@orion-studios/cms 0.5.4 → 0.5.6

package/dist/studio/index.d.ts

@@ -2,7 +2,7 @@ import * as react from 'react';
 import { ComponentType, InputHTMLAttributes } from 'react';
 import { z } from 'zod';
 import { SupabaseClient, Session } from '@supabase/supabase-js';
-import { F as FormConfig, a as FormNotifyConfig } from '../submission-CzrfXu17.js';
+import { F as FormConfig, a as FormNotifyConfig } from '../submission-CKZgx1h7.js';
 
 /**
  * Editor field derivation: turns a block's Zod schema into a default editor
@@ -395,7 +395,6 @@ declare function createStudioApi(options: {
         success: true;
     }>;
     previewToken: (id: string) => Promise<{
-        token: string;
         path: string;
         url: string;
     }>;

package/dist/studio/index.js

@@ -2,8 +2,9 @@
 "use client";
 import {
   FORM_FIELD_TYPES,
-  FormRenderer
-} from "../chunk-WQDHEQDE.js";
+  FormRenderer,
+  getAutoReplyEmailFields
+} from "../chunk-ULE565KD.js";
 
 // src/studio/Studio.tsx
 import { useCallback as useCallback5, useEffect as useEffect11, useMemo as useMemo5, useState as useState12 } from "react";
@@ -988,6 +989,7 @@ function FormEditor({
   const [notifyEmails, setNotifyEmails] = useState5("");
   const [notifySubject, setNotifySubject] = useState5("");
   const [autoReply, setAutoReply] = useState5(false);
+  const [autoReplyEmailField, setAutoReplyEmailField] = useState5("");
   const [dirty, setDirty] = useState5(false);
   const [message, setMessage] = useState5("");
   const [error, setError] = useState5("");
@@ -1005,6 +1007,10 @@ function FormEditor({
       setNotifyEmails((notify.emails || []).join(", "));
       setNotifySubject(notify.subject || "");
       setAutoReply(notify.autoReply === true);
+      const emailFields = getAutoReplyEmailFields(loadedConfig);
+      setAutoReplyEmailField(
+        notify.autoReplyEmailField && emailFields.includes(notify.autoReplyEmailField) ? notify.autoReplyEmailField : emailFields.length === 1 ? emailFields[0] : ""
+      );
     }, (e) => setError(e.message));
   }, [api, slug]);
   const touch = () => {
@@ -1027,6 +1033,12 @@ function FormEditor({
   const save = async () => {
     setError("");
     const emails = notifyEmails.split(/[,\s]+/).map((entry) => entry.trim()).filter(Boolean);
+    const emailFields = getAutoReplyEmailFields(config);
+    const selectedEmailField = emailFields.includes(autoReplyEmailField) ? autoReplyEmailField : emailFields.length === 1 ? emailFields[0] : "";
+    if (autoReply && !selectedEmailField) {
+      setError("Choose one declared email field before enabling auto-reply.");
+      return;
+    }
     try {
       const { form: saved } = await api.updateForm(slug, {
         title,
@@ -1034,7 +1046,8 @@ function FormEditor({
         notify: {
           emails,
           ...notifySubject.trim() ? { subject: notifySubject.trim() } : {},
-          autoReply
+          autoReply,
+          ...autoReply && selectedEmailField ? { autoReplyEmailField: selectedEmailField } : {}
         },
         successMessage
       });
@@ -1048,6 +1061,8 @@ function FormEditor({
   if (!form && !error) return /* @__PURE__ */ jsx5("div", { className: "ost-loading", children: "Loading form\u2026" });
   if (error && !form) return /* @__PURE__ */ jsx5("div", { className: "ost-error", children: error });
   const steps = config.steps || [];
+  const autoReplyEmailFields = getAutoReplyEmailFields(config);
+  const selectedAutoReplyEmailField = autoReplyEmailFields.includes(autoReplyEmailField) ? autoReplyEmailField : autoReplyEmailFields.length === 1 ? autoReplyEmailFields[0] : "";
   return /* @__PURE__ */ jsxs5("div", { className: "ost-view ost-view-wide", children: [
     /* @__PURE__ */ jsxs5("header", { className: "ost-view-header", children: [
       /* @__PURE__ */ jsxs5("div", { className: "ost-row", children: [
@@ -1212,7 +1227,26 @@ function FormEditor({
             ),
             "Auto-reply to the submitter with the success message"
           ] }),
-          /* @__PURE__ */ jsx5("p", { className: "ost-muted", children: "Requires the site's email sending to be configured (RESEND_API_KEY)." })
+          autoReply ? /* @__PURE__ */ jsxs5("label", { className: "ost-label", children: [
+            "Auto-reply email field",
+            /* @__PURE__ */ jsxs5(
+              "select",
+              {
+                className: "ost-input",
+                disabled: !canWrite || autoReplyEmailFields.length === 0,
+                onChange: (event) => {
+                  setAutoReplyEmailField(event.target.value);
+                  touch();
+                },
+                value: selectedAutoReplyEmailField,
+                children: [
+                  autoReplyEmailFields.length !== 1 ? /* @__PURE__ */ jsx5("option", { value: "", children: "Choose an email field" }) : null,
+                  autoReplyEmailFields.map((fieldName) => /* @__PURE__ */ jsx5("option", { value: fieldName, children: fieldName }, fieldName))
+                ]
+              }
+            )
+          ] }) : null,
+          /* @__PURE__ */ jsx5("p", { className: "ost-muted", children: "Auto-reply requires a declared email field and configured email sending (RESEND_API_KEY)." })
         ] })
       ] }),
       /* @__PURE__ */ jsxs5("div", { className: "ost-form-preview", children: [
@@ -2225,7 +2259,7 @@ function PageEditor({
     setBusy("preview");
     try {
       const { url } = await api.previewToken(pageId);
-      window.open(url, "_blank", "noopener");
+      window.open(url, "_blank", "noopener,noreferrer");
     } catch (previewError) {
       setError(previewError instanceof Error ? previewError.message : "Preview failed.");
     } finally {
@@ -3379,7 +3413,7 @@ function MediaView({
           /* @__PURE__ */ jsx11(
             "input",
             {
-              accept: "image/*,application/pdf",
+              accept: "image/jpeg,image/png,image/webp,image/gif,image/avif",
               hidden: true,
               onChange: async (event) => {
                 const file = event.currentTarget.files?.[0];
@@ -3493,12 +3527,12 @@ function MediaDetail({
           children: saving ? "Saving\u2026" : "Save details"
         }
       ),
-      canReplace ? /* @__PURE__ */ jsxs11("label", { className: "ost-btn", title: "The new file keeps every existing reference. CDN caching can take up to an hour to show the new version everywhere.", children: [
+      canReplace && media.mime_type.startsWith("image/") ? /* @__PURE__ */ jsxs11("label", { className: "ost-btn", title: "The new file keeps every existing reference. CDN caching can take up to an hour to show the new version everywhere.", children: [
         replacing ? "Replacing\u2026" : "Replace file",
         /* @__PURE__ */ jsx11(
           "input",
           {
-            accept: media.mime_type.startsWith("image/") ? "image/*" : "application/pdf",
+            accept: "image/jpeg,image/png,image/webp,image/gif,image/avif",
             hidden: true,
             onChange: async (event) => {
               const file = event.currentTarget.files?.[0];

