@stacksjs/defaults 0.70.88 → 0.70.91

package/app/Actions/Blog/BlogDestroyAction.ts

@@ -0,0 +1,25 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action, BlogAdminError, deleteBlogPost } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'Blog Destroy',
+  description: 'Deletes a markdown post from content/blog.',
+  method: 'DELETE',
+  async handle(request: RequestInstance) {
+    try {
+      const slug = String(request.getParam('slug') ?? '')
+
+      if (!deleteBlogPost(slug))
+        return response.json({ message: 'Post not found.' }, 404)
+
+      return response.json({ message: 'Post deleted.', slug })
+    }
+    catch (error) {
+      if (error instanceof BlogAdminError)
+        return response.json({ message: error.message }, error.status)
+
+      throw error
+    }
+  },
+})

package/app/Actions/Blog/BlogIndexAction.ts

@@ -0,0 +1,18 @@
+import { Action, listBlogPosts } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'Blog Index',
+  description: 'Lists every markdown post in content/blog, drafts included.',
+  method: 'GET',
+  async handle() {
+    const posts = listBlogPosts()
+
+    return response.json({
+      posts,
+      publishedCount: posts.filter(p => !p.draft).length,
+      draftCount: posts.filter(p => p.draft).length,
+      featuredCount: posts.filter(p => p.featured).length,
+    })
+  },
+})

package/app/Actions/Blog/BlogShowAction.ts

@@ -0,0 +1,25 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action, BlogAdminError, getBlogPost } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'Blog Show',
+  description: 'Returns one markdown post from content/blog, body included.',
+  method: 'GET',
+  async handle(request: RequestInstance) {
+    try {
+      const post = getBlogPost(String(request.getParam('slug') ?? ''))
+
+      if (!post)
+        return response.json({ message: 'Post not found.' }, 404)
+
+      return response.json(post)
+    }
+    catch (error) {
+      if (error instanceof BlogAdminError)
+        return response.json({ message: error.message }, error.status)
+
+      throw error
+    }
+  },
+})

package/app/Actions/Blog/BlogStoreAction.ts

@@ -0,0 +1,21 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action, BlogAdminError, saveBlogPost } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { blogPayload } from './payload'
+
+export default new Action({
+  name: 'Blog Store',
+  description: 'Creates a markdown post in content/blog.',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    try {
+      return response.json(saveBlogPost(blogPayload(request)), 201)
+    }
+    catch (error) {
+      if (error instanceof BlogAdminError)
+        return response.json({ message: error.message }, error.status)
+
+      throw error
+    }
+  },
+})

package/app/Actions/Blog/BlogUpdateAction.ts

@@ -0,0 +1,23 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action, BlogAdminError, saveBlogPost } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { blogPayload } from './payload'
+
+export default new Action({
+  name: 'Blog Update',
+  description: 'Updates a markdown post in content/blog, renaming the file when the slug changes.',
+  method: 'PATCH',
+  async handle(request: RequestInstance) {
+    try {
+      const originalSlug = String(request.getParam('slug') ?? '')
+
+      return response.json(saveBlogPost(blogPayload(request, originalSlug)))
+    }
+    catch (error) {
+      if (error instanceof BlogAdminError)
+        return response.json({ message: error.message }, error.status)
+
+      throw error
+    }
+  },
+})

