@setzkasten-cms/astro-admin 0.8.0 → 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (85) hide show
  1. package/package.json +22 -6
  2. package/src/admin-page.astro +1 -1
  3. package/src/api-routes/__tests__/auth-guard.test.ts +134 -0
  4. package/src/api-routes/__tests__/feature-gate.test.ts +60 -0
  5. package/src/api-routes/__tests__/github-token-for-request.test.ts +112 -0
  6. package/src/api-routes/__tests__/github-token.test.ts +78 -0
  7. package/src/api-routes/__tests__/global-config-theme.test.ts +71 -0
  8. package/src/api-routes/__tests__/history-rollback.test.ts +196 -0
  9. package/src/api-routes/__tests__/history.test.ts +168 -0
  10. package/src/api-routes/__tests__/init-scan-page-resolve-config.test.ts +61 -0
  11. package/src/api-routes/__tests__/license-tier.test.ts +45 -0
  12. package/src/api-routes/__tests__/migrate-to-multi.test.ts +189 -0
  13. package/src/api-routes/__tests__/pages-meta-store.test.ts +179 -0
  14. package/src/api-routes/__tests__/route-registry.test.ts +120 -0
  15. package/src/api-routes/__tests__/session-cookie.test.ts +67 -0
  16. package/src/api-routes/__tests__/setup-github-app-callback.test.ts +152 -0
  17. package/src/api-routes/__tests__/setup-github-app-repos.test.ts +192 -0
  18. package/src/api-routes/__tests__/setup-github-app.test.ts +107 -0
  19. package/src/api-routes/__tests__/storage-config-for-request.test.ts +78 -0
  20. package/src/api-routes/__tests__/webhook-signing.test.ts +39 -0
  21. package/src/api-routes/__tests__/webhooks.test.ts +219 -0
  22. package/src/api-routes/__tests__/website-resolver-bootstrap-standalone.test.ts +85 -0
  23. package/src/api-routes/__tests__/website-resolver-bootstrap.test.ts +108 -0
  24. package/src/api-routes/__tests__/website-resolver.test.ts +123 -0
  25. package/src/api-routes/__tests__/websites-add.test.ts +305 -0
  26. package/src/api-routes/__tests__/websites-list.test.ts +112 -0
  27. package/src/api-routes/__tests__/websites-remove.test.ts +155 -0
  28. package/src/api-routes/_auth-guard.ts +134 -13
  29. package/src/api-routes/_feature-gate.ts +39 -0
  30. package/src/api-routes/_github-token.ts +64 -0
  31. package/src/api-routes/_license-tier.ts +25 -0
  32. package/src/api-routes/_pages-meta-store.ts +134 -0
  33. package/src/api-routes/_role-resolver.ts +60 -0
  34. package/src/api-routes/_session-cookie.ts +42 -0
  35. package/src/api-routes/_storage-config.ts +77 -4
  36. package/src/api-routes/_vercel-origin.ts +22 -0
  37. package/src/api-routes/_webhook-dispatcher.ts +120 -0
  38. package/src/api-routes/_webhook-signing.ts +13 -0
  39. package/src/api-routes/_webhook-status-store.ts +31 -0
  40. package/src/api-routes/_website-resolver.ts +243 -0
  41. package/src/api-routes/_websites-store.ts +120 -0
  42. package/src/api-routes/asset-proxy.ts +6 -4
  43. package/src/api-routes/auth-callback.ts +8 -7
  44. package/src/api-routes/auth-logout.ts +5 -1
  45. package/src/api-routes/auth-setzkasten-login.ts +37 -11
  46. package/src/api-routes/catalog-add.ts +9 -5
  47. package/src/api-routes/catalog-export.ts +8 -4
  48. package/src/api-routes/config.ts +12 -5
  49. package/src/api-routes/editors.ts +94 -10
  50. package/src/api-routes/github-proxy.ts +5 -5
  51. package/src/api-routes/global-config.ts +23 -6
  52. package/src/api-routes/history-rollback.ts +144 -0
  53. package/src/api-routes/history-version.ts +57 -0
  54. package/src/api-routes/history.ts +119 -0
  55. package/src/api-routes/init-add-section.ts +13 -5
  56. package/src/api-routes/init-apply.ts +5 -3
  57. package/src/api-routes/init-migrate.ts +7 -5
  58. package/src/api-routes/init-scan-page.ts +26 -6
  59. package/src/api-routes/init-scan.ts +5 -3
  60. package/src/api-routes/migrate-to-multi.ts +255 -0
  61. package/src/api-routes/pages.ts +118 -4
  62. package/src/api-routes/section-add.ts +15 -5