package/dist/{submission-BKdBedOe.d.ts → submission-CGz0lElf.d.ts}

@@ -24,6 +24,8 @@ type FormNotifyConfig = {
     subject?: string;
     /** Send the success message back to the submitter's email field. */
     autoReply?: boolean;
+    /** Declared email field used for staff reply-to and auto-replies. */
+    autoReplyEmailField?: string;
 };
 type FormConfig = {
     steps?: Array<{
@@ -33,12 +35,19 @@ type FormConfig = {
     notify?: FormNotifyConfig;
 };
 type RateLimitStore = {
-    isLimited(key: string, now: number): boolean | Promise<boolean>;
+    isLimited(key: string, now: number, cost?: number): boolean | Promise<boolean>;
 };
 declare function createMemoryRateLimitStore(options?: {
     max?: number;
     windowMs?: number;
 }): RateLimitStore;
+/**
+ * Returns unambiguous declared email fields in form order. A repeated name is
+ * eligible only when every declaration for that name is an email field.
+ */
+declare function getAutoReplyEmailFields(config: FormConfig): string[];
+/** Resolves the one declared field that may control submission email delivery. */
+declare function resolveAutoReplyEmailField(config: FormConfig): string | null;
 type ProcessSubmissionArgs = {
     config: FormConfig;
     data: Record<string, unknown>;
@@ -58,4 +67,4 @@ type ProcessSubmissionResult = {
 };
 declare function processSubmission(args: ProcessSubmissionArgs): ProcessSubmissionResult;
 
