@rigel-cms/rigel 0.2.0-beta.1 → 1.0.0-rc.1

package/src/routes/local-media.ts

@@ -1,15 +1,16 @@
 import type { APIRoute } from "astro";
-import { createHash } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { lstat, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { mediaDirectory, listMedia, loadMediaSidecar, writeMediaSidecar, validateMetaUpdate } from "./media-files";
-import { mediaMetadata, safeMediaName } from "../media-types";
+import { fileURLToPath } from "node:url";
+import { mediaDirectory, listMedia, updateMediaSidecar, deleteMediaFile, validateMetaUpdate } from "./media-files";
+import { DEFAULT_MAX_FILE_SIZE, mediaHeaders, mediaMetadata, safeMediaName } from "../media-types";
 import { validMediaBytes } from "./media-validation";
 import config from "virtual:rigel-config";
 
 export const prerender = false;
 
-export const GET: APIRoute = async ({ params }) => {
+export const GET: APIRoute = async ({ params, request }) => {
   const filename = params.filename ?? "";
   if (import.meta.env.PROD || !safeMediaName(filename) || filename.startsWith(".") || /[/\\\u0000]/.test(filename)) {
     return new Response("Not found", { status: 404 });
@@ -18,12 +19,7 @@ export const GET: APIRoute = async ({ params }) => {
     const file = path.join(await mediaDirectory(config.publicDir!, config.mediaDir), filename);
     if (!(await lstat(file)).isFile() || (await lstat(file)).isSymbolicLink()) throw new Error();
     const bytes = await readFile(file);
-    const metadata = mediaMetadata(filename)!;
-    return new Response(new Uint8Array(bytes), { headers: {
-      "Content-Type": metadata.type,
-      "Content-Disposition": `${metadata.category === "Images" ? "inline" : "attachment"}; filename="${filename}"`,
-      "X-Content-Type-Options": "nosniff",
-    } });
+    return new Response(new Uint8Array(bytes), { headers: mediaHeaders(filename, new URL(request.url).searchParams.get("preview") === "1") });
   } catch {
     return new Response("Not found", { status: 404 });
   }
@@ -41,15 +37,15 @@ export const POST: APIRoute = async ({ request }) => {
   const fallback = ({ "image/jpeg": "jpg", "image/png": "png", "image/webp": "webp" } as Record<string, string>)[mime ?? ""];
   const metadata = supplied ? (safeMediaName(supplied) ? mediaMetadata(supplied) : undefined) : fallback ? mediaMetadata(`image.${fallback}`) : undefined;
   if (!metadata || metadata.type !== mime) return new Response("Unsupported or mismatched media type/filename", { status: 415 });
-  const limit = 10 * 1024 * 1024;
+  const limit = config.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;
   const length = request.headers.get("Content-Length");
   if (length !== null && !/^\d+$/.test(length)) {
     return new Response("Invalid Content-Length", { status: 400 });
   }
   if (length !== null && Number(length) > limit) {
-    return new Response("Image exceeds 10 MiB", { status: 413 });
+    return new Response(`Media exceeds ${limit / 1024 / 1024} MB`, { status: 413 });
   }
-  if (!request.body) return new Response("Empty image body", { status: 400 });
+  if (!request.body) return new Response("Empty media body", { status: 400 });
   const chunks: Uint8Array[] = [];
   let size = 0;
   const reader = request.body.getReader();
@@ -60,7 +56,7 @@ export const POST: APIRoute = async ({ request }) => {
       size += value.byteLength;
       if (size > limit) {
         void reader.cancel().catch(() => {});
-        return new Response("Image exceeds 10 MiB", { status: 413 });
+        return new Response(`Media exceeds ${limit / 1024 / 1024} MB`, { status: 413 });
       }
       chunks.push(value);
     }
@@ -73,24 +69,16 @@ export const POST: APIRoute = async ({ request }) => {
   if (!bytes.length) return new Response("Empty image body", { status: 400 });
