@rigel-cms/rigel 0.0.0-stage → 0.1.0-beta.1

package/src/routes/media-files.ts

@@ -0,0 +1,126 @@
+import { lstat, mkdir, readFile, readdir, realpath, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { mediaMetadata, safeMediaName } from "../media-types";
+import { fileURLToPath } from "node:url";
+
+export const imageFile = /\\.(jpe?g|png|webp|gif|avif)$/i;
+const SIDECAR = ".rigel-media.json";
+const META_KEYS: Record<string, number> = { name: 120, title: 200, description: 1000, alt: 1000, author: 80 };
+export interface MediaMeta { name?: string; title?: string; description?: string; alt?: string; author?: string; }
+export interface ListedAsset extends MediaMeta { url: string; name: string; type: string; size: number; modified: string; }
+
+export function mediaFolder(folder = "rigel-media") {
+  if (!folder.split("/").every(part => /^[a-zA-Z0-9_-][a-zA-Z0-9_. -]*$/.test(part))) throw new Error("Invalid media folder");
+  return folder;
+}
+export async function mediaDirectory(publicDir: string, folder = "rigel-media", create = false) {
+  mediaFolder(folder);
+  if (create) await mkdir(fileURLToPath(publicDir), { recursive: true });
+  let directory = await realpath(fileURLToPath(publicDir));
+  for (const part of folder.split("/")) {
+    directory = path.join(directory, part);
+    if (create) await mkdir(directory).catch(error => { if (error.code !== "EEXIST") throw error; });
+    const info = await lstat(directory);
+    if (info.isSymbolicLink() || !info.isDirectory()) throw new Error("Unsafe media directory");
+  }
+  return directory;
+}
+
+function sanitize(value: unknown, max: number): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const clean = value.trim().replace(/[\u0000-\u001f\u007f]/g, "").slice(0, max);
+  return clean || undefined;
+}
+
+/** User-facing renameable label: safe chars + length, no extension required (text display name). */
+export function safeDisplayName(value: unknown): boolean {
+  return typeof value === "string" && value.length > 0 && value.length <= 120
+    && !value.startsWith(".") && /^[a-zA-Z0-9_-][a-zA-Z0-9_. -]*$/.test(value);
+}
+
+async function sidecarPath(directory: string) { return path.join(directory, SIDECAR); }
+
+export async function loadMediaSidecar(directory: string): Promise<Record<string, MediaMeta>> {
+  let text: string;
+  try { text = await readFile(await sidecarPath(directory), "utf8"); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; return {}; }
+  try {
+    const parsed = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const out: Record<string, MediaMeta> = {};
+    for (const [key, value] of Object.entries(parsed)) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+      const meta: MediaMeta = {};
+      for (const [k, max] of Object.entries(META_KEYS)) {
+        const clean = sanitize((value as Record<string, unknown>)[k], max);
+        if (clean !== undefined) meta[k as keyof MediaMeta] = clean;
+      }
+      out[key] = meta;
+    }
+    return out;
+  } catch { return {}; }
+}
+
+export async function writeMediaSidecar(directory: string, record: Record<string, MediaMeta>): Promise<void> {
+  const target = await sidecarPath(directory);
+  const tmp = path.join(directory, `.${SIDECAR}.${process.pid}.${Date.now()}.tmp`);
