@natilon/cms-server 0.1.2 → 0.5.0

package/src/server.mjs

@@ -3,6 +3,8 @@ import fs from "fs";
 import path from "path";
 import { resolveAdminUiDir } from "./admin-ui-path.mjs";
 import { defaultPublicConfig } from "./default-public-config.mjs";
+import { allRoutes } from "./routes.mjs";
+import { mountRoutes, buildPublicAllowlist } from "./express-shim.mjs";
 import {
   createFsJsonContent,
   createGitHubContent,
@@ -10,7 +12,10 @@ import {
   createCdnProxyMedia,
   createBasicAuth,
   createGitHubOAuth,
+  createCloudflareAccess,
   createNetlifyBuild,
+  createFsTemplates,
+  createGitHubTemplates,
 } from "./adapters/index.mjs";
 
 /**
@@ -23,8 +28,6 @@ import {
  * @param {string} [opts.realm]             HTTP basic-auth realm (default "CMS Admin")
  */
 export function createCmsServer({ config, rootDir, publicConfig: publicConfigFn, realm = "CMS Admin" }) {
-  // Auto-derive publicConfig when the consumer doesn't provide one.
-  const publicConfig = publicConfigFn ?? (() => defaultPublicConfig(config));
   const content =
     config.content?.provider === "github"
       ? createGitHubContent({
@@ -59,13 +62,21 @@ export function createCmsServer({ config, rootDir, publicConfig: publicConfigFn,
           jwtTtl: config.auth.jwtTtl,
           realm,
         })
-      : createBasicAuth({
-          user: process.env[config.auth.userEnv] || "admin",
-          pass: process.env[config.auth.passEnv],
-          jwtSecret: process.env[config.auth.jwtSecretEnv],
-          jwtTtl: config.auth.jwtTtl,
-          realm,
-        });
+      : config.auth?.provider === "cloudflare-access"
+        ? createCloudflareAccess({
+            teamDomain: config.auth.teamDomain,
+            audience: config.auth.audience,
+            roles: config.auth.roles || {},
+            defaultRole: config.auth.defaultRole || "editor",
+          })
+        : createBasicAuth({
+            user: process.env[config.auth.userEnv] || "admin",
+            pass: process.env[config.auth.passEnv],
+            users: config.auth.users,
+            jwtSecret: process.env[config.auth.jwtSecretEnv],
+            jwtTtl: config.auth.jwtTtl,
+            realm,
+          });
 
   const cdnMedia = createCdnProxyMedia({
     baseUrl: config.media.cdnBase,
@@ -78,162 +89,68 @@ export function createCmsServer({ config, rootDir, publicConfig: publicConfigFn,
     defaultBranch: process.env.STAGING_BRANCH || config.content.publishBranch,
   });
 
+  const templates =
+    config.content?.provider === "github"
+      ? createGitHubTemplates({
+          token: process.env[config.content.githubTokenEnv || "GITHUB_TOKEN"],
+          owner: config.content.owner,
+          repo: config.content.repo,
+          branch: process.env.STAGING_BRANCH || config.content.branch || "main",
+          templatesDir: config.content.templatesDir,
+          commitMessage: config.content.commitMessage,
+        })
+      : createFsTemplates({ rootDir });
+
+  const adapters = {
+    content,
+    templates,
+    localMedia,
+    cdnMedia,
+    auth,
+    build,
+    publicConfig: () => (publicConfigFn ?? defaultPublicConfig)(config),
+  };
+
   const app = express();
   app.use(express.json({ limit: "10mb" }));
 
-  app.use((_req, res, next) => {
-    res.header("Access-Control-Allow-Origin", "*");
+  const corsOrigin = config.cors?.origin ?? "*";
+  if (corsOrigin === "*" && config.auth?.provider) {
+    console.warn(
+      "WARNING: CORS origin is '*' — any site can call this API in a logged-in user's browser. Set cors.origin in cms.config.mjs to lock down.",
+    );
+  }
+  const corsAllowList = Array.isArray(corsOrigin) ? corsOrigin : [corsOrigin];
+  app.use((req, res, next) => {
+    const reqOrigin = req.headers.origin;
+    if (corsAllowList.includes("*")) {
+      res.header("Access-Control-Allow-Origin", "*");
+    } else if (reqOrigin && corsAllowList.includes(reqOrigin)) {
+      res.header("Access-Control-Allow-Origin", reqOrigin);
+      res.header("Vary", "Origin");
+    }
     res.header("Access-Control-Allow-Methods", "GET,PUT,POST,DELETE,OPTIONS");
     res.header("Access-Control-Allow-Headers", "Content-Type,Authorization");
-    if (_req.method === "OPTIONS") return res.sendStatus(204);
+    if (req.method === "OPTIONS") return res.sendStatus(204);
     next();
   });
 
