@tinacms/graphql 3.0.0 → 4.0.1

package/dist/references/visit.d.ts

@@ -0,0 +1,25 @@
+import type { Collectable, TinaSchema } from '@tinacms/schema-tools';
+/** Marks where a rich-text field was parsed: later segments address tree nodes, not stored keys. */
+export declare const MDX_SEGMENT: {
+    readonly mdx: true;
+};
+export type LocatorSegment = string | number | typeof MDX_SEGMENT;
+export type ReferenceVisit = {
+    /** The stored value: the path of the document being referenced. */
+    value: string;
+    /** The collections the field may point at. The index records it under each. */
+    collections: string[];
+    /** The path to it, as keys and list indices from the document root. */
+    locator: LocatorSegment[];
+    /** Replaces the value in the document being walked. */
+    replace: (next: string | null) => void;
+};
+export declare const encodeLocator: (locator: LocatorSegment[]) => string;
+/**
+ * Walks a stored document alongside its schema, visiting every reference it holds, and returns
+ * whether any `replace` was called.
+ *
+ * The index build and the rename and delete rewrites all use this traversal, so they resolve the
+ * same references.
+ */
+export declare const visitReferences: (data: Record<string, unknown>, collectable: Collectable, tinaSchema: TinaSchema, visit: (reference: ReferenceVisit) => void) => boolean;

package/dist/resolve.d.ts

@@ -1,6 +1,7 @@
 import type { GraphQLConfig } from './types';
 import type { Database } from './database';
-export declare const resolve: ({ config, query, variables, database, silenceErrors, verbose, isAudit, ctxUser, }: {
+import { type CtxUser } from './resolver';
+export declare const resolve: ({ config, query, variables, database, silenceErrors, verbose, isAudit, ctxUser, isSignIn, }: {
     config?: GraphQLConfig;
     query: string;
     variables: object;
@@ -8,9 +9,9 @@ export declare const resolve: ({ config, query, variables, database, silenceErro
     silenceErrors?: boolean;
     verbose?: boolean;
     isAudit?: boolean;
-    ctxUser?: {
-        sub: string;
-    };
+    ctxUser?: CtxUser;
+    /** Set only by the generated database client's `authenticate()`. */
+    isSignIn?: boolean;
 }) => Promise<import("graphql").ExecutionResult<{
     [key: string]: any;
 }, {

package/dist/resolver/auth-fields.d.ts

@@ -1,15 +1,56 @@
-import type { TinaSchema } from '@tinacms/schema-tools';
+import type { Collection, TinaSchema } from '@tinacms/schema-tools';
 import type { GraphQLResolveInfo } from 'graphql';
 import type { Resolver } from './index';
-export declare function handleAuthenticate({ tinaSchema, resolver, sub, password, ctxUser, }: {
+export declare function getUserDocumentContext(tinaSchema: TinaSchema, resolver: Resolver): Promise<{
+    collection: Collection<true>;
+    userField: {
+        path: string[];
+        collectable: import("@tinacms/schema-tools").Collectable;
+        idFieldName?: string;
+        passwordFieldName?: string;
+    };
+    users: any;
+    userDoc: {
+        _sys: {
+            title: any;
+            basename: string;
+            filename: string;
+            extension: string;
+            hasReferences: boolean;
+            path: string;
+            relativePath: string;
+            breadcrumbs: string[];
+            collection: Collection<true>;
+            template: string | number;
+        };
+        _values: {
+            _collection: any;
+            _template: any;
+        };
+        _rawData: {
+            _collection: any;
+            _template: any;
+        };
+        _collection: any;
+        _template: any;
+        __typename: string;
+        id: string;
+    };
+    relativePath: string;
+}>;
+export declare function findUserInCollection(users: any[], userField: any, userSub: string): any;
+/**
+ * A stored hash only carries over to a user with the same uid, so a new or
+ * renamed user saved without a password could never sign in.
+ */
+export declare function assertNewUsersHavePasswords(collection: Collection<true>, newBody: Record<string, unknown>, existingData?: Record<string, unknown>): void;
+export declare function handleAuthenticate({ tinaSchema, resolver, sub, password, isSignIn, }: {
     tinaSchema: TinaSchema;
     resolver: Resolver;
     sub?: string;
     password: string;
     info: GraphQLResolveInfo;
-    ctxUser?: {
-        sub?: string;
-    };
+    isSignIn?: boolean;
 }): Promise<any>;
 export declare function handleAuthorize({ tinaSchema, resolver, sub, ctxUser, }: {
     tinaSchema: TinaSchema;
@@ -18,7 +59,7 @@ export declare function handleAuthorize({ tinaSchema, resolver, sub, ctxUser, }:
     info: GraphQLResolveInfo;
     ctxUser?: {
         sub?: string;
-    };
+    } | null;
 }): Promise<any>;
 export declare function handleUpdatePassword({ tinaSchema, resolver, password, ctxUser, }: {
     tinaSchema: TinaSchema;
@@ -27,5 +68,5 @@ export declare function handleUpdatePassword({ tinaSchema, resolver, password, c
     info: GraphQLResolveInfo;
     ctxUser?: {
         sub?: string;
-    };
+    } | null;
 }): Promise<boolean>;

