@xexr/blog-platform 0.2.0

package/dist/app/api/blog/publish/route.ts

@@ -0,0 +1,360 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { getStorage } from "@/lib/database";
+import { getBlogPlatformVersion, parseVersionHeader } from "@/lib/version";
+import { requireAuth, authenticateRequest } from "@/lib/auth";
+import { enforceRateLimit, getRateLimitHeaders } from "@/lib/ratelimit";
+import { createCorsResponse, handleCorsOptions } from "@/lib/cors";
+import type {
+  PublishPayload,
+  PublishResult,
+  PublishedArticle,
+} from "@/types/contracts";
+
+/**
+ * POST /api/blog/publish
+ *
+ * Publishes an article to the blog platform with full idempotency support.
+ * This endpoint receives content from Bloggy core and stores it for rendering.
+ *
+ * Request body should contain a PublishPayload with:
+ * - article: The complete article data
+ * - idempotencyKey: SHA-256 hash for duplicate prevention
+ * - Optional overrides for slug, meta description, etc.
+ */
+export async function POST(
+  request: NextRequest,
+): Promise<NextResponse<PublishResult>> {
+  try {
+    // Authenticate the request
+    const auth = await authenticateRequest(request);
+    if (!auth.authenticated) {
+      const authCheck = await requireAuth(request);
+      return createCorsResponse(request, authCheck.error!, { status: 401 });
+    }
+
+    // Apply rate limiting using the authentication token
+    const token = auth.token ?? "anonymous";
+    const rateLimitCheck = await enforceRateLimit(token);
+    if (!rateLimitCheck.allowed) {
+      // Extract rate limit info from error response, with safe fallback
+      const rateLimitData =
+        rateLimitCheck.errorResponse.error?.details?.rateLimit;
+      const rateLimitResult =
+        rateLimitData &&
+        typeof rateLimitData === "object" &&
+        "limit" in rateLimitData &&
+        "remaining" in rateLimitData &&
+        "reset" in rateLimitData &&
+        "count" in rateLimitData &&
+        "success" in rateLimitData
+          ? (rateLimitData as {
+              limit: number;
+              remaining: number;
+              reset: number;
+              count: number;
+              success: boolean;
+            })
+          : {
+              limit: 10,
+              remaining: 0,
+              reset: Date.now() + 60000,
+              count: 10,
+              success: false,
+            };
+
+      const rateLimitHeaders = getRateLimitHeaders(rateLimitResult);
+
+      return createCorsResponse(request, rateLimitCheck.errorResponse, {
+        status: 429,
+        headers: rateLimitHeaders,
+      });
+    }
+
+    // Validate request content type
+    const contentType = request.headers.get("content-type");
+    if (!contentType?.includes("application/json")) {
+      return createCorsResponse(
+        request,
+        {
+          success: false,
+          error: {
+            code: "PUB001",
+            message: "Content-Type must be application/json",
+          },
+          idempotencyKey: "",
+        },
+        { status: 400 },
+      );
+    }
+
+    // Parse request body
+    let payload: PublishPayload;
+    try {
+      payload = (await request.json()) as PublishPayload;
+    } catch {
+      return createCorsResponse(
+        request,
+        {
+          success: false,
+          error: {
+            code: "PUB001",
+            message: "Invalid JSON in request body",
+          },
+          idempotencyKey: "",
+        },
+        { status: 400 },
+      );
+    }
+
+    // Validate required fields
+    const validationErrors = validatePublishPayload(payload);
+    if (validationErrors.length > 0) {
+      return createCorsResponse(
+        request,
+        {
+          success: false,
+          error: {
+            code: "PUB001",
