? data.publishedAt : undefined,
+        quietReply: data.quietReply,
+        // Replies may carry their own date; when they don't, the service
+        // inherits the root's rather than stamping "now".
+        publishedAt: data.publishedAt,
       },
       attachments: data.attachments,
     })),