@websolutespa/bom-next 3.0.0

package/src/proxy/route-proxy.ts

@@ -0,0 +1,187 @@
+import { defaultLocale, defaultMarket, IRoute } from '@websolutespa/bom-core';
+import { NextMiddlewareResult } from 'next/dist/server/web/types';
+import { NextFetchEvent, NextRequest, NextResponse } from 'next/server';
+import { localApiGet } from '../lib/http';
+import { getHrefBeforeRedirect, getNextUrl } from '../server/utils';
+import { getRequestOrigin, Middleware, MiddlewareOptions } from './proxy';
+
+export type Proxy = (request: NextRequest, next: NextFetchEvent) => Promise<NextMiddlewareResult>;
+
+export type RouteMiddlewareOptions = {
+  request: NextRequest,
+  next: NextFetchEvent,
+  route: IRoute,
+  disabled?: boolean,
+};
+export type RouteMiddleware = (props: RouteMiddlewareOptions) => NextMiddlewareResult | Promise<NextMiddlewareResult>;
+
+export type RouteInterceptorProxy = (route: IRoute, request: NextRequest, next: NextFetchEvent) => Promise<NextMiddlewareResult>;
+
+export type ResolvedRoute = IRoute & { splat?: string };
+export type RouteResolverResponse = {
+  parent?: IRoute;
+  route?: ResolvedRoute;
+};
+
+/**
+ * Resolves a public request to a CMS route, then rewrites it to the internal
+ * Next.js page while preserving the original browser URL.
+ *
+ * The resolver call is deliberately made to this request's public origin so it
+ * works behind reverse proxies and deployment hosts. A rewrite keeps routing
+ * server-side, avoiding an extra browser round trip that a redirect would add.
+ */
+export function createRouteProxy(...middlewares: RouteMiddleware[]): Middleware {
+  return async function ({ request, next }: MiddlewareOptions) {
+    const url = request.nextUrl;
+    const origin = getRequestOrigin(request);
+    const hrefBeforeRedirect = getHrefBeforeRedirect(request);
+    const { pathname } = url;
+    const headers = new Headers(request.headers);
+    headers.set('x-pathname', pathname);
+    try {
+      const draftMode = request.cookies.has('__prerender_bypass');
+      console.log('draftMode', draftMode);
+      if (draftMode) {
+        // Draft requests need Payload's native preview behavior, so skip the
+        // route lookup and its database/cache work entirely.
+        return;
+      }
+      // Resolve once before invoking route middleware. This shares the route
+      // snapshot result across all middleware rather than letting each one
+      // repeat the internal API request.
+      const resolution = await localApiGet<RouteResolverResponse>(
+        `/-route?pathname=${url.pathname}&href=${url.href}&hrefBeforeRedirect=${hrefBeforeRedirect}`,
+        {},
+        undefined,
+        origin
+      );
+      const route = resolution?.route;
+      // console.log('createRouteProxy', route);
+      if (route) {
+        let middlewareResponse, i = 0;
+        // Run in registration order and stop at the first response. Later
+        // middleware cannot affect a committed rewrite, so short-circuiting
+        // avoids unnecessary authentication or policy checks.
+        while (i < middlewares.length && !middlewareResponse) {
+          const middleware = middlewares[i] as RouteMiddleware;
+          // console.log('createRouteProxy.middlewares', middlewares.length, typeof middleware === 'function');
+          if (typeof middleware === 'function') {
+            middlewareResponse = await middleware({ request, next, route });
+            if (middlewareResponse) {
+              return middlewareResponse;
+            }
+          }
+          i++;
+        }
+        const nextUrl = getNextUrl(request, route);
+        console.log('createRouteProxy.Found', pathname, '>', nextUrl.pathname);
+        // Pass the resolved route as request headers so the internal page can
+        // render without performing a second route-resolution lookup.
+        headers.set('x-market', route.market);
+        headers.set('x-locale', route.locale);
+        headers.set('x-schema', route.schema);
+        headers.set('x-id', String(route.page));
+        headers.set('x-forwarded-pathname', nextUrl.pathname);
+        const response = NextResponse.rewrite(nextUrl, {
+          request: {
+            headers,
+          },
