@open-commune/web 0.1.3

package/pages/management/roles.vue

@@ -0,0 +1,183 @@
+<template>
+  <section class="w-full">
+    <!-- Rôles figés par Commun (admin / rédacteur) : consultation seule. -->
+    <p class="mb-6 rounded-md bg-amber-50 border border-amber-200 px-4 py-3 text-sm text-amber-800">
+      Les rôles sont désormais prédéfinis (administrateur, rédacteur) et ne sont plus personnalisables.
+    </p>
+    <default-table
+      v-if="!$route.params.event"
+      :headers="TABLE_HEADERS"
+      :filters="filters"
+      :items="records"
+      :actions="abilities"
+      :pagination-size="limit"
+      display-search-bar
+      paginated-content
+      @fetch-more="_fetchMore"
+      @update="_openModalForm('update', $event)"
+      @remove="_handle('remove', $event)"
+    />
+  </section>
+</template>
+
+<script setup>
+import buttonSecondary from '~/components/elements/buttons/secondary'
+import defaultTable from '~/components/data/lists/data-lists-table'
+import { useModalStore } from '~/store/layout/modal'
+
+definePageMeta({
+  permissions: ['manage:all'],
+  preFetch: ['Role'],
+  headings: {
+    title: 'Membres',
+    description: 'Retrouvez & managez ici toutes les membres de la plateforme.'
+  }
+})
+
+const { Role } = useModels()
+const $route = useRoute()
+const $modalStore = useModalStore()
+
+// Prepare constants
+const TABLE_HEADERS = [
+  {
+    title: 'Nom',
+    property: 'name',
+    component: 'data-text'
+  },
+  {
+    title: '',
+    component: 'actions'
+  }
+]
+
+// Prepare reactive data
+const limit = ref(25)
+
+// Prepare computed
+const records = computed(() => Role.repo.all())
+const filters = computed(() => [])
+// Rôles figés : aucune action d'édition/suppression proposée.
+const abilities = computed(() => [])
+
+// Prepare methods
+const _fetchMore = async (skip = 0) => {
+  await Role.list(undefined, undefined, { skip, limit: limit.value })
+}
+
+// Prepare methods
+const _handle = async (action, data = {}) => {
+  const { _id } = data
+  switch (action) {
+    case 'add':
+      await Role.create(data)
+      break
+    case 'update':
+      await Role.update(_id, data)
+      break
+    case 'remove':
+      await Role.remove(_id)
+      break
+    default:
+      throw new Error('E_UNHANDLED')
+  }
+}
+
+const _openModalForm = (action, record) => {
+  $modalStore.open({
+    onSubmit: async (data) => _handle(action, data),
+    details: {
+      title: `${action === 'add' ? 'Ajouter' : 'Modifier'} un rôle`,
+      subTitle: 'Reinseignez les informations de ce rôle.',
+      acceptButton: `${action === 'add' ? 'Ajouter' : 'Modifier'}`,
+      closeButton: 'Annuler'
+    },
+    attributes: [
+      {
+        property: 'name',
+        componentOptions: {
+          label: 'Nom du rôle',
+          name: 'name'
+        },
+        component: 'input-text'
+      },
+      {
+        property: 'description',
+        componentOptions: {
+          label: 'Description rôle',
+          name: 'description'
+        },
+        component: 'input-text'
+      },
+      {
+        property: 'permissions',
+        componentOptions: {
+          label: 'Permissions du rôle',
+          name: 'permissions',
+          items: [
+            'manage:all',
+            'read:deployments',
+            'create:deployments',
+            'admin:organizations',
+            'create:organizations',
+            'read:organizations',
+            'update:organizations',
+            'create:collections',
+            'read:collections',
+            'update:collections',
+            'delete:collections',
+            'publish:records',
+            'create:records',
+            'read:records',
+            'update:records',
+            'delete:records',
+            'create:media',
+            'read:media',
+            'update:media',
+            'delete:media',
+            'create:users',
+            'read:users',
+            'update:users',
+            'delete:users',
+            'create:roles',
+            'read:roles',
+            'update:roles',
+            'delete:roles',
+            'create:tokens',
+            'read:tokens',
+            'update:tokens',
+            'delete:tokens'
+          ],
+          enableMultiple: true,
+          object: false,
+          placeHolder: 'Ajouter une ou plusieurs permissions',
+        },
+        component: 'select-enum'
+      },
+      {
+        property: 'onlyOwn',
+        componentOptions: {
+          label: 'Restriction créateur',
+          description: 'Restreindre le champs d\'action d\'un utilisateur à ses propres ressources uniquement.',
+          name: 'onlyOwn',
+          property: 'onlyOwn',
+          readOnly: true
+        },
+        component: 'input-toggle'
+      },
+      {
+        property: 'mfa',
+        componentOptions: {
+          label: 'Authentification multi-facteur',
+          description: 'Vérifier l\'authentification d\'un utilisateur via un facteur supplémentaire (authenticator, sms, ...).',
+          name: 'mfa',
+          property: 'mfa',
+          readOnly: true
+        },
+        component: 'input-toggle'
+      }
+    ],
+    record
+  })
+}
+</script>