-export { type FormConfig as F, HONEYPOT_FIELD_NAME as H, type ProcessSubmissionArgs as P, type RateLimitStore as R, type FormFieldConfig as a, type FormNotifyConfig as b, type ProcessSubmissionResult as c, createMemoryRateLimitStore as d, processSubmission as p };
+export { type FormConfig as F, HONEYPOT_FIELD_NAME as H, type ProcessSubmissionArgs as P, type RateLimitStore as R, type FormFieldConfig as a, type FormNotifyConfig as b, type ProcessSubmissionResult as c, createMemoryRateLimitStore as d, getAutoReplyEmailFields as g, processSubmission as p, resolveAutoReplyEmailField as r };

package/dist/{submission-CzrfXu17.d.ts → submission-CKZgx1h7.d.ts}

@@ -18,6 +18,8 @@ type FormNotifyConfig = {
     subject?: string;
     /** Send the success message back to the submitter's email field. */
     autoReply?: boolean;
+    /** Declared email field used for staff reply-to and auto-replies. */
+    autoReplyEmailField?: string;
 };
 type FormConfig = {
     steps?: Array<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-studios/cms",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "Orion CMS v2 core engine \u2014 JSONB content model on Supabase primitives",
   "type": "module",
   "exports": {
@@ -56,6 +56,7 @@
   "dependencies": {
     "@supabase/ssr": "^0.7.0",
     "@supabase/supabase-js": "^2.58.0",
+    "sharp": "^0.35.3",
     "zod": "^3.25.0"
   },
   "peerDependencies": {

package/sql/bootstrap.sql

@@ -244,7 +244,10 @@ create table if not exists cms_forms (
 -- public form renderer needs the field list), notify addresses are not.
 alter table cms_forms add column if not exists notify jsonb not null default '{}'::jsonb;
 update cms_forms
-  set notify = coalesce(config->'notify', '{}'::jsonb),
+  set notify = case
+        when jsonb_typeof(notify) = 'object' and notify <> '{}'::jsonb then notify
+        else coalesce(config->'notify', '{}'::jsonb)
+      end,
       config = config - 'notify'
   where config ? 'notify';
 
@@ -301,8 +304,10 @@ create table if not exists cms_events (
   region text not null default '',
   city text not null default '',
   meta jsonb not null default '{}'::jsonb,
+  server_verified boolean not null default false,
   created_at timestamptz not null default now()
 );
+alter table cms_events add column if not exists server_verified boolean not null default false;
 create index if not exists cms_events_day_idx on cms_events (created_at desc);
 create index if not exists cms_events_session_idx on cms_events (session_key, created_at);
 create index if not exists cms_events_visitor_idx on cms_events (visitor_key, created_at)
@@ -700,7 +705,8 @@ $$;
 create or replace function cms_rate_limit_consume(
   p_key text,
   p_max integer,
-  p_window_seconds integer
+  p_window_seconds integer,
+  p_cost integer
 ) returns boolean
 language plpgsql
 security definer
@@ -709,13 +715,23 @@ as $$
 declare
   v_count integer;
 begin
+  if p_key is null or length(p_key) < 1 or length(p_key) > 256
+     or p_max < 1 or p_max > 1000000
+     or p_window_seconds < 1 or p_window_seconds > 604800
+     or p_cost < 1 or p_cost > p_max then
+    return false;
+  end if;
+
   insert into cms_rate_limits (key, window_start, count)
-  values (p_key, now(), 1)
+  values (p_key, now(), p_cost)
   on conflict (key) do update
     set count = case
           when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
-          then 1
-          else cms_rate_limits.count + 1
+          then p_cost
+          else least(
+            (p_max + 1)::bigint,
+            cms_rate_limits.count::bigint + p_cost::bigint
+          )::integer
         end,
         window_start = case
           when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
@@ -728,6 +744,35 @@ begin
 end;
 $$;
 