+            message: "Missing required fields",
+            details: { errors: validationErrors },
+          },
+          idempotencyKey: payload.idempotencyKey ?? "",
+        },
+        { status: 400 },
+      );
+    }
+
+    // Check version compatibility if header provided
+    const clientVersionHeader = request.headers.get("X-Bloggy-Version");
+    if (clientVersionHeader) {
+      const parsedVersions = parseVersionHeader(clientVersionHeader);
+      if (parsedVersions?.platformVersion) {
+        const platformVersion = getBlogPlatformVersion();
+
+        // Check for major version incompatibility
+        if (parsedVersions.platformVersion.major !== platformVersion.major) {
+          return createCorsResponse(
+            request,
+            {
+              success: false,
+              error: {
+                code: "PUB009",
+                message:
+                  "Major version incompatibility. Please upgrade your blog platform package.",
+                details: {
+                  clientVersion: parsedVersions.platformVersion.version,
+                  serverVersion: platformVersion.version,
+                },
+              },
+              idempotencyKey: payload.idempotencyKey,
+            },
+            { status: 409 },
+          );
+        }
+      }
+    }
+
+    // Handle dry run validation
+    if (payload.dryRun) {
+      const warnings: string[] = [];
+
+      // Validate content requirements
+      if (payload.article.wordCount < 50) {
+        warnings.push("Article has fewer than 50 words, which may affect SEO");
+      }
+
+      if (!payload.article.excerpt || payload.article.excerpt.length < 120) {
+        warnings.push(
+          "Article excerpt is shorter than recommended 120 characters",
+        );
+      }
+
+      if (!payload.article.meta.keywords.length) {
+        warnings.push("No SEO keywords provided");
+      }
+
+      return createCorsResponse(
+        request,
+        {
+          success: true,
+          warnings,
+          idempotencyKey: payload.idempotencyKey,
+        },
+        { status: 200 },
+      );
+    }
+
+    // Prepare the article with any overrides
+    const finalArticle: PublishedArticle = {
+      ...payload.article,
+      slug: payload.slug ?? payload.article.slug,
+      meta: {
+        ...payload.article.meta,
+        description:
+          payload.metaDescription ?? payload.article.meta.description,
+      },
+    };
+
+    // Validate slug format
+    if (!isValidSlug(finalArticle.slug)) {
+      return createCorsResponse(
+        request,
+        {
+          success: false,
+          error: {
+            code: "PUB002",
+            message:
+              "Slug can only contain lowercase letters, numbers, and hyphens",
+          },
+          idempotencyKey: payload.idempotencyKey,
+        },
+        { status: 400 },
+      );
+    }
+
+    // Get storage and attempt to save
+    const storage = getStorage();
+    const result = await storage.saveArticle(
+      finalArticle,
+      payload.idempotencyKey,
+    );
+
+    // Prepare response headers
+    const platformVersion = getBlogPlatformVersion();
+    const rateLimitHeaders = getRateLimitHeaders(
+      rateLimitCheck.rateLimitResult,
+    );
+
+    const responseHeaders: Record<string, string> = {
+      "X-Bloggy-Version": `platform/${platformVersion.version}`,
+      "X-Idempotency-Key": payload.idempotencyKey,
+      ...rateLimitHeaders,
+    };
+
+    if (result.success) {
+      responseHeaders.Location = result.url ?? `/${finalArticle.slug}`;
+    }
+
+    // Return appropriate status code
+    const statusCode = result.success
+      ? 201
+      : result.error?.code === "PUB003"
+        ? 409
+        : 400;
+
+    return createCorsResponse(request, result, {
