@micelio/strapi-plugin-core 0.1.0 → 0.2.0

package/dist/server/src/preview/revocation.d.ts

@@ -1,8 +1,16 @@
 import { Core } from '@strapi/strapi';
 /**
- * Revokes every preview token and grant of an admin user when they log out of the admin.
+ * Revokes every preview token and grant of an admin user before their logout answers.
  *
  * @remarks
+ * Strapi emits `admin.logout` without waiting for its listeners, so a listener can still be
+ * revoking when the logout response is sent and a draft request that follows finds the grant. An
+ * application middleware, which wraps every request and acts only on the admin's logout route
+ * (the route Strapi resolved, not a path, so every spelling the router accepts revokes), awaits
+ * `revoke` after the controller has run and before the response leaves, so no grant of the user
+ * is served once the logout has answered (ADR-0019, section 3). A failure is logged and does not
+ * fail the logout.
+ *
  * Losing the right to read a draft revokes its grants when the next exchange or draft request
  * checks the user's abilities again (`stillReadable` in the `preview` service).
  */

package/dist/server/src/preview/shortcut.d.ts

@@ -0,0 +1,24 @@
+import { Core } from '@strapi/strapi';
+/** What Strapi hands the `admin.preview` handler: the entry its "Open preview" button was pressed on. */
+interface PreviewHandlerParams {
+    documentId?: string;
+    locale?: string;
+}
+/**
+ * The admin URL of the preview page for an entry, or `undefined` for a type that has no preview.
+ *
+ * @remarks
+ * A collection type has one when it belongs to a site and has a dynamic zone, the same rule
+ * the edit view's action follows. `undefined` makes Strapi answer `204`, and it shows no "Open preview" button.
+ */
+export declare function previewPageUrl(strapi: Core.Strapi, uid: string, { documentId, locale }: PreviewHandlerParams): string | undefined;
+/**
+ * Points Strapi's own "Open preview" button at the plugin's preview page, unless the host has
+ * configured `admin.preview` itself.
+ *
+ * @remarks
+ * The host's `config/admin` wins, `enabled: false` included. Strapi reads the handler on each
+ * request, so setting it while the plugin registers is early enough.
+ */
+export declare function registerPreviewShortcut(strapi: Core.Strapi): void;
+export {};

package/dist/server/src/routes/index.d.ts

@@ -2,5 +2,7 @@ declare const _default: {
     'content-api': () => import('@strapi/types/dist/core').RouterInput;
     admin: () => import('@strapi/types/dist/core').RouterInput;
     site: import('@strapi/types/dist/core/core-api/router').Router;
+    category: import('@strapi/types/dist/core/core-api/router').Router;
+    tag: import('@strapi/types/dist/core/core-api/router').Router;
 };
 export default _default;

package/dist/server/src/routes/taxonomy.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The content API routes of the category type: `/api/categories` and `/api/categories/:id`.
+ *
+ * @remarks
+ * `prefix: ''` drops the `/micelio` segment a plugin's content-api routes get, so the paths are
+ * those `micelio-cms` 0.5 and the frontend have (ADR-0017, amendments of 2026-10-21 and
+ * 2026-10-26). A host that has routes of its own on these paths keeps them: host routes register
+ * first.
+ */
+export declare const categoryRoutes: import('@strapi/types/dist/core/core-api/router').Router;
+/** The content API routes of the tag type: `/api/tags` and `/api/tags/:id`, as {@link categoryRoutes}. */
+export declare const tagRoutes: import('@strapi/types/dist/core/core-api/router').Router;

package/dist/server/src/services/index.d.ts

@@ -2,6 +2,12 @@ declare const _default: {
     site: ({ strapi, }: {
         strapi: import('@strapi/types/dist/core').Strapi;
     }) => Partial<import('@strapi/types/dist/core/core-api/service').Base> & import('@strapi/types/dist/core/core-api/service').Generic & import('@strapi/types/dist/core/core-api/service').Base;
+    category: ({ strapi, }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => Partial<import('@strapi/types/dist/core/core-api/service').Base> & import('@strapi/types/dist/core/core-api/service').Generic & import('@strapi/types/dist/core/core-api/service').Base;
+    tag: ({ strapi, }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => Partial<import('@strapi/types/dist/core/core-api/service').Base> & import('@strapi/types/dist/core/core-api/service').Generic & import('@strapi/types/dist/core/core-api/service').Base;
     transitions: ({ strapi }: {
         strapi: import('@strapi/types/dist/core').Strapi;
     }) => import('./transitions').TransitionsService;

