@setzkasten-cms/astro-admin 0.6.0 → 0.8.0

package/src/api-routes/section-prepare.ts

@@ -1,6 +1,7 @@
 import type { APIRoute } from 'astro'
 import { resolveStorageConfig, prefixPath } from './_storage-config'
 import { generateAddKey } from './section-management'
+import { parseSession, guardPageAccess } from './_auth-guard'
 
 /**
  * POST /api/setzkasten/sections/prepare
@@ -45,6 +46,9 @@ export const POST: APIRoute = async ({ request, cookies }) => {
       return Response.json({ error: 'pageKey and sectionType are required' }, { status: 400 })
     }
 
+    const denied = guardPageAccess(parseSession(cookies.get('setzkasten_session')?.value), pageKey, fullConfig)
+    if (denied) return denied
+
     // 1. Read current page config from GitHub to determine existing keys
     const configKey = '_' + pageKey.replace(/\//g, '_')
     const pageConfigPath = `${contentPath}/pages/${configKey}.json`

package/src/api-routes/updater-check.ts

@@ -0,0 +1,49 @@
+import type { APIRoute } from 'astro'
+
+/**
+ * Lightweight update check without re-registration.
+ *
+ * GET /api/setzkasten/updater/check?instanceId=X
+ */
+export const GET: APIRoute = async ({ cookies, url }) => {
+  const session = cookies.get('setzkasten_session')?.value
+  if (!session) {
+    return new Response('Unauthorized', { status: 401 })
+  }
+
+  const config = (globalThis as any).__SETZKASTEN_CONFIG__ as {
+    updaterUrl?: string
+    version?: string
+  } | undefined
+
+  const updaterUrl = config?.updaterUrl
+  if (!updaterUrl) {
+    return Response.json({
+      updateAvailable: false,
+      latestVersion: config?.version ?? 'unknown',
+      releaseNotesUrl: '',
+    })
+  }
+
+  const instanceId = url.searchParams.get('instanceId') ?? ''
+
+  try {
+    const response = await fetch(
+      `${updaterUrl}/api/check-update?instanceId=${encodeURIComponent(instanceId)}`,
+      { signal: AbortSignal.timeout(5000) },
+    )
+
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status}`)
+    }
+
+    const data = await response.json()
+    return Response.json(data)
+  } catch {
+    return Response.json({
+      updateAvailable: false,
+      latestVersion: config?.version ?? 'unknown',
+      releaseNotesUrl: '',
+    })
+  }
+}