  63. package/src/api-routes/section-commit-pending.ts +117 -5
  64. package/src/api-routes/section-delete.ts +29 -5
  65. package/src/api-routes/section-duplicate.ts +15 -5
  66. package/src/api-routes/section-prepare-copy.ts +15 -4
  67. package/src/api-routes/section-prepare.ts +9 -5
  68. package/src/api-routes/setup-github-app-bounce.ts +52 -0
  69. package/src/api-routes/setup-github-app-branches.ts +63 -0
  70. package/src/api-routes/setup-github-app-callback.ts +71 -0
  71. package/src/api-routes/setup-github-app-installed.ts +44 -0
  72. package/src/api-routes/setup-github-app-repos.ts +46 -0
  73. package/src/api-routes/setup-github-app.ts +58 -0
  74. package/src/api-routes/updater-register.ts +37 -25
  75. package/src/api-routes/updater-transfer.ts +1 -12
  76. package/src/api-routes/webhooks-status.ts +17 -0
  77. package/src/api-routes/webhooks-test.ts +134 -0
  78. package/src/api-routes/webhooks.ts +163 -0
  79. package/src/api-routes/websites-add.ts +113 -0
  80. package/src/api-routes/websites-list.ts +40 -0
  81. package/src/api-routes/websites-remove.ts +74 -0
  82. package/src/init/__tests__/patcher-edge-cases.test.ts +34 -1
  83. package/src/init/__tests__/patcher-mixed-content-wrapper.test.ts +90 -0
  84. package/src/init/template-patcher-v2.ts +42 -4
  85. package/LICENSE +0 -37
@@ -0,0 +1,90 @@
1
+ /**
2
+ * Patcher: mixed-content RTE wrapper conversion.
3
+ *
4
+ * Bug: Adopting a page like Impressum/Datenschutz where a `<p>` contains
5
+ * text + <br /> tags (e.g. address blocks) leaves the `<p>` as the wrapper
6
+ * with `set:html={skData?.description ?? `…`}`. When the field is later
7
+ * edited via the inline RTE, TipTap's getHTML() returns `<p>…</p>`-wrapped
8
+ * HTML — which then gets injected into the existing `<p data-sk-field>`,
9
+ * producing `<p><p>…</p></p>` at render time. HTML5 forbids `<p>` inside
10
+ * `<p>`, so the browser auto-closes the outer `<p>` immediately:
11
+ *
12
+ * <p data-sk-field="…"></p> ← empty! visible as a tiny outline box
13
+ * <p>LILAPIXEL<br>…</p> ← the actual content, unbound
14
+ *
15
+ * Fix: when patchMixedContentField wraps a phrasing-only element (`<p>`,
16
+ * `<span>`), the wrapper is converted to `<div>`. `<div>` is flow content
17
+ * and accepts arbitrary HTML children (including `<p>`).
18
+ */
19
+
20
+ import { describe, it, expect } from 'vitest'
21
+ import { patchTemplateForFields } from '../../init/template-patcher-v2'
22
+ import type { PatchField } from '../../init/template-patcher-v2'
23
+
24
+ const IMPRESSUM_SECTION = `---
25
+ import BaseLayout from '../layouts/BaseLayout.astro';
26
+ ---
27
+
28
+ <BaseLayout>
29
+ <div class="mx-auto w-full max-w-3xl">
30
+ <h1 class="mb-10 text-3xl font-bold">Impressum</h1>
31
+ <section class="mb-8">
32
+ <h2 class="mb-3 text-xl font-semibold">Angaben gemäß § 5 DDG</h2>
33
+ <p class="text-sk-slate leading-relaxed">
34
+ LILAPIXEL<br />
35
+ Birgit Soring<br />
36
+ Le-Corbusier-Str. 31b<br />
37
+ 26127 Oldenburg
38
+ </p>
39
+ </section>
40
+ </div>
41
+ </BaseLayout>
42
+ `
43
+
44
+ describe('patchMixedContentField — phrasing wrapper conversion', () => {
45
+ const fields: PatchField[] = [
46
+ { key: 'heading', type: 'text', defaultValue: 'Impressum' },
47
+ { key: 'heading2', type: 'text', defaultValue: 'Angaben gemäß § 5 DDG' },
48
+ {
49
+ key: 'description',
50
+ type: 'text',
51
+ defaultValue: 'LILAPIXEL Birgit Soring Le-Corbusier-Str. 31b 26127 Oldenburg',
52
+ },
53
+ ]
54
+
55
+ it('converts a <p> mixed-content wrapper to <div> so RTE-injected <p> children remain valid', async () => {
56
+ const patched = await patchTemplateForFields(IMPRESSUM_SECTION, '_page_impressum', fields, [], { mode: 'page' })
57
+
58
+ // The patched description binding must NOT live on a <p> element —
59
+ // otherwise an RTE-edited value of "<p>…</p>" produces nested <p>'s.
