@orthacms/content-server 0.0.0-reserve.0

package/dist/lib/collection/table-builder.js

@@ -0,0 +1,306 @@
+"use strict";
+/**
+ * Turns a field map into physical Drizzle tables. One table per content
+ * type (`content_<name>`), plus one join table per many-relation
+ * (`content_<name>_<field>`). The HOST re-exports these from its
+ * drizzle-kit schema entry, so collection changes become ordinary
+ * committed migrations — exactly like any plugin-owned schema.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snakeCase = snakeCase;
+exports.buildTables = buildTables;
+const drizzle_orm_1 = require("drizzle-orm");
+const pg_core_1 = require("drizzle-orm/pg-core");
+const fields_1 = require("../types/fields");
+const content_type_1 = require("../types/content-type");
+/** camelCase / kebab-case → snake_case column-safe identifier. */
+function snakeCase(value) {
+    return value
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .replace(/[^a-zA-Z0-9]+/g, '_')
+        .toLowerCase();
+}
+/**
+ * The `id` column of a generated table. Generated tables are built from a
+ * dynamic column record, so their columns aren't statically typed — but the
+ * envelope guarantees `id` exists on every one of them.
+ */
+function idColumnOf(table) {
+    return table.id;
+}
+/**
+ * Builds the column for one (non-many-relation) field.
+ *
+ * `enforceRequired` decides the NOT NULL constraint: a **non-publishable** type
+ * is always live, so a required field is `NOT NULL`. A **publishable** type has
+ * a draft stage where a required field may legitimately be empty — "required"
+ * means "required *to publish*", enforced by `EntryValidationService` at publish
+ * time, not the column. So a publishable type's columns stay nullable even when
+ * the field is required.
+ */
+function columnFor(fieldName, spec, enforceRequired, i18n) {
+    const col = snakeCase(fieldName);
+    let builder;
+    switch (spec.type) {
+        case fields_1.CONTENT_FIELD_TYPE.Text:
+        case fields_1.CONTENT_FIELD_TYPE.Select:
+            builder = (0, pg_core_1.text)(col);
+            break;
+        case fields_1.CONTENT_FIELD_TYPE.RichText:
+            // A structured document (the editor's node tree), not an HTML
+            // string — which is what makes a body's heading order, table
+            // headers and language markers checkable rather than opaque.
+            // A body written before that change is a JSON *string* in the same
+            // column, so nothing had to be rewritten to migrate: `jsonb` holds
+            // both, and both read back as a valid `richtext` value.
+            builder = (0, pg_core_1.jsonb)(col);
+            break;
+        case fields_1.CONTENT_FIELD_TYPE.Number:
+            builder = spec.validation.integer
+                ? (0, pg_core_1.integer)(col)
+                : (0, pg_core_1.doublePrecision)(col);
+            break;
+        case fields_1.CONTENT_FIELD_TYPE.Money:
+            // integer minor units — exact arithmetic, no float drift
+            builder = (0, pg_core_1.integer)(col);
+            break;
+        case fields_1.CONTENT_FIELD_TYPE.Boolean:
+            // A required boolean defaults to false so an omitted value is a
+            // concrete `false` rather than a NOT NULL violation. The default is
+            // useful regardless of whether NOT NULL is ultimately enforced.
+            builder = spec.required
+                ? (0, pg_core_1.boolean)(col).default(false)
+                : (0, pg_core_1.boolean)(col);
+            break;
+        case fields_1.CONTENT_FIELD_TYPE.Date:
+            builder = (0, pg_core_1.date)(col);
+            break;
+        case fields_1.CONTENT_FIELD_TYPE.Datetime:
+            builder = (0, pg_core_1.timestamp)(col, { withTimezone: true });
+            break;
+        case fields_1.CONTENT_FIELD_TYPE.Json:
+        case fields_1.CONTENT_FIELD_TYPE.Multiselect:
+            builder = (0, pg_core_1.jsonb)(col);
+            break;
+        case fields_1.CONTENT_FIELD_TYPE.Media:
+            // A media reference is an asset id (or an ordered list of them).
+            // No FK — the assets live in the media plugin's schema, which this
+            // package can't reference (same convention as `workspace_id`);
+            // existence + the `accept` restriction are enforced in the app layer.
+            builder = spec.multiple ? (0, pg_core_1.jsonb)(col) : (0, pg_core_1.uuid)(col);
+            break;
+        case fields_1.CONTENT_FIELD_TYPE.Relation: {
+            // An inverse (back-reference) owns no storage — it reuses the owning
+            // side's column/join table.
+            if (spec.relation?.inverse)
+                return null;
+            if (spec.relation?.many)
+                return null; // join table instead
+            // Lazy reference: the thunk resolves at query/diff time, so
+            // mutually-referencing collections can import each other.
+            builder = (0, pg_core_1.uuid)(`${col}_id`).references(() => idColumnOf(spec.relation.to().table), { onDelete: spec.relation.onDelete });
+            // One-to-one: at most one owner may point at a given target.
+            // Nullable-unique — Postgres allows many NULLs, so owners with no
+            // relation don't collide.
+            //
+            // On an **i18n** type the constraint is per-locale instead, and is
