@setzkasten-cms/astro-admin 1.1.0 → 1.4.0

package/src/api-routes/setup-github-app-callback.ts

@@ -27,7 +27,19 @@ export const GET: APIRoute = async ({ url, request, cookies }) => {
     return new Response(null, { status: 302, headers: { Location: adminUrl.toString() } })
   }
 
-  let data: { id: number; slug: string; pem: string } | null = null
+  // GitHub returns a lot more than these five fields (permissions,
+  // events, html_url, …) but these are the only ones we persist for
+  // the wizard. `client_id` + `client_secret` since v1.2: the GH-App
+  // doubles as the OAuth provider for admin login, so the Manifest
+  // exchange replaces what was previously a separate OAuth-App that
+  // the user had to create on github.com/settings/developers.
+  let data: {
+    id: number
+    slug: string
+    pem: string
+    client_id: string
+    client_secret: string
+  } | null = null
   try {
     const response = await fetch(`https://api.github.com/app-manifests/${code}/conversions`, {
       method: 'POST',
@@ -45,7 +57,13 @@ export const GET: APIRoute = async ({ url, request, cookies }) => {
   // Response.redirect() is immutable and blocks subsequent header writes.
   cookies.set(
     COOKIE_NAME,
-    JSON.stringify({ appId: String(data!.id), slug: data!.slug, privateKey: data!.pem }),
+    JSON.stringify({
+      appId: String(data!.id),
+      slug: data!.slug,
+      privateKey: data!.pem,
+      clientId: data!.client_id,
+      clientSecret: data!.client_secret,
+    }),
     { httpOnly: false, sameSite: 'lax', maxAge: COOKIE_MAX_AGE, path: '/' },
   )
 

package/src/api-routes/updater-register.ts

@@ -1,5 +1,23 @@
 import type { APIRoute } from 'astro'
 
+// Vite-define injected by @setzkasten-cms/astro at build time. Available
+// in API-only Vercel cold-starts where the page-ssr injectScript that
+// writes globalThis.__SETZKASTEN_CONFIG__ does not fire.
+declare const __SETZKASTEN_BUILD_CONFIG__: {
+  adminPath?: string
+  updaterUrl?: string
+  version?: string
+  websiteUrl?: string
+  hasGitHub?: boolean
+  storage?: {
+    owner?: string
+    repo?: string
+    branch?: string
+    contentPath?: string
+    assetsPath?: string
+  }
+} | null | undefined
+
 /**
  * Registers this Setzkasten instance with the central updater backend.
  * Called on every Dashboard load. Returns update status and license tier.
@@ -15,12 +33,23 @@ export const POST: APIRoute = async ({ cookies, request }) => {
     return new Response('Unauthorized', { status: 401 })
   }
 
-  const config = (globalThis as any).__SETZKASTEN_CONFIG__ as {
+  // Two layers: the page-ssr injectScript writes __SETZKASTEN_CONFIG__ on
+  // globalThis (only fires for SSR-rendered pages). The Vite-define
+  // __SETZKASTEN_BUILD_CONFIG__ ships the same shape baked into the bundle
+  // and is therefore visible in API-only Vercel cold-starts where the
+  // injectScript never runs. We prefer the runtime globalThis value (it
+  // can pick up later overrides) but fall back to the build constant.
+  type ConfigShape = {
     updaterUrl?: string
     version?: string
     websiteUrl?: string
     storage?: { owner?: string; repo?: string }
-  } | undefined
+  }
+  const buildConfig = (typeof __SETZKASTEN_BUILD_CONFIG__ !== 'undefined'
+    ? __SETZKASTEN_BUILD_CONFIG__
+    : null) as ConfigShape | null
+  const runtimeConfig = (globalThis as any).__SETZKASTEN_CONFIG__ as ConfigShape | undefined
+  const config: ConfigShape | null = runtimeConfig ?? buildConfig
 
   const currentVersion = config?.version ?? '0.0.0'
   const updaterUrl = config?.updaterUrl

