@xexr/blog-platform 0.2.0

package/dist/app/api/blog/unpublish/route.ts

@@ -0,0 +1,301 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { getStorage } from "@/lib/database";
+import { getBlogPlatformVersion, parseVersionHeader } from "@/lib/version";
+import { requireAuth, authenticateRequest } from "@/lib/auth";
+import { enforceRateLimit, getRateLimitHeaders } from "@/lib/ratelimit";
+import { createCorsResponse, handleCorsOptions } from "@/lib/cors";
+import type { UnpublishPayload, PublishResult } from "@/types/contracts";
+
+/**
+ * POST /api/blog/unpublish
+ *
+ * Unpublishes an article from the blog platform with full idempotency support.
+ * This endpoint receives unpublish requests from Bloggy core and removes the content.
+ *
+ * Request body should contain an UnpublishPayload with:
+ * - slug: The article slug to unpublish
+ * - idempotencyKey: SHA-256 hash for duplicate prevention
+ * - Optional dry run flag for validation
+ */
+export async function POST(
+  request: NextRequest,
+): Promise<NextResponse<PublishResult>> {
+  try {
+    // Authenticate the request
+    const auth = await authenticateRequest(request);
+    if (!auth.authenticated) {
+      const authCheck = await requireAuth(request);
+      return NextResponse.json(authCheck.error!, { status: 401 });
+    }
+
+    // Apply rate limiting using the authentication token
+    const token = auth.token ?? "anonymous";
+    const rateLimitCheck = await enforceRateLimit(token);
+    if (!rateLimitCheck.allowed) {
+      // Extract rate limit info from error response, with safe fallback
+      const rateLimitData =
+        rateLimitCheck.errorResponse.error?.details?.rateLimit;
+      const rateLimitResult =
+        rateLimitData &&
+        typeof rateLimitData === "object" &&
+        "limit" in rateLimitData &&
+        "remaining" in rateLimitData &&
+        "reset" in rateLimitData &&
+        "count" in rateLimitData &&
+        "success" in rateLimitData
+          ? (rateLimitData as {
+              limit: number;
+              remaining: number;
+              reset: number;
+              count: number;
+              success: boolean;
+            })
+          : {
+              limit: 10,
+              remaining: 0,
+              reset: Date.now() + 60000,
+              count: 10,
+              success: false,
+            };
+
+      const rateLimitHeaders = getRateLimitHeaders(rateLimitResult);
+
+      return createCorsResponse(request, rateLimitCheck.errorResponse, {
+        status: 429,
+        headers: rateLimitHeaders,
+      });
+    }
+
+    // Validate request content type
+    const contentType = request.headers.get("content-type");
+    if (!contentType?.includes("application/json")) {
+      return createCorsResponse(
+        request,
+        {
+          success: false,
+          error: {
+            code: "PUB001",
+            message: "Content-Type must be application/json",
+          },
+          idempotencyKey: "",
+        },
+        { status: 400 },
+      );
+    }
+
+    // Parse request body
+    let payload: UnpublishPayload;
+    try {
+      payload = (await request.json()) as UnpublishPayload;
+    } catch {
+      return createCorsResponse(
+        request,
+        {
+          success: false,
+          error: {
+            code: "PUB001",
+            message: "Invalid JSON in request body",
+          },
+          idempotencyKey: "",
+        },
+        { status: 400 },
+      );
+    }
+
+    // Validate required fields
+    const validationErrors = validateUnpublishPayload(payload);
+    if (validationErrors.length > 0) {
+      return createCorsResponse(
+        request,
+        {
+          success: false,
+          error: {
+            code: "PUB001",
+            message: "Missing required fields",
+            details: { errors: validationErrors },
+          },
+          idempotencyKey: payload.idempotencyKey ?? "",
+        },
+        { status: 400 },
+      );
+    }
+
+    // Check version compatibility if header provided
+    const clientVersionHeader = request.headers.get("X-Bloggy-Version");
+    if (clientVersionHeader) {
+      const parsedVersions = parseVersionHeader(clientVersionHeader);
+      if (parsedVersions?.platformVersion) {
