@xleddyl/nuxt-cms 0.1.61 → 0.2.0

package/dist/runtime/server/utils/password.js

@@ -0,0 +1,31 @@
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+const KEY_LENGTH = 64;
+const COST = 16384;
+function derive(password, salt, cost) {
+  return new Promise((resolve, reject) => {
+    scrypt(
+      password,
+      salt,
+      KEY_LENGTH,
+      { N: cost, r: 8, p: 1 },
+      (error, key) => error ? reject(error) : resolve(key)
+    );
+  });
+}
+export async function hashPassword(password) {
+  const salt = randomBytes(16);
+  const key = await derive(password, salt, COST);
+  return `scrypt$${COST}$${salt.toString("base64")}$${key.toString("base64")}`;
+}
+export async function verifyPassword(stored, password) {
+  const [scheme, cost, salt, key] = stored.split("$");
+  if (scheme !== "scrypt" || !cost || !salt || !key) return false;
+  const expected = Buffer.from(key, "base64");
+  const actual = await derive(password, Buffer.from(salt, "base64"), Number(cost));
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+const DUMMY_HASH = "scrypt$16384$AAAAAAAAAAAAAAAAAAAAAA==$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+export async function verifyNothing(password) {
+  await verifyPassword(DUMMY_HASH, password);
+  return false;
+}

package/dist/runtime/server/utils/require-admin.d.ts

@@ -1,3 +1,7 @@
 import type { H3Event } from 'h3';
-export declare function assertSameOrigin(event: H3Event): void;
-export declare function requireAdmin(event: H3Event): Promise<void>;
+import type { CmsSessionUser } from '../../shared/index.js';
+import { assertSameOrigin } from './same-origin.js';
+export { assertSameOrigin };
+export declare function isSuperAdminEmail(event: H3Event, email: string): boolean;
+export declare function requireAdmin(event: H3Event): Promise<CmsSessionUser>;
+export declare function requireSuperAdmin(event: H3Event): Promise<CmsSessionUser>;

package/dist/runtime/server/utils/require-admin.js

@@ -1,37 +1,42 @@
-import { createError, getRequestHeader, getRequestHost } from "h3";
+import { createError } from "h3";
 import { getUserSession, useRuntimeConfig } from "#imports";
-const ORIGINLESS_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-function hostOfUrl(value) {
-  if (!value) return void 0;
-  try {
-    const url = new URL(value);
-    return url.protocol === "http:" || url.protocol === "https:" ? url.host : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function rejectCrossOrigin() {
-  throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
-}
-export function assertSameOrigin(event) {
-  const expectedHost = getRequestHost(event);
-  const origin = getRequestHeader(event, "origin");
-  if (origin) {
-    if (hostOfUrl(origin) !== expectedHost) rejectCrossOrigin();
-    return;
-  }
-  if (ORIGINLESS_SAFE_METHODS.has(event.method)) return;
-  if (hostOfUrl(getRequestHeader(event, "referer")) !== expectedHost) rejectCrossOrigin();
+import { assertSameOrigin } from "./same-origin.js";
+import { findUserById, passwordStamp } from "./users.js";
+export { assertSameOrigin };
+export function isSuperAdminEmail(event, email) {
+  const { adminEmail } = useRuntimeConfig(event).cms;
+  return !!adminEmail && email.toLowerCase() === adminEmail.toLowerCase();
 }
 export async function requireAdmin(event) {
   assertSameOrigin(event);
   const session = await getUserSession(event);
-  const email = session.user?.email;
-  if (!email) {
+  const user = session.user;
+  if (!user?.email) {
     throw createError({ statusCode: 401, statusMessage: "Authentication required" });
   }
-  const { adminEmail } = useRuntimeConfig(event).cms;
-  if (!adminEmail || email.toLowerCase() !== adminEmail.toLowerCase()) {
-    throw createError({ statusCode: 403, statusMessage: "Not authorized" });
+  if (!user.id) {
+    if (!isSuperAdminEmail(event, user.email)) {
+      throw createError({ statusCode: 403, statusMessage: "Not authorized" });
+    }
+    return { email: user.email.toLowerCase(), name: null, role: "superadmin" };
+  }
+  const row = await findUserById(user.id);
+  if (!row || user.passwordStamp !== passwordStamp(row.passwordHash)) {
+    throw createError({ statusCode: 401, statusMessage: "Authentication required" });
+  }
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name ?? null,
+    role: "admin",
+    firstLogin: !!row.mustChangePassword,
+    passwordStamp: user.passwordStamp
+  };
+}
+export async function requireSuperAdmin(event) {
+  const user = await requireAdmin(event);
+  if (user.role !== "superadmin") {
+    throw createError({ statusCode: 403, statusMessage: "Only the super admin can manage users" });
   }
+  return user;
 }

