@pathmx/core 0.5.0 → 0.5.2

package/server/http.ts

@@ -216,7 +216,7 @@ async function dispatchRequest(
 function serveGenerated(app: Engine, pathname: string, head: boolean) {
   if (!pathname.startsWith("/.pmx/")) return
   const asset = app.servedAsset(pathname)
-  if (!asset) return
+  if (asset?.type !== "generated") return
   return new Response(head ? null : asset.body, {
     headers: {
       "Content-Type": asset.contentType,
@@ -248,6 +248,15 @@ async function dispatch(
     })
   }
 
+  const authored = serveAuthored(
+    app,
+    url.pathname,
+    req.method === "HEAD",
+    session,
+    principal,
+  )
+  if (authored) return authored
+
   const route = resolveRoute(app.repo, url.pathname)
   if (route?.type === "source") {
     return serveSource(
@@ -292,6 +301,39 @@ async function dispatch(
   )
 }
 
+function decodePathname(pathname: string) {
+  try {
+    return decodeURIComponent(pathname)
+  } catch {
+    return
+  }
+}
+
+function serveAuthored(
+  app: Engine,
+  pathname: string,
+  head: boolean,
+  session: CredentialSession,
+  principal: Principal,
+) {
+  const path = decodePathname(pathname)
+  if (!path) return
+  const asset = app.servedAsset(path)
+  if (asset?.type !== "authored") return
+  const access = app.readAccess(principal, asset.sourcePath)
+  if (access === "denied") return pageNotFound()
+  return withReadCache(
+    new Response(head ? null : asset.body, {
+      headers: {
+        "Content-Type": asset.contentType,
+        "Cache-Control": "public, max-age=31536000, immutable",
+      },
+    }),
+    access,
+    session,
+  )
+}
+
 function serveSource(
   app: Engine,
   head: boolean,
@@ -317,17 +359,19 @@ async function serveAsset(
   session: CredentialSession,
   principal: Principal,
 ) {
-  let path: string
-  try {
-    path = decodeURIComponent(pathname)
-  } catch {
-    return
-  }
+  const path = decodePathname(pathname)
+  if (!path) return
   if (path.includes("..")) return
   const storagePath = app.repo.storagePath(path)
   if (!storagePath || !(await app.repo.isFile(path))) return
   const access = app.readAccess(principal, path)
   if (access === "denied") return pageNotFound()
   const body = head ? null : await app.environment.storage.readBlob(storagePath)
-  return withReadCache(new Response(body), access, session)
+  return withReadCache(
+    new Response(body, {
+      headers: { "Cache-Control": "public, max-age=0, must-revalidate" },
+    }),
+    access,
+    session,
+  )
 }

package/server/watch.ts

@@ -3,6 +3,7 @@ import { realpathSync } from "node:fs"
 import { relative } from "node:path"
 import type { Engine } from "../host/engine.ts"
 import { SourceDiagnosticError } from "../source-diagnostic.ts"
+import { isAuthoredStoragePath } from "../storage-path.ts"
 import { CssImportIndex } from "./css-imports.ts"
 
 type UnresolvedLink = {
@@ -91,7 +92,13 @@ export function watchPaths(app: Engine, root: string) {
         const changedStyles = new Set<string>()
         for (const event of events) {
           const rel = relative(base, event.path)
-          if (!rel || rel.startsWith("..")) continue
+          if (
+            !rel ||
+            rel.startsWith("..") ||
+            !isAuthoredStoragePath(rel)
+          ) {
+            continue
+          }
           app.log.debug("watch", { file: rel, type: event.type })
           if (rel.endsWith(".md")) await app.syncFromStorage(rel)
           else if (rel.endsWith(".css")) {

package/source/source.ts

@@ -49,7 +49,6 @@ export function sourceIdFromPath(path: string, type = DEFAULT_SOURCE_TYPE) {
 }
 
 export function resolveSourceId(path: string, data: Topmatter) {
-  if (typeof data.id === "string" && data.id.trim()) return data.id.trim()
   const type =
     typeof data.type === "string" && data.type.trim()
       ? data.type.trim()

package/storage-path.ts

@@ -0,0 +1,8 @@
+const CONTROL_DIRECTORIES = new Set([".git", ".pathmx", "node_modules"])
+
+/** True when a storage-relative path belongs to authored project content. */
+export function isAuthoredStoragePath(path: string) {
+  return path
+    .split(/[\\/]/)
+    .every((segment) => !CONTROL_DIRECTORIES.has(segment))
+}