@morphika/andami 0.1.2

package/app/api/admin/pages/route.ts

@@ -0,0 +1,129 @@
+import { NextRequest, NextResponse } from "next/server";
+import { client } from "../../../../lib/sanity/client";
+import { writeClient } from "../../../../lib/sanity/writeClient";
+import { allPagesQuery } from "../../../../lib/sanity/queries";
+import { isAdminAuthenticated } from "../../../../lib/auth";
+import { validateCsrf, csrfErrorResponse } from "../../../../lib/csrf";
+import { isBodyTooLarge, MAX_JSON_BODY_SIZE } from "../../../../lib/security";
+import { auditLog } from "../../../../lib/audit";
+import { logger } from "../../../../lib/logger";
+
+/**
+ * GET /api/admin/pages — List all pages
+ */
+export async function GET() {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  try {
+    const pages = await client.fetch(allPagesQuery);
+    return NextResponse.json({ pages });
+  } catch (err) {
+    logger.error("[Admin:Pages]", "Failed to fetch pages", err);
+    return NextResponse.json(
+      { error: "Failed to fetch pages" },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * POST /api/admin/pages — Create a new page
+ * Body: { title, slug, page_type }
+ */
+export async function POST(request: NextRequest) {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+  if (isBodyTooLarge(request, MAX_JSON_BODY_SIZE)) {
+    return NextResponse.json({ error: "Request body too large" }, { status: 413 });
+  }
+
+  try {
+    const body = await request.json();
+    const { title, slug, page_type, thumbnail_path, cover_video, content_rows } = body;
+
+    // Validate required fields
+    if (!title || !slug) {
+      return NextResponse.json(
+        { error: "Missing required fields: title, slug" },
+        { status: 400 }
+      );
+    }
+
+    // Validate title length
+    if (typeof title === "string" && title.length > 500) {
+      return NextResponse.json(
+        { error: "Title exceeds maximum length of 500 characters" },
+        { status: 400 }
+      );
+    }
+
+    // Validate slug format: lowercase alphanumeric + hyphens only
+    if (typeof slug !== "string" || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) {
+      return NextResponse.json(
+        { error: "Slug must be lowercase alphanumeric with hyphens only (e.g. 'my-page')" },
+        { status: 400 }
+      );
+    }
+
+    // Validate page_type (defaults to "page" if not provided)
+    const resolvedPageType = page_type || "page";
+    const validTypes = ["page", "project"];
+    if (!validTypes.includes(resolvedPageType)) {
+      return NextResponse.json(
+        { error: "Invalid page type" },
+        { status: 400 }
+      );
+    }
+
+    // Check for duplicate slug
+    const existing = await client.fetch(
+      `*[_type == "page" && slug.current == $slug][0]._id`,
+      { slug }
+    );
+    if (existing) {
+      return NextResponse.json(
+        { error: "A page with this slug already exists" },
+        { status: 409 }
+      );
+    }
+
+    // Create the page document
+    const doc = {
+      _type: "page",
+      title,
+      slug: { _type: "slug", current: slug },
+      page_type: resolvedPageType,
+      is_home: false,
+      content_rows: Array.isArray(content_rows) ? content_rows : [],
+      page_settings: {
+        background_color: "#ffffff",
+        text_color: "#000000",
+      },
+      metadata: {
+        seo_title: title,
+        seo_description: "",
+      },
+      draft_mode: true,
+      ...(thumbnail_path ? { thumbnail_path } : {}),
+      ...(cover_video ? { cover_video } : {}),
+    };
+
+    const created = await writeClient.create(doc);
+
+    auditLog("page.create", { slug, page_type: resolvedPageType, title });
+
+    return NextResponse.json({ page: created }, { status: 201 });
+  } catch (err) {
+    logger.error("[Admin:Pages]", "Failed to create page", err);
+    return NextResponse.json(
+      { error: "Failed to create page" },
+      { status: 500 }
+    );
+  }
+}