package/pages/overview.vue

@@ -0,0 +1,15 @@
+<template>
+  <div class="relative block w-full">
+
+  </div>
+</template>
+
+<script setup>
+definePageMeta({
+  permissions: ['entrance:self'],
+  headings: {
+    title: 'Bienvenue',
+    description: ''
+  }
+})
+</script>

package/pages/settings.vue

@@ -0,0 +1,197 @@
+<template>
+  <forms-layout
+    v-bind="{ record, ...ORGANIZATION_FORM }"
+    class="mt-4"
+  />
+</template>
+
+<script setup>
+import { useWorkspaceStore } from '~/store/layout/workspace'
+import formsLayout from '~/components/forms/layouts/layout'
+
+definePageMeta({
+  permissions: ['manage:all'],
+  preFetch: ['Organization'],
+  headings: {
+    title: 'Paramètres',
+    description: 'Retrouvez ici tous les paramètres de l\'organisation.'
+  }
+})
+
+const $workspaceStore = useWorkspaceStore()
+const ORGANIZATION_FORM = ref({
+  layout: [
+    {
+      icon: '',
+      sections: [
+        {
+          componentOptions: {
+            title: 'Logo de l\'organization',
+            description: 'Cliquez sur votre logo pour ajouter une image depuis vos fichiers.',
+            hint: 'Le logo est optionnel mais fortement recommandé.',
+            attributes: [
+              {
+                property: 'logo',
+                componentOptions: {
+                  name: 'cover',
+                  limit: 1,
+                  label: 'Logo de l\'organization'
+                },
+                component: 'input-files-media'
+              }
+            ]
+          },
+          component: 'form-section-default'
+        },
+        {
+          componentOptions: {
+            title: 'Nom de l\'organization',
+            description: 'Ces informations seront visibles publiquement, soyez donc attentif avec ce que vous partagerez.',
+            hint: 'Merci de ne pas dépasser 128 charactères.',
+            attributes: [
+              {
+                property: 'name',
+                componentOptions: {
+                  previewSlug: false,
+                  editableSlug: false,
+                  trim: true,
+                  placeHolder: 'Nom de l\'organisation',
+                  required: true
+                },
+                component: 'input-text'
+              }
+            ]
+          },
+          component: 'form-section-default'
+        }
+        // {
+        //   componentOptions: {
+        //     title: 'Localisation de l\'organization',
+        //     description: 'Ces informations seront visibles publiquement, soyez donc attentif avec ce que vous partagerez.',
+        //     attributes: [
+        //       {
+        //         property: 'location',
+        //         componentOptions: {
+        //           placeHolder: 'Localisation de l\'organisation',
+        //           name: 'organization'
+        //         },
+        //         component: 'input-location'
+        //       }
+        //     ]
+        //   },
+        //   component: 'form-section-default'
+        // }
+      ],
+      title: 'General'
+    },
+    {
+      icon: '',
+      sections: [
+        {
+          componentOptions: {
+            title: 'Collections',
+            description: 'Ces collections permettent de définir les différents jeux de données de l\'organisation.',
+            hint: '🚦 Soyez vigilant lorsque vous modifiez ce champs.',
+            attributes: [
+              {
+                property: 'collections',
+                componentOptions: {},
+                component: 'handler-collections'
+              }
+            ],
+            noAction: true
+          },
+          component: 'form-section-default'
+        }
+      ],
+      title: 'Collections'
+    },
+    {
+      icon: '',
+      sections: [
+        {
+          componentOptions: {
+            title: 'Les thématiques',
+            description: 'Vous pouvez modifier ici les thématiques de cette organisation.',
+            attributes: [
+              {
+                componentOptions: {
+                  collection: 'labels',
+                  alwaysPublish: true
+                },
+                component: 'handler-records'
+              }
+            ],
+            noAction: true
+          },
+          component: 'form-section-default'
+        }
+      ],
+      title: 'Thématiques'
+    },
+    {
+      icon: '',
+      sections: [
+        {
+          componentOptions: {
+            title: 'Deployment settings',
+            description: 'Renseignez la définition du déploiement.',
+            attributes: [
+              {
+                property: 'deployment',
+                componentOptions: {
+                  label: 'Paramètres de déploiement',
+                  name: 'deployment'
+                },
+                component: 'input-json'
+              }
+            ]
+          },
+          component: 'form-section-default'
+        },
+        {
+          componentOptions: {
+            title: 'Tokens de déploiement',
+            description: 'Ces tokens permettent d\'autres applications à accéder à un contenu restreint de cette organisation.Soyez attentif!',
+            attributes: [
+              {
+                componentOptions: {},
+                component: 'handler-tokens'
+              }
+            ],
+            noAction: true
+          },
+          component: 'form-section-default'
+        }
+      ],
+      title: 'Déploiement'
+    },
+    {
+      icon: '',
+      sections: [
+        {
+          componentOptions: {
+            title: 'Configuration de l\'injecteur',
+            description: 'Définissez les différentes pipelines de données ici',
+            attributes: [
+              {
+                property: 'injector',
+                componentOptions: {
+                  label: 'Définition de l\'injecteur',
+                  name: 'injector'
+                },
+                component: 'input-json'
+              }
+            ]
+          },
+          component: 'form-section-default'
+        },
+      ],
+      title: 'Synchronisation des données'
+    }
+  ]
+})
+
+// Prepare computed
+const record = computed(() => $workspaceStore.workspace)
+</script>