+create or replace function cms_rate_limit_consume(
+  p_key text,
+  p_max integer,
+  p_window_seconds integer
+) returns boolean
+language sql
+security definer
+set search_path = public
+as $$
+  select cms_rate_limit_consume(p_key, p_max, p_window_seconds, 1);
+$$;
+
+create or replace function cms_prune_rate_limits(
+  p_before timestamptz
+) returns bigint
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_deleted bigint;
+begin
+  delete from cms_rate_limits
+  where window_start < p_before;
+  get diagnostics v_deleted = row_count;
+  return v_deleted;
+end;
+$$;
+
 create or replace function cms_update_global(
   p_key text,
   p_data jsonb,
@@ -789,8 +834,6 @@ create policy cms_globals_public_read on cms_globals
   for select using (true);
 
 drop policy if exists cms_media_public_read on cms_media;
-create policy cms_media_public_read on cms_media
-  for select using (true);
 
 drop policy if exists cms_forms_public_read on cms_forms;
 create policy cms_forms_public_read on cms_forms
@@ -830,6 +873,8 @@ declare
     'cms_sync_page(text, text, text, jsonb, jsonb)',
     'cms_publish_due_pages()',
     'cms_rate_limit_consume(text, integer, integer)',
+    'cms_rate_limit_consume(text, integer, integer, integer)',
+    'cms_prune_rate_limits(timestamptz)',
     'cms_update_global(text, jsonb, uuid)'
   ];
 begin
@@ -853,6 +898,9 @@ end $fn_lockdown$;
 -- site-specific role, the PostgREST roles get nothing — so grant explicitly.
 -- Wrapped per-role so bootstrap also works on plain Postgres (dev/tests).
 revoke update, delete on cms_page_versions from public;
+revoke select on cms_forms from public;
+revoke select (notify) on cms_forms from public;
+revoke select on cms_media from public;
 do $grants$
 begin
   if exists (select 1 from pg_roles where rolname = 'service_role') then
@@ -868,22 +916,26 @@ begin
   -- cms_pages and cms_forms get column-level read grants. Anonymous readers
   -- see published page state only and never form notification addresses.
   if exists (select 1 from pg_roles where rolname = 'anon') then
-    grant select on cms_globals, cms_media, cms_redirects to anon;
+    grant select on cms_globals, cms_redirects to anon;
+    revoke select on cms_media from anon;
     revoke select on cms_pages from anon;
     grant select (id, slug, path, published_title, published_seo, status, published_layout, published_at, created_at, updated_at)
       on cms_pages to anon;
     revoke all on cms_page_versions from anon;
     revoke select on cms_forms from anon;
+    revoke select (notify) on cms_forms from anon;
     grant select (id, slug, title, config, success_message, created_at, updated_at)
       on cms_forms to anon;
   end if;
   if exists (select 1 from pg_roles where rolname = 'authenticated') then
-    grant select on cms_globals, cms_media, cms_profiles, cms_redirects to authenticated;
+    grant select on cms_globals, cms_profiles, cms_redirects to authenticated;
+    revoke select on cms_media from authenticated;
     revoke select on cms_pages from authenticated;
     grant select (id, slug, path, published_title, published_seo, status, published_layout, published_at, created_at, updated_at)
       on cms_pages to authenticated;
     revoke all on cms_page_versions from authenticated;
     revoke select on cms_forms from authenticated;
+    revoke select (notify) on cms_forms from authenticated;
     grant select (id, slug, title, config, success_message, created_at, updated_at)
       on cms_forms to authenticated;
   end if;

package/sql/migrations/20260827164127_sec_014_form_notify_privacy.sql

@@ -0,0 +1,41 @@
+-- SEC-014: move legacy notification settings out of public form config.
+
+alter table cms_forms
+  add column if not exists notify jsonb not null default '{}'::jsonb;
+
+-- Current private settings remain authoritative when both representations
+-- exist. Older rows without private settings inherit the legacy value.
+update cms_forms
+set notify = case
+      when jsonb_typeof(notify) = 'object' and notify <> '{}'::jsonb then notify
+      else coalesce(config->'notify', '{}'::jsonb)
+    end,
+    config = config - 'notify'
+where config ? 'notify';
+
+-- RLS limits rows, while column grants keep notification settings out of the
+-- public form definition returned by the Supabase Data API.
+revoke select on cms_forms from public;
+revoke select (notify) on cms_forms from public;
+
+do $form_grants$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke select on cms_forms from anon;
+    revoke select (notify) on cms_forms from anon;
+    grant select (id, slug, title, config, success_message, created_at, updated_at)
+      on cms_forms to anon;
+  end if;
+
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke select on cms_forms from authenticated;
+    revoke select (notify) on cms_forms from authenticated;
+    grant select (id, slug, title, config, success_message, created_at, updated_at)
+      on cms_forms to authenticated;
+  end if;
+
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant select, insert, update, delete on cms_forms to service_role;
+  end if;
+end
+$form_grants$;