package/app/api/admin/preview/route.ts

@@ -0,0 +1,53 @@
+import { NextRequest, NextResponse } from "next/server";
+import { client } from "../../../../lib/sanity/client";
+import { pageBySlugQuery } from "../../../../lib/sanity/queries";
+import { isAdminAuthenticated } from "../../../../lib/auth";
+import { logger } from "../../../../lib/logger";
+import type { Page } from "../../../../lib/sanity/types";
+
+/**
+ * Preview API — fetches a page including drafts.
+ *
+ * Used by the builder "Preview" button to show content that
+ * hasn't been published yet.
+ *
+ * Query params:
+ *   ?slug=about        → fetch by slug (includes drafts)
+ */
+export async function GET(req: NextRequest) {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  const { searchParams } = new URL(req.url);
+  const slug = searchParams.get("slug");
+
+  try {
+    let page: Page | null = null;
+
+    if (slug) {
+      // pageBySlugQuery already includes drafts (no draft_mode filter)
+      page = await client.fetch<Page>(pageBySlugQuery, { slug });
+    } else {
+      return NextResponse.json(
+        { error: "Provide ?slug= parameter" },
+        { status: 400 }
+      );
+    }
+
+    if (!page) {
+      return NextResponse.json(
+        { error: "Page not found" },
+        { status: 404 }
+      );
+    }
+
+    return NextResponse.json({ page });
+  } catch (error) {
+    logger.error("[Admin:Preview]", "Preview API error", error);
+    return NextResponse.json(
+      { error: "Failed to fetch page" },
+      { status: 500 }
+    );
+  }
+}