package/plugins/01.session.client.ts

@@ -0,0 +1,5 @@
+// Restores the session BEFORE routing (the guard reads its state): one
+// blocking auth.me on boot when a token is present.
+export default defineNuxtPlugin(async () => {
+  await useSession().restore()
+})

package/plugins/02.vue-query.ts

@@ -0,0 +1,25 @@
+import { QueryClient, VueQueryPlugin } from '@tanstack/vue-query'
+
+/**
+ * Query cache — server state lives here, never in a store. Pages talk to the
+ * domain composables only.
+ *
+ * Key convention (prefix invalidation):
+ *   ['definitions'] · ['entries', collectionId] · ['entries', 'byId', id]
+ * A write mutates then invalidates its domain prefix; every view showing it
+ * refreshes without a reload.
+ */
+export default defineNuxtPlugin((nuxtApp) => {
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        // Freshness window, not eviction: data stays cached (gcTime) and is
+        // revalidated on next use once older than this.
+        staleTime: 30_000,
+        retry: 1,
+        refetchOnWindowFocus: false,
+      },
+    },
+  })
+  nuxtApp.vueApp.use(VueQueryPlugin, { queryClient })
+})

package/public/logo-black.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 436.25 186.76"><g id="Calque_2" data-name="Calque 2"><g id="Calque_1-2" data-name="Calque 1"><path d="M0,78.58H16.89q14.6,0,19.63,1.26a21.85,21.85,0,0,1,11.9,7.38q4.59,5.55,4.58,14t-4.49,13.93a22,22,0,0,1-12.39,7.42Q30.33,124,14.54,124H8.47v39.49H0Zm8.47,8.24v28.85l14.43.17q8.64,0,12.67-1.57a13.08,13.08,0,0,0,6.36-5.15,14.56,14.56,0,0,0,0-15.77,12.72,12.72,0,0,0-6.1-5q-3.78-1.49-12.36-1.49Z"/><path d="M98.22,97.93a31.17,31.17,0,0,1,24,10.47,33.74,33.74,0,0,1-.51,45.65q-9.16,9.81-23.53,9.81t-23.55-9.81a33.69,33.69,0,0,1-.49-45.59A31.09,31.09,0,0,1,98.22,97.93Zm0,7.9A23.16,23.16,0,0,0,81,113.27a24.87,24.87,0,0,0-7.21,18A25.83,25.83,0,0,0,77.07,144a23.16,23.16,0,0,0,8.9,9.11,25.43,25.43,0,0,0,24.59,0A23,23,0,0,0,119.4,144a26,26,0,0,0,3.26-12.73,24.87,24.87,0,0,0-7.21-18A23.16,23.16,0,0,0,98.22,105.83Z"/><path d="M144.7,99.53h8.13v29.3q0,10.77,1.14,14.77a16.44,16.44,0,0,0,6.58,9.13,20.13,20.13,0,0,0,11.68,3.35,19.61,19.61,0,0,0,11.45-3.26,16.68,16.68,0,0,0,6.47-8.59q1.24-3.6,1.25-15.4V99.53h8.25v30.85q0,13-3.07,19.55a23.2,23.2,0,0,1-9.12,10.24q-6.08,3.69-15.23,3.69t-15.34-3.69a22.81,22.81,0,0,1-9.16-10.36q-3-6.66-3-20.06Z"/><path