package/dist/server/src/services/preview.d.ts

@@ -1,5 +1,5 @@
 import { Core } from '@strapi/strapi';
-import { PreviewBinding, PreviewExpectation, PreviewGrantAnswer, PreviewTokenAnswer } from '../types/preview';
+import { PreviewBinding, PreviewExpectation, PreviewGrantAnswer, PreviewResolvedGrant, PreviewSystemBinding, PreviewTokenAnswer } from '../types/preview';
 /** The `preview` service: `strapi.plugin('micelio').service('preview')`, behind the preview routes. */
 export interface PreviewService {
     /**
@@ -20,14 +20,33 @@ export interface PreviewService {
      */
     exchange(token: string, siteDocumentId: string): Promise<PreviewGrantAnswer | null>;
     /**
-     * The binding of a usable grant for a draft of a site, or `null` for every refusal.
+     * Makes a system grant for one version of a draft, and returns its value once.
      *
      * @remarks
-     * Checks again that the admin user may read the draft. When they may not, every grant of that
-     * user and draft is revoked.
+     * For plugin code that measures a draft at publish (ADR-0019, amendment of 2026-10-25); no
+     * route mints one. The grant lives 60 s, is used once, is bound to the site, type, document,
+     * locale and `binding.entryVersion`, and has no admin user. It is stored hashed; expired
+     * credentials past their retention are removed on the way. The caller sends it to the
+     * frontend's weight route only, never to a browser, and never logs it.
+     */
+    issueSystemGrant(binding: PreviewSystemBinding): Promise<string>;
+    /**
+     * What a usable grant names and who it acts for, or `null` for every refusal.
+     *
+     * @remarks
+     * An `admin` grant checks again that the admin user may read the draft; when they may not,
+     * every grant of that user and draft is revoked. A `system` grant is claimed with one
+     * conditional update, so of two checks at once one finds it spent, and it has no user to ask.
+     * Whether the draft is still the version the system grant was minted for is for the caller to
+     * check (`entryVersion`).
+     */
+    resolveGrant(grant: string, expected: PreviewExpectation): Promise<PreviewResolvedGrant | null>;
+    /**
+     * Revokes every unexpired token and grant of an admin user, or only those of one draft.
+     *
+     * @remarks
+     * System grants have no admin user, so this never touches one: 60 s and a single use bound them.
      */
-    resolveGrant(grant: string, expected: PreviewExpectation): Promise<PreviewBinding | null>;
-    /** Revokes every unexpired token and grant of an admin user, or only those of one draft. */
     revoke(adminUser: number, entryDocumentId?: string): Promise<void>;
 }
 /** The site of a preview has no frontend origin: the token route answers `409` `previewUnavailable`. */

package/dist/server/src/site-scope/documents.d.ts

@@ -4,8 +4,18 @@ import { Core, Modules } from '@strapi/strapi';
  *
  * @remarks
  * Outside a request scoped by the `site-scope` route middleware (the admin, boot steps, other
- * plugins) it only refuses to create an entry without a site or to remove its site. Inside one,
- * it also filters every read by the request's site after Strapi has sanitised the query, gives a
- * new entry the request's site, and answers "not found" for a write to another site's entry.
+ * plugins) it only refuses to create an entry without a site or to remove its site. An update
+ * whose `site` leaves the relation as it is (the Content Manager sends empty `connect` and
+ * `disconnect`) does not touch it. An update that adds a locale to an entry gives it the site of
+ * the entry's other locales, because Strapi's i18n does not copy a relation, and is refused with
+ * "site is required" when those rows name different sites or none and the update names none, or with
+ * "site must be the site of the other locales" when it names another one. An update may change the
+ * site of an existing locale only when no other locale of the entry stays on another site, and is
+ * refused otherwise ("site cannot change while other locales of the document stay on another
+ * site"); an entry of a single locale moves freely. Inside a scoped request, it also filters every read by the
+ * request's site after Strapi has sanitised the query, gives a new entry the request's site and
+ * keeps an updated one there whatever `site` the body names, and answers "not found" for a write
+ * to another site's entry, before anything else is read. Publishing or discarding the draft of a
+ * locale keeps its site on the row Strapi rebuilds.
  */
 export declare function siteScopeDocuments(strapi: Core.Strapi): Modules.Documents.Middleware.Middleware;

package/dist/server/src/types/hooks.d.ts

@@ -85,12 +85,13 @@ export interface HookPayloads {
      */
     afterTransition: TransitionPayload;
     /**
-     * Runs after an entry's version goes live: today, after `in_review → published` and
-     * `scheduled → published`, following `afterTransition`.
+     * Runs after an entry's version goes live: today, after `in_review → published`,
+     * `scheduled → published` and `published → published` (republish), following `afterTransition`.
      *
      * @remarks
-     * Treat it as "this version is now live", not "first publication": bogd3v/micelio#699 adds a
-     * transition that puts the edits of a published entry live, and this hook fires for it too. A
+     * Treat it as "this version is now live", not "first publication": `published → published`
+     * puts the edits of a published entry live (ADR-0017, amendment of 2026-10-25), and this hook
+     * fires for it too, with `afterTransition` carrying `published` as both `from` and `to`. A
      * handler that publishes elsewhere (the fediverse, a static rebuild) must be idempotent per
      * `documentId` and `locale`.
      */