package/app/api/admin/r2/connect/route.ts

@@ -0,0 +1,181 @@
+import { NextRequest, NextResponse } from "next/server";
+import { S3Client, HeadBucketCommand, PutBucketCorsCommand } from "@aws-sdk/client-s3";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { writeClient } from "../../../../../lib/sanity/writeClient";
+import { validateCsrf, csrfErrorResponse } from "../../../../../lib/csrf";
+import { encryptToken, isBodyTooLarge, MAX_JSON_BODY_SIZE, jsonError } from "../../../../../lib/security";
+import { logger } from "../../../../../lib/logger";
+
+/**
+ * POST /api/admin/r2/connect — Validate and store R2 credentials.
+ *
+ * 1. Receives { endpoint, bucketName, accessKeyId, secretAccessKey, publicUrl }.
+ * 2. Validates all fields are present and well-formed.
+ * 3. Tests connectivity by sending a HEAD request to the public URL.
+ * 4. Encrypts accessKeyId and secretAccessKey with AES-GCM.
+ * 5. Stores everything in the assetRegistry document.
+ *
+ * Does NOT switch the active storage_provider — that's Phase 4.
+ */
+export async function POST(request: NextRequest) {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+  if (isBodyTooLarge(request, MAX_JSON_BODY_SIZE)) {
+    return jsonError("Request body too large", 413);
+  }
+
+  try {
+    const body = await request.json();
+    const { endpoint, bucketName, accessKeyId, secretAccessKey, publicUrl } = body;
+
+    // ── Validate required fields ──
+    if (!endpoint || typeof endpoint !== "string") {
+      return jsonError("S3 endpoint is required", 400);
+    }
+    if (!bucketName || typeof bucketName !== "string") {
+      return jsonError("Bucket name is required", 400);
+    }
+    if (!accessKeyId || typeof accessKeyId !== "string") {
+      return jsonError("Access Key ID is required", 400);
+    }
+    if (!secretAccessKey || typeof secretAccessKey !== "string") {
+      return jsonError("Secret Access Key is required", 400);
+    }
+    if (!publicUrl || typeof publicUrl !== "string") {
+      return jsonError("Public bucket URL is required", 400);
+    }
+
+    // ── Validate URL formats ──
+    try {
+      const endpointUrl = new URL(endpoint);
+      if (endpointUrl.protocol !== "https:") {
+        return jsonError("S3 endpoint must use HTTPS", 400);
+      }
+      // #13: Whitelist known Cloudflare R2 endpoint patterns to prevent credential theft
+      const hostname = endpointUrl.hostname.toLowerCase();
+      if (!hostname.endsWith(".r2.cloudflarestorage.com") && !hostname.endsWith(".cloudflare.com")) {
+        return jsonError(
+          "S3 endpoint must be a Cloudflare R2 endpoint (*.r2.cloudflarestorage.com). Custom endpoints are not allowed for security.",
+          400
+        );
+      }
+    } catch {
+      return jsonError("Invalid S3 endpoint URL", 400);
+    }
+
+    try {
+      const pubUrl = new URL(publicUrl);
+      if (pubUrl.protocol !== "https:" && pubUrl.protocol !== "http:") {
+        return jsonError("Public URL must use HTTP or HTTPS", 400);
+      }
+    } catch {
+      return jsonError("Invalid public bucket URL", 400);
+    }
+
+    // ── Test connection — HEAD request to the public URL ──
+    // A properly configured public R2 bucket returns 200 or 404 (no index)
+    // but NOT a connection error or auth error (403)
+    try {
+      const testRes = await fetch(publicUrl.replace(/\/$/, ""), {
+        method: "HEAD",
+        signal: AbortSignal.timeout(8000),
+      });
+
+      if (!testRes.ok && testRes.status !== 404) {
+        return jsonError(
+          `Connection test failed: public URL returned HTTP ${testRes.status}. Ensure the bucket has public access enabled.`,
+          400
+        );
+      }
+    } catch (err) {
+      return jsonError(
+        "Cannot reach public URL. Check the URL and try again.",
+        400
+      );
+    }
+
+    // #17: Test S3 API credentials (not just public URL) using HeadBucket
+    try {
+      const testS3 = new S3Client({
+        region: "auto",
+        endpoint: endpoint.trim().replace(/\/$/, ""),
+        credentials: {
+          accessKeyId: accessKeyId.trim(),
+          secretAccessKey: secretAccessKey.trim(),
+        },
+      });
+      await testS3.send(new HeadBucketCommand({ Bucket: bucketName.trim() }));
+
+      // ── Configure CORS for browser-direct uploads ──
+      // Presigned PUT URLs require the bucket to allow cross-origin requests
+      // from the Vercel deployment origin. We allow all origins with * because
+      // the presigned URL itself is the auth gate — only holders of a valid
+      // signed URL can upload. This also covers preview deploys and localhost.
+      try {
+        await testS3.send(
+          new PutBucketCorsCommand({
+            Bucket: bucketName.trim(),
+            CORSConfiguration: {
+              CORSRules: [
+                {
+                  AllowedOrigins: ["*"],
+                  AllowedMethods: ["GET", "PUT", "HEAD"],
+                  AllowedHeaders: ["*"],
+                  ExposeHeaders: ["ETag", "Content-Length"],
+                  MaxAgeSeconds: 86400,
+                },
+              ],
+            },
+          })
+        );
+      } catch (corsErr) {
+        logger.warn("[Admin:R2]", "Failed to auto-configure CORS on R2 bucket", corsErr);
+        // Non-fatal — user can configure CORS manually in Cloudflare dashboard
+      }
+
+      testS3.destroy();
+    } catch (s3Err) {
+      return jsonError(
+        `S3 credential validation failed: ${s3Err instanceof Error ? s3Err.message : "Could not authenticate with the provided credentials"}. Check your Access Key ID, Secret Access Key, and bucket name.`,
+        400
+      );
+    }
+
+    // ── Encrypt credentials ──
+    const encryptedAccessKeyId = await encryptToken(accessKeyId.trim());
+    const encryptedSecretAccessKey = await encryptToken(secretAccessKey.trim());
+
+    // #38: Normalize publicUrl using URL constructor for consistent format
+    const normalizedPublicUrl = new URL(publicUrl.trim()).href.replace(/\/+$/, "");
+    const normalizedEndpoint = new URL(endpoint.trim()).href.replace(/\/+$/, "");
+
+    // ── Store in Sanity ──
+    await writeClient
+      .patch("assetRegistry")
+      .set({
+        r2_bucket_url: normalizedPublicUrl,
+        r2_endpoint: normalizedEndpoint,
+        r2_bucket_name: bucketName.trim(),
+        r2_access_key_id: encryptedAccessKeyId,
+        r2_secret_access_key: encryptedSecretAccessKey,
+        r2_connected_at: new Date().toISOString(),
+      })
+      .commit();
+
+    return NextResponse.json({
+      success: true,
+      bucketName: bucketName.trim(),
+      publicUrl: publicUrl.trim().replace(/\/$/, ""),
+    });
+  } catch (err) {
+    logger.error("[Admin:R2]", "Failed to connect R2", err);
+    return NextResponse.json(
+      { error: "Failed to store R2 configuration" },
+      { status: 500 }
+    );
+  }
+}