package/dist/runtime/server/utils/same-origin.d.ts

@@ -0,0 +1,2 @@
+import type { H3Event } from 'h3';
+export declare function assertSameOrigin(event: H3Event): void;

package/dist/runtime/server/utils/same-origin.js

@@ -0,0 +1,24 @@
+import { createError, getRequestHeader, getRequestHost } from "h3";
+const ORIGINLESS_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function hostOfUrl(value) {
+  if (!value) return void 0;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:" ? url.host : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function rejectCrossOrigin() {
+  throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
+}
+export function assertSameOrigin(event) {
+  const expectedHost = getRequestHost(event);
+  const origin = getRequestHeader(event, "origin");
+  if (origin) {
+    if (hostOfUrl(origin) !== expectedHost) rejectCrossOrigin();
+    return;
+  }
+  if (ORIGINLESS_SAFE_METHODS.has(event.method)) return;
+  if (hostOfUrl(getRequestHeader(event, "referer")) !== expectedHost) rejectCrossOrigin();
+}

package/dist/runtime/server/utils/settings.d.ts

@@ -0,0 +1,16 @@
+import type { H3Event } from 'h3';
+import { z } from 'zod';
+import type { CmsEntrySettings } from '../../shared/index.js';
+export declare const entrySettingsSchema: z.ZodObject<{
+    columns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    layout: z.ZodOptional<z.ZodObject<{
+        main: z.ZodArray<z.ZodObject<{
+            title: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            collapsed: z.ZodOptional<z.ZodBoolean>;
+            rows: z.ZodArray<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export declare function requireSettingsKey(event: H3Event): string;
+export declare function parseSettingsValue(raw: string): CmsEntrySettings | null;

package/dist/runtime/server/utils/settings.js

@@ -0,0 +1,31 @@
+import { createError, getRouterParam } from "h3";
+import { z } from "zod";
+import cmsConfig from "#cms-config";
+const fieldKey = z.string().min(1).max(128);
+const sectionSchema = z.object({
+  title: z.string().max(200).optional(),
+  description: z.string().max(1e3).optional(),
+  collapsed: z.boolean().optional(),
+  rows: z.array(z.array(fieldKey).max(4)).max(500)
+});
+export const entrySettingsSchema = z.object({
+  columns: z.array(fieldKey).max(200).optional(),
+  layout: z.object({
+    main: z.array(sectionSchema).max(100)
+  }).optional()
+}).strict();
+export function requireSettingsKey(event) {
+  const key = getRouterParam(event, "key") ?? "";
+  if (!Object.hasOwn(cmsConfig, key)) {
+    throw createError({ statusCode: 404, statusMessage: `Unknown entry: ${key}` });
+  }
+  return key;
+}
+export function parseSettingsValue(raw) {
+  try {
+    const parsed = entrySettingsSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}

package/dist/runtime/server/utils/users.d.ts

@@ -0,0 +1,15 @@
+import { cms_users } from '#cms-tables';
+import type { CmsAccount } from '../../shared/index.js';
+export type CmsUserRow = typeof cms_users.$inferSelect;
+export declare function findUserByEmail(email: string): Promise<CmsUserRow | undefined>;
+export declare function findUserById(id: string): Promise<CmsUserRow | undefined>;
+export declare function passwordStamp(passwordHash: string): string;
+export declare function sessionUserFor(row: CmsUserRow): {
+    id: string;
+    email: string;
+    name: string | null;
+    role: "admin";
+    firstLogin: boolean;
+    passwordStamp: string;
+};
+export declare function toAccount(row: CmsUserRow): CmsAccount;

package/dist/runtime/server/utils/users.js

@@ -0,0 +1,34 @@
+import { eq } from "drizzle-orm";
+import { useDb } from "#cms-db";
+import { cms_users } from "#cms-tables";
+export async function findUserByEmail(email) {
+  const [row] = await useDb().select().from(cms_users).where(eq(cms_users.email, email.toLowerCase()));
+  return row;
+}
+export async function findUserById(id) {
+  const [row] = await useDb().select().from(cms_users).where(eq(cms_users.id, id));
+  return row;
+}
+export function passwordStamp(passwordHash) {
+  return passwordHash.slice(-16);
+}
+export function sessionUserFor(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name ?? null,
+    role: "admin",
+    firstLogin: !!row.mustChangePassword,
+    passwordStamp: passwordStamp(row.passwordHash)
+  };
+}
+export function toAccount(row) {
+  return {
+    id: row.id,
+    email: row.email,
+    name: row.name ?? null,
+    role: row.role,
+    lastLoginAt: row.lastLoginAt ?? null,
+    createdAt: String(row.createdAt)
+  };
+}