+        const platformVersion = getBlogPlatformVersion();
+
+        // Check for major version incompatibility
+        if (parsedVersions.platformVersion.major !== platformVersion.major) {
+          return createCorsResponse(
+            request,
+            {
+              success: false,
+              error: {
+                code: "PUB009",
+                message:
+                  "Major version incompatibility. Please upgrade your blog platform package.",
+                details: {
+                  clientVersion: parsedVersions.platformVersion.version,
+                  serverVersion: platformVersion.version,
+                },
+              },
+              idempotencyKey: payload.idempotencyKey,
+            },
+            { status: 409 },
+          );
+        }
+      }
+    }
+
+    // Validate slug format
+    if (!isValidSlug(payload.slug)) {
+      return createCorsResponse(
+        request,
+        {
+          success: false,
+          error: {
+            code: "PUB002",
+            message:
+              "Slug can only contain lowercase letters, numbers, and hyphens",
+          },
+          idempotencyKey: payload.idempotencyKey,
+        },
+        { status: 400 },
+      );
+    }
+
+    // Handle dry run validation
+    if (payload.dryRun) {
+      const storage = getStorage();
+      const existingArticle = await storage.getArticle(payload.slug);
+
+      const warnings: string[] = [];
+      if (!existingArticle) {
+        warnings.push("Article with this slug does not exist");
+      }
+
+      return createCorsResponse(
+        request,
+        {
+          success: true,
+          warnings,
+          idempotencyKey: payload.idempotencyKey,
+        },
+        { status: 200 },
+      );
+    }
+
+    // Get storage and attempt to remove article
+    const storage = getStorage();
+    const result = await storage.removeArticle(
+      payload.slug,
+      payload.idempotencyKey,
+    );
+
+    // Prepare response headers
+    const platformVersion = getBlogPlatformVersion();
+    const rateLimitHeaders = getRateLimitHeaders(
+      rateLimitCheck.rateLimitResult,
+    );
+
+    const responseHeaders = {
+      "X-Bloggy-Version": `platform/${platformVersion.version}`,
+      "X-Idempotency-Key": payload.idempotencyKey,
+      ...rateLimitHeaders,
+    };
+
+    // Return appropriate status code
+    const statusCode = result.success
+      ? 200
+      : result.error?.code === "PUB007"
+        ? 404
+        : 400;
+
+    return createCorsResponse(request, result, {
+      status: statusCode,
+      headers: responseHeaders,
+    });
+  } catch (error) {
+    console.error("Unpublish endpoint error:", error);
+
+    const errorResult: PublishResult = {
+      success: false,
+      error: {
+        code: "PUB007",
+        message: "Internal server error during unpublishing",
+      },
+      idempotencyKey: "",
+    };
+
+    return createCorsResponse(request, errorResult, { status: 500 });
+  }
+}
+
+/**
+ * DELETE /api/blog/unpublish
+ *
+ * Alternative HTTP method for unpublishing (some clients prefer DELETE for removal operations)
+ * Accepts the same payload structure as POST
+ */
+export async function DELETE(
+  request: NextRequest,
+): Promise<NextResponse<PublishResult>> {
+  return POST(request);
+}
+
+/**
+ * OPTIONS /api/blog/unpublish
+ *
+ * Handle CORS preflight requests
+ */
+export async function OPTIONS(request: NextRequest): Promise<NextResponse> {
+  return handleCorsOptions(request, ["POST", "DELETE"]);
+}
+
+/**
+ * Validate the unpublish payload structure
+ */
+function validateUnpublishPayload(payload: unknown): string[] {
+  const errors: string[] = [];
+
+  if (!payload || typeof payload !== "object") {
+    errors.push("Request body must be a valid object");
+    return errors;
+  }
+
+  const p = payload as Record<string, unknown>;
+
+  // Check required fields
+  if (!p.slug || typeof p.slug !== "string") {
+    errors.push("Missing required field: slug");
+  }
+
+  if (!p.idempotencyKey || typeof p.idempotencyKey !== "string") {
+    errors.push("Missing required field: idempotencyKey");
+  }
+
+  // Validate slug is not empty
+  if (p.slug && typeof p.slug === "string" && !p.slug.trim()) {
+    errors.push("Slug cannot be empty");