package/app/Actions/Blog/payload.ts

@@ -0,0 +1,56 @@
+import type { BlogPostInput } from '@stacksjs/actions'
+import type { RequestInstance } from '@stacksjs/types'
+
+/**
+ * `true` only for values that actually mean true over the wire.
+ *
+ * A JSON body gives real booleans, but a form post gives `"true"` / `"on"` and
+ * an unchecked box gives nothing at all. Without this the string `"false"` would
+ * be truthy and every post would save as a draft.
+ */
+function bool(value: unknown): boolean {
+  if (typeof value === 'boolean')
+    return value
+
+  return value === 'true' || value === 'on' || value === 1 || value === '1'
+}
+
+function str(value: unknown): string {
+  return value == null ? '' : String(value)
+}
+
+/**
+ * The slug the caller wants the post to HAVE, read from the request body only.
+ *
+ * `request.get('slug')` cannot be used here: the update route is `/blog/{slug}`,
+ * and `get()` resolves the route param, which shadows the body field of the same
+ * name. That silently turned every rename into a no-op, because the "new" slug
+ * always came back as the current one.
+ */
+function bodySlug(request: RequestInstance): string {
+  const body = (request.jsonBody ?? request.formBody) as Record<string, unknown> | undefined
+
+  return str(body?.slug)
+}
+
+/**
+ * Maps a request body onto the blog-admin input shape.
+ *
+ * `originalSlug` is passed in by the update action (from the route param) rather
+ * than read from the body, so a create can never be mistaken for a rename.
+ */
+export function blogPayload(request: RequestInstance, originalSlug = ''): BlogPostInput {
+  return {
+    slug: bodySlug(request),
+    originalSlug,
+    title: str(request.get('title')),
+    description: str(request.get('description')),
+    date: str(request.get('date')),
+    author: str(request.get('author')),
+    authorBio: str(request.get('authorBio')),
+    poster: str(request.get('poster')),
+    featured: bool(request.get('featured')),
+    draft: bool(request.get('draft')),
+    body: str(request.get('body')),
+  }
+}

package/app/Actions/Cms/PostStoreAction.ts

@@ -13,21 +13,26 @@ export default new Action({
   async handle(request) {
     await request.validate()
 
+    const user = await request.user()
+
+    if (!user)
+      return response.unauthorized('Authentication required')
+
     const author = await authors.findOrCreate({
-      name: 'Current User',
-      email: 'current@user.com',
+      name: user.name,
+      email: user.email,
     })
 
+    const status = request.get('status') || 'draft'
+
     const data = {
       author_id: author.id,
       title: request.get('title'),
       excerpt: request.get('excerpt'),
-      slug: request.get('slug'),
       content: request.get('content'),
-      status: request.get('status'),
+      status,
       poster: request.get('poster'),
       views: 0,
-      published_at: Date.now(),
     }
 
     const model = await posts.store(data)

package/app/Actions/Dashboard/Content/AuthorDestroyAction.ts

@@ -0,0 +1,38 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { rowExists, rowId, timestamp } from './content-input'
+
+/**
+ * `DELETE /api/dashboard/authors/{id}` — deletes a CMS author from the dashboard.
+ *
+ * Posts written by the author are kept and unassigned rather than deleted:
+ * losing an author should not silently take their posts with it. The schema
+ * declares no foreign key on `posts.author_id`, so without this the rows would
+ * be left pointing at an id that no longer resolves.
+ */
+export default new Action({
+  name: 'AuthorDestroyAction',
+  description: 'Deletes a CMS author from the dashboard.',
+  method: 'DELETE',
+  async handle(request: RequestInstance) {
+    const id = rowId(request)
+
+    if (!id)
+      return response.json({ message: 'A valid author id is required.' }, 422)
+
+    if (!await rowExists('authors', id))
+      return response.json({ message: 'Author not found.' }, 404)
+
+    await db
+      .updateTable('posts')
+      .set({ author_id: null, updated_at: timestamp() } as any)
+      .where('author_id', '=', id)
+      .execute()
+
+    await db.deleteFrom('authors').where('id', '=', id).execute()
+
+    return response.json({ message: 'Author deleted.', id })
+  },
+})

package/app/Actions/Dashboard/Content/AuthorIndexAction.ts

@@ -1,51 +1,65 @@
 import { Action } from '@stacksjs/actions'
-import { Author } from '@stacksjs/orm'
+import { db } from '@stacksjs/database'
 
