@xleddyl/nuxt-cms 0.1.60 → 0.2.0

package/dist/runtime/server/api/settings.get.js

@@ -0,0 +1,15 @@
+import { defineEventHandler } from "h3";
+import { useDb } from "#cms-db";
+import { cms_settings } from "#cms-tables";
+import { requireAdmin } from "../utils/require-admin.js";
+import { parseSettingsValue } from "../utils/settings.js";
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event);
+  const rows = await useDb().select().from(cms_settings);
+  return Object.fromEntries(
+    rows.flatMap((row) => {
+      const value = parseSettingsValue(row.value);
+      return value ? [[row.key, value]] : [];
+    })
+  );
+});

package/dist/runtime/server/api/settings.put.d.ts

@@ -0,0 +1,3 @@
+import type { CmsEntrySettings } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsEntrySettings>>;
+export default _default;

package/dist/runtime/server/api/settings.put.js

@@ -0,0 +1,14 @@
+import { defineEventHandler, readValidatedBody } from "h3";
+import { useDb } from "#cms-db";
+import { cms_settings } from "#cms-tables";
+import { requireAdmin } from "../utils/require-admin.js";
+import { entrySettingsSchema, requireSettingsKey } from "../utils/settings.js";
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event);
+  const key = requireSettingsKey(event);
+  const body = await readValidatedBody(event, entrySettingsSchema.parse);
+  const value = JSON.stringify(body);
+  const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  await useDb().insert(cms_settings).values({ key, value, updatedAt }).onConflictDoUpdate({ target: cms_settings.key, set: { value, updatedAt } });
+  return body;
+});

package/dist/runtime/server/api/user.delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/api/user.delete.js

@@ -0,0 +1,12 @@
+import { eq } from "drizzle-orm";
+import { createError, defineEventHandler, getRouterParam } from "h3";
+import { useDb } from "#cms-db";
+import { cms_users } from "#cms-tables";
+import { requireSuperAdmin } from "../utils/require-admin.js";
+export default defineEventHandler(async (event) => {
+  await requireSuperAdmin(event);
+  const id = getRouterParam(event, "id") ?? "";
+  const [row] = await useDb().delete(cms_users).where(eq(cms_users.id, id)).returning();
+  if (!row) throw createError({ statusCode: 404, statusMessage: "User not found" });
+  return { ok: true };
+});

package/dist/runtime/server/api/user.put.d.ts

@@ -0,0 +1,3 @@
+import type { CmsAccount } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsAccount>>;
+export default _default;

package/dist/runtime/server/api/user.put.js

@@ -0,0 +1,27 @@
+import { eq } from "drizzle-orm";
+import { createError, defineEventHandler, getRouterParam, readValidatedBody } from "h3";
+import { z } from "zod";
+import { useDb } from "#cms-db";
+import { cms_users } from "#cms-tables";
+import { MIN_PASSWORD_LENGTH } from "../../shared/index.js";
+import { hashPassword } from "../utils/password.js";
+import { requireSuperAdmin } from "../utils/require-admin.js";
+import { toAccount } from "../utils/users.js";
+const bodySchema = z.object({
+  name: z.string().trim().max(120).nullish(),
+  password: z.string().min(MIN_PASSWORD_LENGTH).max(256).optional()
+});
+export default defineEventHandler(async (event) => {
+  await requireSuperAdmin(event);
+  const id = getRouterParam(event, "id") ?? "";
+  const body = await readValidatedBody(event, bodySchema.parse);
+  const set = { updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  if (body.name !== void 0) set.name = body.name || null;
+  if (body.password) {
+    set.passwordHash = await hashPassword(body.password);
+    set.mustChangePassword = true;
+  }
+  const [row] = await useDb().update(cms_users).set(set).where(eq(cms_users.id, id)).returning();
+  if (!row) throw createError({ statusCode: 404, statusMessage: "User not found" });
+  return toAccount(row);
+});

package/dist/runtime/server/api/users.get.d.ts

@@ -0,0 +1,3 @@
+import type { CmsAccount } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsAccount[]>>;
+export default _default;