package/dist/runtime/shared/index.d.ts

@@ -1,5 +1,6 @@
 import type { PgTable } from 'drizzle-orm/pg-core';
 import type { SQLiteTable } from 'drizzle-orm/sqlite-core';
+import type { CmsLayoutBlock, CmsListInput } from './layout.js';
 export type CmsTable = SQLiteTable | PgTable;
 export type FieldType = 'text' | 'richtext' | 'number' | 'boolean' | 'date' | 'email' | 'slug' | 'select' | 'json' | 'media' | 'relation' | 'blocks';
 export interface CmsI18n {
@@ -76,6 +77,8 @@ export interface CmsTab {
 export interface FieldConfig {
     label: string;
     type: FieldType;
+    description?: string;
+    placeholder?: string;
     tab?: string;
     required?: boolean;
     private?: boolean;
@@ -138,6 +141,9 @@ export interface CmsEntry {
     columns?: string[];
     tabs?: CmsTab[];
     table?: CmsTable;
+    icon?: string;
+    layout?: CmsLayoutBlock[];
+    list?: CmsListInput;
 }
 export declare const MOBILE_MEDIA_SUFFIX = "Mobile";
 export declare function mobileMediaKey(key: string): string;
@@ -168,6 +174,8 @@ export declare function blocksFieldTypeName(entryName: string, fieldKey: string)
 export declare function blockTypeName(entryName: string, fieldKey: string, blockName: string): string;
 interface FieldInputBase {
     label: string;
+    description?: string;
+    placeholder?: string;
     required?: boolean;
     private?: boolean;
     tab?: string;
@@ -234,6 +242,9 @@ export type CmsFieldInput = TextFieldInput | RichtextFieldInput | NumberFieldInp
 interface CmsEntryInputBase {
     id: string;
     label: string;
+    icon?: string;
+    layout?: CmsLayoutBlock[];
+    list?: CmsListInput;
     drafts?: boolean;
     tabs?: CmsTab[];
     fields: Record<string, CmsFieldInput>;
@@ -261,4 +272,5 @@ export interface CmsPageInput extends CmsEntryInputBase {
 export type CmsEntryInput = CmsCollectionInput | CmsSingleInput | CmsPageInput;
 export type CmsConfigInput = Record<string, CmsEntryInput>;
 export declare function defineCmsConfig<T extends CmsConfigInput>(config: T): T;
-export {};
+export * from './layout.js';
+export * from './users.js';

package/dist/runtime/shared/index.js

@@ -379,3 +379,5 @@ export function blockTypeName(entryName, fieldKey, blockName) {
 export function defineCmsConfig(config) {
   return config;
 }
+export * from "./layout.js";
+export * from "./users.js";

package/dist/runtime/shared/layout.d.ts

@@ -0,0 +1,34 @@
+import type { FieldConfig } from './index.js';
+export declare const MAX_LAYOUT_ROW_FIELDS = 4;
+export type CmsLayoutRow = string | string[];
+export interface CmsLayoutSectionInput {
+    title: string;
+    description?: string;
+    collapsed?: boolean;
+    rows: CmsLayoutRow[];
+}
+export type CmsLayoutBlock = CmsLayoutRow | CmsLayoutSectionInput;
+export interface CmsLayoutSection {
+    title?: string;
+    description?: string;
+    collapsed?: boolean;
+    rows: string[][];
+}
+export interface CmsFormLayout {
+    main: CmsLayoutSection[];
+}
+export interface CmsListInput {
+    columns?: string[];
+}
+export interface CmsEntrySettings {
+    columns?: string[];
+    layout?: CmsFormLayout;
+}
+export type CmsSettingsMap = Record<string, CmsEntrySettings>;
+export declare function layoutFromConfig(input: CmsLayoutBlock[] | undefined): CmsFormLayout;
+export declare function layoutKeys(input: CmsLayoutBlock[] | undefined): string[];
+export declare function resolveFormLayout(fields: Record<string, FieldConfig>, layout: CmsFormLayout | undefined): CmsFormLayout;
+export declare function defaultListColumns(fields: Record<string, FieldConfig>, list: CmsListInput | undefined, extra?: string[]): string[];
+export declare function resolveListColumns(fields: Record<string, FieldConfig>, saved: string[] | undefined, list: CmsListInput | undefined, extra?: string[]): string[];
+export declare function layoutErrors(at: string, fields: Record<string, FieldConfig>, input: CmsLayoutBlock[] | undefined): string[];
+export declare function listErrors(at: string, fields: Record<string, FieldConfig>, list: CmsListInput | undefined, extra?: string[]): string[];