+            // emitted as a composite index below rather than here: a localized
+            // record is N rows, one per language, so a column-wide UNIQUE would
+            // read "one *row* may point at this target" when what the model
+            // means is "one *record* may". The English and German rows of one
+            // article legitimately share an SEO record; two different articles
+            // must not.
+            if (spec.relation.unique && !i18n)
+                builder = builder.unique();
+            break;
+        }
+    }
+    return enforceRequired && spec.required ? builder.notNull() : builder;
+}
+/** Builds the main table + join tables for a content type. */
+function buildTables(typeName, fields, meta = {}) {
+    const tableName = `content_${snakeCase(typeName)}`;
+    const columns = {
+        /** Primary key. */
+        id: (0, pg_core_1.uuid)('id').primaryKey().defaultRandom(),
+        /**
+         * Owning workspace. Stamped on create and filtered on every read/write
+         * by the entries services (scoped via `WorkspaceGuard`'s `X-Workspace-Id`
+         * header), so entries never cross workspaces. Plain uuid, no FK — the
+         * `workspaces` table lives in the identity plugin's schema, which this
+         * package can't reference; isolation is enforced in the app layer.
+         */
+        workspaceId: (0, pg_core_1.uuid)('workspace_id'),
+        /** Row creation timestamp. */
+        createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true })
+            .notNull()
+            .defaultNow(),
+        /** Last update timestamp (the service layer refreshes it). */
+        updatedAt: (0, pg_core_1.timestamp)('updated_at', { withTimezone: true })
+            .notNull()
+            .defaultNow()
+    };
+    // Publish workflow is opt-in: only a `publishable` type carries a
+    // draft/published `status` and the `published_at` stamp — two halves of
+    // the same concept. A non-publishable type has no publish state; every row
+    // is simply live. `published_at` is nullable with no default (null = "not
+    // yet published"; the service layer stamps it).
+    if (meta.publishable) {
+        columns['status'] = (0, pg_core_1.text)('status', {
+            enum: [content_type_1.ENTRY_STATUS.Draft, content_type_1.ENTRY_STATUS.Published]
+        })
+            .notNull()
+            .default(content_type_1.ENTRY_STATUS.Draft);
+        columns['publishedAt'] = (0, pg_core_1.timestamp)('published_at', {
+            withTimezone: true
+        });
+    }
+    // Soft delete: nullable `deleted_at` (null = "not deleted"; service stamps it).
+    if (meta.paranoid) {
+        columns['deletedAt'] = (0, pg_core_1.timestamp)('deleted_at', { withTimezone: true });
+    }
+    // Row-per-locale: each locale of an entry is a full row; siblings share a
+    // `locale_group_id`. The group id defaults to a fresh uuid so a plain
+    // create starts its own translation group — linking into an existing group
+    // (translation creation) sets it explicitly. The slug's meaning (allowed
+    // values, the default) is owned by the bound localization plugin.
+    if (meta.i18n) {
+        columns['locale'] = (0, pg_core_1.text)('locale').notNull();
+        columns['localeGroupId'] = (0, pg_core_1.uuid)('locale_group_id')
+            .notNull()
+            .defaultRandom();
+    }
+    // Publishable types keep required columns nullable (a draft may be
+    // incomplete; publish enforces requiredness). Non-publishable types are
+    // always live, so a required field is NOT NULL.
+    const enforceRequired = !meta.publishable;
+    for (const [fieldName, spec] of Object.entries(fields)) {
+        const column = columnFor(fieldName, spec, enforceRequired, !!meta.i18n);
+        if (column)
+            columns[fieldName] = column;
+    }
+    const table = (0, pg_core_1.pgTable)(tableName, columns, (t) => {
+        const cols = t;
+        // Every list view filters by workspace; i18n types also filter by
+        // locale, and publishable types by status — fold each into the list
+        // index only where the column exists.
+        const listColumns = [
+            cols['workspaceId'],
+            ...(meta.i18n ? [cols['locale']] : []),
+            ...(meta.publishable ? [cols['status']] : [])
+        ];
+        const listIndexName = meta.i18n
+            ? `${tableName}_workspace_locale_idx`
+            : meta.publishable
+                ? `${tableName}_workspace_status_idx`
+                : `${tableName}_workspace_idx`;
+        const indexes = [
+            (0, pg_core_1.index)(listIndexName).on(listColumns[0], ...listColumns.slice(1))
+        ];
+        // Each owning single relation's FK. The *inverse* of such a relation is
+        // read by filtering this column (`inArray(fk, sourceIds)` in
+        // `RelationLinkService.previewInverse`), which the records table now
+        // runs for a whole page on every render — unindexed that is a sequential
+        // scan of the collection per keystroke, sort click and page change.
+        // `unique: true` already implies an index, so skip those.
+        for (const [fieldName, spec] of Object.entries(fields)) {
+            if (spec.type !== fields_1.CONTENT_FIELD_TYPE.Relation)
+                continue;
+            if (spec.relation?.many ||