package/dist/runtime/server/api/users.get.js

@@ -0,0 +1,11 @@
+import { asc } from "drizzle-orm";
+import { defineEventHandler } from "h3";
+import { useDb } from "#cms-db";
+import { cms_users } from "#cms-tables";
+import { requireSuperAdmin } from "../utils/require-admin.js";
+import { toAccount } from "../utils/users.js";
+export default defineEventHandler(async (event) => {
+  await requireSuperAdmin(event);
+  const rows = await useDb().select().from(cms_users).orderBy(asc(cms_users.createdAt));
+  return rows.map(toAccount);
+});

package/dist/runtime/server/api/users.post.d.ts

@@ -0,0 +1,3 @@
+import type { CmsAccount } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsAccount>>;
+export default _default;

package/dist/runtime/server/api/users.post.js

@@ -0,0 +1,32 @@
+import { createError, defineEventHandler, readValidatedBody } from "h3";
+import { z } from "zod";
+import { useDb } from "#cms-db";
+import { cms_users } from "#cms-tables";
+import { MIN_PASSWORD_LENGTH } from "../../shared/index.js";
+import { customId } from "../utils/custom-id.js";
+import { hashPassword } from "../utils/password.js";
+import { isSuperAdminEmail, requireSuperAdmin } from "../utils/require-admin.js";
+import { findUserByEmail, toAccount } from "../utils/users.js";
+const bodySchema = z.object({
+  email: z.string().trim().toLowerCase().email().max(254),
+  name: z.string().trim().max(120).nullish(),
+  password: z.string().min(MIN_PASSWORD_LENGTH).max(256)
+});
+export default defineEventHandler(async (event) => {
+  await requireSuperAdmin(event);
+  const body = await readValidatedBody(event, bodySchema.parse);
+  if (isSuperAdminEmail(event, body.email) || await findUserByEmail(body.email)) {
+    throw createError({ statusCode: 409, statusMessage: "A user with this email already exists" });
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const [row] = await useDb().insert(cms_users).values({
+    id: customId("usr"),
+    email: body.email,
+    name: body.name || null,
+    role: "admin",
+    passwordHash: await hashPassword(body.password),
+    createdAt: now,
+    updatedAt: now
+  }).returning();
+  return toAccount(row);
+});

package/dist/runtime/server/plugins/session-validate.d.ts

@@ -0,0 +1,2 @@
+declare const _default: () => void;
+export default _default;

package/dist/runtime/server/plugins/session-validate.js

@@ -0,0 +1,13 @@
+import { createError } from "h3";
+import { clearUserSession, sessionHooks } from "#imports";
+import { findUserById, passwordStamp } from "../utils/users.js";
+export default () => {
+  sessionHooks.hook("fetch", async (session, event) => {
+    const user = session.user;
+    if (!user?.id) return;
+    const row = await findUserById(user.id);
+    if (row && user.passwordStamp === passwordStamp(row.passwordHash)) return;
+    await clearUserSession(event);
+    throw createError({ statusCode: 401, statusMessage: "Session expired" });
+  });
+};

package/dist/runtime/server/routes/auth/login.post.js

@@ -1,8 +1,13 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createError, defineEventHandler, getRequestIP, readValidatedBody } from "h3";
 import { z } from "zod";
-import { setUserSession, useRuntimeConfig, useStorage } from "#imports";
-import { assertSameOrigin } from "../../utils/require-admin.js";
+import { replaceUserSession, useRuntimeConfig, useStorage } from "#imports";
+import { eq } from "drizzle-orm";
+import { useDb } from "#cms-db";
+import { cms_users } from "#cms-tables";
+import { verifyNothing, verifyPassword } from "../../utils/password.js";
+import { assertSameOrigin } from "../../utils/same-origin.js";
+import { findUserByEmail, sessionUserFor } from "../../utils/users.js";
 const credentialsSchema = z.object({
   email: z.string().trim().min(1),
   password: z.string().min(1)
@@ -62,17 +67,22 @@ export default defineEventHandler(async (event) => {
     });
   }
   const body = await readValidatedBody(event, credentialsSchema.parse);
+  const email = body.email.toLowerCase();
   const { adminEmail, adminPassword } = useRuntimeConfig(event).cms;
-  if (!adminEmail || !adminPassword) {
-    throw createError({ statusCode: 403, statusMessage: "Admin credentials are not configured" });
+  const superAdmin = !!adminEmail && !!adminPassword && safeEqual(email, adminEmail.toLowerCase()) && safeEqual(body.password, adminPassword);
+  if (superAdmin) {
+    await rateStorage().removeItem(ip);
+    await replaceUserSession(event, { user: { email, role: "superadmin" } });
+    return { loggedIn: true };
   }
-  const emailOk = safeEqual(body.email.toLowerCase(), adminEmail.toLowerCase());
-  const passwordOk = safeEqual(body.password, adminPassword);
-  if (!emailOk || !passwordOk) {
+  const row = await findUserByEmail(email);
+  const passwordOk = row ? await verifyPassword(row.passwordHash, body.password) : await verifyNothing(body.password);
+  if (!row || !passwordOk) {
     await Promise.all([recordFailure(ip, now), recordFailure(GLOBAL_KEY, now), prune(now)]);
     throw createError({ statusCode: 401, statusMessage: "Invalid credentials" });
   }
   await rateStorage().removeItem(ip);
-  await setUserSession(event, { user: { email: adminEmail.toLowerCase() } });
+  await useDb().update(cms_users).set({ lastLoginAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cms_users.id, row.id));
+  await replaceUserSession(event, { user: sessionUserFor(row) });
   return { loggedIn: true };
 });