package/dist/runtime/shared/layout.js

@@ -0,0 +1,130 @@
+export const MAX_LAYOUT_ROW_FIELDS = 4;
+function isSectionInput(block) {
+  return typeof block === "object" && !Array.isArray(block);
+}
+function toRow(row) {
+  return Array.isArray(row) ? [...row] : [row];
+}
+function sectionsFromBlocks(blocks) {
+  const sections = [];
+  let loose = null;
+  for (const block of blocks ?? []) {
+    if (isSectionInput(block)) {
+      loose = null;
+      sections.push({
+        title: block.title,
+        ...block.description ? { description: block.description } : {},
+        ...block.collapsed ? { collapsed: true } : {},
+        rows: block.rows.map(toRow)
+      });
+      continue;
+    }
+    if (!loose) {
+      loose = { rows: [] };
+      sections.push(loose);
+    }
+    loose.rows.push(toRow(block));
+  }
+  return sections;
+}
+export function layoutFromConfig(input) {
+  return { main: sectionsFromBlocks(input) };
+}
+export function layoutKeys(input) {
+  return layoutFromConfig(input).main.flatMap((section) => section.rows.flat());
+}
+function cloneSection(section) {
+  return { ...section, rows: section.rows.map((row) => [...row]) };
+}
+export function resolveFormLayout(fields, layout) {
+  const known = new Set(Object.keys(fields));
+  const mobileOf = new Map(
+    Object.entries(fields).filter(([, field]) => field.mobileOf && known.has(field.mobileOf)).map(([key, field]) => [field.mobileOf, key])
+  );
+  const placed = /* @__PURE__ */ new Set();
+  const clean = (sections) => (sections ?? []).map(cloneSection).map((section) => ({
+    ...section,
+    rows: section.rows.map(
+      (row) => row.filter((key) => {
+        if (!known.has(key) || placed.has(key)) return false;
+        placed.add(key);
+        return true;
+      })
+    ).filter((row) => row.length)
+  }));
+  const main = clean(layout?.main);
+  for (const section of main) {
+    for (let r = 0; r < section.rows.length; r++) {
+      const row = section.rows[r];
+      for (const [parent, mobile] of mobileOf) {
+        const index = row.indexOf(parent);
+        if (index === -1 || placed.has(mobile)) continue;
+        if (row.length < MAX_LAYOUT_ROW_FIELDS) row.splice(index + 1, 0, mobile);
+        else section.rows.splice(r + 1, 0, [mobile]);
+        placed.add(mobile);
+      }
+    }
+  }
+  const missing = Object.keys(fields).filter((key) => !placed.has(key));
+  if (missing.length) {
+    const rows = [];
+    for (const key of missing) {
+      if (placed.has(key)) continue;
+      const mobile = mobileOf.get(key);
+      const row = mobile && !placed.has(mobile) ? [key, mobile] : [key];
+      row.forEach((k) => placed.add(k));
+      rows.push(row);
+    }
+    const last = main[main.length - 1];
+    if (last && !last.title) last.rows.push(...rows);
+    else main.push({ rows });
+  }
+  return { main };
+}
+export function defaultListColumns(fields, list, extra = []) {
+  const available = [...Object.keys(fields), ...extra];
+  const configured = list?.columns?.filter((key) => available.includes(key));
+  if (configured?.length) return configured;
+  return [...Object.keys(fields).slice(0, 4), ...extra];
+}
+export function resolveListColumns(fields, saved, list, extra = []) {
+  const available = /* @__PURE__ */ new Set([...Object.keys(fields), ...extra]);
+  const kept = saved?.filter((key) => available.has(key));
+  return kept?.length ? [...new Set(kept)] : defaultListColumns(fields, list, extra);
+}
+export function layoutErrors(at, fields, input) {
+  if (!input) return [];
+  const errors = [];
+  if (!Array.isArray(input)) return [`${at}: layout must be an array of rows and sections`];
+  const blocks = input;
+  const seen = /* @__PURE__ */ new Set();
+  const checkRow = (row) => {
+    const keys = toRow(row);
+    if (!keys.length) errors.push(`${at}: layout has an empty row`);
+    if (keys.length > MAX_LAYOUT_ROW_FIELDS)
+      errors.push(
+        `${at}: layout row [${keys.join(", ")}] has more than ${MAX_LAYOUT_ROW_FIELDS} fields`
+      );
+    for (const key of keys) {
+      if (!Object.hasOwn(fields, key))
+        errors.push(`${at}: layout names '${key}', which is not a declared field`);
+      else if (seen.has(key)) errors.push(`${at}: layout names '${key}' more than once`);
+      seen.add(key);
+    }
+  };
+  for (const block of blocks) {
+    if (isSectionInput(block)) {
+      if (!block.title) errors.push(`${at}: every layout section needs a title`);
+      if (!Array.isArray(block.rows))
+        errors.push(`${at}: layout section '${block.title}' needs a rows array`);
+      else block.rows.forEach(checkRow);
+    } else {
+      checkRow(block);
+    }
+  }
+  return errors;
+}
+export function listErrors(at, fields, list, extra = []) {
+  if (!list?.columns) return [];
+  return list.columns.filter((key) => !Object.hasOwn(fields, key) && !extra.includes(key)).map((key) => `${at}: list.columns names '${key}', which is not a declared field`);
+}