-  // GitHub OAuth routes (unauthenticated — must be mounted before the auth guard)
-  if (auth.oauthRoutes) {
-    app.get("/admin/oauth/login", (req, res) => auth.oauthRoutes.login(req, res));
-    app.get("/admin/oauth/callback", (req, res) => auth.oauthRoutes.callback(req, res));
-  }
+  const routes = allRoutes(config);
 
   if (auth.configured) {
+    const allow = buildPublicAllowlist(routes);
     app.use(
       auth.middlewareWith(
-        (req) =>
-          req.path.startsWith(`${localMedia.urlPrefix}/`) ||
-          req.path === "/api/config" ||
-          req.path.startsWith("/admin/oauth/"),
+        (req) => req.path.startsWith(`${localMedia.urlPrefix}/`) || allow(req),
       ),
     );
   } else {
     console.warn(`WARNING: ${config.auth.passEnv} not set — running without authentication`);
   }
 
-  const TEMPLATES_DIR = path.join(rootDir, ".cms-templates");
-
-  function sanitizeSlug(s) {
-    return String(s).replace(/[^a-zA-Z0-9._-]/g, "");
-  }
-
-  function requireAdmin(req, res, next) {
-    if (req.cmsUser && req.cmsUser.role !== "admin") {
-      return res.status(403).json({ error: "Admin role required" });
-    }
-    next();
-  }
-
-  app.get("/api/config", (_req, res) => {
-    const cfg = publicConfig ? publicConfig() : {};
-    // Always expose auth provider and previewUrlPattern to the browser
-    if (!cfg.auth) cfg.auth = {};
-    if (!cfg.auth.provider) cfg.auth.provider = config.auth?.provider || "basic";
-    if (!cfg.previewUrlPattern && config.previewUrlPattern) {
-      cfg.previewUrlPattern = config.previewUrlPattern;
-    }
-    res.json(cfg);
-  });
-
-  app.get("/api/me", (req, res) => {
-    res.json(req.cmsUser || { login: "admin", role: "admin" });
-  });
-
-  app.get("/api/collections", async (_req, res) => {
-    res.json(await content.listCollections());
-  });
-
-  app.get("/api/collections/:collection", async (req, res) => {
-    const sortConfig = config.collections?.[req.params.collection]?.sort ?? null;
-    const pages = await content.listPages(req.params.collection, sortConfig);
-    if (pages === null) return res.status(404).json({ error: "Not found" });
-    res.json(pages);
-  });
-
-  app.get("/api/collections/:collection/:file", async (req, res) => {
-    const data = await content.readPage(req.params.collection, req.params.file);
-    if (!data) return res.status(404).json({ error: "Not found" });
-    res.json(data);
-  });
-
-  app.put("/api/collections/:collection/:file", async (req, res) => {
-    await content.writePage(req.params.collection, req.params.file, req.body);
-    res.json({ ok: true });
-  });
-
-  app.post("/api/collections/:collection", async (req, res) => {
-    const result = await content.createPage(req.params.collection, req.body);
-    res.json({ ok: true, file: result.file });
-  });
-
-  app.delete("/api/collections/:collection/:file", requireAdmin, async (req, res) => {
-    const ok = await content.deletePage(req.params.collection, req.params.file);
-    if (!ok) return res.status(404).json({ error: "Not found" });
-    res.json({ ok: true });
-  });
-
-  app.post("/api/collections/:collection/:file/duplicate", async (req, res) => {
-    const result = await content.duplicatePage(req.params.collection, req.params.file);
-    if (!result) return res.status(404).json({ error: "Not found" });
-    res.json({ ok: true, file: result.file });
-  });
-
-  app.get("/api/history/:collection/:file", async (req, res) => {
-    try {
-      res.json(await content.listHistory(req.params.collection, req.params.file));
-    } catch (err) {
-      res.status(500).json({ error: err.message });
-    }
-  });
-
-  app.post("/api/history/:collection/:file/:ts/restore", async (req, res) => {
-    try {
-      const ok = await content.restoreHistory(req.params.collection, req.params.file, req.params.ts);
-      if (!ok) return res.status(404).json({ error: "Revision not found" });