+  await writeFile(tmp, JSON.stringify(record, null, 2), { flag: "wx" });
+  await rename(tmp, target);
+}
+
+export function validateMetaUpdate(
+  body: unknown,
+  existing: Set<string>,
+): { ok: true; value: { url: string; name?: string; title?: string; description?: string; alt?: string } } | { ok: false; error: string } {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return { ok: false, error: "Invalid request body" };
+  const b = body as Record<string, unknown>;
+  const allowed = ["url", "name", "title", "description", "alt"];
+  if (Object.keys(b).some(key => !allowed.includes(key))) return { ok: false, error: "Unknown metadata field" };
+  if (typeof b.url !== "string" || !existing.has(b.url)) return { ok: false, error: "Unknown asset" };
+  const value: { url: string; name?: string; title?: string; description?: string; alt?: string } = { url: b.url };
+  if ("name" in b) {
+    const candidate = typeof b.name === "string" ? b.name.trim() : b.name;
+    if (!safeDisplayName(candidate)) return { ok: false, error: "Invalid display name" };
+    value.name = typeof candidate === "string" ? candidate : undefined;
+  }
+  if ("title" in b) {
+    if (typeof b.title !== "string") return { ok: false, error: "Title must be a string" };
+    value.title = sanitize(b.title, 200);
+  }
+  if ("description" in b) {
+    if (typeof b.description !== "string") return { ok: false, error: "Description must be a string" };
+    value.description = sanitize(b.description, 1000);
+  }
+  if ("alt" in b) {
+    if (typeof b.alt !== "string") return { ok: false, error: "Alt text must be a string" };
+    if (!mediaMetadata(b.url)?.type.startsWith("image/")) return { ok: false, error: "Alt text is only available for images" };
+    value.alt = sanitize(b.alt.replace(/\s+/g, " "), 1000) ?? "";
+  }
+  return { ok: true, value };
+}
+
+export async function listMedia(publicDir: string, folder = "rigel-media") {
+  const assets: ListedAsset[] = [];
+  let directory = "";
+  try { directory = await mediaDirectory(publicDir, folder); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+  if (!directory) return assets;
+  const sidecar = await loadMediaSidecar(directory);
+  async function walk(current: string, relative = "") {
+    for (const entry of await readdir(current, { withFileTypes: true })) {
+      if (entry.name.startsWith(".") || entry.isSymbolicLink()) continue;
+      const name = relative + entry.name;
+      if (entry.isDirectory()) await walk(path.join(current, entry.name), name + "/");
+      else if (entry.isFile() && safeMediaName(entry.name)) {
+        const info = await lstat(path.join(current, entry.name));
+        if (!info.isFile()) continue;
+        const metadata = mediaMetadata(name)!;
+        const url = "/" + `${folder}/${name}`.split("/").map(encodeURIComponent).join("/");
+        const meta = sidecar[url] ?? {};
+        assets.push({ name: meta.name ?? name, url, type: metadata.type, size: info.size, modified: info.mtime.toISOString(), title: meta.title, description: meta.description, alt: meta.alt, author: meta.author });
+      }
+    }
+  }
+  await walk(directory);
+  return assets.sort((a, b) => a.name.localeCompare(b.name));
+}

