@kontainer/strapi-plugin 0.1.0

package/dist/server/index.js

@@ -0,0 +1,356 @@
+"use strict";
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
+const node_http = require("node:http");
+const node_https = require("node:https");
+const bootstrap = async ({ strapi }) => {
+  const url = await strapi.plugin("kontainer").service("service").getUrl();
+  if (!url) return;
+  try {
+    const host = new URL(url).host;
+    const fileUrl = strapi.plugin("kontainer").config("url", "");
+    const fileHost = fileUrl ? new URL(fileUrl).host : "";
+    const covered = host === "kontainer.com" || host.endsWith(".kontainer.com") || host === fileHost;
+    if (!covered) {
+      strapi.log.warn(
+        `[kontainer] ${host} is not covered by the plugin's Content-Security-Policy patch. Thumbnails may be blocked in the admin. Set KONTAINER_URL (config/plugins) to ${url} or add ${host} to img-src in config/middlewares.`
+      );
+    }
+  } catch {
+  }
+};
+const destroy = ({ strapi }) => {
+};
+const KONTAINER_CSP_SOURCES = ["https://*.kontainer.com", "https://kontainer.com"];
+const patchContentSecurityPolicy = (strapi) => {
+  const sources = [...KONTAINER_CSP_SOURCES];
+  const fileUrl = strapi.plugin("kontainer").config("url", "");
+  if (fileUrl) {
+    try {
+      const u = new URL(fileUrl);
+      sources.push(`${u.protocol}//${u.host}`);
+    } catch {
+    }
+  }
+  const middlewares2 = strapi.config.get("middlewares");
+  const patched = middlewares2.map((mw) => {
+    const isPlain = mw === "strapi::security";
+    const entry = mw;
+    if (!isPlain && entry?.name !== "strapi::security") return mw;
+    const config2 = isPlain ? {} : entry.config ?? {};
+    const csp = config2.contentSecurityPolicy ?? {};
+    const directives = csp.directives ?? {};
+    const baseImg = ["'self'", "data:", "blob:", "https://market-assets.strapi.io"];
+    const baseMedia = ["'self'", "data:", "blob:"];
+    const merge = (existing, base) => [
+      .../* @__PURE__ */ new Set([...existing ?? base, ...sources])
+    ];
+    return {
+      name: "strapi::security",
+      config: {
+        ...config2,
+        contentSecurityPolicy: {
+          ...csp,
+          useDefaults: csp.useDefaults ?? true,
+          directives: {
+            ...directives,
+            "img-src": merge(directives["img-src"], baseImg),
+            "media-src": merge(directives["media-src"], baseMedia)
+          }
+        }
+      }
+    };
+  });
+  strapi.config.set("middlewares", patched);
+};
+const register = ({ strapi }) => {
+  strapi.customFields.register({
+    name: "media",
+    plugin: "kontainer",
+    type: "json"
+  });
+  patchContentSecurityPolicy(strapi);
+};
+const config = {
+  default: {
+    // Kontainer tenant URL the picker opens, e.g. https://yourcompany.kontainer.com
+    url: ""
+  },
+  validator(config2) {
+    if (config2.url && typeof config2.url !== "string") {
+      throw new Error("kontainer plugin: `url` must be a string");
+    }
+  }
+};
+const contentTypes = {};
+const isValidUrl = (value) => {
+  try {
+    const u = new URL(value);
+    return u.protocol === "https:" || u.protocol === "http:";
+  } catch {
+    return false;
+  }
+};
+const controller = ({ strapi }) => ({
+  // Which entries reference a given Kontainer file id.
+  async usage(ctx) {
+    const { fileId } = ctx.params;
+    if (!fileId) {
+      return ctx.badRequest("fileId is required");
+    }
+    const data = await strapi.plugin("kontainer").service("service").findUsage(String(fileId));
+    ctx.body = { fileId: String(fileId), count: data.length, data };
+  },
+  // Effective picker URL for the admin input component.