d="M216.25,76.75h8.12v87.06h-8.12Z"/><path d="M258.52,101.1a35.52,35.52,0,0,1,14.39-2.94,31,31,0,0,1,22.9,9.61,31.8,31.8,0,0,1,9.5,23.18,32.34,32.34,0,0,1-9.45,23.47,30.6,30.6,0,0,1-22.72,9.67A31.09,31.09,0,0,1,259.35,161a33.81,33.81,0,0,1-11.39-9.3v35h-8V127.29a43.43,43.43,0,0,1,6.18-16.89A36.22,36.22,0,0,1,258.52,101.1Zm-3.92,12.11a25,25,0,0,0-7.22,18.26,25.93,25.93,0,0,0,3.21,12.85,23.37,23.37,0,0,0,9.16,9.1,25.31,25.31,0,0,0,12.59,3.35,24.06,24.06,0,0,0,12.28-3.35,24.57,24.57,0,0,0,9.16-9.45,25.71,25.71,0,0,0,3.4-12.73,25.39,25.39,0,0,0-3.38-12.71,24.63,24.63,0,0,0-9.07-9.3,24.24,24.24,0,0,0-12.5-3.35A23.75,23.75,0,0,0,254.6,113.21Z"/><path d="M401.3,4.32c-37.74-13.13-70.44,5.59-79.08,30.43-3.34,9.26-.69,14.91,2.11,18,5.32,5.88,14.82,6.74,19.87,5.48a14.89,14.89,0,0,0,4-1.73,9.79,9.79,0,0,0,1.15,3.84,7.13,7.13,0,0,0,6.43,3.57c3.73,0,7.56-2,11.54-6a9.2,9.2,0,0,0,.84,2.11,7.81,7.81,0,0,0,7.09,3.84c8.75,0,15.57-10.58,22.16-20.81.94-1.46,1.86-2.89,2.76-4.25,1.77,3.74,3.68,8.52,3.91,11.84a7,7,0,0,1-1.76,5.43,4.81,4.81,0,0,1-2.85,1.63c-2,0-2-.54-2-.94a2,2,0,0,1,.45-.6,3.29,3.29,0,0,0-4.12-5.12,7.7,7.7,0,0,0-2.89,5.6c0,3.52,2.24,7.63,8.57,7.63a11.09,11.09,0,0,0,7.65-3.71,13.62,13.62,0,0,0,3.51-10.36c-.51-7.65-6.92-18.92-7.19-19.4a3.28,3.28,0,0,0-5.5-.31c-2,2.74-4.07,5.92-6.05,9-5.11,7.94-11.48,17.81-16.64,17.81-1.07,0-1.27-.36-1.4-.57-.84-1.46-.43-5.44,1.51-8.83,1.56-2.72,3.09-5.54,4.23-7.68.23-.42.46-.87.69-1.3.55-1,.93-1.77,1.1-2.11a3.94,3.94,0,0,0,.3-.88,3.21,3.21,0,0,0-5.64-2.84,27,27,0,0,0-1.37,2.37c-.18.35-.39.75-.62,1.17-7,13-13.73,20.67-18.27,20.67-.57,0-.65-.14-.74-.29-.83-1.44-.29-5.72,1.65-9.09,3.06-5.35,6.43-11.2,6.43-11.2a4.59,4.59,0,0,0,.24-.59,3.27,3.27,0,0,0-5.9-2.76c-.94,1.56-1.82,3-2.66,4.47-4.56,7.71-7.57,12.8-12.24,14-3.41.85-10.13.09-13.39-3.51-2.33-2.58-2.6-6.41-.79-11.42C336,15.06,365.23-1.27,399.14,10.53c19.65,6.83,35.93,24.11,29,43.92-7.89,22.69-36.71,30.73-61.51,30.73h-1.24a45.27,45.27,0,0,1-8-.79l-.47-.1a11.66,11.66,0,0,0-7.84,1.07L330.2,95.14c5.05-9.58,9-19.17,7.18-23.2A3.36,3.36,0,0,0,333,70.18a3.2,3.2,0,0,0-1.69,4.25c.51,2.92-5.89,16.33-12.19,27a3.28,3.28,0,0,0,2.83,5,3.35,3.35,0,0,0,1.51-.36l28.64-14.86a5.09,5.09,0,0,1,3.42-.47l.63.13a52.64,52.64,0,0,0,9.2.91c27.36.29,59.86-8.78,69-35.14C440.68,38.53,431.33,14.77,401.3,4.32Z"/></g></g></svg>