package/src/api-routes/updater-register.ts

@@ -0,0 +1,107 @@
+import type { APIRoute } from 'astro'
+
+/**
+ * Registers this Setzkasten instance with the central updater backend.
+ * Called on every Dashboard load. Returns update status and license tier.
+ *
+ * POST /api/setzkasten/updater/register
+ *
+ * Body (optional — for UI activation flow):
+ *   { licenseEmail: string, licenseKey: string }
+ *
+ * Priority for credentials:
+ *   1. Config (`setzkasten.config.ts` → license.{email,key}) — always wins if set
+ *   2. Request body — UI activation flow, one-time
+ *   3. Firebase instance fallback — stored binding from previous activation
+ */
+export const POST: APIRoute = async ({ cookies, request }) => {
+  const session = cookies.get('setzkasten_session')?.value
+  if (!session) {
+    return new Response('Unauthorized', { status: 401 })
+  }
+
+  const config = (globalThis as any).__SETZKASTEN_CONFIG__ as {
+    updaterUrl?: string
+    version?: string
+    websiteUrl?: string
+    storage?: { owner?: string; repo?: string }
+  } | undefined
+
+  const fullConfig = (globalThis as any).__SETZKASTEN_FULL_CONFIG__ as {
+    license?: { email?: string; key?: string; telemetryEnabled?: boolean }
+  } | undefined
+
+  const currentVersion = config?.version ?? '0.0.0'
+  const updaterUrl = config?.updaterUrl
+  if (!updaterUrl) {
+    return Response.json({
+      instanceId: null,
+      updateAvailable: false,
+      currentVersion,
+      latestVersion: null,
+      releaseNotesUrl: '',
+      licenseTier: 'free',
+      licenseValid: false,
+    })
+  }
+
+  const owner = config?.storage?.owner ?? ''
+  const repo = config?.storage?.repo ?? ''
+  const repoUrl = owner && repo ? `${owner}/${repo}` : ''
+  const websiteUrl = config?.websiteUrl ?? ''
+  const configLicense = fullConfig?.license
+
+  // ── Parse optional UI activation payload ──────────────────────────────
+  let uiEmail: string | undefined
+  let uiKey: string | undefined
+  try {
+    if (request.headers.get('content-type')?.includes('application/json')) {
+      const parsed = await request.json() as { licenseEmail?: string; licenseKey?: string }
+      uiEmail = parsed.licenseEmail?.trim() || undefined
+      uiKey = parsed.licenseKey?.trim() || undefined
+    }
+  } catch {
+    // Empty / malformed body is fine — treat as no UI input
+  }
+
+  // Config wins over UI. UI only applies if config has no license.
+  const licenseEmail = configLicense?.email ?? uiEmail
+  const licenseKey = configLicense?.key ?? uiKey
+
+  try {
+    const response = await fetch(`${updaterUrl}/api/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        repoUrl,
+        websiteUrl,
+        currentVersion,
+        licenseEmail,
+        licenseKey,
+        telemetryEnabled: configLicense?.telemetryEnabled !== false,
+        managedWebsites: [],
+      }),
+      signal: AbortSignal.timeout(5000),
+    })
+
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status}`)
+    }
+
+    const data = await response.json() as { firebaseConfig?: { apiKey: string; authDomain: string; projectId: string }; [key: string]: unknown }
+
+    // Pass firebaseConfig through if the Updater returned one (Pro/Enterprise licenses).
+    // Writing to _global_config.json is done explicitly via the GlobalConfigView activation flow.
+    return Response.json({ ...data, currentVersion, _firebaseConfig: data.firebaseConfig ?? null })
+  } catch {
+    return Response.json({
+      instanceId: null,
+      updateAvailable: false,
+      currentVersion,
+      latestVersion: null,
+      releaseNotesUrl: '',
+      licenseTier: 'free',
+      licenseValid: false,
+    })
+  }
+}

package/src/api-routes/updater-transfer.ts

@@ -0,0 +1,62 @@
+import type { APIRoute } from 'astro'
+import { createHash } from 'node:crypto'
+
+/**
+ * Transfer a license to the current Setzkasten instance.
+ *
+ * POST /api/setzkasten/updater/transfer
+ */
+export const POST: APIRoute = async ({ cookies }) => {
+  const session = cookies.get('setzkasten_session')?.value
+  if (!session) {
+    return new Response('Unauthorized', { status: 401 })
+  }
+
+  const config = (globalThis as any).__SETZKASTEN_CONFIG__ as {
+    updaterUrl?: string
+    websiteUrl?: string
+    storage?: { owner?: string; repo?: string }
+  } | undefined
+
+  const fullConfig = (globalThis as any).__SETZKASTEN_FULL_CONFIG__ as {
+    license?: { email?: string; key?: string }
+  } | undefined
+
+  const updaterUrl = config?.updaterUrl
+  if (!updaterUrl) {
+    return Response.json({ error: 'Updater not configured' }, { status: 400 })
+  }
+
+  const license = fullConfig?.license
+  if (!license?.key || !license?.email) {
+    return Response.json({ error: 'No license configured' }, { status: 400 })
+  }
+
+  const owner = config?.storage?.owner ?? ''
+  const repo = config?.storage?.repo ?? ''
+  const repoUrl = owner && repo ? `${owner}/${repo}` : ''
+  const websiteUrl = config?.websiteUrl ?? ''
+
+  // Compute deterministic instanceId (same as backend register)
+  const raw = (repoUrl || 'unknown') + '|' + (websiteUrl || 'unknown')
+  const instanceId = createHash('sha256').update(raw).digest('hex').slice(0, 32)
+
+  try {
+    const response = await fetch(`${updaterUrl}/api/transfer`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        licenseKey: license.key,
+        licenseEmail: license.email,
+        toInstanceId: instanceId,
+        toWebsiteUrl: websiteUrl,
+      }),
+      signal: AbortSignal.timeout(5000),
+    })
+
+    const data = await response.json()
+    return Response.json(data, { status: response.status })
+  } catch {
+    return Response.json({ error: 'Transfer failed' }, { status: 500 })
+  }
+}