package/dist/server/src/types/preview.d.ts

@@ -1,9 +1,5 @@
-/** What a preview token or grant is bound to (ADR-0019, section 3). */
-export interface PreviewBinding {
-    /** The `id` of the admin user who asked for the token. */
-    adminUser: number;
-    /** The origin of the admin page that asked, which the frontend frames itself for. */
-    adminOrigin: string;
+/** What every preview credential is bound to: one document of one site. */
+export interface PreviewTarget {
     /** The `documentId` of the site. */
     siteDocumentId: string;
     /** The content type UID. */
@@ -12,19 +8,48 @@ export interface PreviewBinding {
     /** The locale of the draft; `null` for a type that is not localised. */
     entryLocale: string | null;
 }
-/** Which of the two credentials a record is. */
-export type PreviewCredentialKind = 'token' | 'grant';
+/** What a preview token or grant is bound to (ADR-0019, section 3). */
+export interface PreviewBinding extends PreviewTarget {
+    /** The `id` of the admin user who asked for the token. */
+    adminUser: number;
+    /** The origin of the admin page that asked, which the frontend frames itself for. */
+    adminOrigin: string;
+}
+/**
+ * What a system grant is bound to (ADR-0019, amendment of 2026-10-25): a document and the version
+ * of its draft, and no admin user.
+ */
+export interface PreviewSystemBinding extends PreviewTarget {
+    /** The `updatedAt` of the draft at the moment of minting, as an ISO 8601 date. */
+    entryVersion: string;
+}
+/** Which of the credentials a record is: a token, a grant, or the plugin's own system grant. */
+export type PreviewCredentialKind = 'token' | 'grant' | 'system';
+/** Who a grant acts for: an admin user, or the plugin itself. */
+export type PreviewActor = 'admin' | 'system';
 /** A credential as the store keeps it: never its value, only the hash. */
-export interface PreviewCredentialRecord extends PreviewBinding {
+export interface PreviewCredentialRecord extends PreviewTarget {
     kind: PreviewCredentialKind;
     /** SHA-256 of the value, in hex. */
     hash: string;
+    /** The admin user a token or grant is bound to; `null` for a system grant. */
+    adminUser: number | null;
+    /** The admin origin a token or grant is bound to; `null` for a system grant. */
+    adminOrigin: string | null;
+    /** The `updatedAt` of the draft a system grant was minted for; `null` for the other kinds. */
+    entryVersion: string | null;
     expiresAt: Date;
-    /** When a token was exchanged; `null` while unused, and always `null` for a grant. */
+    /** When a token was exchanged or a system grant was used; `null` while unused, and always `null` for a grant. */
     usedAt: Date | null;
     /** When logging out or losing the right to read the document ended it. */
     revokedAt: Date | null;
 }
+/** The grant a request presented, once it checked out: what it names and who it acts for. */
+export interface PreviewResolvedGrant extends PreviewTarget {
+    actor: PreviewActor;
+    /** The version a `system` grant was minted for; `null` for an `admin` grant. */
+    entryVersion: string | null;
+}
 /** What a request presents a credential for. Absent fields are not checked. */
 export interface PreviewExpectation {
     siteDocumentId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micelio/strapi-plugin-core",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Micelio's core as a Strapi 5 plugin: sites, blocks, the editorial workflow, hooks and the host check.",
   "type": "commonjs",
   "license": "AGPL-3.0-only",
@@ -14,7 +14,7 @@
     "micelio"
   ],
   "engines": {
-    "node": ">=22.12"
+    "node": ">=22.19.0"
   },
   "micelio": "0.6",
   "strapi": {
@@ -100,6 +100,7 @@
     "@micelio/tsconfig": "^0.1.0",
     "@strapi/design-system": "^2.2.4",
     "@strapi/icons": "^2.2.4",
+    "@strapi/plugin-users-permissions": "^5.59.0",
     "@strapi/sdk-plugin": "^6.1.1",
     "@strapi/strapi": "^5.59.0",
     "@strapi/typescript-utils": "^5.59.0",
@@ -110,7 +111,7 @@
     "better-sqlite3": "12.11.1",
     "eslint": "^10.12.0",
     "jiti": "^2.7.0",
-    "playwright": "^1.63.0",
+    "playwright": "1.64.1",
     "postcss": "^8.5.31",
     "prettier": "^3.9.10",
     "react": "^18.3.1",