+        });
+        // const response = NextResponse.redirect(url);
+        return response;
+      } else {
+        const parentRoute = resolution?.parent;
+        // The resolver returns the nearest parent even when no leaf route
+        // matches. Reusing its market and locale makes the 404 contextual
+        // without another lookup; defaults cover an entirely unknown path.
+        const market = parentRoute?.market || defaultMarket;
+        const locale = parentRoute?.locale || defaultLocale;
+        const nextUrl = request.nextUrl.clone();
+        nextUrl.pathname = `/${market}/${locale}/404`;
+        headers.set('x-market', market);
+        headers.set('x-locale', locale);
+        headers.set('x-schema', 'not_found');
+        headers.set('x-id', '404');
+        headers.set('x-forwarded-pathname', nextUrl.pathname);
+        console.log('createRouteProxy.NotFound', pathname);
+        const response = NextResponse
+          .rewrite(nextUrl, {
+            request: {
+              headers,
+            },
+          });
+        return response;
+      }
+    } catch (error: unknown) {
+      const routeError = error && typeof error === 'object'
+        ? error as { status?: number; statusText?: string; url?: string }
+        : {};
+
+      if (routeError.status && routeError.status >= 300 && routeError.status < 400) {
+        console.log('createRouteProxy.3xx', url.pathname, routeError.status, routeError.statusText);
+        const nextUrl = request.nextUrl.clone();
+        // The handler has already validated the redirect target. Redirect the
+        // browser once so its address bar changes, rather than rewriting a
+        // route whose canonical URL is different.
+        nextUrl.pathname = '/';
+        headers.set('x-forwarded-pathname', nextUrl.pathname);
+        const response = NextResponse.redirect(nextUrl, 307);
+        return response;
+      } else if (routeError.status && routeError.status >= 400 && routeError.status < 500) {
+        if (routeError.status === 404) {
+          /**
+           * A resolver miss is not necessarily a CMS 404: it may be a Next.js
+           * file-system route such as an API endpoint or static asset. Letting
+           * Next continue avoids routing those requests through a fallback
+           * render and keeps their fast native handling intact.
+           */
+          // console.log('createRouteProxy.route.notfound', url.pathname);
+          return;
+        }
+        console.log('createRouteProxy.4xx', url.pathname, routeError.status, routeError.statusText);
+        // Other client errors are terminal CMS outcomes, so render the shared
+        // 404 page directly instead of issuing a separate client navigation.
+        const market = defaultMarket;
+        const locale = defaultLocale;
+        const nextUrl = request.nextUrl.clone();
+        nextUrl.pathname = `/${market}/${locale}/404`;
+        headers.set('x-market', market);
+        headers.set('x-locale', locale);
+        headers.set('x-schema', 'not_found');
+        headers.set('x-id', '404');
+        headers.set('x-forwarded-pathname', nextUrl.pathname);
+        console.log('createRouteProxy.NotFound', pathname);
+        const response = NextResponse
+          .rewrite(nextUrl, {
+            request: {
+              headers,
+            },
+          });
+        return response;
+        /*
+        const response = NextResponse.next({
+          status: routeError.status,
+          statusText: routeError.statusText,
+          headers,
+        });
+        return response;
+        */
+      }
+      // A resolver failure must not block unrelated Next.js routes. Returning
+      // undefined delegates to the normal pipeline and avoids masking a
+      // transient upstream failure with a misleading synthetic response.
+      console.log('createRouteProxy.error.5xx', url.pathname, routeError.url, routeError.status, routeError.statusText || error);
+      return;
+    }
+  };
+}
+
+/*
+
+export const routeInterceptor: Proxy = async function (request: NextRequest, next: NextFetchEvent) {
+  const middleware = await createRouteProxy();
+  return await middleware(request, next);
+};
+
+*/