package/sql/migrations/20260827172120_sec_015_analytics_ingest_limits.sql

@@ -0,0 +1,101 @@
+-- Bound public analytics storage by accepted event count and separate
+-- server-verified conversions from forgeable browser observations.
+
+alter table cms_events
+  add column if not exists server_verified boolean not null default false;
+
+create or replace function cms_rate_limit_consume(
+  p_key text,
+  p_max integer,
+  p_window_seconds integer,
+  p_cost integer
+) returns boolean
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_count integer;
+begin
+  if p_key is null or length(p_key) < 1 or length(p_key) > 256
+     or p_max < 1 or p_max > 1000000
+     or p_window_seconds < 1 or p_window_seconds > 604800
+     or p_cost < 1 or p_cost > p_max then
+    return false;
+  end if;
+
+  insert into cms_rate_limits (key, window_start, count)
+  values (p_key, now(), p_cost)
+  on conflict (key) do update
+    set count = case
+          when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
+          then p_cost
+          else least(
+            (p_max + 1)::bigint,
+            cms_rate_limits.count::bigint + p_cost::bigint
+          )::integer
+        end,
+        window_start = case
+          when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
+          then now()
+          else cms_rate_limits.window_start
+        end
+  returning count into v_count;
+
+  return v_count <= p_max;
+end;
+$$;
+
+-- Preserve the existing form-submission caller while new analytics callers
+-- use the weighted overload.
+create or replace function cms_rate_limit_consume(
+  p_key text,
+  p_max integer,
+  p_window_seconds integer
+) returns boolean
+language sql
+security definer
+set search_path = public
+as $$
+  select cms_rate_limit_consume(p_key, p_max, p_window_seconds, 1);
+$$;
+
+create or replace function cms_prune_rate_limits(
+  p_before timestamptz
+) returns bigint
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_deleted bigint;
+begin
+  delete from cms_rate_limits
+  where window_start < p_before;
+  get diagnostics v_deleted = row_count;
+  return v_deleted;
+end;
+$$;
+
+revoke execute on function cms_rate_limit_consume(text, integer, integer) from public;
+revoke execute on function cms_rate_limit_consume(text, integer, integer, integer) from public;
+revoke execute on function cms_prune_rate_limits(timestamptz) from public;
+
+do $lockdown$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke execute on function cms_rate_limit_consume(text, integer, integer) from anon;
+    revoke execute on function cms_rate_limit_consume(text, integer, integer, integer) from anon;
+    revoke execute on function cms_prune_rate_limits(timestamptz) from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke execute on function cms_rate_limit_consume(text, integer, integer) from authenticated;
+    revoke execute on function cms_rate_limit_consume(text, integer, integer, integer) from authenticated;
+    revoke execute on function cms_prune_rate_limits(timestamptz) from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant execute on function cms_rate_limit_consume(text, integer, integer) to service_role;
+    grant execute on function cms_rate_limit_consume(text, integer, integer, integer) to service_role;
+    grant execute on function cms_prune_rate_limits(timestamptz) to service_role;
+  end if;
+end $lockdown$;

package/sql/migrations/20260827232146_sec_016_media_privacy.sql

@@ -0,0 +1,21 @@
+-- SEC-016: keep unused and draft media metadata out of public enumeration.
+-- Published layouts already carry the storage paths needed by public pages.
+
+drop policy if exists cms_media_public_read on cms_media;
+revoke select on cms_media from public;
+
+do $media_grants$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke select on cms_media from anon;
+  end if;
+
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke select on cms_media from authenticated;
+  end if;
+
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant select, insert, update, delete on cms_media to service_role;
+  end if;
+end
+$media_grants$;