-      res.json({ ok: true });
-    } catch (err) {
-      res.status(500).json({ error: err.message });
-    }
-  });
-
-  app.get("/api/templates", (_req, res) => {
-    if (!fs.existsSync(TEMPLATES_DIR)) return res.json([]);
-    const files = fs.readdirSync(TEMPLATES_DIR).filter((f) => f.endsWith(".json"));
-    const list = files.map((f) => {
-      const data = JSON.parse(fs.readFileSync(path.join(TEMPLATES_DIR, f), "utf-8"));
-      return { name: data.name, slug: f.replace(".json", ""), blockCount: (data.blocks || []).length };
-    });
-    res.json(list);
-  });
-
-  app.get("/api/templates/:slug", (req, res) => {
-    const file = path.join(TEMPLATES_DIR, sanitizeSlug(req.params.slug) + ".json");
-    if (!fs.existsSync(file)) return res.status(404).json({ error: "Not found" });
-    res.json(JSON.parse(fs.readFileSync(file, "utf-8")));
-  });
-
-  app.post("/api/templates", (req, res) => {
-    const { name, blocks } = req.body;
-    if (!name || !blocks) return res.status(400).json({ error: "name and blocks required" });
-    if (!fs.existsSync(TEMPLATES_DIR)) fs.mkdirSync(TEMPLATES_DIR, { recursive: true });
-    const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-    const file = path.join(TEMPLATES_DIR, slug + ".json");
-    fs.writeFileSync(file, JSON.stringify({ name, blocks }, null, 2), "utf-8");
-    res.json({ ok: true, slug });
-  });
-
-  app.delete("/api/templates/:slug", requireAdmin, (req, res) => {
-    const file = path.join(TEMPLATES_DIR, sanitizeSlug(req.params.slug) + ".json");
-    if (!fs.existsSync(file)) return res.status(404).json({ error: "Not found" });
-    fs.unlinkSync(file);
-    res.json({ ok: true });
-  });
-
-  app.get("/api/assets", async (_req, res) => {
-    res.json(await localMedia.listGrouped());
-  });
-
-  app.get("/api/assets/:folder", async (req, res) => {
-    res.json(await localMedia.listFolder(req.params.folder));
-  });
+  mountRoutes(app, routes, { adapters, config });
 
+  // Local media static file serve (Express-only — Worker has no local fs).
   app.get(`${localMedia.urlPrefix}/{*filepath}`, (req, res) => {
     const sub = Array.isArray(req.params.filepath)
       ? req.params.filepath.join("/")
@@ -243,78 +160,15 @@ export function createCmsServer({ config, rootDir, publicConfig: publicConfigFn,
     res.sendFile(full);
   });
 
-  function handleMediaError(res, err) {
-    const status = err.upstreamStatus || 500;
-    res.status(status >= 400 && status < 600 ? status : 502).json({
-      error: err.message,
-    });
-  }
-
-  app.get("/api/media/folders", async (_req, res) => {
-    try {
-      res.json(await cdnMedia.listFolders());
-    } catch (err) {
-      handleMediaError(res, err);
-    }
-  });
-
-  app.get("/api/media/folder/:folder", async (req, res) => {
-    try {
-      res.json(
-        await cdnMedia.listFolder(req.params.folder, {
-          page: parseInt(req.query.page) || 1,
-          perPage: parseInt(req.query.per_page) || 30,
-          search: req.query.search || "",
-        }),
-      );
-    } catch (err) {
-      handleMediaError(res, err);
-    }
-  });
-
-  app.post("/api/media/upload", async (req, res) => {
-    try {
-      res.json(await cdnMedia.upload(req.body));
-    } catch (err) {
-      handleMediaError(res, err);
-    }
-  });
-
-  app.post("/api/publish", requireAdmin, async (_req, res) => {
-    try {
-      const result = await content.publish();
-      res.json(result);
-    } catch (err) {
-      res.status(500).json({ ok: false, message: err.message });
-    }
-  });
-
-  app.get("/api/publish/status", async (_req, res) => {
-    try {
-      res.json(await content.pendingChanges());
-    } catch (err) {
-      res.status(500).json({ error: err.message });
-    }
+  app.get("/api/assets", async (_req, res) => {
+    res.json(await localMedia.listGrouped());
   });
 