package/dist/resolver/index.d.ts

@@ -4,11 +4,26 @@
 import { Database } from '../database';
 import type { Collectable, Collection, Template, TinaField, TinaSchema } from '@tinacms/schema-tools';
 import type { GraphQLConfig } from '../types';
+export type AuthCollectionWriteOp = 'create' | 'update' | 'rename' | 'delete' | 'addPending' | 'createFolder';
+/**
+ * The signed-in user behind a request. Leave it undefined only when the caller
+ * vouches for the call itself, and pass null when nobody is signed in.
+ */
+export type CtxUser = {
+    sub?: string;
+} | null | undefined;
+type UpdateDocumentArgs = {
+    collectionName: string;
+    relativePath: string;
+    newRelativePath?: string;
+    newBody?: Record<string, unknown>;
+};
 interface ResolverConfig {
     config?: GraphQLConfig;
     database: Database;
     tinaSchema: TinaSchema;
     isAudit: boolean;
+    ctxUser?: CtxUser;
 }
 export declare const createResolver: (args: ResolverConfig) => Resolver;
 export declare const resolveFieldData: ({ namespace, ...field }: TinaField<true>, rawData: unknown, accumulator: {
@@ -66,6 +81,7 @@ export declare class Resolver {
     database: Database;
     tinaSchema: TinaSchema;
     isAudit: boolean;
+    ctxUser: CtxUser;
     constructor(init: ResolverConfig);
     resolveCollection: (_args: any, collectionName: string, hasDocuments?: boolean) => Promise<{
         fields: TinaField<true>[];
@@ -248,6 +264,12 @@ export declare class Resolver {
      */
     private static validateRelativePath;
     private validatePath;
+    private assertAuthCollectionWrite;
+    private assertReferenceUpdates;
+    private isAuthCollectionPath;
+    private withAuthCollectionLock;
+    private isStoredInCollection;
+    private isStoredUser;
     /**
      * Helper method to get collection and construct validated path.
      * This encapsulates the common pattern of getting a collection, joining paths,
@@ -349,12 +371,7 @@ export declare class Resolver {
         __typename: string;
         id: string;
     }>;
-    resolveUpdateDocument: ({ collectionName, relativePath, newRelativePath, newBody, }: {
-        collectionName: string;
-        relativePath: string;
-        newRelativePath?: string;
-        newBody?: Record<string, unknown>;
-    }) => Promise<{
+    resolveUpdateDocument: (args: UpdateDocumentArgs) => Promise<{
         _sys: {
             title: any;
             basename: string;
@@ -380,6 +397,12 @@ export declare class Resolver {
         __typename: string;
         id: string;
     }>;
+    private updateDocument;
+    /**
+     * Rewrites the auth collection's user store without the admin check, so the
+     * caller must check the request user.
+     */
+    updateAuthDocumentInternal: (update: (rawData: Record<string, any>) => Record<string, any>) => Promise<void>;
     resolveDeleteDocument: ({ collectionName, relativePath, }: {
         collectionName: string;
         relativePath: string;
@@ -570,6 +593,14 @@ export declare class Resolver {
             endCursor: string;
         };
     }>;
+    /**
+     * Repoints every reference to `from` at `to`, or clears it when `to` is null.
+     *
+     * Each referring document is re-walked rather than addressed by the locators the index stored,
+     * since a stored path cannot address a reference inside rich text. Only a document the walk
+     * changed is written back.
+     */
+    private rewriteReferences;
     /**
      * Checks if a document has references to it
      * @param id  The id of the document to check for references

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tinacms/graphql",
   "type": "module",
-  "version": "3.0.0",
+  "version": "4.0.1",
   "main": "dist/index.js",
   "module": "./dist/index.js",
   "files": [
@@ -36,15 +36,15 @@
     "gray-matter": "^4.0.3",
     "isomorphic-git": "^1.29.0",
     "js-sha1": "^0.6.0",
-    "js-yaml": "^3.15.1",
+    "js-yaml": "^3.15.2",
     "jsonpath-plus": "^10.3.0",
     "many-level": "^2.0.0",
     "micromatch": "4.0.8",
     "normalize-path": "^3.0.0",
     "readable-stream": "^4.7.0",
     "yup": "^1.6.1",
-    "@tinacms/mdx": "^2.2.3",
-    "@tinacms/schema-tools": "^2.10.0"
+    "@tinacms/mdx": "^2.4.0",
+    "@tinacms/schema-tools": "^2.11.0"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org"
@@ -72,8 +72,8 @@
     "vite": "^4.5.9",
     "vitest": "^0.32.4",
     "zod": "^3.24.2",
-    "@tinacms/schema-tools": "2.10.0",
-    "@tinacms/scripts": "1.6.4"
+    "@tinacms/scripts": "1.6.4",
+    "@tinacms/schema-tools": "2.11.0"
   },
   "scripts": {
     "types": "pnpm tsc",