   const extension = metadata.extension === "jpeg" ? "jpg" : metadata.extension;
   if (!validMediaBytes(bytes, extension)) return new Response("Media type does not match its bytes", { status: 415 });
-  const filename = `${createHash("sha256").update(bytes).digest("hex")}.${extension}`;
+  const filename = `${randomUUID()}.${extension}`;
   let url = "";
   try {
     const directory = await mediaDirectory(config.publicDir!, config.mediaDir, true);
     const existing = await lstat(path.join(directory, filename)).catch(error => { if (error.code !== "ENOENT") throw error; });
     if (existing && (!existing.isFile() || existing.isSymbolicLink())) throw new Error();
-    try {
-      await writeFile(path.join(directory, filename), bytes, { flag: "wx" });
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
-    }
+    await writeFile(path.join(directory, filename), bytes, { flag: "wx" });
     url = `/${(config.mediaDir ?? "rigel-media").split("/").map(encodeURIComponent).join("/")}/${filename}`;
     const author = (request.headers.get("X-Rigel-Author") ?? "").trim().replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 80);
-    if (author) {
-      const record = await loadMediaSidecar(directory);
-      record[url] = { ...(record[url] ?? {}), author };
-      await writeMediaSidecar(directory, record);
-    }
+    await updateMediaSidecar(directory, url, author ? { author } : {}, { name: (supplied ?? filename).slice(0, 120) });
   } catch {
     return new Response("Could not save image", { status: 500 });
   }
@@ -112,13 +100,30 @@ export const POST: APIRoute = async ({ request }) => {
     const assets = await listMedia(config.publicDir!, config.mediaDir);
     const valid = validateMetaUpdate(body, new Set(assets.map(asset => asset.url)));
     if (!valid.ok) return new Response(valid.error, { status: 400 });
-    const record = await loadMediaSidecar(directory);
     const patch: { name?: string; title?: string; description?: string; alt?: string } = {};
     if (valid.value.name !== undefined) patch.name = valid.value.name;
     if (valid.value.title !== undefined) patch.title = valid.value.title;
     if (valid.value.description !== undefined) patch.description = valid.value.description;
     if (valid.value.alt !== undefined) patch.alt = valid.value.alt;
-    record[valid.value.url] = { ...(record[valid.value.url] ?? {}), ...patch };
-    await writeMediaSidecar(directory, record);
+    try {
+      const file = path.join(fileURLToPath(config.publicDir!), ...valid.value.url.slice(1).split("/").map(decodeURIComponent));
+      await updateMediaSidecar(directory, valid.value.url, patch, {}, file);
+    } catch (error) {
+      return new Response("Could not save metadata", { status: (error as NodeJS.ErrnoException).code === "ENOENT" ? 404 : 500 });
+    }
     return Response.json((await listMedia(config.publicDir!, config.mediaDir)).find(asset => asset.url === valid.value.url) ?? { url: valid.value.url });
   };
+
+export const DELETE: APIRoute = async ({ request }) => {
+  if (import.meta.env.PROD) return new Response("Local backend is dev-only", { status: 404 });
+  if (request.headers.get("Origin") !== new URL(request.url).origin) return new Response("Same-origin request required", { status: 403 });
+  let body: unknown;
+  try { body = await request.json(); } catch { return new Response("Invalid JSON body", { status: 400 }); }
+  if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).length !== 1 || !("url" in body) || typeof body.url !== "string") return new Response("A media URL is required", { status: 400 });
+  try {
+    if (!await deleteMediaFile(config.publicDir!, config.mediaDir, body.url)) return new Response("File not found", { status: 404 });
+    return new Response(null, { status: 204 });
+  } catch {
+    return new Response("Could not delete file. Try again.", { status: 500 });
+  }
+};