package/src/api-routes/webhooks-status.ts

@@ -0,0 +1,17 @@
+import type { APIRoute } from 'astro'
+import { requireAdmin } from './_auth-guard'
+import { getWebhookStatus } from './_webhook-status-store'
+
+/**
+ * GET /api/setzkasten/webhooks/status
+ *
+ * Returns the in-memory status map (lastFiredAt + lastStatus per webhook
+ * id). Empty for cold-started instances; the UI handles that gracefully
+ * with "noch nie gefeuert".
+ */
+export const GET: APIRoute = async ({ cookies }) => {
+  const denied = requireAdmin(cookies.get('setzkasten_session')?.value)
+  if (denied) return denied
+
+  return Response.json({ status: getWebhookStatus() })
+}

package/src/api-routes/webhooks-test.ts

@@ -0,0 +1,134 @@
+import type { APIRoute } from 'astro'
+import {
+  parseWebhooksFile,
+  type WebhookConfig,
+  type WebhookPayload,
+} from '@setzkasten-cms/core'
+import { resolveStorageConfigForRequest } from './_storage-config'
+import { resolveGitHubTokenForRequest } from './_github-token'
+import { parseSession, requireAdmin } from './_auth-guard'
+import { gateFeature } from './_feature-gate'
+import { recordWebhookFire } from './_webhook-status-store'
+import { signPayload } from './_webhook-signing'
+
+const WEBHOOKS_FILE = (contentPath: string) => `${contentPath}/_webhooks.json`
+const TEST_TIMEOUT_MS = 10_000
+
+/**
+ * POST /api/setzkasten/webhooks/test
+ * Body: { id: string }
+ *
+ * Fires a synthetic test payload at the configured URL and returns
+ * { ok, status, latencyMs }. Admin-only, Pro-gated. Used by the UI
+ * "Test-Fire"-Button to verify a webhook config end-to-end.
+ */
+export const POST: APIRoute = async ({ request, cookies }) => {
+  const denied = requireAdmin(cookies.get('setzkasten_session')?.value)
+  if (denied) return denied
+
+  const gate = gateFeature('webhooks')
+  if (gate) return gate
+
+  const session = parseSession(cookies.get('setzkasten_session')?.value)
+  if (!session) return new Response('Unauthorized', { status: 401 })
+
+  let body: { id?: string }
+  try {
+    body = (await request.json()) as { id?: string }
+  } catch {
+    return Response.json({ error: 'Invalid JSON' }, { status: 400 })
+  }
+  if (!body.id) {
+    return Response.json({ error: 'id is required' }, { status: 400 })
+  }
+
+  const tokenResult = await resolveGitHubTokenForRequest(request)
+  if (!tokenResult.ok) return new Response(tokenResult.error.message, { status: 500 })
+
+  const storage = await resolveStorageConfigForRequest(request)
+  if (!storage) {
+    return Response.json({ error: 'Could not resolve owner/repo' }, { status: 400 })
+  }
+  const { owner, repo, branch } = storage
+
+  const serverConfig = (globalThis as {
+    __SETZKASTEN_CONFIG__?: { storage?: { contentPath?: string } }
+  }).__SETZKASTEN_CONFIG__
+  const contentPath = serverConfig?.storage?.contentPath ?? 'content'
+
+  // Read webhooks file directly (no cache — we want the freshly-saved value)
+  const fileRes = await fetch(
+    `https://api.github.com/repos/${owner}/${repo}/contents/${WEBHOOKS_FILE(contentPath)}?ref=${branch}`,
+    {
+      headers: {
+        Authorization: `Bearer ${tokenResult.value}`,
+        Accept: 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28',
+      },
+    },
+  )
+  if (fileRes.status === 404) {
+    return Response.json({ error: 'No webhooks configured' }, { status: 404 })
+  }
+  if (!fileRes.ok) {
+    return Response.json({ error: 'Could not read webhooks file' }, { status: 502 })
+  }
+  const data = (await fileRes.json()) as { content: string; encoding: string }
+  const raw =
+    data.encoding === 'base64'
+      ? Buffer.from(data.content, 'base64').toString('utf-8')
+      : data.content
+  const parsed = parseWebhooksFile(raw)
+  if (!parsed.ok) {
+    return Response.json({ error: 'Webhooks file is malformed' }, { status: 502 })
+  }
+
+  const target: WebhookConfig | undefined = parsed.value.webhooks.find((w) => w.id === body.id)
+  if (!target) {
+    return Response.json({ error: `Webhook "${body.id}" not found` }, { status: 404 })
+  }
+
+  // Build test payload — flagged as a test so receivers can ignore it
+  const payload: WebhookPayload & { test: boolean } = {
+    event: 'content.save',
+    timestamp: new Date().toISOString(),
+    website: { id: owner, repo: `${owner}/${repo}`, branch },
+    user: { email: session.user.email, name: session.user.name },
+    commit: { sha: '0'.repeat(40), message: 'test webhook fire' },
+    files: [],
+    test: true,
+  }
+  const payloadBody = JSON.stringify(payload)
+
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+    'X-Setzkasten-Event': 'content.save',
+    'X-Setzkasten-Delivery': crypto.randomUUID(),
+    'X-Setzkasten-Test': 'true',
+  }
+  if (target.secret) {
+    headers['X-Setzkasten-Signature'] = `sha256=${signPayload(payloadBody, target.secret)}`
+  }
+
+  const startedAt = Date.now()
+  try {
+    const res = await fetch(target.url, {
+      method: 'POST',
+      headers,
+      body: payloadBody,
+      signal: AbortSignal.timeout(TEST_TIMEOUT_MS),
+    })
+    const latencyMs = Date.now() - startedAt
+    recordWebhookFire(target.id, res.status)
+    return Response.json({ ok: res.ok, status: res.status, latencyMs })
+  } catch (err) {
+    const latencyMs = Date.now() - startedAt
+    recordWebhookFire(target.id, 'error')
+    return Response.json({
+      ok: false,
+      status: 'error',
+      latencyMs,
+      error: err instanceof Error ? err.message : 'Unknown error',
+    })
+  }
+}