package/dist/runtime/shared/users.d.ts

@@ -0,0 +1,18 @@
+export type CmsUserRole = 'superadmin' | 'admin';
+export interface CmsSessionUser {
+    id?: string;
+    email: string;
+    name?: string | null;
+    role?: CmsUserRole;
+    firstLogin?: boolean;
+    passwordStamp?: string;
+}
+export interface CmsAccount {
+    id: string;
+    email: string;
+    name: string | null;
+    role: CmsUserRole;
+    lastLoginAt: string | null;
+    createdAt: string;
+}
+export declare const MIN_PASSWORD_LENGTH = 8;

package/dist/runtime/shared/users.js

@@ -0,0 +1 @@
+export const MIN_PASSWORD_LENGTH = 8;

package/dist/runtime/shared/validation.js

@@ -31,8 +31,9 @@ function scalarSchema(field, m) {
       return field.required ? z.string().trim().min(1, m.required) : z.string();
   }
 }
-function optionalize(field, base) {
-  return field.required ? base : base.nullish().transform((v) => v ?? null);
+function optionalize(field, base, m) {
+  if (!field.required) return base.nullish().transform((v) => v ?? null);
+  return z.any().refine((v) => v !== null && v !== void 0, m.required).pipe(base);
 }
 function translatableSchema(field, i18n, m) {
   const { locales, defaultLocale } = i18n;
@@ -42,7 +43,7 @@ function translatableSchema(field, i18n, m) {
 function blockFieldSchema(blockField, i18n, m) {
   if (isTranslatableField(blockField) && i18n.locales.length)
     return translatableSchema(blockField, i18n, m);
-  return optionalize(blockField, scalarSchema(blockField, m));
+  return optionalize(blockField, scalarSchema(blockField, m), m);
 }
 function blocksSchema(field, i18n, m) {
   const variants = Object.entries(field.blocks ?? {}).map(
@@ -99,7 +100,7 @@ export function buildEntrySchema(entry, i18n, messages) {
       shape[key] = field.required ? json.refine((v) => v !== void 0 && v !== null, m.required) : json.nullish().transform((v) => v ?? null);
       continue;
     }
-    shape[key] = optionalize(field, scalarSchema(field, m));
+    shape[key] = optionalize(field, scalarSchema(field, m), m);
   }
   if (entry.drafts) {
     shape.status = z.enum(["draft", "published"]).nullish().transform((v) => v ?? void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xleddyl/nuxt-cms",
-  "version": "0.1.61",
+  "version": "0.2.0",
   "description": "Lightweight CMS that ships with your Nuxt app: runs on the Nitro server, content types defined in code, /cms admin panel, GraphQL API, SQLite or Postgres. No external CMS needed!",
   "license": "MIT",
   "author": "Edoardo Alberti (https://github.com/xleddyl)",
@@ -60,8 +60,8 @@
     "dist"
   ],
   "dependencies": {
-    "@fontsource-variable/hanken-grotesk": "^5.3.0",
-    "@fontsource/fragment-mono": "^5.3.0",
+    "@fontsource-variable/geist": "^5.3.0",
+    "@fontsource-variable/geist-mono": "^5.3.0",
     "@nuxt/kit": "^4.4.8",
     "@tailwindcss/vite": "^4.3.2",
     "@tiptap/starter-kit": "^3.0.0",