package/src/api-routes/updater-unbind.ts

@@ -0,0 +1,59 @@
+import type { APIRoute } from 'astro'
+import { createHash } from 'node:crypto'
+
+/**
+ * Release the license binding for this Setzkasten instance.
+ *
+ * POST /api/setzkasten/updater/unbind
+ *
+ * Reads license credentials from either:
+ *   1. `setzkasten.config.ts` → license.{email,key}
+ *   2. Request body (UI removal flow): { licenseEmail, licenseKey }
+ *
+ * On success, Firebase clears `instance.licenseKey` and removes this
+ * instance from `license.boundTo` / `license.boundInstances`.
+ */
+export const POST: APIRoute = async ({ cookies, request }) => {
+  const session = cookies.get('setzkasten_session')?.value
+  if (!session) {
+    return new Response('Unauthorized', { status: 401 })
+  }
+
+  const config = (globalThis as any).__SETZKASTEN_CONFIG__ as {
+    updaterUrl?: string
+    websiteUrl?: string
+    storage?: { owner?: string; repo?: string }
+  } | undefined
+
+  const fullConfig = (globalThis as any).__SETZKASTEN_FULL_CONFIG__ as {
+    license?: { email?: string; key?: string }
+  } | undefined
+
+  const updaterUrl = config?.updaterUrl
+  if (!updaterUrl) {
+    return Response.json({ error: 'Updater not configured' }, { status: 400 })
+  }
+
+  const owner = config?.storage?.owner ?? ''
+  const repo = config?.storage?.repo ?? ''
+  const repoUrl = owner && repo ? `${owner}/${repo}` : ''
+  const websiteUrl = config?.websiteUrl ?? ''
+
+  // Compute deterministic instanceId (same as backend register)
+  const raw = (repoUrl || 'unknown') + '|' + (websiteUrl || 'unknown')
+  const instanceId = createHash('sha256').update(raw).digest('hex').slice(0, 32)
+
+  try {
+    const response = await fetch(`${updaterUrl}/api/unbind`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ instanceId }),
+      signal: AbortSignal.timeout(5000),
+    })
+
+    const data = await response.json()
+    return Response.json(data, { status: response.status })
+  } catch {
+    return Response.json({ error: 'Unbind failed' }, { status: 500 })
+  }
+}