package/public/logo-white.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 436.25 186.76"><defs><style>.cls-1{fill:#fff;}</style></defs><g id="Calque_2" data-name="Calque 2"><g id="Calque_1-2" data-name="Calque 1"><path class="cls-1" d="M0,78.58H16.89q14.6,0,19.63,1.26a21.85,21.85,0,0,1,11.9,7.38q4.59,5.55,4.58,14t-4.49,13.93a22,22,0,0,1-12.39,7.42Q30.33,124,14.54,124H8.47v39.49H0Zm8.47,8.24v28.85l14.43.17q8.64,0,12.67-1.57a13.08,13.08,0,0,0,6.36-5.15,14.56,14.56,0,0,0,0-15.77,12.72,12.72,0,0,0-6.1-5q-3.78-1.49-12.36-1.49Z"/><path class="cls-1" d="M98.22,97.93a31.17,31.17,0,0,1,24,10.47,33.74,33.74,0,0,1-.51,45.65q-9.16,9.81-23.53,9.81t-23.55-9.81a33.69,33.69,0,0,1-.49-45.59A31.09,31.09,0,0,1,98.22,97.93Zm0,7.9A23.16,23.16,0,0,0,81,113.27a24.87,24.87,0,0,0-7.21,18A25.83,25.83,0,0,0,77.07,144a23.16,23.16,0,0,0,8.9,9.11,25.43,25.43,0,0,0,24.59,0A23,23,0,0,0,119.4,144a26,26,0,0,0,3.26-12.73,24.87,24.87,0,0,0-7.21-18A23.16,23.16,0,0,0,98.22,105.83Z"/><path class="cls-1" d="M144.7,99.53h8.13v29.3q0,10.77,1.14,14.77a16.44,16.44,0,0,0,6.58,9.13,20.13,20.13,0,0,0,11.68,3.35,19.61,19.61,0,0,0,11.45-3.26,16.68,16.68,0,0,0,6.47-8.59q1.24-3.6,1.25-15.4V99.53h8.25v30.85q0,13-3.07,19.55a23.2,23.2,0,0,1-9.12,10.24q-6.08,3.69-15.23,3.69t-15.34-3.69a22.81,22.81,0,0,1-9.16-10.36q-3-6.66-3-20.06Z"/><path class="cls-1" d="M216.25,76.75h8.12v87.06h-8.12Z"/><path class="cls-1" d="M258.52,101.1a35.52,35.52,0,0,1,14.39-2.94,31,31,0,0,1,22.9,9.61,31.8,31.8,0,0,1,9.5,23.18,32.34,32.34,0,0,1-9.45,23.47,30.6,30.6,0,0,1-22.72,9.67A31.09,31.09,0,0,1,259.35,161a33.81,33.81,0,0,1-11.39-9.3v35h-8V127.29a43.43,43.43,0,0,1,6.18-16.89A36.22,36.22,0,0,1,258.52,101.1Zm-3.92,12.11a25,25,0,0,0-7.22,18.26,25.93,25.93,0,0,0,3.21,12.85,23.37,23.37,0,0,0,9.16,9.1,25.31,25.31,0,0,0,12.59,3.35,24.06,24.06,0,0,0,12.28-3.35,24.57,24.57,0,0,0,9.16-9.45,25.71,25.71,0,0,0,3.4-12.73,25.39,25.39,0,0,0-3.38-12.71,24.63,24.63,0,0,0-9.07-9.3,24.24,24.24,0,0,0-12.5-3.35A23.75,23.75,0,0,0,254.6,113.21Z"/><path