-// Mock data used when the ORM is unavailable (e.g. dashboard dev with no DB
-// seeded). Shape matches the `Author` interface in
-// storage/framework/defaults/views/dashboard/content/authors/index.stx so
-// the page can hydrate directly from this response.
-const mockAuthors = [
-  { id: 1, name: 'Jane Doe', email: 'jane@example.com', role: 'Editor', avatar: 'https://i.pravatar.cc/150?img=1', bio: 'Tech writer with 10+ years of experience covering web frameworks and performance.', postCount: 24, totalViews: 145000, totalComments: 312, created_at: '2022-01-15' },
-  { id: 2, name: 'John Smith', email: 'john@example.com', role: 'Author', avatar: 'https://i.pravatar.cc/150?img=2', bio: 'Specialist in TypeScript and frontend tooling.', postCount: 18, totalViews: 98000, totalComments: 220, created_at: '2022-04-08' },
-  { id: 3, name: 'Michael Brown', email: 'michael@example.com', role: 'Author', avatar: 'https://i.pravatar.cc/150?img=3', bio: 'Reviews hardware and software for developers.', postCount: 12, totalViews: 64000, totalComments: 145, created_at: '2022-09-21' },
-  { id: 4, name: 'Emily Davis', email: 'emily@example.com', role: 'Author', avatar: 'https://i.pravatar.cc/150?img=4', bio: 'Accessibility advocate and design systems engineer.', postCount: 9, totalViews: 41000, totalComments: 88, created_at: '2023-02-14' },
-  { id: 5, name: 'Sarah Williams', email: 'sarah@example.com', role: 'Author', avatar: 'https://i.pravatar.cc/150?img=5', bio: 'Backend engineer focused on API design and databases.', postCount: 6, totalViews: 22000, totalComments: 47, created_at: '2023-06-30' },
-]
+interface AuthorRow {
+  id: number
+  name: string | null
+  email: string | null
+  bio: string | null
+  avatar: string | null
+  created_at: string | null
+  updated_at: string | null
+}
 
+/**
+ * `GET /api/dashboard/authors` — backs `views/dashboard/content/authors/index.stx`.
+ *
+ * Reads straight from the `authors` table via `db` rather than the ORM model:
+ * `Author` from `@stacksjs/orm` exposes no query methods today, so the previous
+ * `Author.all()` call threw on every request — and the action caught it and
+ * served five hardcoded "Jane Doe" rows, which made an empty (or broken)
+ * dashboard look populated. There is deliberately no fallback now: a failure
+ * here must surface as a failure.
+ *
+ * `postCount` is derived here rather than read off the row. The `authors` table
+ * has no counter column, and nothing would maintain one if it did.
+ */
 export default new Action({
   name: 'AuthorIndexAction',
-  description: 'Returns authors data for the dashboard.',
+  description: 'Returns CMS authors for the dashboard.',
   method: 'GET',
+  apiResponse: true,
   async handle() {
-    try {
-      const allAuthors = await Author.all()
+    const [rows, postAuthors] = await Promise.all([
+      db.selectFrom('authors').selectAll().orderBy('created_at', 'desc').execute() as unknown as Promise<AuthorRow[]>,
+      db.selectFrom('posts').select(['author_id']).execute() as unknown as Promise<Array<{ author_id: number | null }>>,
+    ])
 
-      // Empty result from a real ORM still falls through to mock data so the
-      // dev dashboard always has something to render.
-      if (!allAuthors || allAuthors.length === 0)
-        return { authors: mockAuthors }
+    const postCounts = new Map<number, number>()
+    for (const post of postAuthors) {
+      if (post.author_id == null)
+        continue
 
-      const authors = allAuthors.map((a, idx) => {
-        const name = String(a.get('name') || '')
-        return {
-          id: Number(a.get('id') || idx + 1),
-          name,
-          email: String(a.get('email') || ''),
-          role: String(a.get('role') || 'Writer'),
-          avatar: String(a.get('avatar') || `https://i.pravatar.cc/150?img=${idx + 1}`),
-          bio: String(a.get('bio') || ''),
-          postCount: Number(a.get('post_count') || a.get('posts') || 0),
-          totalViews: Number(a.get('total_views') || 0),
-          totalComments: Number(a.get('total_comments') || 0),
-          created_at: String(a.get('created_at') || ''),
-        }
-      })
-
-      return { authors }
-    }
-    catch {
-      return { authors: mockAuthors }
+      const id = Number(post.author_id)
+      postCounts.set(id, (postCounts.get(id) || 0) + 1)
     }
+
+    const authors = rows.map(row => ({
+      id: Number(row.id),
+      name: String(row.name || ''),
+      email: String(row.email || ''),
+      bio: String(row.bio || ''),
+      avatar: String(row.avatar || ''),
+      postCount: postCounts.get(Number(row.id)) || 0,
+      created_at: row.created_at || null,
+      updated_at: row.updated_at || null,
+    }))
+
+    // Posts whose author no longer exists are not counted: the stat means
+    // "posts reachable from this list", which is what the page's Assigned Posts
+    // tile claims to show.
+    const assignedPostCount = authors.reduce((sum, author) => sum + author.postCount, 0)
+
+    return { authors, assignedPostCount }
   },
 })