package/src/routes/local-menu.ts

@@ -1,4 +1,5 @@
 import type { APIRoute } from "astro";
+import { serializeContentJson } from "../json-output";
 import { constants } from "node:fs";
 import { lstat, open, realpath, rename, unlink } from "node:fs/promises";
 import path from "node:path";
@@ -60,7 +61,7 @@ const handle: APIRoute = async ({ request, params }) => {
     temporary = path.join(path.dirname(file), `.${slug}-${randomUUID()}.tmp`);
     const output = await open(temporary, "wx", 0o600);
     try {
-      await output.writeFile(JSON.stringify(menu, null, 2) + "\n", "utf8");
+      await output.writeFile(serializeContentJson(menu, config.jsonOutput), "utf8");
       await output.sync();
     } finally { await output.close(); }
     await menuFile(slug);

package/src/routes/local-post.ts

@@ -1,4 +1,5 @@
 import type { APIRoute } from "astro";
+import { serializeContentJson } from "../json-output";
 import { writeFile, mkdir, rm, readFile, readdir, rename, link } from "node:fs/promises";
 import { assertUniqueUrlSlugs, normalizeUrlSlug } from "../slugs";
 import { randomUUID } from "node:crypto";
@@ -66,7 +67,7 @@ const savePost: APIRoute = async ({ request, params }) => {
   const fm = { ...body.frontmatter };
   const temporary = `${file}.${randomUUID()}.tmp`;
   try {
-    await writeFile(temporary, JSON.stringify({ frontmatter: fm, body: body.body }, null, 2) + "\n", { flag: "wx" });
+    await writeFile(temporary, serializeContentJson({ frontmatter: fm, body: body.body }, config.jsonOutput), { flag: "wx" });
     if (request.headers.get("If-None-Match") === "*") {
       try { await link(temporary, file); }
       catch (error) {

package/src/routes/media-files.ts

@@ -1,4 +1,4 @@
-import { lstat, mkdir, readFile, readdir, realpath, rename, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, readdir, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { mediaMetadata, safeMediaName } from "../media-types";
 import { fileURLToPath } from "node:url";
@@ -68,6 +68,41 @@ export async function writeMediaSidecar(directory: string, record: Record<string
   await rename(tmp, target);
 }
 
+let pendingSidecarWrite: Promise<unknown> = Promise.resolve();
+function queueMediaWrite<T>(operation: () => Promise<T>): Promise<T> {
+  const update = pendingSidecarWrite.catch(() => {}).then(operation);
+  pendingSidecarWrite = update;
+  return update;
+}
+export function updateMediaSidecar(directory: string, url: string, patch: MediaMeta, defaults: MediaMeta = {}, file?: string): Promise<void> {
+  return queueMediaWrite(async () => {
+    if (file) {
+      const info = await lstat(file);
+      if (!info.isFile() || info.isSymbolicLink()) throw new Error("Unsafe media file");
+    }
+    const record = await loadMediaSidecar(directory);
+    record[url] = { ...defaults, ...(record[url] ?? {}), ...patch };
+    await writeMediaSidecar(directory, record);
+  });
+}
+export function deleteMediaFile(publicDir: string, folder: string | undefined, url: string): Promise<boolean> {
+  return queueMediaWrite(async () => {
+    if (!(await listMedia(publicDir, folder)).some(asset => asset.url === url)) return false;
+    const relative = decodeURIComponent(url.slice(1));
+    const parent = await mediaDirectory(publicDir, path.posix.dirname(relative));
+    const file = path.join(parent, path.posix.basename(relative));
+    const info = await lstat(file);
+    if (!info.isFile() || info.isSymbolicLink()) throw new Error("Unsafe media file");
+    const directory = await mediaDirectory(publicDir, folder);
+    const record = await loadMediaSidecar(directory), next = { ...record };
+    delete next[url];
+    await writeMediaSidecar(directory, next);
+    try { await unlink(file); }
+    catch (error) { await writeMediaSidecar(directory, record); throw error; }
+    return true;
+  });
+}
+
 export function validateMetaUpdate(
   body: unknown,
   existing: Set<string>,