class="cls-1" d="M401.3,4.32c-37.74-13.13-70.44,5.59-79.08,30.43-3.34,9.26-.69,14.91,2.11,18,5.32,5.88,14.82,6.74,19.87,5.48a14.89,14.89,0,0,0,4-1.73,9.79,9.79,0,0,0,1.15,3.84,7.13,7.13,0,0,0,6.43,3.57c3.73,0,7.56-2,11.54-6a9.2,9.2,0,0,0,.84,2.11,7.81,7.81,0,0,0,7.09,3.84c8.75,0,15.57-10.58,22.16-20.81.94-1.46,1.86-2.89,2.76-4.25,1.77,3.74,3.68,8.52,3.91,11.84a7,7,0,0,1-1.76,5.43,4.81,4.81,0,0,1-2.85,1.63c-2,0-2-.54-2-.94a2,2,0,0,1,.45-.6,3.29,3.29,0,0,0-4.12-5.12,7.7,7.7,0,0,0-2.89,5.6c0,3.52,2.24,7.63,8.57,7.63a11.09,11.09,0,0,0,7.65-3.71,13.62,13.62,0,0,0,3.51-10.36c-.51-7.65-6.92-18.92-7.19-19.4a3.28,3.28,0,0,0-5.5-.31c-2,2.74-4.07,5.92-6.05,9-5.11,7.94-11.48,17.81-16.64,17.81-1.07,0-1.27-.36-1.4-.57-.84-1.46-.43-5.44,1.51-8.83,1.56-2.72,3.09-5.54,4.23-7.68.23-.42.46-.87.69-1.3.55-1,.93-1.77,1.1-2.11a3.94,3.94,0,0,0,.3-.88,3.21,3.21,0,0,0-5.64-2.84,27,27,0,0,0-1.37,2.37c-.18.35-.39.75-.62,1.17-7,13-13.73,20.67-18.27,20.67-.57,0-.65-.14-.74-.29-.83-1.44-.29-5.72,1.65-9.09,3.06-5.35,6.43-11.2,6.43-11.2a4.59,4.59,0,0,0,.24-.59,3.27,3.27,0,0,0-5.9-2.76c-.94,1.56-1.82,3-2.66,4.47-4.56,7.71-7.57,12.8-12.24,14-3.41.85-10.13.09-13.39-3.51-2.33-2.58-2.6-6.41-.79-11.42C336,15.06,365.23-1.27,399.14,10.53c19.65,6.83,35.93,24.11,29,43.92-7.89,22.69-36.71,30.73-61.51,30.73h-1.24a45.27,45.27,0,0,1-8-.79l-.47-.1a11.66,11.66,0,0,0-7.84,1.07L330.2,95.14c5.05-9.58,9-19.17,7.18-23.2A3.36,3.36,0,0,0,333,70.18a3.2,3.2,0,0,0-1.69,4.25c.51,2.92-5.89,16.33-12.19,27a3.28,3.28,0,0,0,2.83,5,3.35,3.35,0,0,0,1.51-.36l28.64-14.86a5.09,5.09,0,0,1,3.42-.47l.63.13a52.64,52.64,0,0,0,9.2.91c27.36.29,59.86-8.78,69-35.14C440.68,38.53,431.33,14.77,401.3,4.32Z"/></g></g></svg>