package/app/Actions/Dashboard/Content/AuthorStoreAction.ts

@@ -0,0 +1,61 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { randomUUIDv7 } from 'bun'
+import { findRow, insertedId, str, timestamp } from './content-input'
+
+/**
+ * `POST /api/dashboard/authors` — creates a CMS author from the dashboard.
+ *
+ * Does not reuse `Actions/Cms/AuthorStoreAction`: that runs the `Author` model
+ * validation, which requires a name of at least five characters and rejects the
+ * empty bio/avatar the dashboard dialog submits.
+ *
+ * The email check is done here because `authors_email_name_index` is not a
+ * unique index — nothing in the schema stops a duplicate.
+ */
+export default new Action({
+  name: 'AuthorStoreAction',
+  description: 'Creates a CMS author from the dashboard.',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const name = str(request.get('name')).trim()
+    const email = str(request.get('email')).trim()
+
+    if (!name)
+      return response.json({ message: 'Name is required.' }, 422)
+
+    if (!email)
+      return response.json({ message: 'Email is required.' }, 422)
+
+    const duplicate = await db
+      .selectFrom('authors')
+      .select(['id'])
+      .where('email', '=', email)
+      .executeTakeFirst()
+
+    if (duplicate)
+      return response.json({ message: 'An author with that email already exists.' }, 422)
+
+    const now = timestamp()
+
+    const result = await db
+      .insertInto('authors')
+      .values({
+        uuid: randomUUIDv7(),
+        name,
+        email,
+        created_at: now,
+        updated_at: now,
+      } as any)
+      .executeTakeFirst()
+
+    const id = insertedId(result)
+
+    if (!id)
+      return response.json({ message: 'Could not create author.' }, 500)
+
+    return response.json(await findRow('authors', id), 201)
+  },
+})

package/app/Actions/Dashboard/Content/CategoryDestroyAction.ts

@@ -0,0 +1,30 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { rowExists, rowId } from './content-input'
+
+/**
+ * `DELETE /api/dashboard/categories/{id}` — deletes a CMS category.
+ *
+ * A plain row delete: this schema has no `categorizable_models` pivot table, so
+ * there is nothing to cascade to.
+ */
+export default new Action({
+  name: 'CategoryDestroyAction',
+  description: 'Deletes a CMS category from the dashboard.',
+  method: 'DELETE',
+  async handle(request: RequestInstance) {
+    const id = rowId(request)
+
+    if (!id)
+      return response.json({ message: 'A valid category id is required.' }, 422)
+
+    if (!await rowExists('categories', id))
+      return response.json({ message: 'Category not found.' }, 404)
+
+    await db.deleteFrom('categories').where('id', '=', id).execute()
+
+    return response.json({ message: 'Category deleted.', id })
+  },
+})

package/app/Actions/Dashboard/Content/CategoryIndexAction.ts

@@ -1,27 +1,50 @@
 import { Action } from '@stacksjs/actions'
-import { Category } from '@stacksjs/orm'
+import { db } from '@stacksjs/database'
 