package/src/routes/media-validation.ts

@@ -0,0 +1,37 @@
+import { MEDIA_TYPES } from '../media-types';
+
+export function validMediaBytes(bytes: Buffer, extension: string): boolean {
+  const starts = (hex: string) => bytes.subarray(0, hex.length / 2).equals(Buffer.from(hex, 'hex'));
+  const text = (start: number, end: number) => bytes.subarray(start, end).toString('latin1');
+  if (['jpg', 'jpeg'].includes(extension)) return starts('ffd8ff');
+  if (extension === 'png') return starts('89504e470d0a1a0a');
+  if (extension === 'webp') return text(0, 4) === 'RIFF' && text(8, 12) === 'WEBP';
+  if (extension === 'gif') return ['GIF87a', 'GIF89a'].includes(text(0, 6));
+  if (['avif', 'mp4', 'm4a', 'mov'].includes(extension)) {
+    if (bytes.length < 16 || text(4, 8) !== 'ftyp') return false;
+    const brands = text(8, Math.min(bytes.readUInt32BE(0), 128));
+    return extension === 'avif' ? /avif|avis/.test(brands) : extension === 'm4a' ? /M4A |M4B /.test(brands) : extension === 'mov' ? brands.includes('qt  ') : /isom|iso2|mp41|mp42|avc1/.test(brands);
+  }
+  if (extension === 'wav') return text(0, 4) === 'RIFF' && text(8, 12) === 'WAVE';
+  if (extension === 'mp3') return text(0, 3) === 'ID3' || (bytes[0] === 255 && (bytes[1] & 0xe0) === 0xe0);
+  if (extension === 'ogg') return text(0, 4) === 'OggS' && /vorbis|OpusHead|Speex/.test(text(0, 256));
+  if (extension === 'webm') return starts('1a45dfa3') && text(0, 128).includes('webm');
+  if (extension === 'pdf') return text(0, 5) === '%PDF-' && text(Math.max(0, bytes.length - 1024), bytes.length).includes('%%EOF');
+  if (['doc', 'xls', 'ppt'].includes(extension)) return starts('d0cf11e0a1b11ae1') && bytes.includes(Buffer.from({doc: 'WordDocument', xls: 'Workbook', ppt: 'PowerPoint Document'}[extension]!, 'utf16le'));
+  if (extension === 'rtf') return text(0, 5) === '{\\rtf';
+  if (['zip', 'docx', 'xlsx', 'pptx', 'odt', 'ods'].includes(extension)) {
+    if (!starts('504b0304') && !starts('504b0506')) return false;
+    if (!bytes.includes(Buffer.from('504b0506', 'hex'))) return false;
+    if (extension === 'zip') return true;
+    if (['odt', 'ods'].includes(extension)) return bytes.includes(Buffer.from(MEDIA_TYPES[extension].type));
+    return bytes.includes(Buffer.from('[Content_Types].xml')) && bytes.includes(Buffer.from({docx: 'word/document.xml', xlsx: 'xl/workbook.xml', pptx: 'ppt/presentation.xml'}[extension]!));
+  }
+  if (extension === 'gz') return starts('1f8b08');
+  if (extension === '7z') return starts('377abcaf271c');
+  if (extension === 'rar') return starts('526172211a07');
+  if (extension === 'tar') return bytes.length >= 512 && text(257, 262) === 'ustar';
+  if (extension === 'csv') {
+    try { const value = new TextDecoder('utf-8', {fatal: true}).decode(bytes); return !/[\u0000-\u0008\u000b\u000c\u000e-\u001f<>]/.test(value) && /[,;\t]/.test(value); } catch { return false; }
+  }
+  return false;
+}

package/src/routes/media.json.ts

@@ -0,0 +1,12 @@
+import type { APIRoute } from "astro";
+import config from "virtual:rigel-config";
+import { listMedia } from "./media-files";
+
+export const GET: APIRoute = async () => {
+  try {
+    const assets = await listMedia(config.publicDir!, config.mediaDir);
+    return Response.json({ assets, images: assets.filter(asset => asset.type.startsWith("image/")), folder: config.mediaDir ?? "rigel-media", writable: import.meta.env.DEV && config.backend === "local" });
+  } catch {
+    return Response.json({ error: "Could not read the configured media directory" }, { status: 500 });
+  }
+};

package/src/routes/rigel-page.astro

@@ -0,0 +1,25 @@
+---
+---
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="robots" content="noindex, nofollow" />
+    <title>Rigel — Content Editor</title>
+    <style>
+      *, *::before, *::after { box-sizing: border-box; }
+      html { background: #F8FAFC; color-scheme: light; }
+      html[data-theme="dark"] { background: #080F1C; color-scheme: dark; }
+      html[data-contrast="high"] { background: #FFFFFF; }
+      html[data-theme="dark"][data-contrast="high"] { background: #000000; }
+      body { margin: 0; background: inherit; }
+    </style>
+  </head>
+  <body>
+    <div id="rigel"></div>
+    <script type="module">
+      import "../editor/main.ts";
+    </script>
+  </body>
+</html>