+  async config(ctx) {
+    ctx.body = { url: await strapi.plugin("kontainer").service("service").getUrl() };
+  },
+  async getSettings(ctx) {
+    ctx.body = await strapi.plugin("kontainer").service("service").getSettings();
+  },
+  async validateSettings(ctx) {
+    const url = String(ctx.query.url ?? "");
+    if (!url) {
+      return ctx.badRequest("url query parameter is required");
+    }
+    ctx.body = await strapi.plugin("kontainer").service("service").validateUrl(url);
+  },
+  async updateSettings(ctx) {
+    const { url } = ctx.request.body ?? {};
+    if (typeof url !== "string" || url !== "" && !isValidUrl(url)) {
+      return ctx.badRequest("url must be empty or a valid http(s) URL");
+    }
+    await strapi.plugin("kontainer").service("service").setSettings({ url: url.replace(/\/+$/, "") });
+    ctx.body = await strapi.plugin("kontainer").service("service").getSettings();
+  }
+});
+const controllers = {
+  controller
+};
+const middlewares = {};
+const policies = {};
+const contentAPIRoutes = () => ({
+  type: "content-api",
+  routes: [
+    {
+      method: "GET",
+      path: "/usage/:fileId",
+      handler: "controller.usage",
+      config: {
+        policies: []
+      }
+    }
+  ]
+});
+const adminAPIRoutes = () => ({
+  type: "admin",
+  routes: [
+    {
+      method: "GET",
+      path: "/config",
+      handler: "controller.config",
+      config: {
+        policies: ["admin::isAuthenticatedAdmin"]
+      }
+    },
+    {
+      method: "GET",
+      path: "/settings",
+      handler: "controller.getSettings",
+      config: {
+        policies: ["admin::isAuthenticatedAdmin"]
+      }
+    },
+    {
+      method: "PUT",
+      path: "/settings",
+      handler: "controller.updateSettings",
+      config: {
+        policies: ["admin::isAuthenticatedAdmin"]
+      }
+    },
+    {
+      method: "GET",
+      path: "/settings/validate",
+      handler: "controller.validateSettings",
+      config: {
+        policies: ["admin::isAuthenticatedAdmin"]
+      }
+    }
+  ]
+});
+const routes = {
+  "content-api": contentAPIRoutes,
+  admin: adminAPIRoutes
+};
+const CUSTOM_FIELD = "plugin::kontainer.media";
+const fetchLocationHeader = (probeUrl) => new Promise((resolve, reject) => {
+  const request = probeUrl.protocol === "https:" ? node_https.request : node_http.request;
+  const req = request(
+    probeUrl,
+    {
+      method: "GET",
+      timeout: 5e3,
+      // local dev instances use self-signed certificates
+      rejectUnauthorized: process.env.NODE_ENV === "production"
+    },
+    (res) => {
+      res.destroy();
+      resolve(res.headers.location);
+    }
+  );
+  req.on("timeout", () => req.destroy(new Error("timeout")));
+  req.on("error", reject);
+  req.end();
+});
+const referencesFile = (value, fileId) => {
+  if (Array.isArray(value)) {
+    return value.some((v) => referencesFile(v, fileId));
+  }
+  if (value && typeof value === "object") {
+    const obj = value;
+    if (obj.fileId !== void 0 && String(obj.fileId) === fileId) return true;
+    return Object.values(obj).some((v) => referencesFile(v, fileId));
+  }
+  return false;
+};
+const service = ({ strapi }) => ({
+  settingsStore() {
+    return strapi.store({ type: "plugin", name: "kontainer" });
+  },
+  // Admin-panel setting wins; config/plugins (env) is the fallback.
+  async getUrl() {
+    const stored = await this.settingsStore().get({ key: "settings" });
+    const url = stored?.url || strapi.plugin("kontainer").config("url", "");
+    return url.replace(/\/+$/, "");
+  },
+  async getSettings() {
+    const stored = await this.settingsStore().get({ key: "settings" });
+    return {
+      url: stored?.url ?? "",
+      fileUrl: strapi.plugin("kontainer").config("url", "")
+    };
+  },
+  async setSettings(settings) {
+    await this.settingsStore().set({ key: "settings", value: settings });
+  },
+  // Is the URL an actual Kontainer instance? The picker entry point
+  // (/?cmsMode=1) redirects to ?cmsContextId=<uuid> — a stable fingerprint
+  // that works unauthenticated.