-  app.get("/api/deploy/status", async (req, res) => {
-    if (!build.configured) return res.json({ configured: false });
-    try {
-      res.json(
-        await build.getDeployStatus({
-          branch: req.query.branch,
-          sha: req.query.sha,
-        }),
-      );
-    } catch (err) {
-      if (err.upstreamStatus) {
-        return res.status(502).json({ configured: true, error: err.message });
-      }
-      res.status(500).json({ configured: true, error: err.message });
-    }
+  app.get("/api/assets/:folder", async (req, res) => {
+    res.json(await localMedia.listFolder(req.params.folder));
   });
 
-  return { app, adapters: { content, localMedia, cdnMedia, auth, build } };
+  return { app, adapters: { content, templates, localMedia, cdnMedia, auth, build } };
 }
 
 /**
@@ -327,12 +181,13 @@ export function startScheduler(content, intervalMs = 60_000) {
     try {
       const due = await content.listScheduled();
       if (!due.length) return;
-      for (const { collection, file, data } of due) {
+      const items = due.map(({ collection, file, data }) => {
         delete data.meta.publishAt;
         data.meta.draft = false;
-        await content.writePage(collection, file, data);
-        console.log(`[scheduler] Auto-published ${collection}/${file}`);
-      }
+        return { collection, file, data };
+      });
+      await content.writeBatch(items, "[scheduler] Auto-publish");
+      console.log(`[scheduler] Auto-published ${items.length} item(s)`);
       const result = await content.publish();
       console.log("[scheduler] " + result.message);
     } catch (err) {
@@ -355,10 +210,20 @@ export async function mountAdminUi(app, adminUi) {
   const resolved =
     adminUi.mode === "auto"
       ? process.env.NODE_ENV === "production"
-        ? { mode: "static", dir: adminUi.distDir }
-        : { mode: "vite-dev", root: adminUi.sourceDir, base: adminUi.base || "/admin/" }
+        ? { mode: "static", dir: adminUi.distDir, previewThemeCss: adminUi.previewThemeCss }
+        : { mode: "vite-dev", root: adminUi.sourceDir, base: adminUi.base || "/admin/", previewThemeCss: adminUi.previewThemeCss }
       : adminUi;
 
+  // Optional user CSS override for in-canvas preview styling.
+  // Served before the static handler so it always responds (empty if unset),
+  // preventing a 404 from the <link> tag in index.html.
+  const themePath = resolved.previewThemeCss;
+  app.get("/admin/preview-theme.css", (_req, res) => {
+    res.type("text/css");
+    if (themePath && fs.existsSync(themePath)) res.sendFile(path.resolve(themePath));
+    else res.send("/* no preview-theme.css configured */");
+  });
+
   if (resolved.mode === "static") {
     if (!fs.existsSync(path.join(resolved.dir, "index.html"))) {
       throw new Error(
@@ -395,14 +260,18 @@ export async function mountAdminUi(app, adminUi) {
 export async function startCmsServer(opts) {
   const { app, adapters } = createCmsServer(opts);
 
-  // Auto-detect admin UI dist when not explicitly configured.
+  const previewThemeCss =
+    opts.config?.previewThemeCss
+      ? path.resolve(opts.rootDir || process.cwd(), opts.config.previewThemeCss)
+      : null;
+
   const adminUi = opts.adminUi ?? (() => {
     const dir = resolveAdminUiDir();
     if (!dir) {
       console.warn("admin-ui dist not found — run `npm run build:admin-ui` first, or pass adminUi option explicitly.");
       return null;
     }
-    return { mode: "static", dir };
+    return { mode: "static", dir, previewThemeCss };
   })();
 
   await mountAdminUi(app, adminUi);