package/src/routes/serialize.ts

@@ -0,0 +1,139 @@
+export const VALUES_RE = /values:\s*\{[\s\S]*?\n\s*\},\n\}\);/;
+
+function valuesLiteral(source: string) {
+  let i = 0;
+  let range: [number, number] | undefined;
+  const fail = (): never => { throw new Error("Unsupported copy literal; use data-only defineCopy values"); };
+  const skip = () => {
+    while (true) {
+      const match = /^(?:\s+|\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)/.exec(source.slice(i));
+      if (!match) break;
+      i += match[0].length;
+    }
+  };
+  const take = (text: string) => { skip(); if (!source.startsWith(text, i)) fail(); i += text.length; };
+  const string = (): string => {
+    const quote = source[i++];
+    let value = "";
+    while (i < source.length) {
+      const char = source[i++];
+      if (char === quote) return value;
+      if (char === "\n" || char === "\r") fail();
+      if (char !== "\\") { value += char; continue; }
+      const escape = source[i++];
+      const simple: Record<string, string> = { n: "\n", r: "\r", t: "\t", b: "\b", f: "\f", v: "\v", "\\": "\\", "'": "'", '"': '"', "/": "/" };
+      if (Object.hasOwn(simple, escape)) value += simple[escape];
+      else if (escape === "u" || escape === "x") {
+        const length = escape === "u" ? 4 : 2;
+        const hex = source.slice(i, i + length);
+        if (!new RegExp(`^[0-9a-fA-F]{${length}}$`).test(hex)) fail();
+        value += String.fromCharCode(parseInt(hex, 16)); i += length;
+      } else fail();
+    }
+    return fail();
+  };
+  const value = (depth = 0): unknown => {
+    if (depth > 100) fail();
+    skip();
+    if (source[i] === '"' || source[i] === "'") return string();
+    const opener = source[i];
+    if (opener === "{" || opener === "[") {
+      i++;
+      const object: Record<string, unknown> = {};
+      const array: unknown[] = [];
+      const end = opener === "{" ? "}" : "]";
+      skip();
+      while (source[i] !== end) {
+        let key = "";
+        if (opener === "{") {
+          skip();
+          if (source[i] === '"' || source[i] === "'") key = string();
+          else {
+            const match = /^[A-Za-z_$][A-Za-z0-9_$]*/.exec(source.slice(i));
+            if (!match) fail();
+            key = match![0]; i += key.length;
+          }
+          if (["__proto__", "prototype", "constructor"].includes(key) || Object.hasOwn(object, key)) fail();
+          take(":");
+        }
+        skip(); const start = i;
+        const child = value(depth + 1);
+        if (opener === "{") object[key] = child; else array.push(child);
+        if (depth === 0 && key === "values") range = [start, i];
+        skip();
+        if (source[i] !== ",") break;
+        i++; skip();
+      }
+      take(end);
+      return opener === "{" ? object : array;
+    }
+    const match = /^(?:true|false|null|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/.exec(source.slice(i));
+    if (!match) return fail();
+    i += match[0].length;
+    const result = JSON.parse(match[0]);
+    if (typeof result === "number" && !Number.isFinite(result)) fail();
+    return result;
+  };
+  skip();
+  const imported = /^import\s*\{\s*defineCopy\s*\}\s*from\s*(["'])@rigel-cms\/rigel\/content\1\s*;/.exec(source.slice(i));
+  if (imported) i += imported[0].length;
+  take("export"); take("default"); take("defineCopy"); take("(");
+  const page = value();
+  take(")"); skip(); if (source[i] === ";") i++; skip();
+  if (i !== source.length || !range || !page || typeof page !== "object" || Array.isArray(page)) fail();
+  const values = (page as Record<string, unknown>).values;
+  if (!values || typeof values !== "object" || Array.isArray(values)) fail();
+  return { values: values as Record<string, unknown>, range: range! };
+}
+
+export function readValues(source: string): Record<string, unknown> {
+  return valuesLiteral(source).values;
+}
+
+export function serializeValues(values: Record<string, unknown>): string {
+  const groups = Object.entries(values)
+    .map(([gid, fields]) => `    ${safeKey(gid)}: ${fmtValue(fields, 3)},`)
+    .join("\n");
+  return `{\n${groups}\n  }`;
+}
+
+export function applyValues(
+  source: string,
+  values: Record<string, unknown>,
+): string {
+  const { range: [start, end] } = valuesLiteral(source);
+  const literal = serializeValues(values);
+  readValues(`export default defineCopy({values:${literal}});`);
+  return source.slice(0, start) + literal + source.slice(end);
+}
+
+function fmtValue(v: unknown, indent: number): string {
+  const pad = "  ".repeat(indent);
+  if (Array.isArray(v)) {
+    if (v.length === 0) return "[]";
+    const items = v.map((x) => `${pad}${inlineObj(x)}`).join(",\n");
+    return `[\n${items},\n${"  ".repeat(indent - 1)}]`;
+  }
+  if (v !== null && typeof v === "object") {
+    if (Object.keys(v).length === 0) return "{}";
+    const entries = Object.entries(v as Record<string, unknown>)
+      .map(([k, x]) => `${pad}${safeKey(k)}: ${fmtValue(x, indent + 1)}`)
+      .join(",\n");
+    return `{\n${entries},\n${"  ".repeat(indent - 1)}}`;
+  }
+  return JSON.stringify(v);
+}
+
+function inlineObj(v: unknown): string {
+  if (v !== null && typeof v === "object" && !Array.isArray(v)) {
+    const entries = Object.entries(v as Record<string, unknown>)
+      .map(([k, x]) => `${safeKey(k)}: ${JSON.stringify(x)}`)
+      .join(", ");
+    return `{ ${entries} }`;
+  }
+  return JSON.stringify(v);
+}
+
+function safeKey(k: string): string {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(k) ? k : JSON.stringify(k);
+}