+  }
+
+  return errors;
+}
+
+/**
+ * Validate slug format
+ * Must be lowercase, alphanumeric, and hyphens only
+ */
+function isValidSlug(slug: string): boolean {
+  if (!slug || typeof slug !== "string") {
+    return false;
+  }
+
+  // Allow lowercase letters, numbers, and hyphens
+  // Must start and end with alphanumeric character
+  const slugRegex = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+  return slugRegex.test(slug) && slug.length >= 1 && slug.length <= 100;
+}

package/dist/app/api/blog/version/route.ts

@@ -0,0 +1,259 @@
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+import {
+  getBlogPlatformVersion,
+  parseVersionHeader,
+  checkVersionCompatibility,
+  type VersionCompatibilityResult,
+  type VersionInfo,
+} from "@/lib/version";
+import { requireAuth, authenticateRequest } from "@/lib/auth";
+import { enforceRateLimit, getRateLimitHeaders } from "@/lib/ratelimit";
+import { createCorsResponse, handleCorsOptions } from "@/lib/cors";
+
+/**
+ * Version compatibility response
+ */
+interface VersionResponse {
+  success: boolean;
+  versions: {
+    bloggy: VersionInfo;
+    platform: VersionInfo;
+  };
+  compatibility: VersionCompatibilityResult;
+  error?: string;
+}
+
+/**
+ * GET /api/blog/version
+ *
+ * Returns version information and compatibility status for Bloggy core and blog platform.
+ * Used by customers to verify compatibility before publishing.
+ *
+ * Optional X-Bloggy-Version header can be provided to check compatibility
+ * with specific versions.
+ */
+export async function GET(
+  request: NextRequest,
+): Promise<NextResponse<VersionResponse>> {
+  try {
+    // Authenticate the request
+    const auth = await authenticateRequest(request);
+    if (!auth.authenticated) {
+      const authCheck = await requireAuth(request);
+      const errorResponse: VersionResponse = {
+        success: false,
+        versions: {
+          bloggy: {
+            name: "unknown",
+            version: "unknown",
+            major: 0,
+            minor: 0,
+            patch: 0,
+          },
+          platform: {
+            name: "unknown",
+            version: "unknown",
+            major: 0,
+            minor: 0,
+            patch: 0,
+          },
+        },
+        compatibility: {
+          compatible: false,
+          errorMessage: authCheck.error?.error?.message ?? "Authentication required",
+        },
+      };
+      return createCorsResponse(request, errorResponse, { status: 401 });
+    }
+
+    // Apply rate limiting using the authentication token
+    const token = auth.token ?? "anonymous";
+    const rateLimitCheck = await enforceRateLimit(token);
+    if (!rateLimitCheck.allowed) {
+      // Extract rate limit info from error response, with safe fallback
+      const rateLimitData =
+        rateLimitCheck.errorResponse.error?.details?.rateLimit;
+      const rateLimitResult =
+        rateLimitData &&
+        typeof rateLimitData === "object" &&
+        "limit" in rateLimitData &&
+        "remaining" in rateLimitData &&
+        "reset" in rateLimitData &&
+        "count" in rateLimitData &&
+        "success" in rateLimitData
+          ? (rateLimitData as {
+              limit: number;
+              remaining: number;
+              reset: number;
+              count: number;
+              success: boolean;
+            })
+          : {
+              limit: 10,
+              remaining: 0,
+              reset: Date.now() + 60000,
+              count: 10,
+              success: false,
+            };
+
+      const rateLimitHeaders = getRateLimitHeaders(rateLimitResult);
+
+      // Create a proper version response with error
+      const errorVersionResponse: VersionResponse = {
+        success: false,
+        versions: {
+          bloggy: {
+            name: "unknown",
+            version: "unknown",
+            major: 0,
+            minor: 0,
+            patch: 0,
+          },
+          platform: {
+            name: "unknown",
+            version: "unknown",
+            major: 0,
+            minor: 0,
+            patch: 0,
+          },
+        },
+        compatibility: {
+          compatible: false,
+          errorMessage:
+            rateLimitCheck.errorResponse.error?.message ??