+                spec.relation?.inverse ||
+                spec.relation?.unique)
+                continue;
+            const fk = cols[fieldName];
+            if (!fk)
+                continue;
+            indexes.push((0, pg_core_1.index)(`${tableName}_${snakeCase(fieldName)}_id_idx`).on(fk));
+        }
+        if (meta.i18n) {
+            // One row per (group, locale). Partial on paranoid types so a
+            // soft-deleted sibling never blocks re-creating that locale —
+            // restoring into a conflict then fails (23505 → 409 upstream).
+            const groupLocale = (0, pg_core_1.uniqueIndex)(`${tableName}_group_locale_unique`).on(cols['localeGroupId'], cols['locale']);
+            indexes.push(meta.paranoid
+                ? groupLocale.where((0, drizzle_orm_1.isNull)(cols['deletedAt']))
+                : groupLocale);
+            // One-to-one, **scoped to the locale** — the i18n counterpart of the
+            // column-level UNIQUE `columnFor` emits on a plain type.
+            //
+            // A localized record is one row per language, so "at most one owner
+            // points at this target" has to be counted in records, not rows.
+            // `(locale, <field>_id)` says exactly that: within any one language
+            // a target is claimed once, while the same target may be shared by
+            // the locale rows of the record that owns it — which is what a
+            // relation synced across the group *is*. Nullable-unique survives,
+            // since Postgres treats NULLs as distinct in a composite index too.
+            for (const [fieldName, spec] of Object.entries(fields)) {
+                if (spec.type !== fields_1.CONTENT_FIELD_TYPE.Relation ||
+                    !spec.relation?.unique ||
+                    spec.relation.many ||
+                    spec.relation.inverse)
+                    continue;
+                const fk = cols[fieldName];
+                if (!fk)
+                    continue;
+                // The FK leads deliberately. Uniqueness of a pair is
+                // order-independent, but the leading column decides what the
+                // index can also *serve* — and the inverse side of this
+                // relation reads `inArray(<fk>, sourceIds)` for a whole page on
+                // every records-table render. Leading with `locale` would leave
+                // that a sequential scan, since the skipped plain FK index just
+                // below assumes `unique` already provides one.
+                const localeUnique = (0, pg_core_1.uniqueIndex)(`${tableName}_${snakeCase(fieldName)}_locale_unique`).on(fk, cols['locale']);
+                // Partial on paranoid types for the same reason as the pair
+                // above: a trashed row must not hold a target hostage.
+                indexes.push(meta.paranoid
+                    ? localeUnique.where((0, drizzle_orm_1.isNull)(cols['deletedAt']))
+                    : localeUnique);
+            }
+        }
+        return indexes;
+    });
+    const joinTables = {};
+    for (const [fieldName, spec] of Object.entries(fields)) {
+        if (spec.type !== fields_1.CONTENT_FIELD_TYPE.Relation ||
+            !spec.relation?.many ||
+            spec.relation.inverse // inverse reuses the owning side's join table
+        )
+            continue;
+        const joinName = `${tableName}_${snakeCase(fieldName)}`;
+        joinTables[fieldName] = (0, pg_core_1.pgTable)(joinName, {
+            /** The owning entry. Join rows die with it. */
+            sourceId: (0, pg_core_1.uuid)('source_id')
+                .notNull()
+                .references(() => idColumnOf(table), {
+                onDelete: 'cascade'
+            }),
+            /** The referenced entry on the target type. */
+            targetId: (0, pg_core_1.uuid)('target_id')
+                .notNull()
+                .references(() => idColumnOf(spec.relation.to().table), {
+                onDelete: 'cascade'
+            }),
+            /**
+             * Ordinal of this target within its **source's** ordered list —
+             * the source's own ordering of its many-relation, so a
+             * drag-reorder survives a reload. Float, so a target can be moved
+             * between two neighbours without renumbering the whole list.
+             * Defaults to 0 (append picks `max(position)+1` for the source).
+             * The inverse side reads by it too (stable), but doesn't own the
+             * order — a two-way link has one order, the owning side's.
+             */
+            position: (0, pg_core_1.doublePrecision)('position').notNull().default(0)
+        }, (t) => {
+            const cols = t;
+            return [
+                // one link per pair; leftmost prefix covers "links of an entry"
+                (0, pg_core_1.unique)(`${joinName}_pair_unique`).on(cols['sourceId'], cols['targetId']),
+                // reverse lookups: "which entries reference this target?"
+                (0, pg_core_1.index)(`${joinName}_target_idx`).on(cols['targetId']),
+                // ordered read of a source's links: `WHERE source_id ORDER BY position`
+                (0, pg_core_1.index)(`${joinName}_source_pos_idx`).on(cols['sourceId'], cols['position'])
+            ];
+        });
+    }
+    return { table, joinTables };
+}