package/src/schema/docs.ts

@@ -0,0 +1,33 @@
+import { isPlainObject } from "./validate";
+import type { ContentDocument } from "./types";
+
+export interface DocumentIndex {
+  byId: Map<string, ContentDocument>;
+  list: ContentDocument[];
+}
+
+export function buildDocumentIndex(documents: ContentDocument[]): DocumentIndex {
+  const byId = new Map<string, ContentDocument>();
+  for (const doc of documents) byId.set(doc.id, doc);
+  return { byId, list: documents };
+}
+
+export function deref(value: unknown, index: DocumentIndex): ContentDocument | undefined {
+  if (!isPlainObject(value) || typeof value._ref !== "string") return undefined;
+  return index.byId.get(value._ref);
+}
+
+export function referencedIds(value: unknown): string[] {
+  const ids: string[] = [];
+  const visit = (current: unknown) => {
+    if (Array.isArray(current)) {
+      current.forEach(visit);
+      return;
+    }
+    if (!isPlainObject(current)) return;
+    if (typeof current._ref === "string") ids.push(current._ref);
+    for (const child of Object.values(current)) visit(child);
+  };
+  visit(value);
+  return [...new Set(ids)];
+}

package/src/schema/paths.ts

@@ -0,0 +1,136 @@
+import { documentDef, isPlainObject, objectDef } from "./validate";
+import {
+  SLUG_PATTERN,
+  type ContentDocument,
+  type DocumentDef,
+  type FieldDef,
+  type Schema,
+} from "./types";
+
+export function newKey(): string {
+  return `k${crypto.randomUUID().replace(/-/g, "").slice(0, 12)}`;
+}
+
+export function cloneJson<T>(value: T): T {
+  return JSON.parse(JSON.stringify(value)) as T;
+}
+
+export interface ResolvedPath {
+  found: boolean;
+  value?: unknown;
+}
+
+const BLOCKED = new Set(["__proto__", "constructor", "prototype"]);
+
+export function resolvePath(values: unknown, path: string): ResolvedPath {
+  let current: unknown = values;
+  for (const segment of path.split(".")) {
+    if (BLOCKED.has(segment)) return { found: false };
+    if (Array.isArray(current)) {
+      const item = current.find((entry) => isPlainObject(entry) && entry._key === segment);
+      if (item !== undefined) {
+        current = item;
+        continue;
+      }
+      if (!/^\d+$/.test(segment)) return { found: false };
+      const index = Number(segment);
+      if (index >= current.length) return { found: false };
+      current = current[index];
+      continue;
+    }
+    if (!isPlainObject(current) || !Object.hasOwn(current, segment)) return { found: false };
+    current = current[segment];
+  }
+  return { found: true, value: current };
+}
+
+export function setPath(values: Record<string, unknown>, path: string, next: unknown): boolean {
+  const segments = path.split(".");
+  if (!segments.length || segments.some((segment) => BLOCKED.has(segment))) return false;
+  let current: unknown = values;
+  for (let index = 0; index < segments.length - 1; index++) {
+    const segment = segments[index];
+    if (Array.isArray(current)) {
+      current = /^\d+$/.test(segment)
+        ? current[Number(segment)]
+        : current.find((entry) => isPlainObject(entry) && entry._key === segment);
+    } else if (isPlainObject(current)) {
+      current = current[segment];
+    } else return false;
+  }
+  const last = segments[segments.length - 1];
+  if (Array.isArray(current)) {
+    const index = /^\d+$/.test(last)
+      ? Number(last)
+      : current.findIndex((entry) => isPlainObject(entry) && entry._key === last);
+    if (index < 0 || index >= current.length) return false;
+    current[index] = next;