+      status: statusCode,
+      headers: responseHeaders,
+    });
+  } catch (error) {
+    console.error("Publish endpoint error:", error);
+
+    const errorResult: PublishResult = {
+      success: false,
+      error: {
+        code: "PUB007",
+        message: "Internal server error during publishing",
+      },
+      idempotencyKey: "",
+    };
+
+    return createCorsResponse(request, errorResult, { status: 500 });
+  }
+}
+
+/**
+ * OPTIONS /api/blog/publish
+ *
+ * Handle CORS preflight requests
+ */
+export async function OPTIONS(request: NextRequest): Promise<NextResponse> {
+  return handleCorsOptions(request, ["POST"], {
+    allowedHeaders: [
+      "Content-Type",
+      "X-Bloggy-Version",
+      "X-Idempotency-Key",
+      "Authorization",
+      "X-Requested-With",
+    ],
+  });
+}
+
+/**
+ * Validate the publish payload structure
+ */
+function validatePublishPayload(payload: unknown): string[] {
+  const errors: string[] = [];
+
+  if (!payload || typeof payload !== "object") {
+    errors.push("Request body must be a valid object");
+    return errors;
+  }
+
+  const p = payload as Record<string, unknown>;
+
+  // Check required top-level fields
+  if (!p.article || typeof p.article !== "object") {
+    errors.push("Missing required field: article");
+  }
+
+  if (!p.idempotencyKey || typeof p.idempotencyKey !== "string") {
+    errors.push("Missing required field: idempotencyKey");
+  }
+
+  // Validate article structure if present
+  if (p.article && typeof p.article === "object") {
+    const article = p.article as Record<string, unknown>;
+
+    const requiredFields = [
+      "id",
+      "slug",
+      "title",
+      "content",
+      "publishedAt",
+      "site",
+    ];
+    for (const field of requiredFields) {
+      if (!article[field]) {
+        errors.push(`Missing required article field: ${field}`);
+      }
+    }
+
+    // Validate site structure
+    if (article.site && typeof article.site === "object") {
+      const site = article.site as Record<string, unknown>;
+      const requiredSiteFields = ["id", "name", "domain"];
+      for (const field of requiredSiteFields) {
+        if (!site[field]) {
+          errors.push(`Missing required site field: ${field}`);
+        }
+      }
+    }
+
+    // Validate meta structure
+    if (article.meta && typeof article.meta === "object") {
+      const meta = article.meta as Record<string, unknown>;
+      if (!Array.isArray(meta.keywords)) {
+        errors.push("Article meta.keywords must be an array");
+      }
+    }
+  }
+
+  return errors;
+}
+
+/**
+ * Validate slug format
+ * Must be lowercase, alphanumeric, and hyphens only
+ */
+function isValidSlug(slug: string): boolean {
+  if (!slug || typeof slug !== "string") {
+    return false;
+  }
+
+  // Allow lowercase letters, numbers, and hyphens
+  // Must start and end with alphanumeric character
+  const slugRegex = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+  return slugRegex.test(slug) && slug.length >= 1 && slug.length <= 100;
+}
+
+export { isValidSlug };

package/dist/app/api/blog/slugs/[slug]/route.ts

@@ -0,0 +1,166 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { getStorage } from "@/lib/database";
+import { getBlogPlatformVersion, parseVersionHeader } from "@/lib/version";
+import { requireAuth, authenticateRequest } from "@/lib/auth";
+import { enforceRateLimit, getRateLimitHeaders } from "@/lib/ratelimit";
+import { createCorsResponse, handleCorsOptions } from "@/lib/cors";
+import { isValidSlug } from "@/app/api/blog/publish/route"; // Reuse slug validation from publish
+
+/**
+ * GET /api/blog/slugs/{slug}
+ *
+ * Checks if a slug is already in use on the blog platform.
+ * Used for dry-run validation in publishing workflow.