package/dist/lib/content-types/controllers/get-content-schema.controller.d.ts

@@ -0,0 +1,24 @@
+import type { ContentTypeRegistry, SerializedContentType } from '../../registry/content-type-registry';
+import { WorkspaceGrantsQuery } from '../queries/workspace-grants.query';
+/**
+ * `GET /api/content-schema/:name` — the full field schema of one content
+ * type: types, validation rules, and admin presentation props. This is
+ * what the admin's dynamic tables/forms render from. Authentication is
+ * enforced by the app-wide AuthGuard; read access is gated on `content:read`.
+ *
+ * **Workspace-scoped**, like its `/filter-fields` sibling and unlike the
+ * `GET /api/content-schema` catalogue: the schema of a type is the shape of
+ * content this workspace may open, so a type the workspace was not granted
+ * (`workspace_content`) answers with exactly the `404` an unknown name gets —
+ * same status, same message, grants read before the registry decision — and
+ * the route therefore discloses nothing about the content model outside the
+ * caller's workspace. Serving it unconditionally was the read half of the
+ * hole `ContentGrantGuard` closes on the entry routes.
+ */
+export declare class GetContentSchemaController {
+    private readonly registry;
+    private readonly grants;
+    constructor(registry: ContentTypeRegistry, grants: WorkspaceGrantsQuery);
+    get(name: string, workspaceId: string): Promise<SerializedContentType>;
+}
+//# sourceMappingURL=get-content-schema.controller.d.ts.map

package/dist/lib/content-types/controllers/get-content-schema.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-content-schema.controller.d.ts","sourceRoot":"","sources":["../../../../src/lib/content-types/controllers/get-content-schema.controller.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACR,mBAAmB,EACnB,qBAAqB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,qBAGa,0BAA0B;IAG/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,oBAAoB;IAI3C,GAAG,CACU,IAAI,EAAE,MAAM,EACP,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,qBAAqB,CAAC;CAUpC"}