package/app/api/admin/r2/delete/route.ts

@@ -0,0 +1,198 @@
+import { NextRequest, NextResponse } from "next/server";
+import { S3Client, DeleteObjectCommand, ListObjectsV2Command, DeleteObjectsCommand } from "@aws-sdk/client-s3";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { validateCsrf, csrfErrorResponse } from "../../../../../lib/csrf";
+import { isBodyTooLarge, MAX_JSON_BODY_SIZE, jsonError, isValidAssetPath, checkRateLimit } from "../../../../../lib/security";
+import { client } from "../../../../../lib/sanity/client";
+import { writeClient } from "../../../../../lib/sanity/writeClient";
+import { decryptToken } from "../../../../../lib/security";
+import { auditLog } from "../../../../../lib/audit";
+import { logger } from "../../../../../lib/logger";
+import { isRasterImage, thumbKeyForPath } from "../../../../../lib/thumbnails/generate";
+
+/**
+ * POST /api/admin/r2/delete — Delete a file or folder from R2.
+ *
+ * Body: { key: string, isFolder?: boolean }
+ *   - key: relative path (e.g. "Projects/hero.jpg" or "Projects/MyFolder")
+ *   - isFolder: if true, deletes all objects with the key as prefix
+ *
+ * Also removes matching entries from the Sanity asset registry.
+ * For raster images, also deletes the corresponding _thumbs/ thumbnail (best-effort).
+ */
+export async function POST(request: NextRequest) {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+  if (isBodyTooLarge(request, MAX_JSON_BODY_SIZE)) {
+    return jsonError("Request body too large", 413);
+  }
+  // #32: Rate limit R2 delete operations (30 per minute)
+  const ip = request.headers.get("x-forwarded-for") || "unknown";
+  if (!checkRateLimit(`r2-delete:${ip}`, 30, 60_000)) {
+    return jsonError("Too many requests. Please slow down.", 429);
+  }
+
+  try {
+    const body = await request.json();
+    const { key, isFolder } = body;
+
+    if (!key || typeof key !== "string") {
+      return jsonError("Key is required", 400);
+    }
+    // #1, #16: Always validate path regardless of isFolder flag — prevents path traversal
+    if (!isValidAssetPath(key)) {
+      return jsonError("Invalid path", 400);
+    }
+
+    // Fetch R2 credentials
+    const registry = await client.fetch(
+      `*[_type == "assetRegistry"][0]{
+        _id, r2_endpoint, r2_bucket_name, r2_access_key_id, r2_secret_access_key, assets
+      }`
+    );
+
+    if (!registry?.r2_endpoint || !registry?.r2_bucket_name) {
+      return jsonError("R2 is not connected", 400);
+    }
+
+    const accessKeyId = await decryptToken(registry.r2_access_key_id);
+    const secretAccessKey = await decryptToken(registry.r2_secret_access_key);
+
+    const s3 = new S3Client({
+      region: "auto",
+      endpoint: registry.r2_endpoint,
+      credentials: { accessKeyId, secretAccessKey },
+    });
+
+    let deletedKeys: string[] = [];
+
+    if (isFolder) {
+      // List all objects with this prefix and delete them
+      const prefix = key.replace(/\/+$/, "") + "/";
+      let continuationToken: string | undefined;
+
+      do {
+        const list = await s3.send(
+          new ListObjectsV2Command({
+            Bucket: registry.r2_bucket_name,
+            Prefix: prefix,
+            ContinuationToken: continuationToken,
+            MaxKeys: 1000,
+          })
+        );
+
+        const objects = (list.Contents || []).map((obj) => ({ Key: obj.Key! }));
+        if (objects.length > 0) {
+          // #15: Check for partial failures in batch delete
+          const deleteResult = await s3.send(
+            new DeleteObjectsCommand({
+              Bucket: registry.r2_bucket_name,
+              Delete: { Objects: objects },
+            })
+          );
+          const errors = deleteResult.Errors || [];
+          if (errors.length > 0) {
+            logger.error("[Admin:R2]", `Partial failure: ${errors.length} of ${objects.length} objects failed`, errors);
+          }
+          // Only count successfully deleted keys
+          const failedKeys = new Set(errors.map((e) => e.Key));
+          const succeeded = objects.filter((o) => !failedKeys.has(o.Key));
+          deletedKeys.push(...succeeded.map((o) => o.Key));
+        }
+
+        continuationToken = list.NextContinuationToken;
+      } while (continuationToken);
+
+      // ── Thumbnail propagation: also delete _thumbs/{folder}/ contents ──
