@prenta/core 0.118.0

package/dist/api/routes/preview.js

@@ -0,0 +1,111 @@
+import { logEvent } from '../../security/audit.js';
+import { createPreviewAdapter } from '../../preview/index.js';
+import { createPreviewStreamResponse } from '../../preview/sse-stream.js';
+import { guardedDb } from '../guarded-db.js';
+import { json, errorResponse, internalError, getSessionSecret, requireAuth, } from '../route-helpers.js';
+export function registerPreviewRoutes(router) {
+    const db = guardedDb;
+    // ---------------------------------------------------------------------------
+    // Preview routes
+    // ---------------------------------------------------------------------------
+    router.post('/preview/token', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const body = (await request.json());
+            if (!body.collection || !body.documentId) {
+                return errorResponse('collection and documentId are required', 400);
+            }
+            // Verify the document actually exists so we don't issue tokens for
+            // hypothetical ids — a leaked token would otherwise silently work
+            // once a doc with that id appeared.
+            const doc = await db().document.findFirst({
+                where: { id: body.documentId, collection: body.collection, deletedAt: null },
+                select: { id: true, slug: true },
+            });
+            if (!doc)
+                return errorResponse('Document not found', 404);
+            const preview = createPreviewAdapter(getSessionSecret(), db());
+            const session = await preview.createPreviewSession(body.collection, body.documentId, {
+                ttlSeconds: body.ttlSeconds,
+                issuedBy: auth.session.userId,
+            });
+            await logEvent({
+                event: 'preview_token_issued',
+                userId: auth.session.userId,
+                details: {
+                    collection: body.collection,
+                    documentId: body.documentId,
+                    expiresAt: session.expiresAt.toISOString(),
+                },
+            });
+            return json({
+                data: {
+                    token: session.token,
+                    expiresAt: session.expiresAt,
+                    slug: doc.slug,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'create preview token');
+        }
+    });
+    router.get('/preview/:collection/:id', async (request, params) => {
+        try {
+            const url = new URL(request.url);
+            const token = url.searchParams.get('token');
+            if (!token)
+                return errorResponse('Preview token required', 401);
+            const preview = createPreviewAdapter(getSessionSecret(), db());
+            const session = await preview.validatePreviewToken(token);
+            if (!session)
+                return errorResponse('Invalid or expired preview token', 401);
+            if (session.collection !== params.collection || session.documentId !== params.id) {
+                return errorResponse('Token does not match requested resource', 403);
+            }
+            const data = await preview.getPreviewData(session);
+            if (!data)
+                return errorResponse('Document not found', 404);
+            return json({ data });
+        }
+        catch (err) {
+            return internalError(err, 'fetch preview data');
+        }
+    });
+    /**
+     * Server-Sent Events stream for live preview. The admin's `LivePreview`
+     * panel opens an `EventSource('/api/cms/preview/stream?token=...')` and
+     * relays every `event: update` frame to the previewed iframe through
+     * `postMessage`. Token-based auth (instead of cookies) because
+     * `EventSource` cannot send arbitrary headers.
+     *
+     * Emits:
+     *   - `event: ready` once on connection (handshake).
+     *   - `event: update` whenever the underlying draft document is updated
+     *     (see `PUT /collections/:slug/:id` for the emit site).
+     *   - `: heartbeat\n\n` keepalive comments every 25 s so proxies don't
+     *     reap idle connections.
+     *
+     * Closes cleanly after 4 minutes so platform idle caps don't terminate
+     * the connection mid-event; EventSource will auto-reconnect.
+     */
+    router.get('/preview/stream', async (request) => {
+        try {
+            const url = new URL(request.url);
+            const token = url.searchParams.get('token');
+            if (!token)
+                return errorResponse('Preview token required', 401);
+            const preview = createPreviewAdapter(getSessionSecret(), db());
+            const session = await preview.validatePreviewToken(token);
+            if (!session)
+                return errorResponse('Invalid or expired preview token', 401);
+            return createPreviewStreamResponse(session);
+        }
+        catch (err) {
+            return internalError(err, 'open preview stream');
+        }
+    });
+}
+//# sourceMappingURL=preview.js.map

package/dist/api/routes/preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../../src/api/routes/preview.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EACL,IAAI,EACJ,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,WAAW,GACZ,MAAM,qBAAqB,CAAA;AAE5B,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,MAAM,EAAE,GAAG,SAAS,CAAA;IACpB,8EAA8E;IAC9E,iBAAiB;IACjB,8EAA8E;IAE9E,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAA;YAEjC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAIjC,CAAA;YACD,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,OAAO,aAAa,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAA;YACrE,CAAC;YAED,mEAAmE;YACnE,kEAAkE;YAClE,oCAAoC;YACpC,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACxC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC5E,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;aACjC,CAAC,CAAA;YACF,IAAI,CAAC,GAAG;gBAAE,OAAO,aAAa,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;YAEzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;gBACnF,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;aAC9B,CAAC,CAAA;YAEF,MAAM,QAAQ,CAAC;gBACb,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,OAAO,EAAE;oBACP,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;iBAC3C;aACF,CAAC,CAAA;YAEF,OAAO,IAAI,CAAC;gBACV,IAAI,EAAE;oBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;iBACf;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAA;QACnD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,CAAC,KAAK;gBAAE,OAAO,aAAa,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAA;YAE/D,MAAM,OAAO,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACzD,IAAI,CAAC,OAAO;gBAAE,OAAO,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAE3E,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;gBACjF,OAAO,aAAa,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAA;YACtE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,aAAa,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;YAE1D,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAA;QACjD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,CAAC,KAAK;gBAAE,OAAO,aAAa,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAA;YAE/D,MAAM,OAAO,GAAG,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;YAC9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACzD,IAAI,CAAC,OAAO;gBAAE,OAAO,aAAa,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAE3E,OAAO,2BAA2B,CAAC,OAAO,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;QAClD,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/routes/redirects.d.ts

@@ -0,0 +1,3 @@
+import type { ApiRouter } from '../router.js';
+export declare function registerRedirectRoutes(router: ApiRouter): void;
+//# sourceMappingURL=redirects.d.ts.map

package/dist/api/routes/redirects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirects.d.ts","sourceRoot":"","sources":["../../../src/api/routes/redirects.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AA2D7C,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA07B9D"}