package/src/api-routes/webhooks.ts

@@ -0,0 +1,163 @@
+import type { APIRoute } from 'astro'
+import {
+  parseWebhooksFile,
+  validateWebhookConfig,
+  type WebhookConfig,
+} from '@setzkasten-cms/core'
+import { resolveStorageConfigForRequest } from './_storage-config'
+import { resolveGitHubTokenForRequest } from './_github-token'
+import { parseSession, requireAdmin } from './_auth-guard'
+import { cachedFetch, invalidateCache } from './_github-cache'
+import { withTrailers } from './_commit-trailers'
+import { gateFeature } from './_feature-gate'
+
+const WEBHOOKS_FILE = (contentPath: string) => `${contentPath}/_webhooks.json`
+
+// ---------------------------------------------------------------------------
+// GET /api/setzkasten/webhooks — list (admin only, cached 60s)
+// ---------------------------------------------------------------------------
+
+export const GET: APIRoute = async ({ request, cookies }) => {
+  const denied = requireAdmin(cookies.get('setzkasten_session')?.value)
+  if (denied) return denied
+
+  const tokenResult = await resolveGitHubTokenForRequest(request)
+  if (!tokenResult.ok) return new Response(tokenResult.error.message, { status: 500 })
+
+  const storage = await resolveStorageConfigForRequest(request)
+  if (!storage) {
+    return Response.json({ error: 'Could not resolve owner/repo' }, { status: 400 })
+  }
+  const { owner, repo, branch } = storage
+  const contentPath = resolveContentPath()
+
+  const cacheKey = `webhooks:${owner}/${repo}:${branch}`
+  const webhooks = await cachedFetch(cacheKey, 60_000, async () => {
+    const res = await fetch(
+      `https://api.github.com/repos/${owner}/${repo}/contents/${WEBHOOKS_FILE(contentPath)}?ref=${branch}`,
+      {
+        headers: {
+          Authorization: `Bearer ${tokenResult.value}`,
+          Accept: 'application/vnd.github+json',
+          'X-GitHub-Api-Version': '2022-11-28',
+        },
+      },
+    )
+    if (res.status === 404) return [] as readonly WebhookConfig[]
+    if (!res.ok) return null
+    const data = (await res.json()) as { content: string; encoding: string }
+    const raw =
+      data.encoding === 'base64'
+        ? Buffer.from(data.content, 'base64').toString('utf-8')
+        : data.content
+    const parsed = parseWebhooksFile(raw)
+    return parsed.ok ? parsed.value.webhooks : null
+  })
+
+  if (webhooks === null) {
+    return Response.json({ error: 'Could not read webhooks file' }, { status: 502 })
+  }
+  return Response.json({ webhooks })
+}
+
+// ---------------------------------------------------------------------------
+// PUT /api/setzkasten/webhooks — replace whole list (admin + Pro-gated)
+// ---------------------------------------------------------------------------
+
+export const PUT: APIRoute = async ({ request, cookies }) => {
+  const denied = requireAdmin(cookies.get('setzkasten_session')?.value)
+  if (denied) return denied
+
+  const gate = gateFeature('webhooks')
+  if (gate) return gate
+
+  const session = parseSession(cookies.get('setzkasten_session')?.value)