package/src/server/context.ts

@@ -0,0 +1,147 @@
+'use server';
+
+import { headers as getHeaders } from 'next/headers';
+import type { CollectionSlug, SanitizedConfig } from 'payload';
+import { cache } from 'react';
+import { getLabelFromLabels } from '../lib/label';
+import { getLink } from '../lib/link';
+import type { IPageContext, TypedPageContext } from '../types';
+import { getLayout } from './layout';
+import { getPayload } from './mixer';
+import { getPage } from './page';
+
+/**
+ * Per-request context store (React.cache ensures a fresh Map per RSC render).
+ * Safe to use inside Next.js server components — do NOT call this at build time.
+ */
+const PageContext = cache(() => {
+  return new Map<string, any>();
+});
+
+export async function getPageContext<TSlug extends CollectionSlug = CollectionSlug>(): Promise<TypedPageContext<TSlug>> {
+  return {
+    layout: PageContext().get('layout'),
+    page: PageContext().get('page'),
+    user: PageContext().get('user') || null,
+    label: PageContext().get('label'),
+    link: PageContext().get('link'),
+  } as TypedPageContext<TSlug>;
+}
+
+export async function setPageContext<TSlug extends CollectionSlug>(data: TypedPageContext<TSlug>) {
+  const context = PageContext();
+  for (const key in data) {
+    context.set(key, data[key as keyof IPageContext]);
+  }
+}
+
+/**
+ * Same as createPageContext but without draft mode — used for error/not-found pages
+ * that should always show published content regardless of draft mode state.
+ */
+export async function createNotFoundContext<TSlug extends CollectionSlug>(
+  market: string,
+  locale: string,
+  slug: TSlug,
+  id: string,
+  config: Promise<SanitizedConfig>,
+  headers?: Awaited<ReturnType<typeof getHeaders>>
+): Promise<TypedPageContext<TSlug>> {
+  const { payload, user, getContext } = await getPayload({ config, headers });
+  const context = await getContext(market, locale);
+
+  const layout = await getLayout(market, locale, payload, user, context);
+  const page = await getPage(slug, id, market, locale, payload, user, context);
+
+  const label = getLabelFromLabels(layout.labels);
+  const link = (category: string) => getLink(category, layout);
+
+  const pageContext = {
+    layout,
+    page,
+    user,
+    label,
+    link,
+  } as TypedPageContext<TSlug>;
+
+  setPageContext(pageContext);
+
+  return pageContext;
+}
+
+/**
+ * Initialises the full page context using Payload local API.
+ *
+ * Replaces the @websolutespa/bom-next/server createPageContext that goes through the store
+ * abstraction. All data is fetched directly from Payload; the mixer context
+ * (routes + categories) is passed to every payload.find call so that
+ * payload-plugin-bowl can enrich responses.
+ */
+export async function createPageContext<TSlug extends CollectionSlug>(
+  market: string,
+  locale: string,
+  slug: TSlug,
+  id: string,
+  config: Promise<SanitizedConfig>,
+  headers?: Awaited<ReturnType<typeof getHeaders>>
+): Promise<TypedPageContext<TSlug>> {
+
+  // const draft = await draftMode();
+  const draft = { isEnabled: false };
+
+  const { payload, user, getContext } = await getPayload({ config, headers });
+  const context = await getContext(market, locale);
+
+  const layout = await getLayout(market, locale, payload, user, context, draft.isEnabled);
+  const page = await getPage(slug, id, market, locale, payload, user, context, draft.isEnabled);
+
+  const label = getLabelFromLabels(layout.labels);
+  const link = (category: string) => getLink(category, layout);
+
+  const pageContext = {
+    layout,
+    page,
+    user,
+    label,
+    link,
+  } as TypedPageContext<TSlug>;
+
+  setPageContext(pageContext);
+
+  /*
+  if (draft.isEnabled) {
+    draft.disable();
+  }
+  */
+
+  return pageContext;
+}
+
+/**
+ * Layout-only context — no page fetch. Used by RootLayout server components.
+ */
+export async function createLayoutContext(
+  market: string,
+  locale: string,
+  config: Promise<SanitizedConfig>,
+  headers?: Awaited<ReturnType<typeof getHeaders>>
+) {
+  const { payload, user, getContext } = await getPayload({ config, headers });
+  const context = await getContext(market, locale);
+
+  const layout = await getLayout(market, locale, payload, user, context);
+
+  const label = getLabelFromLabels(layout.labels);
+  const link = (category: string) => getLink(category, layout);
+
+  const pageContext = {
+    layout,
+    user,
+    label,
+    link,
+  } as unknown as IPageContext;
+
+  setPageContext(pageContext);
+
+  return pageContext;
+}