+  async validateUrl(raw) {
+    let url;
+    try {
+      url = new URL(raw);
+      if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error("unsupported protocol");
+      }
+    } catch {
+      return { valid: false, reason: "invalid-url" };
+    }
+    try {
+      const location = await fetchLocationHeader(
+        new URL(`${url.protocol}//${url.host}/?cmsMode=1`)
+      );
+      return location?.includes("cmsContextId=") ? { valid: true } : { valid: false, reason: "not-kontainer" };
+    } catch {
+      return { valid: false, reason: "unreachable" };
+    }
+  },
+  // Does this component (or any component nested in it) use the custom field?
+  componentHasKontainerField(uid, seen = /* @__PURE__ */ new Set()) {
+    if (seen.has(uid)) return false;
+    seen.add(uid);
+    const attributes = strapi.components[uid]?.attributes ?? {};
+    return Object.values(attributes).some((attr) => {
+      if (attr.customField === CUSTOM_FIELD) return true;
+      if (attr.type === "component") {
+        return this.componentHasKontainerField(attr.component, seen);
+      }
+      if (attr.type === "dynamiczone") {
+        return attr.components.some(
+          (c) => this.componentHasKontainerField(c, seen)
+        );
+      }
+      return false;
+    });
+  },
+  // Populate spec covering every path to a kontainer field inside a component.
+  populateForComponent(uid) {
+    const attributes = strapi.components[uid]?.attributes ?? {};
+    const inner = this.populateForAttributes(attributes);
+    return Object.keys(inner).length ? { populate: inner } : true;
+  },
+  populateForAttributes(attributes) {
+    const populate = {};
+    for (const [name, attr] of Object.entries(attributes)) {
+      if (attr.type === "component" && this.componentHasKontainerField(attr.component)) {
+        populate[name] = this.populateForComponent(attr.component);
+      } else if (attr.type === "dynamiczone") {
+        const withField = attr.components.filter(
+          (c) => this.componentHasKontainerField(c)
+        );
+        if (withField.length) {
+          populate[name] = {
+            on: Object.fromEntries(
+              withField.map((c) => [c, this.populateForComponent(c)])
+            )
+          };
+        }
+      }
+    }
+    return populate;
+  },
+  async findUsage(fileId) {
+    const usage = [];
+    for (const [uid, contentType] of Object.entries(strapi.contentTypes)) {
+      if (!uid.startsWith("api::")) continue;
+      const attributes = contentType.attributes;
+      const directFields = Object.entries(attributes).filter(([, attr]) => attr.customField === CUSTOM_FIELD).map(([name]) => name);
+      const populate = this.populateForAttributes(attributes);
+      const candidateFields = [...directFields, ...Object.keys(populate)];
+      if (!candidateFields.length) continue;
+      for (const status of ["draft", "published"]) {
+        const pageSize = 500;
+        for (let start = 0; ; start += pageSize) {
+          const entries = await strapi.documents(uid).findMany({
+            status,
+            populate,
+            locale: "*",
+            start,
+            limit: pageSize
+          });
+          for (const entry of entries) {
+            for (const field of candidateFields) {
+              if (!referencesFile(entry[field], fileId)) continue;
+              usage.push({
+                contentType: uid,
+                field,
+                documentId: entry.documentId,
+                id: entry.id,
+                locale: entry.locale ?? null,
+                status
+              });
+            }
+          }
+          if (entries.length < pageSize) break;
+        }
+      }
+    }
+    return usage;
+  }
+});
+const services = {