+    return true;
+  }
+  if (!isPlainObject(current)) return false;
+  current[last] = next;
+  return true;
+}
+
+export function sectionDef(schema: Schema, type: string) {
+  return schema.objects.find((entry) => entry.name === type && entry.type === "section");
+}
+
+export function arrayObjectFields(schema: Schema, field: FieldDef): FieldDef[] {
+  const item = field.items?.find((entry) => entry.type === "object" && entry.name);
+  if (!item || item.type !== "object") return [];
+  return objectDef(schema, item.name!).fields;
+}
+
+export function fieldByKey(fields: FieldDef[], key: string): FieldDef | undefined {
+  return fields.find((field) => field.key === key);
+}
+
+export function regenerateKeys<T>(value: T): T {
+  if (Array.isArray(value)) return value.map((item) => regenerateKeys(item)) as T;
+  if (!isPlainObject(value)) return value;
+  const next: Record<string, unknown> = {};
+  for (const [key, child] of Object.entries(value)) next[key] = regenerateKeys(child);
+  if (typeof value._key === "string") next._key = newKey();
+  return next as T;
+}
+
+export function newDocumentFromTemplate(schema: Schema, typeName: string, title: string, slug: string): Record<string, unknown> {
+  if (!SLUG_PATTERN.test(slug)) throw new Error("Slug must be lowercase letters, numbers and single dashes.");
+  const def = documentDef(schema, typeName);
+  const data: Record<string, unknown> = { ...def.initialValue, _id: `${typeName}:${slug}`, _type: typeName, slug };
+  for (const field of def.fields) {
+    if (field.key === "title") data.title = title;
+    else if (field.key === "name" && !def.fields.some(field => field.key === "title")) data.name = title;
+    else if (data[field.key] !== undefined) continue;
+    else if (field.initialValue !== undefined) data[field.key] = field.initialValue;
+    else if (field.type === "array") data[field.key] = [];
+  }
+  if (def.template?.length) {
+    data.sections = def.template.map((section) => {
+      const sectionType = sectionDef(schema, section.type);
+      if (!sectionType) throw new Error(`Template references unknown section ${section.type}`);
+      const values: Record<string, unknown> = { _key: newKey(), _type: section.type };
+      for (const field of sectionType.fields) {
+        if (section.values && Object.hasOwn(section.values, field.key)) values[field.key] = section.values[field.key];
+        else if (field.initialValue !== undefined) values[field.key] = field.initialValue;
+        else if (field.type === "array") values[field.key] = [];
+      }
+      return values;
+    });
+  }
+  return regenerateKeys(data);
+}
+
+export function assertUniqueSlug(documents: ContentDocument[], typeName: string, slug: string, legacySlugs: string[] = []) {
+  if (!SLUG_PATTERN.test(slug)) throw new Error("Slug must be lowercase letters, numbers and single dashes.");
+  if (documents.some((doc) => doc.type === typeName && doc.slug === slug)) throw new Error(`A ${typeName} document with slug "${slug}" already exists.`);
+  if (legacySlugs.includes(slug)) throw new Error(`The slug "${slug}" is already used by a copy page.`);
+}
+
+export function pageRoute(slug: string, mapping: { url: string; index?: string } | undefined): string | null {
+  if (!mapping) return null;
+  if (slug === "home" && mapping.index) return mapping.index;
+  const path = mapping.url.replaceAll("{slug}", slug);
+  return /^\/(?!\/)/.test(path) && !/[\\\s?#]/.test(path) && !path.split("/").includes("..") && !/^\/rigel(?:\/|$)/.test(path) ? path : null;
+}