+            "Rate limit exceeded",
+        },
+      };
+
+      return createCorsResponse(request, errorVersionResponse, {
+        status: 429,
+        headers: rateLimitHeaders,
+      });
+    }
+
+    // Get current platform version information
+    const platformVersion = getBlogPlatformVersion();
+
+    // Parse Bloggy version from X-Bloggy-Version header
+    const clientVersionHeader = request.headers.get("X-Bloggy-Version");
+    let bloggyVersion: VersionInfo = {
+      name: "unknown",
+      version: "unknown",
+      major: 0,
+      minor: 0,
+      patch: 0,
+    };
+
+    if (clientVersionHeader) {
+      try {
+        // Try parsing as simple version string first (e.g., "0.1.0")
+        if (/^\d+\.\d+\.\d+/.test(clientVersionHeader)) {
+          const parts = clientVersionHeader.split(".");
+          const major = parseInt(parts[0] ?? "0", 10);
+          const minor = parseInt(parts[1] ?? "0", 10);
+          const patch = parseInt(parts[2]?.split("-")[0] ?? "0", 10);
+
+          bloggyVersion = {
+            name: "bloggy",
+            version: clientVersionHeader,
+            major,
+            minor,
+            patch,
+          };
+        } else {
+          // Try parsing as formatted header (e.g., "bloggy/1.0.0 platform/1.0.0")
+          const parsedVersions = parseVersionHeader(clientVersionHeader);
+          if (parsedVersions?.bloggyVersion) {
+            bloggyVersion = parsedVersions.bloggyVersion;
+          }
+        }
+      } catch (error) {
+        console.warn("Failed to parse X-Bloggy-Version header:", error);
+      }
+    }
+
+    // Check compatibility between Bloggy core and platform versions
+    // Only perform check if we have a valid Bloggy version (not "unknown")
+    let compatibility: VersionCompatibilityResult = { compatible: true };
+
+    if (bloggyVersion.version !== "unknown") {
+      // Compare Bloggy core version with platform version
+      // Both should follow semantic versioning
+      compatibility = checkVersionCompatibility(bloggyVersion, platformVersion);
+    }
+
+    const response: VersionResponse = {
+      success: true,
+      versions: {
+        bloggy: bloggyVersion,
+        platform: platformVersion,
+      },
+      compatibility,
+    };
+
+    // Prepare response headers
+    const rateLimitHeaders = getRateLimitHeaders(
+      rateLimitCheck.rateLimitResult,
+    );
+
+    const responseHeaders = {
+      "X-Bloggy-Version": `platform/${platformVersion.version}`,
+      "Cache-Control": "public, max-age=300, stale-while-revalidate=60",
+      ...rateLimitHeaders,
+    };
+
+    // Always return 200 OK with compatibility details in response body
+    // The client should check compatibility.compatible field, not HTTP status
+    return createCorsResponse(request, response, {
+      status: 200,
+      headers: responseHeaders,
+    });
+  } catch (error) {
+    console.error("Version endpoint error:", error);
+
+    const errorResponse: VersionResponse = {
+      success: false,
+      versions: {
+        bloggy: {
+          name: "unknown",
+          version: "unknown",
+          major: 0,
+          minor: 0,
+          patch: 0,
+        },
+        platform: {
+          name: "unknown",
+          version: "unknown",
+          major: 0,
+          minor: 0,
+          patch: 0,
+        },
+      },
+      compatibility: {
+        compatible: false,
+        errorMessage:
+          "Internal server error while checking version compatibility",
+      },
+      error: error instanceof Error ? error.message : "Unknown error",
+    };
+
+    return createCorsResponse(request, errorResponse, { status: 500 });
+  }
+}
+
+/**
+ * OPTIONS /api/blog/version
+ *
+ * Handle CORS preflight requests
+ */
+export async function OPTIONS(request: NextRequest): Promise<NextResponse> {
+  return handleCorsOptions(request, ["GET"], {
+    allowedHeaders: [
+      "Content-Type",
+      "X-Bloggy-Version",
+      "Authorization",
+      "X-Requested-With",
+    ],
+  });
+}