+  service
+};
+const index = {
+  register,
+  bootstrap,
+  destroy,
+  config,
+  controllers,
+  routes,
+  services,
+  contentTypes,
+  policies,
+  middlewares
+};
+exports.default = index;

package/dist/server/index.mjs

@@ -0,0 +1,356 @@
+import { request as request$1 } from "node:http";
+import { request } from "node:https";
+const bootstrap = async ({ strapi }) => {
+  const url = await strapi.plugin("kontainer").service("service").getUrl();
+  if (!url) return;
+  try {
+    const host = new URL(url).host;
+    const fileUrl = strapi.plugin("kontainer").config("url", "");
+    const fileHost = fileUrl ? new URL(fileUrl).host : "";
+    const covered = host === "kontainer.com" || host.endsWith(".kontainer.com") || host === fileHost;
+    if (!covered) {
+      strapi.log.warn(
+        `[kontainer] ${host} is not covered by the plugin's Content-Security-Policy patch. Thumbnails may be blocked in the admin. Set KONTAINER_URL (config/plugins) to ${url} or add ${host} to img-src in config/middlewares.`
+      );
+    }
+  } catch {
+  }
+};
+const destroy = ({ strapi }) => {
+};
+const KONTAINER_CSP_SOURCES = ["https://*.kontainer.com", "https://kontainer.com"];
+const patchContentSecurityPolicy = (strapi) => {
+  const sources = [...KONTAINER_CSP_SOURCES];
+  const fileUrl = strapi.plugin("kontainer").config("url", "");
+  if (fileUrl) {
+    try {
+      const u = new URL(fileUrl);
+      sources.push(`${u.protocol}//${u.host}`);
+    } catch {
+    }
+  }
+  const middlewares2 = strapi.config.get("middlewares");
+  const patched = middlewares2.map((mw) => {
+    const isPlain = mw === "strapi::security";
+    const entry = mw;
+    if (!isPlain && entry?.name !== "strapi::security") return mw;
+    const config2 = isPlain ? {} : entry.config ?? {};
+    const csp = config2.contentSecurityPolicy ?? {};
+    const directives = csp.directives ?? {};
+    const baseImg = ["'self'", "data:", "blob:", "https://market-assets.strapi.io"];
+    const baseMedia = ["'self'", "data:", "blob:"];
+    const merge = (existing, base) => [
+      .../* @__PURE__ */ new Set([...existing ?? base, ...sources])
+    ];
+    return {
+      name: "strapi::security",
+      config: {
+        ...config2,
+        contentSecurityPolicy: {
+          ...csp,
+          useDefaults: csp.useDefaults ?? true,
+          directives: {
+            ...directives,
+            "img-src": merge(directives["img-src"], baseImg),
+            "media-src": merge(directives["media-src"], baseMedia)
+          }
+        }
+      }
+    };
+  });
+  strapi.config.set("middlewares", patched);
+};
+const register = ({ strapi }) => {
+  strapi.customFields.register({
+    name: "media",
+    plugin: "kontainer",
+    type: "json"
+  });
+  patchContentSecurityPolicy(strapi);
+};
+const config = {
+  default: {
+    // Kontainer tenant URL the picker opens, e.g. https://yourcompany.kontainer.com
+    url: ""
+  },
+  validator(config2) {
+    if (config2.url && typeof config2.url !== "string") {
+      throw new Error("kontainer plugin: `url` must be a string");
+    }
+  }
+};
+const contentTypes = {};
+const isValidUrl = (value) => {
+  try {
+    const u = new URL(value);
+    return u.protocol === "https:" || u.protocol === "http:";
+  } catch {
+    return false;
+  }
+};
+const controller = ({ strapi }) => ({
+  // Which entries reference a given Kontainer file id.
+  async usage(ctx) {
+    const { fileId } = ctx.params;
+    if (!fileId) {
+      return ctx.badRequest("fileId is required");
+    }
+    const data = await strapi.plugin("kontainer").service("service").findUsage(String(fileId));
+    ctx.body = { fileId: String(fileId), count: data.length, data };
+  },
+  // Effective picker URL for the admin input component.