package/src/routes/media-validation.ts

@@ -30,8 +30,8 @@ export function validMediaBytes(bytes: Buffer, extension: string): boolean {
   if (extension === '7z') return starts('377abcaf271c');
   if (extension === 'rar') return starts('526172211a07');
   if (extension === 'tar') return bytes.length >= 512 && text(257, 262) === 'ustar';
-  if (extension === 'csv') {
-    try { const value = new TextDecoder('utf-8', {fatal: true}).decode(bytes); return !/[\u0000-\u0008\u000b\u000c\u000e-\u001f<>]/.test(value) && /[,;\t]/.test(value); } catch { return false; }
+  if (extension === 'csv' || extension === 'txt') {
+    try { const value = new TextDecoder('utf-8', {fatal: true}).decode(bytes); return !/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/.test(value) && (extension === 'txt' || (!/[<>]/.test(value) && /[,;\t]/.test(value))); } catch { return false; }
   }
   return false;
 }

package/src/schema/store.ts

@@ -6,6 +6,7 @@ import { isPlainObject } from "./validate";
 import { SLUG_PATTERN, type ContentDocument, type Schema } from "./types";
 import { normalizeUrlSlug, validateDocumentSlugs } from "../slugs";
 import type { PreviewConfig } from "../preview";
+import { serializeContentJson, type JsonOutput } from "../json-output";
 
 const MAX_BYTES = 1024 * 1024;
 const FOLDER_PART = /^[a-zA-Z0-9_-][a-zA-Z0-9_. -]*$/;
@@ -115,6 +116,7 @@ async function writeDocumentFile(
   data: Record<string, unknown>,
   mode: "create" | "update",
   preview?: PreviewConfig,
+  jsonOutput?: JsonOutput,
 ): Promise<void> {
   const type = schema.documents.find((entry) => entry.name === typeName);
   if (!type) throw new DocumentStoreError(`Unknown document type ${typeName}`, 404);
@@ -137,7 +139,7 @@ async function writeDocumentFile(
     const documents = await readDocuments(schema, root, preview);
     validateDocumentSlugs(schema, [...documents.filter(doc => doc.id !== `${typeName}:${slug}`), { id: `${typeName}:${slug}`, type: typeName, slug, data }], preview);
   } catch (error) { throw new DocumentStoreError((error as Error).message); }
-  const serialized = JSON.stringify(data, null, 2) + "\n";
+  const serialized = serializeContentJson(data, jsonOutput);
   if (Buffer.byteLength(serialized) > MAX_BYTES) throw new DocumentStoreError("Document exceeds the 1 MiB limit", 413);
   const temporary = path.join(directory, `.${slug}-${randomUUID()}.tmp`);
   try {

package/src/vite/manifest-plugin.ts

@@ -19,6 +19,7 @@ export function rigelManifestPlugin(cfg: RigelConfig, publicDir?: URL, root?: UR
   const github: GitHubBackendConfig | undefined = cfg.backend === "github" ? {
     repo: cfg.repo!, branch: cfg.branch!, publishBranch: cfg.publishBranch!, repoRoot: cfg.repoRoot!, authOrigin: cfg.authOrigin!, appSlug: cfg.appSlug!, copyDir: cfg.copyDir,
     collections: collections.map(({ name, folder }) => ({ name, folder })),
+    jsonOutput: cfg.jsonOutput,
     ...(cfg.menus ? { menus: { folder: cfg.menus.folder, maxDepth: cfg.menus.maxDepth! } } : {}),
   } : undefined;
 
@@ -132,9 +133,11 @@ export const menus = {
         return `export default ${JSON.stringify({
           copyDir: cfg.copyDir,
           backend: cfg.backend,
+          jsonOutput: cfg.jsonOutput,
           demo: cfg.demo,
           publicDir: publicDir?.href,
           mediaDir: cfg.mediaDir,
+          maxFileSize: cfg.maxFileSize,
           root: root?.href,
           menus: cfg.menus,
           collections: cfg.collections ?? [],