+  if (!session) return new Response('Unauthorized', { status: 401 })
+
+  let body: { webhooks?: unknown }
+  try {
+    body = (await request.json()) as { webhooks?: unknown }
+  } catch {
+    return Response.json({ error: 'Invalid JSON' }, { status: 400 })
+  }
+  if (!Array.isArray(body.webhooks)) {
+    return Response.json({ error: 'webhooks must be an array' }, { status: 400 })
+  }
+
+  const validated: WebhookConfig[] = []
+  const seenIds = new Set<string>()
+  for (let i = 0; i < body.webhooks.length; i++) {
+    const result = validateWebhookConfig(body.webhooks[i])
+    if (!result.ok) {
+      return Response.json(
+        { error: result.error.message, index: i },
+        { status: 400 },
+      )
+    }
+    if (seenIds.has(result.value.id)) {
+      return Response.json(
+        { error: `Duplicate webhook id: ${result.value.id}`, index: i },
+        { status: 400 },
+      )
+    }
+    seenIds.add(result.value.id)
+    validated.push(result.value)
+  }
+
+  const tokenResult = await resolveGitHubTokenForRequest(request)
+  if (!tokenResult.ok) return new Response(tokenResult.error.message, { status: 500 })
+
+  const storage = await resolveStorageConfigForRequest(request)
+  if (!storage) {
+    return Response.json({ error: 'Could not resolve owner/repo' }, { status: 400 })
+  }
+  const { owner, repo, branch } = storage
+  const contentPath = resolveContentPath()
+  const filePath = WEBHOOKS_FILE(contentPath)
+
+  const headers = {
+    Authorization: `Bearer ${tokenResult.value}`,
+    Accept: 'application/vnd.github+json',
+    'X-GitHub-Api-Version': '2022-11-28',
+    'Content-Type': 'application/json',
+  }
+
+  // Read current SHA for in-place updates
+  let currentSha: string | null = null
+  const existingRes = await fetch(
+    `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}?ref=${branch}`,
+    { headers },
+  )
+  if (existingRes.ok) {
+    const data = (await existingRes.json()) as { sha: string }
+    currentSha = data.sha
+  }
+
+  const fileBody = JSON.stringify({ version: 1, webhooks: validated }, null, 2)
+  const putBody: Record<string, unknown> = {
+    message: withTrailers('chore(webhooks): update webhook configuration', session.user.email),
+    content: Buffer.from(fileBody).toString('base64'),
+    branch,
+  }
+  if (currentSha) putBody.sha = currentSha
+
+  const putRes = await fetch(
+    `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`,
+    { method: 'PUT', headers, body: JSON.stringify(putBody) },
+  )
+
+  if (!putRes.ok) {
+    const text = await putRes.text()
+    return Response.json({ error: `Webhook write failed: ${text}` }, { status: 502 })
+  }
+
+  invalidateCache(`webhooks:${owner}/${repo}:${branch}`)
+  return Response.json({ ok: true, webhooks: validated })
+}
+
+function resolveContentPath(): string {
+  const serverConfig = (globalThis as {
+    __SETZKASTEN_CONFIG__?: { storage?: { contentPath?: string } }
+  }).__SETZKASTEN_CONFIG__
+  return serverConfig?.storage?.contentPath ?? 'content'
+}