package/dist/lib/content-types/controllers/get-content-schema.controller.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetContentSchemaController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const content_tokens_1 = require("../../content.tokens");
+const workspace_grants_query_1 = require("../queries/workspace-grants.query");
+/**
+ * `GET /api/content-schema/:name` — the full field schema of one content
+ * type: types, validation rules, and admin presentation props. This is
+ * what the admin's dynamic tables/forms render from. Authentication is
+ * enforced by the app-wide AuthGuard; read access is gated on `content:read`.
+ *
+ * **Workspace-scoped**, like its `/filter-fields` sibling and unlike the
+ * `GET /api/content-schema` catalogue: the schema of a type is the shape of
+ * content this workspace may open, so a type the workspace was not granted
+ * (`workspace_content`) answers with exactly the `404` an unknown name gets —
+ * same status, same message, grants read before the registry decision — and
+ * the route therefore discloses nothing about the content model outside the
+ * caller's workspace. Serving it unconditionally was the read half of the
+ * hole `ContentGrantGuard` closes on the entry routes.
+ */
+let GetContentSchemaController = class GetContentSchemaController {
+    registry;
+    grants;
+    constructor(registry, grants) {
+        this.registry = registry;
+        this.grants = grants;
+    }
+    async get(name, workspaceId) {
+        const serialized = this.registry.serialize(name);
+        // Read the grants before deciding, so an ungranted type and an unknown
+        // one are indistinguishable — same status, same body, same work done.
+        const granted = await this.grants.grantedSlugs(workspaceId);
+        if (!serialized || !granted.has(name)) {
+            throw new common_1.NotFoundException(`Unknown content type "${name}".`);
+        }
+        return serialized;
+    }
+};
+exports.GetContentSchemaController = GetContentSchemaController;
+tslib_1.__decorate([
+    (0, common_1.Get)(':name'),
+    tslib_1.__param(0, (0, common_1.Param)('name')),
+    tslib_1.__param(1, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], GetContentSchemaController.prototype, "get", null);
+exports.GetContentSchemaController = GetContentSchemaController = tslib_1.__decorate([
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_READ),
+    (0, common_1.Controller)('content-schema'),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__metadata("design:paramtypes", [Function, workspace_grants_query_1.WorkspaceGrantsQuery])
+], GetContentSchemaController);

package/dist/lib/content-types/controllers/get-filter-fields.controller.d.ts

@@ -0,0 +1,35 @@
+import type { ContentTypeRegistry } from '../../registry/content-type-registry';
+import type { FilterFieldsResponse } from '../../entries/types/filter-surface';
+import { WorkspaceGrantsQuery } from '../queries/workspace-grants.query';
+/**
+ * `GET /api/content-schema/:name/filter-fields` — every scalar path the
+ * records-table query builder may filter on: the type's own fields plus,
+ * recursively within the relation-hop budget, its relations' fields
+ * (`author.name`, `author.company.name`). This is the admin counterpart of
+ * the SQL `FilterSchema` the list endpoint enforces — both come from a
+ * single `buildEntryFilterSurface` traversal, so the picker can never offer
+ * a path the API would reject with a 400.
+ *
+ * **Workspace-scoped**, unlike the sibling `/content-schema` routes (which
+ * serve the global, code-defined type catalogue). The response describes
+ * what *this* workspace may traverse, so it is pruned to the workspace's
+ * `workspace_content` grants in two places:
+ *
+ * - the requested `:name` must itself be granted, else **404** — the same
+ *   answer an unknown type gets, so the endpoint carries no signal about
+ *   which types exist outside the caller's workspace;
+ * - `grantedTypes` prunes the offered relations, mirroring the entry
+ *   editor's `availableTypeNames`, so the picker never offers a traversal
+ *   into a collection the caller cannot open.
+ *
+ * The SQL the list endpoint runs is workspace-scoped regardless, so this is
+ * about not *disclosing* the shape of another workspace's content model,
+ * not about row access.
+ */
+export declare class GetFilterFieldsController {
+    private readonly registry;
+    private readonly grants;
+    constructor(registry: ContentTypeRegistry, grants: WorkspaceGrantsQuery);
+    filterFields(name: string, workspaceId: string): Promise<FilterFieldsResponse>;
+}
+//# sourceMappingURL=get-filter-fields.controller.d.ts.map

package/dist/lib/content-types/controllers/get-filter-fields.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-filter-fields.controller.d.ts","sourceRoot":"","sources":["../../../../src/lib/content-types/controllers/get-filter-fields.controller.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAGa,yBAAyB;IAG9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,oBAAoB;IAI3C,YAAY,CACC,IAAI,EAAE,MAAM,EACP,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,oBAAoB,CAAC;CAenC"}