package/server/api/trpc/[...trpc].ts

@@ -0,0 +1,28 @@
+import { defineEventHandler, toWebRequest } from 'h3';
+import { appRouter } from '@open-commune/core/trpc';
+import type { AuthSession } from '@open-commune/core';
+import { fetchRequestHandler } from '@trpc/server/adapters/fetch';
+import { useCore } from '../../utils/core.ts';
+
+// Mounts the core tRPC router under /api/trpc/*. The context is assembled from
+// what the plugin and the session middleware already attached to the event.
+export default defineEventHandler(async (event) => {
+  return fetchRequestHandler({
+    endpoint: '/api/trpc',
+    req: toWebRequest(event),
+    router: appRouter,
+    createContext: () => ({
+      services: useCore().services,
+      session: (event.context.session as AuthSession | null | undefined) ?? null,
+      requestMeta: {
+        ua: event.node.req.headers['user-agent'] ?? null,
+        ip:
+          (event.node.req.headers['x-forwarded-for'] as string | undefined)
+            ?.split(',')[0]
+            ?.trim() ??
+          event.node.req.socket.remoteAddress ??
+          null,
+      },
+    }),
+  });
+});

package/server/api/v1/content/deployment.get.ts

@@ -0,0 +1,45 @@
+import { createError, defineEventHandler } from 'h3';
+import { useCore } from '../../../utils/core.ts';
+
+/**
+ * Legacy-compatible plane: the payload current site builds consume —
+ * `_theme` (visual identity), `_pages` (page definitions) and `slugs`
+ * (static paths plus every published `/collection/slug`).
+ */
+export default defineEventHandler(async () => {
+  const { organization, collections, media } = useCore().services;
+
+  const settings = await organization.get();
+  if (!settings)
+    throw createError({ statusCode: 404, statusMessage: 'organization not initialized' });
+
+  const deployment = (settings.deployment ?? {}) as {
+    theme?: unknown;
+    definition?: Array<{ path?: string }>;
+    sort?: unknown;
+  };
+  // The theme lives under deployment.theme; older records may still carry it
+  // under settings.theme, hence the fallback below.
+  const theme =
+    deployment.theme ?? (settings.settings as { theme?: unknown } | null)?.theme ?? undefined;
+  const pageSlugs = (deployment.definition ?? [])
+    .map((page) => page.path ?? '')
+    .filter((path) => path && !path.includes(':'));
+
+  return {
+    name: 'success',
+    description: 'Action succeed.',
+    data: {
+      // The organisation's imported identifier, when it has one.
+      _id: (settings.legacyExtra as { legacyId?: string } | null)?.legacyId ?? settings.id,
+      name: settings.name,
+      ...(deployment.sort !== undefined ? { sort: deployment.sort } : {}),
+      // Iso legacy `_parseRecursively` : les chaînes `_media:<id>` de _theme/_pages
+      // sont remplacées par le média signé. Clé OMISE quand le thème est absent
+      // (an organisation may have no deployment.theme at all).
+      ...(theme !== undefined ? { _theme: await media.resolveMediaPlaceholders(theme) } : {}),
+      _pages: await media.resolveMediaPlaceholders(deployment.definition ?? []),
+      slugs: [...pageSlugs, ...(await collections.publishedSlugs())],
+    },
+  };
+});

package/server/api/v1/content/records.get.ts

@@ -0,0 +1,12 @@
+import { defineEventHandler } from 'h3';
+import { useCore } from '../../../utils/core.ts';
+
+/**
+ * Legacy-compatible plane: the current site builds call this exact path.
+ * Flat map of published entries keyed by id, media resolved, wrapped in the
+ * `{ name, description, data }` envelope those clients expect.
+ */
+export default defineEventHandler(async () => {
+  const records = await useCore().services.collections.legacyRecordsPayload();
+  return { name: 'success', description: 'Action succeed.', data: { records } };
+});

package/server/middleware/0.security.ts

@@ -0,0 +1,19 @@
+import { randomUUID } from 'node:crypto';
+import { defineEventHandler, getRequestHeader, setResponseHeader } from 'h3';
+
+/**
+ * First middleware in the chain: correlation id and baseline security headers.
+ * Rate limiting belongs to the reverse proxy, not here.
+ */
+export default defineEventHandler((event) => {
+  const requestId = getRequestHeader(event, 'x-request-id') ?? randomUUID();
+  setResponseHeader(event, 'x-request-id', requestId);
+
+  setResponseHeader(event, 'x-content-type-options', 'nosniff');
+  setResponseHeader(event, 'x-frame-options', 'DENY');
+  setResponseHeader(event, 'referrer-policy', 'no-referrer');
+  // HSTS only behind TLS — never over plain http in dev.
+  if (getRequestHeader(event, 'x-forwarded-proto') === 'https') {
+    setResponseHeader(event, 'strict-transport-security', 'max-age=31536000; includeSubDomains');
+  }
+});