+  async config(ctx) {
+    ctx.body = { url: await strapi.plugin("kontainer").service("service").getUrl() };
+  },
+  async getSettings(ctx) {
+    ctx.body = await strapi.plugin("kontainer").service("service").getSettings();
+  },
+  async validateSettings(ctx) {
+    const url = String(ctx.query.url ?? "");
+    if (!url) {
+      return ctx.badRequest("url query parameter is required");
+    }
+    ctx.body = await strapi.plugin("kontainer").service("service").validateUrl(url);
+  },
+  async updateSettings(ctx) {
+    const { url } = ctx.request.body ?? {};
+    if (typeof url !== "string" || url !== "" && !isValidUrl(url)) {
+      return ctx.badRequest("url must be empty or a valid http(s) URL");
+    }
+    await strapi.plugin("kontainer").service("service").setSettings({ url: url.replace(/\/+$/, "") });
+    ctx.body = await strapi.plugin("kontainer").service("service").getSettings();
+  }
+});
+const controllers = {
+  controller
+};
+const middlewares = {};
+const policies = {};
+const contentAPIRoutes = () => ({
+  type: "content-api",
+  routes: [
+    {
+      method: "GET",
+      path: "/usage/:fileId",
+      handler: "controller.usage",
+      config: {
+        policies: []
+      }
+    }
+  ]
+});
+const adminAPIRoutes = () => ({
+  type: "admin",
+  routes: [
+    {
+      method: "GET",
+      path: "/config",
+      handler: "controller.config",
+      config: {
+        policies: ["admin::isAuthenticatedAdmin"]
+      }
+    },
+    {
+      method: "GET",
+      path: "/settings",
+      handler: "controller.getSettings",
+      config: {
+        policies: ["admin::isAuthenticatedAdmin"]
+      }
+    },
+    {
+      method: "PUT",
+      path: "/settings",
+      handler: "controller.updateSettings",
+      config: {
+        policies: ["admin::isAuthenticatedAdmin"]
+      }
+    },
+    {
+      method: "GET",
+      path: "/settings/validate",
+      handler: "controller.validateSettings",
+      config: {
+        policies: ["admin::isAuthenticatedAdmin"]
+      }
+    }
+  ]
+});
+const routes = {
+  "content-api": contentAPIRoutes,
+  admin: adminAPIRoutes
+};
+const CUSTOM_FIELD = "plugin::kontainer.media";
+const fetchLocationHeader = (probeUrl) => new Promise((resolve, reject) => {
+  const request$2 = probeUrl.protocol === "https:" ? request : request$1;
+  const req = request$2(
+    probeUrl,
+    {
+      method: "GET",
+      timeout: 5e3,
+      // local dev instances use self-signed certificates
+      rejectUnauthorized: process.env.NODE_ENV === "production"
+    },
+    (res) => {
+      res.destroy();
+      resolve(res.headers.location);
+    }
+  );
+  req.on("timeout", () => req.destroy(new Error("timeout")));
+  req.on("error", reject);
+  req.end();
+});
+const referencesFile = (value, fileId) => {
+  if (Array.isArray(value)) {
+    return value.some((v) => referencesFile(v, fileId));
+  }
+  if (value && typeof value === "object") {
+    const obj = value;
+    if (obj.fileId !== void 0 && String(obj.fileId) === fileId) return true;
+    return Object.values(obj).some((v) => referencesFile(v, fileId));
+  }
+  return false;
+};
+const service = ({ strapi }) => ({
+  settingsStore() {
+    return strapi.store({ type: "plugin", name: "kontainer" });
+  },
+  // Admin-panel setting wins; config/plugins (env) is the fallback.
+  async getUrl() {
+    const stored = await this.settingsStore().get({ key: "settings" });
+    const url = stored?.url || strapi.plugin("kontainer").config("url", "");
+    return url.replace(/\/+$/, "");
+  },
+  async getSettings() {
+    const stored = await this.settingsStore().get({ key: "settings" });
+    return {
+      url: stored?.url ?? "",
+      fileUrl: strapi.plugin("kontainer").config("url", "")
+    };
+  },
+  async setSettings(settings) {
+    await this.settingsStore().set({ key: "settings", value: settings });
+  },
+  // Is the URL an actual Kontainer instance? The picker entry point
+  // (/?cmsMode=1) redirects to ?cmsContextId=<uuid> — a stable fingerprint
+  // that works unauthenticated.