package/src/server/handlers/auth.handler.ts

@@ -0,0 +1,27 @@
+import { headers as getHeaders } from 'next/headers';
+import { NextRequest } from 'next/server';
+import { SanitizedConfig } from 'payload';
+import { getPayload } from '../mixer';
+import { getHandlerErrorResponse } from './error-response';
+
+export function getAuthMeHandler(config: Promise<SanitizedConfig>) {
+  return async function (request: NextRequest) {
+    try {
+      const headers = await getHeaders();
+      const { user } = await getPayload({ config, headers });
+      const roles = (user?.roles || []);
+      if (roles.includes('user') && 'firstName' in user) {
+        return Response.json({
+          id: user.id,
+          email: user.email,
+          firstName: user.firstName,
+          lastName: user.lastName,
+        }, { status: 200 });
+      }
+      return Response.json(null, { status: 200 });
+    } catch (error) {
+      console.log('getAuthMeHandler.error', error);
+      return getHandlerErrorResponse(error);
+    }
+  };
+}

package/src/server/handlers/captions.handler.ts

@@ -0,0 +1,32 @@
+import { NextRequest } from 'next/server';
+import { SanitizedConfig } from 'payload';
+import { getHandlerErrorResponse } from './error-response';
+
+export function getCaptionsVTT(config: Promise<SanitizedConfig>) {
+  return async function (request: NextRequest) {
+    try {
+      const searchParams = request.nextUrl.searchParams;
+      const title = searchParams.get('title') || 'Untitled';
+      const body = /* html */`WEBVTT
+
+00:00:01.000 --> 00:00:03.000
+- This video has no audio.
+
+${title ? `
+00:00:04.000 --> 00:00:06.000
+- The title of the video is "${title}".
+` : ''}`;
+      return new Response(body, {
+        status: 200,
+        headers: {
+          'Content-Type': 'text/plain; charset=UTF-8',
+          'X-Frame-Options': 'SAMEORIGIN',
+          'X-Robots-Tag': 'noindex, follow',
+        },
+      });
+    } catch (error: unknown) {
+      console.error('getCaptionsVTT.error', error);
+      return getHandlerErrorResponse(error);
+    }
+  };
+}