60
+ expect(patched).not.toMatch(/<p[^>]*data-sk-field="_page_impressum\.description"/)
61
+
62
+ // Instead, the wrapper should be a <div> that retains the original classes.
63
+ expect(patched).toMatch(/<div[^>]*class="text-sk-slate leading-relaxed"[^>]*data-sk-field="_page_impressum\.description"/)
64
+ expect(patched).toMatch(/data-sk-field="_page_impressum\.description"[^>]*set:html=\{skData\?\.description/)
65
+
66
+ // The closing tag must match (no </p> for this binding's wrapper).
67
+ // A simple sanity check: the <div ... data-sk-field="…description"> must be followed by </div>.
68
+ const openMatch = patched.match(/<div[^>]*data-sk-field="_page_impressum\.description"[^>]*>/)
69
+ expect(openMatch).toBeTruthy()
70
+ const openIdx = patched.indexOf(openMatch![0])
71
+ const afterOpen = patched.slice(openIdx + openMatch![0].length)
72
+ // The next closing tag for this wrapper must be </div>, not </p>.
73
+ expect(afterOpen).toMatch(/^[\s\S]*?<\/div>/)
74
+ })
75
+
76
+ it('does NOT convert headings — h2 stays h2 even if it had inline content', async () => {
77
+ // Headings rarely host RTE content but must remain semantically intact.
78
+ // patchTextField (not patchMixedContentField) handles plain text headings,
79
+ // so the <h2> should keep its tag name.
80
+ const patched = await patchTemplateForFields(IMPRESSUM_SECTION, '_page_impressum', fields, [], { mode: 'page' })
81
+ expect(patched).toMatch(/<h2[^>]*data-sk-field="_page_impressum\.heading2"/)
82
+ })
83
+
84
+ it('keeps the original <p> classes on the converted <div> wrapper', async () => {
85
+ const patched = await patchTemplateForFields(IMPRESSUM_SECTION, '_page_impressum', fields, [], { mode: 'page' })
86
+ // The Tailwind classes from the original <p class="text-sk-slate leading-relaxed">
87
+ // must be preserved on the new <div>.
88
+ expect(patched).toContain('text-sk-slate leading-relaxed')
89
+ })
90
+ })
@@ -351,7 +351,7 @@ export async function patchTemplateForFields(
351
351
  * Matches: <tag ...data-sk-field...>{skData?.field}</tag>
352
352
  * Result: <tag ...data-sk-field... set:html={skData?.field}></tag>
353
353
  */
354
- function convertToSetHtml(source: string): string {
354
+ export function convertToSetHtml(source: string): string {
355
355
  const marker = 'data-sk-field'
356
356
  let result = source
357
357
  let searchFrom = 0
@@ -381,9 +381,14 @@ function convertToSetHtml(source: string): string {
381
381
  const innerMatch = afterTag.match(/^(\s*)\{([^{}]+)\}(\s*)<\/(\w+)>/)
382
382
  if (!innerMatch) continue
383
383
 
384
- // Only convert CMS bindings (skData?.field or item.field)
385
- const expr = innerMatch[2]!
386
- if (!/^(?:skData\?\.\w+|item\.\w+)$/.test(expr)) continue
384
+ // Only convert CMS bindings: a simple property access on a section-data
385
+ // variable. Templates emitted by this patcher use `skData?.field`, but
386
+ // hand-rolled section components in the wild commonly use `data?.field`
387
+ // (the convention in apps/website). Accept any `<name>(?.|.)<field>`
388
+ // pattern — the surrounding `data-sk-field` already proves this is a CMS
389
+ // binding, so we don't need to whitelist variable names.