+  async validateUrl(raw) {
+    let url;
+    try {
+      url = new URL(raw);
+      if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error("unsupported protocol");
+      }
+    } catch {
+      return { valid: false, reason: "invalid-url" };
+    }
+    try {
+      const location = await fetchLocationHeader(
+        new URL(`${url.protocol}//${url.host}/?cmsMode=1`)
+      );
+      return location?.includes("cmsContextId=") ? { valid: true } : { valid: false, reason: "not-kontainer" };
+    } catch {
+      return { valid: false, reason: "unreachable" };
+    }
+  },
+  // Does this component (or any component nested in it) use the custom field?
+  componentHasKontainerField(uid, seen = /* @__PURE__ */ new Set()) {
+    if (seen.has(uid)) return false;
+    seen.add(uid);
+    const attributes = strapi.components[uid]?.attributes ?? {};
+    return Object.values(attributes).some((attr) => {
+      if (attr.customField === CUSTOM_FIELD) return true;
+      if (attr.type === "component") {
+        return this.componentHasKontainerField(attr.component, seen);
+      }
+      if (attr.type === "dynamiczone") {
+        return attr.components.some(
+          (c) => this.componentHasKontainerField(c, seen)
+        );
+      }
+      return false;
+    });
+  },
+  // Populate spec covering every path to a kontainer field inside a component.
+  populateForComponent(uid) {
+    const attributes = strapi.components[uid]?.attributes ?? {};
+    const inner = this.populateForAttributes(attributes);
+    return Object.keys(inner).length ? { populate: inner } : true;
+  },
+  populateForAttributes(attributes) {
+    const populate = {};
+    for (const [name, attr] of Object.entries(attributes)) {
+      if (attr.type === "component" && this.componentHasKontainerField(attr.component)) {
+        populate[name] = this.populateForComponent(attr.component);
+      } else if (attr.type === "dynamiczone") {
+        const withField = attr.components.filter(
+          (c) => this.componentHasKontainerField(c)
+        );
+        if (withField.length) {
+          populate[name] = {
+            on: Object.fromEntries(
+              withField.map((c) => [c, this.populateForComponent(c)])
+            )
+          };
+        }
+      }
+    }
+    return populate;
+  },
+  async findUsage(fileId) {
+    const usage = [];
+    for (const [uid, contentType] of Object.entries(strapi.contentTypes)) {
+      if (!uid.startsWith("api::")) continue;
+      const attributes = contentType.attributes;
+      const directFields = Object.entries(attributes).filter(([, attr]) => attr.customField === CUSTOM_FIELD).map(([name]) => name);
+      const populate = this.populateForAttributes(attributes);
+      const candidateFields = [...directFields, ...Object.keys(populate)];
+      if (!candidateFields.length) continue;
+      for (const status of ["draft", "published"]) {
+        const pageSize = 500;
+        for (let start = 0; ; start += pageSize) {
+          const entries = await strapi.documents(uid).findMany({
+            status,
+            populate,
+            locale: "*",
+            start,
+            limit: pageSize
+          });
+          for (const entry of entries) {
+            for (const field of candidateFields) {
+              if (!referencesFile(entry[field], fileId)) continue;
+              usage.push({
+                contentType: uid,
+                field,
+                documentId: entry.documentId,
+                id: entry.id,
+                locale: entry.locale ?? null,
+                status
+              });
+            }
+          }
+          if (entries.length < pageSize) break;
+        }
+      }
+    }
+    return usage;
+  }
+});
+const services = {
+  service
+};
+const index = {
+  register,
+  bootstrap,
+  destroy,
+  config,
+  controllers,
+  routes,
+  services,
+  contentTypes,
+  policies,
+  middlewares
+};
+export {
+  index as default
+};