package/src/init/__tests__/page-level.test.ts

@@ -1031,3 +1031,50 @@ describe('Nested map live-edit: inner items have data-sk-field', () => {
     expect(patched).toMatch(/sections.*map.*section.*_i/)
   })
 })
+
+// ---------------------------------------------------------------------------
+// Template literal variables in frontmatter must NOT become content fields
+// Reproduces: docs/catalog page with code examples in template literals
+// ---------------------------------------------------------------------------
+
+describe('Page-level: template literal variables not extracted as fields', () => {
+  let section: Awaited<ReturnType<typeof analyzeAstroSection>>
+
+  beforeAll(async () => {
+    const source = readFileSync(join(SECTIONS_DIR, 'PageWithTemplateLiterals.astro'), 'utf-8')
+    section = await analyzeAstroSection(source, '_page_docs_example', 'docsExamplePage', 'src/pages/docs/example.astro', { mode: 'page' })
+  })
+
+  it('should detect the real content fields (heading, description)', () => {
+    const keys = section.fields.map(f => f.key)
+    expect(keys).toContain('heading')
+    expect(keys).toContain('description')
+  })
+
+  it('should NOT extract variables from inside template literal strings (templates, hero, json, template)', () => {
+    const keys = section.fields.map(f => f.key)
+    expect(keys).not.toContain('templates')
+    expect(keys).not.toContain('hero')
+    expect(keys).not.toContain('json')
+    expect(keys).not.toContain('template')
+  })
+
+  it('should NOT extract the code variables themselves (exampleCode, cliCode, apiCode)', () => {
+    const keys = section.fields.map(f => f.key)
+    expect(keys).not.toContain('exampleCode')
+    expect(keys).not.toContain('cliCode')
+    expect(keys).not.toContain('apiCode')
+  })
+
+  it('should find only legitimate fields (no spurious template-literal variables)', () => {
+    const keys = section.fields.map(f => f.key)
+    // Only real content fields should be present — no code variable names
+    const spurious = ['templates', 'hero', 'json', 'template', 'exampleCode', 'cliCode', 'apiCode']
+    for (const key of spurious) {
+      expect(keys).not.toContain(key)
+    }
+    // heading and description must be present
+    expect(keys).toContain('heading')
+    expect(keys).toContain('description')
+  })
+})

package/src/init/__tests__/section-pipeline.test.ts

@@ -68,7 +68,9 @@ function checkCssIntegrity(
   return { ok: lost.length === 0, lost }
 }
 
-const SK_FIELD_NOT_NEEDED = new Set(['image', 'icon'])
+// icon and image fields now get data-sk-field via patchIconOrImageField
+// (only when the patcher can find a suitable container in the AST)
+const SK_FIELD_NOT_NEEDED = new Set<string>([])
 
 function fieldNeedsSkBinding(field: { key: string; type: string }): boolean {
   if (SK_FIELD_NOT_NEEDED.has(field.type)) return false

package/src/init/astro-section-analyzer-v2.ts

@@ -201,16 +201,43 @@ function splitAstroFile(source: string): { frontmatter: string; template: string
   return { frontmatter, template: source.slice(templateStart), templateOffset: templateStart }
 }
 
+function stripTemplateLiterals(source: string): string {
+  let result = ''
+  let i = 0
+  while (i < source.length) {
+    if (source[i] === '`') {
+      // Skip entire template literal (including nested ${...} expressions)
+      i++
+      let depth = 0
+      while (i < source.length) {
+        if (source[i] === '\\') { i += 2; continue }
+        if (source[i] === '$' && source[i + 1] === '{') { depth++; i += 2; continue }
+        if (source[i] === '{') { depth++; i++; continue }
+        if (source[i] === '}' && depth > 0) { depth--; i++; continue }
+        if (source[i] === '`' && depth === 0) { i++; break }
+        i++
+      }
+      result += '``' // placeholder so surrounding code stays parseable
+    } else {
+      result += source[i]
+      i++
+    }
+  }
+  return result
+}
+
 function extractFrontmatterVariables(frontmatter: string): string[] {
+  // Strip template literals so code inside backtick strings isn't parsed as variables
+  const stripped = stripTemplateLiterals(frontmatter)
   const variables: string[] = []
   const constRegex = /(?:const|let)\s+(\w+)\s*=\s*(.*)/g
   let match: RegExpExecArray | null
-  while ((match = constRegex.exec(frontmatter)) !== null) {
+  while ((match = constRegex.exec(stripped)) !== null) {
     const name = match[1]!
     const rhs = match[2]?.trim() ?? ''
     if (isInternalVariable(name)) continue
     // Skip exported declarations (e.g. "export const prerender = true")
-    const charBefore = match.index > 0 ? frontmatter.slice(Math.max(0, match.index - 10), match.index) : ''
+    const charBefore = match.index > 0 ? stripped.slice(Math.max(0, match.index - 10), match.index) : ''
     if (/export\s*$/.test(charBefore)) continue
     if (/\.\s*map\s*\(/.test(rhs) || /\w+\?\.\w+/.test(rhs)) continue
     if (/^\[/.test(rhs) && /^default/i.test(name)) continue