package/src/server/handlers/collection.handler.test.ts

@@ -0,0 +1,57 @@
+// @vitest-environment node
+
+import { describe, expect, test } from 'vitest';
+import { getHandlerErrorResponse } from './error-response';
+
+describe('getHandlerErrorResponse', () => {
+    test('preserves a Payload authorization error as a 403 response', async () => {
+        const response = getHandlerErrorResponse({
+            isPublic: true,
+            message: 'You are not allowed to perform this action.',
+            status: 403,
+        });
+
+        expect(response.status).toBe(403);
+        await expect(response.json()).resolves.toEqual({
+            errors: [{
+                message: 'You are not allowed to perform this action.',
+            }],
+        });
+    });
+
+    test('preserves public Payload validation data', async () => {
+        const response = getHandlerErrorResponse({
+            data: {
+                collection: 'page',
+                errors: [{ message: 'Title is required', path: 'title' }],
+            },
+            isPublic: true,
+            message: 'The following field is invalid: Title',
+            name: 'ValidationError',
+            status: 400,
+        });
+
+        expect(response.status).toBe(400);
+        await expect(response.json()).resolves.toEqual({
+            errors: [{
+                data: {
+                    collection: 'page',
+                    errors: [{ message: 'Title is required', path: 'title' }],
+                },
+                message: 'The following field is invalid: Title',
+                name: 'ValidationError',
+            }],
+        });
+    });
+
+    test('hides non-public errors behind a 500 response', async () => {
+        const response = getHandlerErrorResponse(new Error('database unavailable'));
+
+        expect(response.status).toBe(500);
+        await expect(response.json()).resolves.toEqual({
+            errors: [{
+                message: 'Something went wrong.',
+            }],
+        });
+    });
+});