package/src/schema/store.ts

@@ -0,0 +1,141 @@
+import { randomUUID } from "node:crypto";
+import { link, lstat, mkdir, open, readdir, realpath, rename, unlink } from "node:fs/promises";
+import path from "node:path";
+import { constants } from "node:fs";
+import { isPlainObject } from "./validate";
+import { SLUG_PATTERN, type ContentDocument, type Schema } from "./types";
+
+const MAX_BYTES = 1024 * 1024;
+const FOLDER_PART = /^[a-zA-Z0-9_-][a-zA-Z0-9_. -]*$/;
+
+export class DocumentStoreError extends Error {
+  status: number;
+  constructor(message: string, status = 400) {
+    super(message);
+    this.status = status;
+  }
+}
+
+async function resolveRoot(root: string): Promise<string> {
+  const real = await realpath(root).catch(() => {
+    throw new DocumentStoreError("Site root is unavailable", 500);
+  });
+  return real;
+}
+
+async function resolveFolder(root: string, folder: string): Promise<string> {
+  if (!folder.split("/").every((part) => FOLDER_PART.test(part))) throw new DocumentStoreError("Unsafe document folder", 500);
+  let directory = await resolveRoot(root);
+  for (const part of folder.split("/")) {
+    directory = path.join(directory, part);
+    const info = await lstat(directory).catch((error: NodeJS.ErrnoException) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (!info) throw new DocumentStoreError(`Document folder ${folder} does not exist`, 500);
+    if (info.isSymbolicLink() || !info.isDirectory()) throw new DocumentStoreError(`Document folder ${folder} must contain only real directories`, 500);
+  }
+  return directory;
+}
+
+async function readJsonFile(file: string): Promise<unknown> {
+  const info = await lstat(file);
+  if (info.isSymbolicLink() || !info.isFile()) throw new DocumentStoreError("Document must be a regular file", 500);
+  if (info.size > MAX_BYTES) throw new DocumentStoreError("Document exceeds the 1 MiB limit", 413);
+  const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    return JSON.parse(await handle.readFile("utf8"));
+  } finally {
+    await handle.close();
+  }
+}
+
+async function ensureFolder(root: string, folder: string): Promise<string> {
+  if (!folder.split("/").every((part) => FOLDER_PART.test(part))) throw new DocumentStoreError("Unsafe document folder", 500);
+  let directory = await resolveRoot(root);
+  for (const part of folder.split("/")) {
+    directory = path.join(directory, part);
+    let info = await lstat(directory).catch((error: NodeJS.ErrnoException) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (!info) {
+      await mkdir(directory);
+      info = await lstat(directory);
+    }
+    if (info.isSymbolicLink() || !info.isDirectory()) throw new DocumentStoreError(`Document folder ${folder} must contain only real directories`, 500);
+  }
+  return directory;
+}
+
+export async function readDocuments(schema: Schema, root: string): Promise<ContentDocument[]> {
+  const documents: ContentDocument[] = [];
+  for (const type of schema.documents) {
+    let directory: string;
+    try {
+      directory = await resolveFolder(root, type.folder);
+    } catch (error) {
+      if (error instanceof DocumentStoreError && error.status === 500 && /does not exist/.test(error.message)) continue;