package/src/init/template-patcher-v2.ts

@@ -296,6 +296,15 @@ export async function patchTemplateForFields(
       continue
     }
 
+    // --- Icon / Image fields: add data-sk-field to their container element ---
+    // These fields can't be matched by text content. Instead we look for:
+    // 1. A CMS expression referencing this field (e.g. {skData?.icon} as an attr value)
+    // 2. A component/element with an `icon` or `src`/image prop that matches the default
+    if (field.type === 'icon' || field.type === 'image') {
+      patchIconOrImageField(source, sectionKey, field, varName, ast, edits)
+      continue
+    }
+
     // Fields without string defaultValue can't be matched by content
     if (!field.defaultValue || typeof field.defaultValue !== 'string') continue
     if (field.defaultValue.length < 2) continue
@@ -607,6 +616,64 @@ function patchMixedContentField(
   })
 }
 
+/**
+ * Patches an icon or image field by finding the nearest suitable container
+ * in the AST and adding data-sk-field to it.
+ *
+ * Strategy:
+ * - For icon: look for an element whose `icon`, `name`, or `data-icon` attribute
+ *   matches the default value, or a component named *Icon* — then add data-sk-field
+ *   to its parent container element.
+ * - For image: look for <img> / <Image> element whose `src` matches the default,
+ *   or an element whose expression refs the field key — add data-sk-field to parent.
+ * - Fallback: skip (no edit, no crash).
+ */
+function patchIconOrImageField(
+  source: string,
+  sectionKey: string,
+  field: { key: string; type: string; defaultValue?: unknown },
+  _varName: string,
+  ast: AstNode,
+  edits: Edit[],
+): void {
+  const bindingKey = `${sectionKey}.${field.key}`
+  const defaultStr = typeof field.defaultValue === 'string' ? field.defaultValue : ''
+
+  let targetParent: AstNode | null = null
+
+  walkAst(ast, (node, parent) => {
+    if (targetParent) return // already found
+    if (!parent || !isElement(parent)) return
+    // Skip if parent already has data-sk-field
+    if (parent.attributes?.some(a => a.name === 'data-sk-field')) return
+
+    if (field.type === 'icon') {
+      // Match component named *Icon* or element with icon/name attr matching default
+      const isIconComp = isElement(node) && /icon/i.test(node.name ?? '')
+      const hasIconAttr = node.attributes?.some(
+        a => (a.name === 'icon' || a.name === 'name' || a.name === 'data-icon') &&
+             (a.value === defaultStr || a.value.includes(field.key))
+      )
+      if (isIconComp || hasIconAttr) {
+        targetParent = parent
+      }
+    } else if (field.type === 'image') {
+      // Match <img> / <Image> / <picture> element
+      const tag = node.name ?? ''
+      const isImgEl = /^(img|Image|picture)$/.test(tag)
+      const hasSrcAttr = node.attributes?.some(
+        a => a.name === 'src' && (a.value === defaultStr || a.value.includes(field.key))
+      )
+      if (isImgEl || hasSrcAttr) {
+        targetParent = parent
+      }
+    }
+  })
+
+  if (!targetParent) return
+  addAttributeToElement(source, targetParent, `data-sk-field="${bindingKey}"`, edits)
+}
+
 function patchCmsBoundField(
   source: string,
   sectionKey: string,