package/src/server/handlers/collection.handler.ts

@@ -0,0 +1,212 @@
+
+import { qsDeserialize } from '@websolutespa/bom-core';
+import { headers as getHeaders } from 'next/headers';
+import { CollectionSlug, GlobalSlug, SanitizedConfig } from 'payload';
+import { getLocalApi } from '../local-api';
+import { getPayload } from '../mixer';
+import { getHandlerErrorResponse } from './error-response';
+
+// find a specific document by id or
+// find paginated documents
+export function collectionGetHandler(config: Promise<SanitizedConfig>) {
+  return async function (request: Request, {
+    params: getParams,
+  }: {
+    params: Promise<{ collections: string[]; }>;
+  }) {
+    try {
+      const headers = await getHeaders();
+      const { payload, user, getContext } = await getPayload({ config, headers });
+      const collectionSlugs = payload.config.collections.map(x => x.slug);
+      const globalSlugs = payload.config.globals.map(x => x.slug);
+      const keys = [
+        ...collectionSlugs,
+        ...globalSlugs,
+      ];
+      keys.sort();
+      const { collections } = await getParams;
+      if (!Array.isArray(collections) || collections?.length === 0) {
+        console.error('storeHandler.collectionGet', 'method not allowed', collections);
+        return new Response('method not allowed', {
+          status: 405,
+          statusText: 'method not allowed',
+        });
+      }
+      const slug = collections[0] as CollectionSlug | GlobalSlug;
+      const id: string = collections[1];
+      const search = new URL(request.url).search;
+      const params = qsDeserialize(search);
+      const context = params.market && params.locale ? await getContext(params.market, params.locale) : undefined;
+      if (!keys.includes(slug)) {
+        console.error('storeHandler.collectionGet', 'keys', slug);
+        console.error('storeHandler.collectionGet', 'method not allowed', slug);
+        return new Response('method not allowed', {
+          status: 405,
+          statusText: 'method not allowed',
+        });
+      }
+      const localApi = await getLocalApi(config, slug);
+      if (id) {
+        // find by id
+        const item = await localApi.findOne({
+          ...params,
+          id,
+          context,
+          user,
+        });
+        if (item) {
+          return Response.json(item);
+        } else {
+          return new Response('not found', {
+            status: 404,
+            statusText: 'not found',
+          });
+        }
+      } else if (String(params.pagination) === 'true') {
+        // find paginated documents
+        const items = await localApi.findPaged({
+          ...params,
+          context,
+          user,
+        });
+        return Response.json(items);
+      } else {
+        // find many
+        const items = await localApi.findMany({
+          ...params,
+          context,
+          user,
+        });
+        return Response.json(items);
+      }
+    } catch (error: unknown) {
+      const response = getHandlerErrorResponse(error);
+      console.error('storeHandler.collectionGet.error', response.status, error);
+      return response;
+    }
+  };
+}
+
+// create a new document + post route
+export function collectionPostHandler(config: Promise<SanitizedConfig>) {
+  return async function (request: Request, {
+    params: getParams,
+  }: {
+    params: Promise<{ collections: string[]; }>;
+  }) {
+    try {
+      const { payload } = await getPayload({ config });
+      const keys = [
+        ...payload.config.collections.map(x => x.slug),
+        ...payload.config.globals.map(x => x.slug),
+      ];
+      keys.sort();
+      const { collections } = await getParams;
+      if (!Array.isArray(collections) || collections.length !== 1) {
+        console.error('method not allowed', collections);
+        return new Response('method not allowed', {
+          status: 405,
+          statusText: 'method not allowed',
+        });
+      }
+      const slug = collections[0] as CollectionSlug | GlobalSlug;
+      if (!keys.includes(slug)) {
+        console.error('storeHandler.collectionGet', 'method not allowed', slug);
+        return new Response('method not allowed', {
+          status: 405,
+          statusText: 'method not allowed',
+        });
+      }
+      // api post route pathname
+      /*
+      if (slug === 'route') {
+        return routePost(store, request);
+      }
+      */
+      // !!! todo post create
+    } catch (error: unknown) {
+      const response = getHandlerErrorResponse(error);
+      console.error('storeHandler.collectionPost.error', response.status, error);
+      return response;
+    }
+  };
+}
+
+// update a document by id
+export function collectionPatchHandler(config: Promise<SanitizedConfig>) {
+  return async function (request: Request, {
+    params: getParams,
+  }: {
+    params: Promise<{ collections: string[]; }>;
+  }) {
+    try {
+      const { payload } = await getPayload({ config });
+      const keys = [
+        ...payload.config.collections.map(x => x.slug),
+        ...payload.config.globals.map(x => x.slug),
+      ];
+      keys.sort();
+      const { collections } = await getParams;
+      if (!Array.isArray(collections) || collections.length !== 2) {
+        console.error('method not allowed', collections);
+        return new Response('method not allowed', {
+          status: 405,
+          statusText: 'method not allowed',
+        });
+      }
+      const slug = collections[0] as CollectionSlug | GlobalSlug;
+      if (!keys.includes(slug)) {
+        console.error('storeHandler.collectionGet', 'method not allowed', slug);
+        return new Response('method not allowed', {
+          status: 405,
+          statusText: 'method not allowed',
+        });
+      }
+      // !!! todo patch update
+    } catch (error: unknown) {
+      const response = getHandlerErrorResponse(error);
+      console.error('storeHandler.collectionPatch.error', response.status, error);
+      return response;
+    }
+  };
+}
+
+// delete an existing document by id
+export function collectionDeleteHandler(config: Promise<SanitizedConfig>) {
+  return async function (request: Request, {
+    params: getParams,
+  }: {
+    params: Promise<{ collections: string[]; }>;
+  }) {
+    try {
+      const { payload } = await getPayload({ config });
+      const keys = [
+        ...payload.config.collections.map(x => x.slug),
+        ...payload.config.globals.map(x => x.slug),
+      ];
+      keys.sort();
+      const { collections } = await getParams;
+      if (!Array.isArray(collections) || collections.length !== 2) {
+        console.error('method not allowed', collections);
+        return new Response('method not allowed', {
+          status: 405,
+          statusText: 'method not allowed',
+        });
+      }
+      const slug = collections[0] as CollectionSlug | GlobalSlug;
+      if (!keys.includes(slug)) {
+        console.error('storeHandler.collectionGet', 'method not allowed', slug);
+        return new Response('method not allowed', {
+          status: 405,
+          statusText: 'method not allowed',
+        });
+      }
+      const id: string = collections[1];
+      // !!! todo delete
+    } catch (error: unknown) {
+      const response = getHandlerErrorResponse(error);
+      console.error('storeHandler.collectionDelete.error', response.status, error);
+      return response;
+    }
+  };
+}