package/dist/lib/content-types/controllers/get-filter-fields.controller.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetFilterFieldsController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const content_tokens_1 = require("../../content.tokens");
+const entry_filter_surface_1 = require("../../entries/infrastructure/queries/entry-filter-surface");
+const workspace_grants_query_1 = require("../queries/workspace-grants.query");
+/**
+ * `GET /api/content-schema/:name/filter-fields` — every scalar path the
+ * records-table query builder may filter on: the type's own fields plus,
+ * recursively within the relation-hop budget, its relations' fields
+ * (`author.name`, `author.company.name`). This is the admin counterpart of
+ * the SQL `FilterSchema` the list endpoint enforces — both come from a
+ * single `buildEntryFilterSurface` traversal, so the picker can never offer
+ * a path the API would reject with a 400.
+ *
+ * **Workspace-scoped**, unlike the sibling `/content-schema` routes (which
+ * serve the global, code-defined type catalogue). The response describes
+ * what *this* workspace may traverse, so it is pruned to the workspace's
+ * `workspace_content` grants in two places:
+ *
+ * - the requested `:name` must itself be granted, else **404** — the same
+ *   answer an unknown type gets, so the endpoint carries no signal about
+ *   which types exist outside the caller's workspace;
+ * - `grantedTypes` prunes the offered relations, mirroring the entry
+ *   editor's `availableTypeNames`, so the picker never offers a traversal
+ *   into a collection the caller cannot open.
+ *
+ * The SQL the list endpoint runs is workspace-scoped regardless, so this is
+ * about not *disclosing* the shape of another workspace's content model,
+ * not about row access.
+ */
+let GetFilterFieldsController = class GetFilterFieldsController {
+    registry;
+    grants;
+    constructor(registry, grants) {
+        this.registry = registry;
+        this.grants = grants;
+    }
+    async filterFields(name, workspaceId) {
+        const type = this.registry.get(name);
+        // Resolve the grants before the registry check so an ungranted type
+        // and an unknown one are indistinguishable — same status, same body,
+        // same work done.
+        const grantedTypes = await this.grants.grantedSlugs(workspaceId);
+        if (!type || !grantedTypes.has(name)) {
+            throw new common_1.NotFoundException(`Unknown content type "${name}".`);
+        }
+        const { fields } = (0, entry_filter_surface_1.buildEntryFilterSurface)(type, {
+            workspaceId,
+            grantedTypes
+        });
+        return { fields };
+    }
+};
+exports.GetFilterFieldsController = GetFilterFieldsController;
+tslib_1.__decorate([
+    (0, common_1.Get)(':name/filter-fields'),
+    tslib_1.__param(0, (0, common_1.Param)('name')),
+    tslib_1.__param(1, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], GetFilterFieldsController.prototype, "filterFields", null);
+exports.GetFilterFieldsController = GetFilterFieldsController = tslib_1.__decorate([
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_READ),
+    (0, common_1.Controller)('content-schema'),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__metadata("design:paramtypes", [Function, workspace_grants_query_1.WorkspaceGrantsQuery])
+], GetFilterFieldsController);

package/dist/lib/content-types/controllers/list-content-schema.controller.d.ts

@@ -0,0 +1,15 @@
+import type { ContentTypeRegistry, SerializedContentTypeSummary } from '../../registry/content-type-registry';
+/**
+ * `GET /api/content-schema` — summaries of every code-defined content
+ * type (collections and singles). Shape-compatible with identity's
+ * `ContentTypeDescriptor`, so once identity's workspace grants consume
+ * this registry, its mock `/api/content-types` retires in favor of this
+ * source of truth. Authentication is enforced by the app-wide AuthGuard;
+ * read access is gated on `content:read`.
+ */
+export declare class ListContentSchemaController {
+    private readonly registry;
+    constructor(registry: ContentTypeRegistry);
+    list(): SerializedContentTypeSummary[];
+}
+//# sourceMappingURL=list-content-schema.controller.d.ts.map

package/dist/lib/content-types/controllers/list-content-schema.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-content-schema.controller.d.ts","sourceRoot":"","sources":["../../../../src/lib/content-types/controllers/list-content-schema.controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,mBAAmB,EACnB,4BAA4B,EAC/B,MAAM,sCAAsC,CAAC;AAE9C;;;;;;;GAOG;AACH,qBAGa,2BAA2B;IAGhC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,mBAAmB;IAIlD,IAAI,IAAI,4BAA4B,EAAE;CAGzC"}