package/dist/runtime/server/utils/media-folders.d.ts

@@ -0,0 +1,86 @@
+import type { MediaStore } from './media.js';
+export declare function writeMediaFolderMarker(store: MediaStore, folder: string): Promise<void>;
+export declare function mediaRowsInFolder(folder: string): Omit<import("drizzle-orm/sqlite-core").SQLiteSelectBase<"cms_media", "sync", import("better-sqlite3").RunResult, {
+    key: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+        name: "key";
+        tableName: "cms_media";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {
+        length: number | undefined;
+    }>;
+    folder: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+        name: "folder";
+        tableName: "cms_media";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {
+        length: number | undefined;
+    }>;
+}, "partial", Record<"cms_media", "not-null">, false, "where", {
+    key: string;
+    folder: string | null;
+}[], {
+    key: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+        name: "key";
+        tableName: "cms_media";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {
+        length: number | undefined;
+    }>;
+    folder: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+        name: "folder";
+        tableName: "cms_media";
+        dataType: "string";
+        columnType: "SQLiteText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {
+        length: number | undefined;
+    }>;
+}>, "where">;
+export declare function deleteMediaRows(store: MediaStore, keys: string[]): Promise<void>;
+export declare function keyChunks(keys: string[]): string[][];

package/dist/runtime/server/utils/media-folders.js

@@ -0,0 +1,37 @@
+import { inArray, like, or } from "drizzle-orm";
+import { useDb } from "#cms-db";
+import { cms_media } from "#cms-tables";
+import { mediaFolderMarkerKey } from "../../shared/index.js";
+const KEY_CHUNK = 90;
+export async function writeMediaFolderMarker(store, folder) {
+  const key = mediaFolderMarkerKey(folder);
+  await store.write(key, new Uint8Array(), "application/x-empty");
+  const values = {
+    key,
+    mime: "application/x-empty",
+    size: 0,
+    width: null,
+    height: null,
+    alt: null,
+    folder
+  };
+  await useDb().insert(cms_media).values(values).onConflictDoUpdate({ target: cms_media.key, set: values });
+}
+export function mediaRowsInFolder(folder) {
+  return useDb().select({ key: cms_media.key, folder: cms_media.folder }).from(cms_media).where(or(like(cms_media.folder, `${folder}/%`), like(cms_media.folder, folder)));
+}
+export async function deleteMediaRows(store, keys) {
+  for (const key of keys) {
+    await store.remove(key);
+  }
+  for (const chunk of keyChunks(keys)) {
+    await useDb().delete(cms_media).where(inArray(cms_media.key, chunk));
+  }
+}
+export function keyChunks(keys) {
+  const chunks = [];
+  for (let index = 0; index < keys.length; index += KEY_CHUNK) {
+    chunks.push(keys.slice(index, index + KEY_CHUNK));
+  }
+  return chunks;
+}