+      // Best-effort — failures here don't affect the main operation.
+      try {
+        const thumbPrefix = `_thumbs/${prefix}`;
+        let thumbContinuation: string | undefined;
+
+        do {
+          const thumbList = await s3.send(
+            new ListObjectsV2Command({
+              Bucket: registry.r2_bucket_name,
+              Prefix: thumbPrefix,
+              ContinuationToken: thumbContinuation,
+              MaxKeys: 1000,
+            })
+          );
+
+          const thumbObjects = (thumbList.Contents || []).map((obj) => ({ Key: obj.Key! }));
+          if (thumbObjects.length > 0) {
+            await s3.send(
+              new DeleteObjectsCommand({
+                Bucket: registry.r2_bucket_name,
+                Delete: { Objects: thumbObjects },
+              })
+            );
+          }
+
+          thumbContinuation = thumbList.NextContinuationToken;
+        } while (thumbContinuation);
+      } catch (thumbErr) {
+        logger.warn("[Admin:R2]", "Failed to delete folder thumbnails (best-effort)", thumbErr);
+      }
+    } else {
+      // Delete single file
+      await s3.send(
+        new DeleteObjectCommand({
+          Bucket: registry.r2_bucket_name,
+          Key: key,
+        })
+      );
+      deletedKeys = [key];
+
+      // ── Thumbnail propagation: delete _thumbs/ counterpart for raster images ──
+      // S3 DeleteObject on a non-existent key is a no-op, so no need to check existence.
+      if (isRasterImage(key)) {
+        try {
+          const thumbKey = thumbKeyForPath(key);
+          await s3.send(
+            new DeleteObjectCommand({
+              Bucket: registry.r2_bucket_name,
+              Key: thumbKey,
+            })
+          );
+        } catch (thumbErr) {
+          logger.warn("[Admin:R2]", "Failed to delete thumbnail (best-effort)", thumbErr);
+        }
+      }
+    }
+
+    // Remove matching entries from Sanity registry
+    if (deletedKeys.length > 0 && registry.assets?.length) {
+      const keysToRemove = new Set(deletedKeys);
+      const toUnset = registry.assets
+        .filter((a: { path: string; _key: string }) => keysToRemove.has(a.path))
+        .map((a: { _key: string }) => `assets[_key=="${a._key}"]`);
+
+      if (toUnset.length > 0) {
+        await writeClient
+          .patch(registry._id)
+          .unset(toUnset)
+          .commit();
+      }
+    }
+
+    auditLog("r2.delete", { key, isFolder, deletedCount: deletedKeys.length });
+
+    return NextResponse.json({
+      success: true,
+      deletedCount: deletedKeys.length,
+    });
+  } catch (err) {
+    // #5: Gracefully handle corrupted encrypted tokens
+    if (err instanceof Error && (err.message.includes("decrypt") || err.message.includes("atob") || err.message.includes("Invalid encrypted"))) {
+      logger.error("[Admin:R2]", "Failed to decrypt R2 credentials", err);
+      return jsonError("R2 credentials are corrupted. Please reconnect R2 in /admin/storage.", 500);
+    }
+    logger.error("[Admin:R2]", "Failed to delete from R2", err);
+    return jsonError("Failed to delete", 500);
+  }
+}

package/app/api/admin/r2/disconnect/route.ts

@@ -0,0 +1,42 @@
+import { NextRequest, NextResponse } from "next/server";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { writeClient } from "../../../../../lib/sanity/writeClient";
+import { validateCsrf, csrfErrorResponse } from "../../../../../lib/csrf";
+import { logger } from "../../../../../lib/logger";
+
+/**
+ * POST /api/admin/r2/disconnect — Clear R2 credentials from the registry.
+ *
+ * Removes all R2-specific fields. Does NOT change storage_provider —
+ * if R2 was the active provider, the caller should handle that separately.
+ */
+export async function POST(request: NextRequest) {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+
+  try {
+    await writeClient
+      .patch("assetRegistry")
+      .unset([
+        "r2_bucket_url",
+        "r2_access_key_id",
+        "r2_secret_access_key",
+        "r2_endpoint",
+        "r2_bucket_name",
+        "r2_connected_at",
+      ])
+      .commit();
+
+    return NextResponse.json({ success: true });
+  } catch (err) {
+    logger.error("[Admin:R2]", "Failed to disconnect R2", err);
+    return NextResponse.json(
+      { error: "Failed to disconnect R2" },
+      { status: 500 }
+    );
+  }
+}