+interface CategoryRow {
+  id: number
+  name: string | null
+  slug: string | null
+  description: string | null
+  is_active: number | null
+  created_at: string | null
+  updated_at: string | null
+}
+
+/**
+ * `GET /api/dashboard/categories` — backs `views/dashboard/content/categories/index.stx`.
+ *
+ * Reads the `categories` table via `db`. The previous `Category.all()` call
+ * threw on every request (the ORM model exposes no query methods) and the catch
+ * turned that into an empty list, so a broken read was indistinguishable from a
+ * CMS with no categories. It also mapped `parent_id` and `post_count`, neither
+ * of which this table has.
+ *
+ * Note this is the same `categories` table the commerce `Category` model owns —
+ * CMS and commerce categories are not separated in the schema today.
+ */
 export default new Action({
   name: 'CategoryIndexAction',
-  description: 'Returns categories data for the dashboard.',
+  description: 'Returns CMS categories for the dashboard.',
   method: 'GET',
+  apiResponse: true,
   async handle() {
-    try {
-      const allCategories = await Category.all()
+    const rows = await db
+      .selectFrom('categories')
+      .selectAll()
+      .orderBy('created_at', 'desc')
+      .execute() as unknown as CategoryRow[]
 
-      const categories = allCategories.map(c => ({
-        id: Number(c.get('id')),
-        name: String(c.get('name') || ''),
-        slug: String(c.get('slug') || ''),
-        description: String(c.get('description') || ''),
-        parentId: c.get('parent_id') || null,
-        postCount: Number(c.get('post_count') || 0),
-      }))
+    const categories = rows.map(row => ({
+      id: Number(row.id),
+      name: String(row.name || ''),
+      slug: String(row.slug || ''),
+      description: String(row.description || ''),
+      is_active: row.is_active == null ? true : Boolean(row.is_active),
+      created_at: row.created_at || null,
+      updated_at: row.updated_at || null,
+    }))
 
-      return { categories }
-    }
-    catch {
-      return { categories: [] }
-    }
+    return { categories }
   },
 })

package/app/Actions/Dashboard/Content/CategoryStoreAction.ts

@@ -0,0 +1,58 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { findRow, insertedId, slugify, str, timestamp } from './content-input'
+
+/**
+ * `POST /api/dashboard/categories` — creates a CMS category from the dashboard.
+ *
+ * The dialog pre-fills the slug from the name but lets it be edited or cleared,
+ * so an empty slug is derived here rather than rejected.
+ */
+export default new Action({
+  name: 'CategoryStoreAction',
+  description: 'Creates a CMS category from the dashboard.',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const name = str(request.get('name')).trim()
+    const description = str(request.get('description'))
+    const slug = slugify(str(request.get('slug')) || name)
+
+    if (!name)
+      return response.json({ message: 'Name is required.' }, 422)
+
+    if (!slug)
+      return response.json({ message: 'Slug could not be derived from the name; enter one.' }, 422)
+
+    const duplicate = await db
+      .selectFrom('categories')
+      .select(['id'])
+      .where('slug', '=', slug)
+      .executeTakeFirst()
+
+    if (duplicate)
+      return response.json({ message: 'A category with that slug already exists.' }, 422)
+
+    const now = timestamp()
+
+    const result = await db
+      .insertInto('categories')
+      .values({
+        name,
+        slug,
+        description,
+        is_active: 1,
+        created_at: now,
+        updated_at: now,
+      } as any)
+      .executeTakeFirst()
+
+    const id = insertedId(result)
+
+    if (!id)
+      return response.json({ message: 'Could not create category.' }, 500)
+
+    return response.json(await findRow('categories', id), 201)
+  },
+})

package/app/Actions/Dashboard/Content/CommentDestroyAction.ts

@@ -0,0 +1,30 @@
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions'
+import { db } from '@stacksjs/database'
+import { response } from '@stacksjs/router'
+import { rowExists, rowId } from './content-input'
+
+/**
+ * `DELETE /api/dashboard/comments/{id}` — deletes a comment from the dashboard.
+ *
+ * A hard delete. The `trash` status exists for the reversible case, and the
+ * page's delete button confirms first.
+ */
+export default new Action({
+  name: 'CommentDestroyAction',
+  description: 'Deletes a CMS comment from the dashboard.',
+  method: 'DELETE',
+  async handle(request: RequestInstance) {
+    const id = rowId(request)
+
+    if (!id)
+      return response.json({ message: 'A valid comment id is required.' }, 422)
+
+    if (!await rowExists('comments', id))
+      return response.json({ message: 'Comment not found.' }, 404)
+
+    await db.deleteFrom('comments').where('id', '=', id).execute()
+
+    return response.json({ message: 'Comment deleted.', id })
+  },
+})