package/dist/runtime/server/utils/media-references.d.ts

@@ -1,10 +1,16 @@
 import type { BaseSQLiteDatabase, SQLiteTable } from 'drizzle-orm/sqlite-core';
-import type { FieldConfig } from '../../shared/index.js';
+import type { CmsEntry, FieldConfig, MediaUsage } from '../../shared/index.js';
 export interface MediaReference {
     field: string;
     key: string;
 }
 export type MediaLookup = (keys: string[]) => Promise<Set<string>>;
 export declare function mediaReferences(fields: Record<string, FieldConfig>, values: Record<string, unknown>): MediaReference[];
+export interface MediaUsageSource {
+    name: string;
+    entry: CmsEntry;
+    rows: Record<string, unknown>[];
+}
+export declare function collectMediaUsage(sources: MediaUsageSource[], keys: string[]): Record<string, MediaUsage[]>;
 export declare function assertKnownMedia(references: MediaReference[], lookup: MediaLookup): Promise<void>;
 export declare function mediaKeysInTable(db: Pick<BaseSQLiteDatabase<'sync' | 'async', unknown>, 'select'>, table: SQLiteTable, keys: string[]): Promise<Set<string>>;

package/dist/runtime/server/utils/media-references.js

@@ -1,5 +1,6 @@
 import { inArray } from "drizzle-orm";
 import { createError } from "h3";
+import { PAGE_PATH_FIELD, pageFields, pageRouteOf } from "../../shared/index.js";
 const LOOKUP_CHUNK = 90;
 function mediaKeysOf(value) {
   if (typeof value === "string") return value ? [value] : [];
@@ -29,6 +30,45 @@ export function mediaReferences(fields, values) {
   }
   return references;
 }
+function titleOf(entry, row) {
+  if (entry.kind === "page") {
+    const path = row[PAGE_PATH_FIELD];
+    return pageRouteOf(entry, String(row.id))?.label ?? (typeof path === "string" ? path : null);
+  }
+  const value = entry.titleField ? row[entry.titleField] : void 0;
+  if (typeof value === "string") return value || null;
+  if (value && typeof value === "object") {
+    const first = Object.values(value).find(
+      (candidate) => typeof candidate === "string" && candidate !== ""
+    );
+    return first ?? null;
+  }
+  return null;
+}
+function fieldsOf(entry, row) {
+  const path = row[PAGE_PATH_FIELD];
+  return entry.kind === "page" && typeof path === "string" ? pageFields(entry, path) : entry.fields;
+}
+export function collectMediaUsage(sources, keys) {
+  const usage = Object.fromEntries(keys.map((key) => [key, []]));
+  for (const { name, entry, rows } of sources) {
+    for (const row of rows) {
+      for (const reference of mediaReferences(fieldsOf(entry, row), row)) {
+        const list = usage[reference.key];
+        if (!list) continue;
+        list.push({
+          collection: name,
+          label: entry.label,
+          kind: entry.kind,
+          id: entry.kind === "single" ? null : String(row.id),
+          title: titleOf(entry, row),
+          field: reference.field
+        });
+      }
+    }
+  }
+  return usage;
+}
 export async function assertKnownMedia(references, lookup) {
   if (!references.length) return;
   const known = await lookup([...new Set(references.map((reference) => reference.key))]);

package/dist/runtime/server/utils/media-usage.d.ts

@@ -0,0 +1,2 @@
+import type { MediaUsage } from '../../shared/index.js';
+export declare function loadMediaUsage(keys: string[]): Promise<Record<string, MediaUsage[]>>;

package/dist/runtime/server/utils/media-usage.js

@@ -0,0 +1,18 @@
+import cmsConfig from "#cms-config";
+import { useDb } from "#cms-db";
+import { collectMediaUsage } from "./media-references.js";
+import { readPages } from "./page-storage.js";
+import { decodeRows, resolveTable } from "./registry.js";
+async function usageSources() {
+  const sources = [];
+  for (const [name, entry] of Object.entries(cmsConfig)) {
+    const table = resolveTable(name);
+    if (!table) continue;
+    const rows = entry.kind === "page" ? await readPages(name, entry, table) : decodeRows(entry, await useDb().select().from(table));
+    sources.push({ name, entry, rows });
+  }
+  return sources;
+}
+export async function loadMediaUsage(keys) {
+  return collectMediaUsage(await usageSources(), keys);
+}