390
+ const expr = innerMatch[2]!.trim()
391
+ if (!/^\w+\??\.\w+$/.test(expr)) continue
387
392
 
388
393
  const fullInnerLength = innerMatch[0]!.length
389
394
  const closeTag = `</${innerMatch[4]}>`
@@ -556,10 +561,28 @@ function getElementTextContent(node: AstNode): string {
556
561
  return (node.children ?? []).map(getElementTextContent).join('')
557
562
  }
558
563
 
564
+ /**
565
+ * HTML elements whose content model only allows phrasing content (no block-level
566
+ * children, especially no nested <p>). When such an element is selected as the
567
+ * RTE wrapper, a TipTap-edited value of `<p>…</p>` would be injected via set:html,
568
+ * producing invalid markup like `<p><p>…</p></p>`. The browser auto-closes the
569
+ * outer wrapper immediately, leaving the data-sk-field element empty.
570
+ *
571
+ * Patcher converts these wrappers to <div> (flow content, accepts everything).
572
+ * Headings (<h1>-<h6>) are intentionally not in this list — they are handled
573
+ * by patchTextField, not patchMixedContentField, and converting them would
574
+ * silently drop semantic meaning.
575
+ */
576
+ const PHRASING_ONLY_RTE_WRAPPERS = new Set(['p', 'span'])
577
+
559
578
  /**
560
579
  * Patch a mixed-content element as a rich text field.
561
580
  * Adds data-sk-field + set:html to the element, keeping original HTML as fallback.
562
581
  * The live editor uses the RTE (contentEditable) for this field.
582
+ *
583
+ * If the wrapper is a phrasing-content-only tag (p, span), it is converted to
584
+ * <div> so that future RTE-injected block content (e.g. TipTap's <p>…</p>)
585
+ * remains valid HTML.
563
586
  */
564
587
  function patchMixedContentField(
565
588
  source: string,
@@ -614,6 +637,21 @@ function patchMixedContentField(
614
637
  deleteCount: closeIdx - innerStart,
615
638
  insert: '',
616
639
  })
640
+
641
+ // Phrasing-only wrappers cannot host RTE-injected block content (e.g. <p>).
642
+ // Rewrite the opening + closing tag to <div> while keeping all attributes.
643
+ if (PHRASING_ONLY_RTE_WRAPPERS.has(tagName)) {
644
+ edits.push({
645
+ offset: tagIdx + 1, // position of the tag-name char after '<'
646
+ deleteCount: tagName.length,
647
+ insert: 'div',
648
+ })
649
+ edits.push({
650
+ offset: closeIdx + 2, // position of the tag-name char after '</'
651
+ deleteCount: tagName.length,
652
+ insert: 'div',
653
+ })
654
+ }
617
655
  }
618
656
 
619
657
  /**
package/LICENSE DELETED
@@ -1,37 +0,0 @@
1
- Setzkasten Community License
2
-
3
- Copyright (c) 2026 Lilapixel
4
-
5
- Permission is hereby granted, free of charge, to any person obtaining a copy
6
- of this software and associated documentation files (the "Software"), to use,
7
- copy, modify, merge, publish, and distribute the Software, subject to the
8
- following conditions:
9
-
10
- 1. The above copyright notice and this permission notice shall be included in
11
- all copies or substantial portions of the Software.
12
-
13
- 2. The Software may not be used for commercial purposes without a separate
14
- commercial license from the copyright holder. "Commercial purposes" means
15
- any use of the Software that is primarily intended for or directed toward
16
- commercial advantage or monetary compensation. This includes, but is not
17
- limited to:
18
- - Using the Software to manage content for a commercial website or product
19
- - Offering the Software as part of a paid service
20
- - Using the Software within a for-profit organization
21
-
22
- 3. Non-commercial use is permitted without restriction. This includes:
23
- - Personal projects
24
- - Open source projects
25
- - Educational and academic use
26
- - Non-profit organizations
27
-
28
- 4. A commercial license ("Enterprise License") may be obtained by contacting
29
- Lilapixel at hello@lilapixel.de.
30
-
31
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
32
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
33
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
34
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
35
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
36
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
37
- SOFTWARE.