+ *
+ * Returns: { exists: boolean, message?: string }
+ * - exists: false -> available
+ * - exists: true -> taken, with suggestion message
+ */
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ slug: string }> },
+): Promise<NextResponse> {
+  try {
+    const { slug } = await params;
+    // Authenticate (required for security)
+    const auth = await authenticateRequest(request);
+    if (!auth.authenticated) {
+      const authCheck = await requireAuth(request);
+      return NextResponse.json(authCheck.error!, { status: 401 });
+    }
+
+    const token = auth.token ?? "anonymous";
+
+    // Rate limiting (same as publish: 5/min per token)
+    const rateLimitCheck = await enforceRateLimit(token);
+    if (!rateLimitCheck.allowed) {
+      const rateLimitData = (rateLimitCheck.errorResponse.error?.details
+        ?.rateLimit as {
+        limit: number;
+        remaining: number;
+        reset: number;
+        count: number;
+        success: boolean;
+      }) || {
+        limit: 10,
+        remaining: 0,
+        reset: Date.now() + 60000,
+        count: 10,
+        success: false,
+      };
+
+      const rateLimitHeaders = getRateLimitHeaders(rateLimitData);
+
+      return createCorsResponse(request, rateLimitCheck.errorResponse, {
+        status: 429,
+        headers: rateLimitHeaders,
+      });
+    }
+
+    // Extract slug from params
+    if (!slug || !isValidSlug(slug)) {
+      return createCorsResponse(
+        request,
+        {
+          exists: false, // Treat invalid as non-existent, but error for clarity
+          error: {
+            code: "PUB002",
+            message:
+              "Invalid slug format. Must be lowercase letters, numbers, and hyphens only.",
+          },
+        },
+        { status: 400 },
+      );
+    }
+
+    // Version compatibility check
+    const clientVersionHeader = request.headers.get("X-Bloggy-Version");
+    if (clientVersionHeader) {
+      const parsedVersions = parseVersionHeader(clientVersionHeader);
+      if (parsedVersions?.platformVersion) {
+        const platformVersion = getBlogPlatformVersion();
+        if (parsedVersions.platformVersion.major !== platformVersion.major) {
+          return createCorsResponse(
+            request,
+            {
+              exists: false,
+              error: {
+                code: "PUB009",
+                message:
+                  "Major version incompatibility. Please upgrade your blog platform package.",
+                details: {
+                  clientVersion: parsedVersions.platformVersion.version,
+                  serverVersion: platformVersion.version,
+                },
+              },
+            },
+            { status: 409 },
+          );
+        }
+      }
+    }
+
+    // Check existence via storage
+    const storage = getStorage();
+    const existingArticle = await storage.getArticle(slug);
+    const exists = existingArticle !== null;
+
+    const responseBody = {
+      exists,
+      ...(exists && {
+        message:
+          "Slug is already in use. Please choose another (e.g., append '-v2').",
+      }),
+    };
+
+    // Headers
+    const platformVersion = getBlogPlatformVersion();
+    const rateLimitHeaders = getRateLimitHeaders(
+      rateLimitCheck.rateLimitResult,
+    );
+    const responseHeaders: Record<string, string> = {
+      "X-Bloggy-Version": `platform/${platformVersion.version}`,
+      ...rateLimitHeaders,
+    };
+
+    // Optional idempotency log (if provided)
+    const idempotencyKey = request.headers.get("X-Idempotency-Key");
+    if (idempotencyKey) {
+      responseHeaders["X-Idempotency-Key"] = idempotencyKey;
+      // Log for debugging
+      console.log(
+        `Slug check for idempotency: ${idempotencyKey}, exists: ${exists}`,
+      );
+    }
+
+    return createCorsResponse(request, responseBody, {
+      status: 200,
+      headers: responseHeaders,
+    });
+  } catch (error: unknown) {
+    console.error(
+      "Slug existence check error:",
+      error instanceof Error ? error.message : String(error),
+    );
+
+    return createCorsResponse(
+      request,
+      {
+        exists: false,
+        error: {
+          code: "PUB007",
+          message: "Internal server error during slug check",
+        },
+      },
+      { status: 500 },
+    );
+  }
+}
+
+/**
+ * OPTIONS /api/blog/slugs/{slug}
+ * Handle CORS preflight
+ */
+export async function OPTIONS(request: NextRequest): Promise<NextResponse> {
+  return handleCorsOptions(request, ["GET"]);
+}