package/dist/runtime/server/utils/password.d.ts

@@ -0,0 +1,3 @@
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(stored: string, password: string): Promise<boolean>;
+export declare function verifyNothing(password: string): Promise<false>;

package/dist/runtime/server/utils/password.js

@@ -0,0 +1,31 @@
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+const KEY_LENGTH = 64;
+const COST = 16384;
+function derive(password, salt, cost) {
+  return new Promise((resolve, reject) => {
+    scrypt(
+      password,
+      salt,
+      KEY_LENGTH,
+      { N: cost, r: 8, p: 1 },
+      (error, key) => error ? reject(error) : resolve(key)
+    );
+  });
+}
+export async function hashPassword(password) {
+  const salt = randomBytes(16);
+  const key = await derive(password, salt, COST);
+  return `scrypt$${COST}$${salt.toString("base64")}$${key.toString("base64")}`;
+}
+export async function verifyPassword(stored, password) {
+  const [scheme, cost, salt, key] = stored.split("$");
+  if (scheme !== "scrypt" || !cost || !salt || !key) return false;
+  const expected = Buffer.from(key, "base64");
+  const actual = await derive(password, Buffer.from(salt, "base64"), Number(cost));
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+const DUMMY_HASH = "scrypt$16384$AAAAAAAAAAAAAAAAAAAAAA==$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+export async function verifyNothing(password) {
+  await verifyPassword(DUMMY_HASH, password);
+  return false;
+}

package/dist/runtime/server/utils/require-admin.d.ts

@@ -1,3 +1,7 @@
 import type { H3Event } from 'h3';
-export declare function assertSameOrigin(event: H3Event): void;
-export declare function requireAdmin(event: H3Event): Promise<void>;
+import type { CmsSessionUser } from '../../shared/index.js';
+import { assertSameOrigin } from './same-origin.js';
+export { assertSameOrigin };
+export declare function isSuperAdminEmail(event: H3Event, email: string): boolean;
+export declare function requireAdmin(event: H3Event): Promise<CmsSessionUser>;
+export declare function requireSuperAdmin(event: H3Event): Promise<CmsSessionUser>;

package/dist/runtime/server/utils/require-admin.js

@@ -1,37 +1,42 @@
-import { createError, getRequestHeader, getRequestHost } from "h3";
+import { createError } from "h3";
 import { getUserSession, useRuntimeConfig } from "#imports";
-const ORIGINLESS_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-function hostOfUrl(value) {
-  if (!value) return void 0;
-  try {
-    const url = new URL(value);
-    return url.protocol === "http:" || url.protocol === "https:" ? url.host : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function rejectCrossOrigin() {
-  throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
-}
-export function assertSameOrigin(event) {
-  const expectedHost = getRequestHost(event);
-  const origin = getRequestHeader(event, "origin");
-  if (origin) {
-    if (hostOfUrl(origin) !== expectedHost) rejectCrossOrigin();
-    return;
-  }
-  if (ORIGINLESS_SAFE_METHODS.has(event.method)) return;
-  if (hostOfUrl(getRequestHeader(event, "referer")) !== expectedHost) rejectCrossOrigin();
+import { assertSameOrigin } from "./same-origin.js";
+import { findUserById, passwordStamp } from "./users.js";
+export { assertSameOrigin };
+export function isSuperAdminEmail(event, email) {
+  const { adminEmail } = useRuntimeConfig(event).cms;
+  return !!adminEmail && email.toLowerCase() === adminEmail.toLowerCase();
 }
 export async function requireAdmin(event) {
   assertSameOrigin(event);
   const session = await getUserSession(event);
-  const email = session.user?.email;
-  if (!email) {
+  const user = session.user;
+  if (!user?.email) {
     throw createError({ statusCode: 401, statusMessage: "Authentication required" });
   }
-  const { adminEmail } = useRuntimeConfig(event).cms;
-  if (!adminEmail || email.toLowerCase() !== adminEmail.toLowerCase()) {
-    throw createError({ statusCode: 403, statusMessage: "Not authorized" });
+  if (!user.id) {
+    if (!isSuperAdminEmail(event, user.email)) {
+      throw createError({ statusCode: 403, statusMessage: "Not authorized" });
+    }
+    return { email: user.email.toLowerCase(), name: null, role: "superadmin" };
+  }
+  const row = await findUserById(user.id);
+  if (!row || user.passwordStamp !== passwordStamp(row.passwordHash)) {
+    throw createError({ statusCode: 401, statusMessage: "Authentication required" });
+  }
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name ?? null,
+    role: "admin",
+    firstLogin: !!row.mustChangePassword,
+    passwordStamp: user.passwordStamp
+  };
+}
+export async function requireSuperAdmin(event) {
+  const user = await requireAdmin(event);
+  if (user.role !== "superadmin") {
+    throw createError({ statusCode: 403, statusMessage: "Only the super admin can manage users" });
   }
+  return user;
 }