package/dist/lib/content-types/controllers/list-content-schema.controller.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ListContentSchemaController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const content_tokens_1 = require("../../content.tokens");
+/**
+ * `GET /api/content-schema` — summaries of every code-defined content
+ * type (collections and singles). Shape-compatible with identity's
+ * `ContentTypeDescriptor`, so once identity's workspace grants consume
+ * this registry, its mock `/api/content-types` retires in favor of this
+ * source of truth. Authentication is enforced by the app-wide AuthGuard;
+ * read access is gated on `content:read`.
+ */
+let ListContentSchemaController = class ListContentSchemaController {
+    registry;
+    constructor(registry) {
+        this.registry = registry;
+    }
+    list() {
+        return this.registry.summaries();
+    }
+};
+exports.ListContentSchemaController = ListContentSchemaController;
+tslib_1.__decorate([
+    (0, common_1.Get)(),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Array)
+], ListContentSchemaController.prototype, "list", null);
+exports.ListContentSchemaController = ListContentSchemaController = tslib_1.__decorate([
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_READ),
+    (0, common_1.Controller)('content-schema'),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__metadata("design:paramtypes", [Function])
+], ListContentSchemaController);

package/dist/lib/content-types/queries/workspace-grants.query.d.ts

@@ -0,0 +1,25 @@
+import { type Database } from '@orthacms/database';
+/**
+ * Reads a workspace's **content grants** — the `workspace_content` slugs the
+ * open workspace may access, written by the workspace create/edit wizard.
+ *
+ * The grants are workspaces-owned data, but the dependency only runs one way:
+ * content-server already depends on `@orthacms/workspaces-server` for
+ * `WorkspaceGuard`, and that package deliberately re-exports its Drizzle
+ * schema. Inverting this into a port would mean workspaces depending on
+ * content, which is the cycle `CONTENT_CATALOG` exists to avoid.
+ *
+ * A thin CQRS read — no aggregate, no write path.
+ */
+export declare class WorkspaceGrantsQuery {
+    private readonly db;
+    constructor(db: Database);
+    /**
+     * Every content slug granted to `workspaceId`. Returned as a `Set` so
+     * callers can test membership per relation hop without re-querying.
+     * An empty set means the workspace was granted nothing — callers must
+     * treat that as "no access", never as "no filtering".
+     */
+    grantedSlugs(workspaceId: string): Promise<Set<string>>;
+}
+//# sourceMappingURL=workspace-grants.query.d.ts.map

package/dist/lib/content-types/queries/workspace-grants.query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-grants.query.d.ts","sourceRoot":"","sources":["../../../../src/lib/content-types/queries/workspace-grants.query.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGnE;;;;;;;;;;;GAWG;AACH,qBACa,oBAAoB;IACC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAE3D;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;CAOhE"}

package/dist/lib/content-types/queries/workspace-grants.query.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkspaceGrantsQuery = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const database_1 = require("@orthacms/database");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+/**
+ * Reads a workspace's **content grants** — the `workspace_content` slugs the
+ * open workspace may access, written by the workspace create/edit wizard.
+ *
+ * The grants are workspaces-owned data, but the dependency only runs one way:
+ * content-server already depends on `@orthacms/workspaces-server` for
+ * `WorkspaceGuard`, and that package deliberately re-exports its Drizzle
+ * schema. Inverting this into a port would mean workspaces depending on
+ * content, which is the cycle `CONTENT_CATALOG` exists to avoid.
+ *
+ * A thin CQRS read — no aggregate, no write path.
+ */
+let WorkspaceGrantsQuery = class WorkspaceGrantsQuery {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Every content slug granted to `workspaceId`. Returned as a `Set` so
+     * callers can test membership per relation hop without re-querying.
+     * An empty set means the workspace was granted nothing — callers must
+     * treat that as "no access", never as "no filtering".
+     */
+    async grantedSlugs(workspaceId) {
+        const rows = await this.db
+            .select({ slug: workspaces_server_1.workspaceContent.slug })
+            .from(workspaces_server_1.workspaceContent)
+            .where((0, drizzle_orm_1.eq)(workspaces_server_1.workspaceContent.workspaceId, workspaceId));
+        return new Set(rows.map((row) => row.slug));
+    }
+};
+exports.WorkspaceGrantsQuery = WorkspaceGrantsQuery;
+exports.WorkspaceGrantsQuery = WorkspaceGrantsQuery = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, database_1.InjectDatabase)()),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], WorkspaceGrantsQuery);