+      throw error;
+    }
+    const names = (await readdir(directory)).filter((name) => name.endsWith(".json")).sort();
+    for (const name of names) {
+      const slug = name.slice(0, -5);
+      if (!SLUG_PATTERN.test(slug)) throw new DocumentStoreError(`Invalid document filename ${name}`, 500);
+      const data = await readJsonFile(path.join(directory, name));
+      if (!isPlainObject(data)) throw new DocumentStoreError(`Document ${name} must be a JSON object`, 500);
+      if (data._type !== undefined && data._type !== type.name) throw new DocumentStoreError(`${name}: _type must be ${type.name}`, 500);
+      documents.push({ id: `${type.name}:${slug}`, type: type.name, slug, data: data as Record<string, unknown> });
+    }
+  }
+  return documents;
+}
+
+export async function readDocument(schema: Schema, root: string, typeName: string, slug: string): Promise<ContentDocument | null> {
+  const documents = await readDocuments(schema, root);
+  return documents.find((doc) => doc.type === typeName && doc.slug === slug) ?? null;
+}
+
+export async function writeDocument(
+  schema: Schema,
+  root: string,
+  typeName: string,
+  slug: string,
+  data: Record<string, unknown>,
+  mode: "create" | "update",
+): Promise<void> {
+  const type = schema.documents.find((entry) => entry.name === typeName);
+  if (!type) throw new DocumentStoreError(`Unknown document type ${typeName}`, 404);
+  if (mode === "create" && (type.creatable === false || type.singleton)) throw new DocumentStoreError("Creating entries is disabled for this document type", 403);
+  if (!SLUG_PATTERN.test(slug)) throw new DocumentStoreError("Invalid document slug", 400);
+  if (!isPlainObject(data)) throw new DocumentStoreError("Document must be an object", 400);
+  const directory = await ensureFolder(root, type.folder);
+  const file = path.join(directory, `${slug}.json`);
+  const existing = await lstat(file).catch((error: NodeJS.ErrnoException) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (existing && (existing.isSymbolicLink() || !existing.isFile())) throw new DocumentStoreError("Document path is unsafe", 409);
+  if (mode === "create" && existing) throw new DocumentStoreError("A document with that slug already exists", 409);
+  if (mode === "update" && !existing) throw new DocumentStoreError("No such document", 404);
+  const serialized = JSON.stringify(data, null, 2) + "\n";
+  if (Buffer.byteLength(serialized) > MAX_BYTES) throw new DocumentStoreError("Document exceeds the 1 MiB limit", 413);
+  const temporary = path.join(directory, `.${slug}-${randomUUID()}.tmp`);
+  try {
+    const handle = await open(temporary, "wx", 0o600);
+    try {
+      await handle.writeFile(serialized, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    if (mode === "create") await link(temporary, file);
+    else await rename(temporary, file);
+  } catch (error) {
+    if (error instanceof DocumentStoreError) throw error;
+    if ((error as NodeJS.ErrnoException).code === "EEXIST") throw new DocumentStoreError("A document with that slug already exists", 409);
+    throw new DocumentStoreError("Could not write document", 500);
+  } finally {
+    await unlink(temporary).catch(() => {});
+  }
+}