package/dist/runtime/server/utils/same-origin.d.ts

@@ -0,0 +1,2 @@
+import type { H3Event } from 'h3';
+export declare function assertSameOrigin(event: H3Event): void;

package/dist/runtime/server/utils/same-origin.js

@@ -0,0 +1,24 @@
+import { createError, getRequestHeader, getRequestHost } from "h3";
+const ORIGINLESS_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function hostOfUrl(value) {
+  if (!value) return void 0;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:" ? url.host : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function rejectCrossOrigin() {
+  throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
+}
+export function assertSameOrigin(event) {
+  const expectedHost = getRequestHost(event);
+  const origin = getRequestHeader(event, "origin");
+  if (origin) {
+    if (hostOfUrl(origin) !== expectedHost) rejectCrossOrigin();
+    return;
+  }
+  if (ORIGINLESS_SAFE_METHODS.has(event.method)) return;
+  if (hostOfUrl(getRequestHeader(event, "referer")) !== expectedHost) rejectCrossOrigin();
+}

package/dist/runtime/server/utils/settings.d.ts

@@ -0,0 +1,16 @@
+import type { H3Event } from 'h3';
+import { z } from 'zod';
+import type { CmsEntrySettings } from '../../shared/index.js';
+export declare const entrySettingsSchema: z.ZodObject<{
+    columns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    layout: z.ZodOptional<z.ZodObject<{
+        main: z.ZodArray<z.ZodObject<{
+            title: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            collapsed: z.ZodOptional<z.ZodBoolean>;
+            rows: z.ZodArray<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export declare function requireSettingsKey(event: H3Event): string;
+export declare function parseSettingsValue(raw: string): CmsEntrySettings | null;

package/dist/runtime/server/utils/settings.js

@@ -0,0 +1,31 @@
+import { createError, getRouterParam } from "h3";
+import { z } from "zod";
+import cmsConfig from "#cms-config";
+const fieldKey = z.string().min(1).max(128);
+const sectionSchema = z.object({
+  title: z.string().max(200).optional(),
+  description: z.string().max(1e3).optional(),
+  collapsed: z.boolean().optional(),
+  rows: z.array(z.array(fieldKey).max(4)).max(500)
+});
+export const entrySettingsSchema = z.object({
+  columns: z.array(fieldKey).max(200).optional(),
+  layout: z.object({
+    main: z.array(sectionSchema).max(100)
+  }).optional()
+}).strict();
+export function requireSettingsKey(event) {
+  const key = getRouterParam(event, "key") ?? "";
+  if (!Object.hasOwn(cmsConfig, key)) {
+    throw createError({ statusCode: 404, statusMessage: `Unknown entry: ${key}` });
+  }
+  return key;
+}
+export function parseSettingsValue(raw) {
+  try {
+    const parsed = entrySettingsSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}

package/dist/runtime/server/utils/users.d.ts

@@ -0,0 +1,15 @@
+import { cms_users } from '#cms-tables';
+import type { CmsAccount } from '../../shared/index.js';
+export type CmsUserRow = typeof cms_users.$inferSelect;
+export declare function findUserByEmail(email: string): Promise<CmsUserRow | undefined>;
+export declare function findUserById(id: string): Promise<CmsUserRow | undefined>;
+export declare function passwordStamp(passwordHash: string): string;
+export declare function sessionUserFor(row: CmsUserRow): {
+    id: string;
+    email: string;
+    name: string | null;
+    role: "admin";
+    firstLogin: boolean;
+    passwordStamp: string;
+};
+export declare function toAccount(row: CmsUserRow): CmsAccount;