package/src/init/__tests__/patcher-edge-cases.test.ts

@@ -25,9 +25,42 @@
  */
 
 import { describe, it, expect } from 'vitest'
-import { patchTemplateForFields, stripTemplateFallbacks } from '../../init/template-patcher-v2'
+import { patchTemplateForFields, stripTemplateFallbacks, convertToSetHtml } from '../../init/template-patcher-v2'
 import type { PatchField } from '../../init/template-patcher-v2'
 
+// ---------------------------------------------------------------------------
+// convertToSetHtml: auto-upgrade `<tag>{x?.field}</tag>` → `<tag set:html=…>`
+// when the inline RTE introduces HTML markup. Regression: previously the
+// regex only matched skData?.field / item.field, missing hand-rolled section
+// components (apps/website/...) that destructure `data` from Astro.props.
+// ---------------------------------------------------------------------------
+
+describe('convertToSetHtml — variable-name flexibility', () => {
+  it('converts data?.field bindings (Astro.props destructure pattern)', () => {
+    const source = `<h2 data-sk-field="how.heading">{data?.heading}</h2>`
+    expect(convertToSetHtml(source)).toBe(
+      `<h2 data-sk-field="how.heading" set:html={data?.heading}></h2>`,
+    )
+  })
+
+  it('still converts skData?.field bindings (canonical pattern)', () => {
+    const source = `<h2 data-sk-field="how.heading">{skData?.heading}</h2>`
+    expect(convertToSetHtml(source)).toBe(
+      `<h2 data-sk-field="how.heading" set:html={skData?.heading}></h2>`,
+    )
+  })
+
+  it('is idempotent — already-converted templates pass through unchanged', () => {
+    const source = `<h2 data-sk-field="how.heading" set:html={data?.heading}></h2>`
+    expect(convertToSetHtml(source)).toBe(source)
+  })
+
+  it('leaves data-sk-field elements with non-binding content alone', () => {
+    const source = `<h2 data-sk-field="how.heading">Static</h2>`
+    expect(convertToSetHtml(source)).toBe(source)
+  })
+})
+
 // ---------------------------------------------------------------------------
 // Edge Case 1: UTF-8 / multi-byte characters
 //

package/src/init/template-patcher-v2.ts

@@ -351,7 +351,7 @@ export async function patchTemplateForFields(
  * Matches: <tag ...data-sk-field...>{skData?.field}</tag>
  * Result:  <tag ...data-sk-field... set:html={skData?.field}></tag>
  */
-function convertToSetHtml(source: string): string {
+export function convertToSetHtml(source: string): string {
   const marker = 'data-sk-field'
   let result = source
   let searchFrom = 0
@@ -381,9 +381,14 @@ function convertToSetHtml(source: string): string {
     const innerMatch = afterTag.match(/^(\s*)\{([^{}]+)\}(\s*)<\/(\w+)>/)
     if (!innerMatch) continue
 
-    // Only convert CMS bindings (skData?.field or item.field)
-    const expr = innerMatch[2]!
-    if (!/^(?:skData\?\.\w+|item\.\w+)$/.test(expr)) continue
+    // Only convert CMS bindings: a simple property access on a section-data
+    // variable. Templates emitted by this patcher use `skData?.field`, but
+    // hand-rolled section components in the wild commonly use `data?.field`
+    // (the convention in apps/website). Accept any `<name>(?.|.)<field>`
+    // pattern — the surrounding `data-sk-field` already proves this is a CMS
+    // binding, so we don't need to whitelist variable names.
+    const expr = innerMatch[2]!.trim()
+    if (!/^\w+\??\.\w+$/.test(expr)) continue
 
     const fullInnerLength = innerMatch[0]!.length
     const closeTag = `</${innerMatch[4]}>`