package/server/middleware/1.cors.ts

@@ -0,0 +1,31 @@
+import { defineEventHandler, handleCors } from 'h3';
+
+/**
+ * Any origin is allowed: auth is a Bearer header, never a cookie, so a browser
+ * never attaches credentials on its own.
+ *
+ * The origin is REFLECTED rather than wildcarded — browsers reject
+ * `Access-Control-Allow-Origin: *` on credentialed requests, and nuxt-auth
+ * sends `credentials: 'include'`.
+ */
+export default defineEventHandler((event) => {
+  // h3 v1: returns true when it has answered the preflight itself.
+  if (
+    handleCors(event, {
+      origin: () => true,
+      credentials: true,
+      methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+      allowHeaders: [
+        'Content-Type',
+        'Authorization',
+        'x-trpc-source',
+        'x-trpc-batch-mode',
+        'Accept',
+        'trpc-accept',
+      ],
+      maxAge: '600',
+    })
+  ) {
+    return;
+  }
+});

package/server/middleware/2.session.ts

@@ -0,0 +1,20 @@
+import { defineEventHandler, getRequestHeader } from 'h3';
+import { useCore } from '../utils/core.ts';
+
+/**
+ * Session resolution. Middlewares are numbered because order matters.
+ *
+ * Auth travels as a Bearer token, never a cookie, and is verified against the
+ * database on every request. Handlers read `event.context.session`.
+ */
+function readSessionToken(authorization: string): string | null {
+  if (!authorization.startsWith('Bearer ')) return null;
+  const token = authorization.slice('Bearer '.length);
+  // API tokens (commun_ prefix) belong to the content plane, not to sessions.
+  return token.startsWith('commun_') ? null : token;
+}
+
+export default defineEventHandler(async (event) => {
+  const token = readSessionToken(getRequestHeader(event, 'authorization') ?? '');
+  event.context.session = token ? await useCore().services.users.verifySession(token) : null;
+});

package/server/middleware/3.api-token.ts

@@ -0,0 +1,20 @@
+import { createError, defineEventHandler, getRequestHeader, getRequestURL } from 'h3';
+import { useCore } from '../utils/core.ts';
+
+/**
+ * API-token guard of the public content plane; runs after `2.session`.
+ *
+ * Accepts both `Authorization: Bearer <token>` and the bare
+ * `Authorization: <token>` form that existing site builds send.
+ */
+const GUARDED_PATHS = new Set(['/api/v1/content/records', '/api/v1/content/deployment']);
+
+export default defineEventHandler(async (event) => {
+  if (!GUARDED_PATHS.has(getRequestURL(event).pathname)) return;
+
+  const auth = getRequestHeader(event, 'authorization') ?? '';
+  const token = auth.startsWith('Bearer ') ? auth.slice('Bearer '.length) : auth;
+  if (!token || !(await useCore().services.users.verifyApiToken(token))) {
+    throw createError({ statusCode: 401, statusMessage: 'missing or invalid API token' });
+  }
+});

package/server/plugins/core.ts

@@ -0,0 +1,8 @@
+import { defineNitroPlugin } from 'nitropack/runtime';
+import { useCore } from '../utils/core.ts';
+
+/** Instantiate the Core at server START, so migrations and config validation
+ * run at boot rather than on the first request. */
+export default defineNitroPlugin(() => {
+  useCore();
+});

package/server/routes/_tasks/[name].post.ts

@@ -0,0 +1,20 @@
+import { createError, defineEventHandler, getRouterParam } from 'h3';
+import { runTask } from 'nitropack/runtime';
+
+/**
+ * Runs a Nitro task over HTTP, for the E2E suite only: Nitro's own task
+ * endpoint exists in the dev preset, and the suite boots the production bundle.
+ *
+ * DEAD unless COMMUN_TASKS_HTTP=1, which only the E2E harness sets — never the
+ * Docker image, the CI smoke test, or a deployed instance.
+ */
+export default defineEventHandler(async (event) => {
+  if (process.env.COMMUN_TASKS_HTTP !== '1') {
+    throw createError({ statusCode: 404 });
+  }
+  const name = getRouterParam(event, 'name');
+  if (!name) {
+    throw createError({ statusCode: 400, statusMessage: 'missing task name' });
+  }
+  return runTask(name);
+});

package/server/routes/health.get.ts

@@ -0,0 +1,6 @@
+import { defineEventHandler } from 'h3';
+import { useCore } from '../utils/core.ts';
+
+// Returns the HealthStatus DTO from @open-commune/core untouched (review: no
+// object rebuilding in the transport layer).
+export default defineEventHandler(() => useCore().services.health.check());