@xleddyl/nuxt-cms 0.1.9 → 0.1.10

package/dist/runtime/app/pages/admin-collection.vue

@@ -32,7 +32,22 @@
          </div>
       </CmsPageHeader>
 
-      <div v-if="config.kind === 'single'" class="cms-card p-7">
+      <CmsEmptyState
+         v-if="error"
+         icon="i-lucide-triangle-alert"
+         :title="t('cms.collection.loadError')"
+      >
+         <UButton
+            :label="t('cms.collection.retry')"
+            icon="i-lucide-refresh-cw"
+            variant="subtle"
+            class="mt-3 rounded-full px-4"
+            :loading="status === 'pending'"
+            @click="reload"
+         />
+      </CmsEmptyState>
+
+      <div v-else-if="config.kind === 'single'" class="cms-card p-7">
          <CmsEntryForm
             v-model="formState"
             :fields="config.fields"
@@ -43,6 +58,14 @@
       </div>
 
       <template v-else>
+         <UInput
+            v-if="total || searchTerm"
+            v-model="search"
+            icon="i-lucide-search"
+            :placeholder="t('cms.collection.searchPlaceholder')"
+            class="max-w-xs"
+         />
+
          <div v-if="rows.length" class="cms-card overflow-hidden">
             <UTable
                v-model:column-visibility="columnVisibility"
@@ -81,6 +104,19 @@
             </UTable>
          </div>
 
+         <div v-else-if="status === 'pending'" class="flex justify-center py-10">
+            <UIcon
+               name="i-lucide-loader-circle"
+               class="text-(--ui-text-dimmed) size-6 animate-spin"
+            />
+         </div>
+
+         <CmsEmptyState
+            v-else-if="searchTerm"
+            icon="i-lucide-search-x"
+            :title="t('cms.collection.noResults')"
+         />
+
          <CmsEmptyState
             v-else
             icon="i-lucide-sprout"
@@ -95,6 +131,10 @@
                @click="openCreate"
             />
          </CmsEmptyState>
+
+         <div v-if="total > PAGE_SIZE" class="flex justify-center">
+            <UPagination v-model:page="page" :total="total" :items-per-page="PAGE_SIZE" />
+         </div>
       </template>
    </div>
 </template>
@@ -115,6 +155,7 @@ import {
   watch
 } from "#imports";
 import cmsConfig from "#cms-config";
+import { useCmsConfirm } from "../composables/cms-confirm";
 import { useCmsRuntime } from "../composables/cms-runtime";
 import { cmsApi } from "../utils/api";
 import { errorMessage } from "../utils/ui";
@@ -137,8 +178,37 @@ const fieldKeys = Object.keys(config.fields);
 const drafts = config.kind === "collection" && !!config.drafts;
 const formKeys = drafts ? [...fieldKeys, "status"] : fieldKeys;
 const endpoint = `/api/cms/admin/${name}`;
-const { data, refresh } = await useFetch(endpoint);
-const rows = computed(() => Array.isArray(data.value) ? data.value : []);
+const PAGE_SIZE = 25;
+const page = ref(1);
+const search = ref("");
+const searchTerm = ref("");
+let searchTimer;
+watch(search, (value) => {
+  clearTimeout(searchTimer);
+  searchTimer = setTimeout(() => {
+    searchTerm.value = value.trim();
+    page.value = 1;
+  }, 300);
+});
+const listQuery = computed(() => ({
+  limit: PAGE_SIZE,
+  offset: (page.value - 1) * PAGE_SIZE,
+  ...searchTerm.value ? { search: searchTerm.value } : {}
+}));
+const { data, refresh, error, status } = await useFetch(endpoint, {
+  query: config.kind === "collection" ? listQuery : void 0
+});
+function isList(value) {
+  return !!value && Array.isArray(value.items);
+}
+const rows = computed(() => isList(data.value) ? data.value.items : []);
+const total = computed(() => isList(data.value) ? data.value.total : 0);
+const reload = async () => {
+  await refresh();
+  if (config.kind === "single" && !error.value) {
+    formState.value = data.value && !isList(data.value) ? pickFields(data.value) : emptyState();
+  }
+};
 const tableUi = {
   thead: "border-b border-(--cms-line)",
   th: "cms-kicker px-5 py-3 font-normal",
@@ -154,15 +224,16 @@ function pickFields(row) {
   return Object.fromEntries(formKeys.map((k) => [k, row[k] ?? null]));
 }
 async function submit(action) {
+  if (saving.value) return false;
   saving.value = true;
   try {
     await action();
     await refresh();
     return true;
-  } catch (error) {
+  } catch (error2) {
     toast.add({
       title: t("cms.toast.saveFailed"),
-      description: errorMessage(error),
+      description: errorMessage(error2),
       color: "error"
     });
     return false;
@@ -171,7 +242,7 @@ async function submit(action) {
   }
 }
 if (config.kind === "single") {
-  formState.value = data.value && !Array.isArray(data.value) ? pickFields(data.value) : emptyState();
+  formState.value = data.value && !isList(data.value) ? pickFields(data.value) : emptyState();
 }
 async function saveSingle() {
   const ok = await submit(() => cmsApi(endpoint, { method: "PUT", body: formState.value }));
@@ -249,25 +320,29 @@ const columnItems = computed(
   }))
 );
 const kicker = computed(
-  () => config.kind === "single" ? t("cms.collection.kickerSingle") : t("cms.collection.kicker", rows.value.length)
+  () => config.kind === "single" ? t("cms.collection.kickerSingle") : t("cms.collection.kicker", total.value)
 );
 function onSelect(_event, row) {
   navigateTo(`/cms/${name}/${row.original.id}`);
 }
 async function toggleStatus(row) {
   const next = row.status === "published" ? "draft" : "published";
-  await submit(
-    () => cmsApi(`${endpoint}/${row.id}`, {
+  await submit(async () => {
+    const fresh = await cmsApi(`${endpoint}/${row.id}`);
+    await cmsApi(`${endpoint}/${row.id}`, {
       method: "PUT",
-      body: { ...pickFields(row), status: next }
-    })
-  );
+      body: { ...pickFields(fresh), status: next }
+    });
+  });
 }
 function openCreate() {
   navigateTo(`/cms/${name}/new`);
 }
+const confirmAction = useCmsConfirm();
 async function deleteRow(row) {
-  if (!confirm(t("cms.collection.deleteConfirm"))) return;
-  await submit(() => cmsApi(`${endpoint}/${row.id}`, { method: "DELETE" }));
+  if (!await confirmAction(t("cms.collection.deleteConfirm"))) return;
+  const lastOnPage = rows.value.length === 1 && page.value > 1;
+  const ok = await submit(() => cmsApi(`${endpoint}/${row.id}`, { method: "DELETE" }));
+  if (ok && lastOnPage) page.value -= 1;
 }
 </script>

package/dist/runtime/app/pages/admin-entry.vue

@@ -69,6 +69,7 @@ import {
   watch
 } from "#imports";
 import cmsConfig from "#cms-config";
+import { useCmsConfirm } from "../composables/cms-confirm";
 import { cmsApi } from "../utils/api";
 import { errorMessage } from "../utils/ui";
 const FORM_ID = "cms-entry-form";
@@ -100,9 +101,14 @@ function pickFields(row) {
 }
 const formState = ref(emptyState());
 if (!isNew) {
-  const { data } = await useFetch(`${endpoint}/${id}`);
-  if (!data.value) {
-    throw createError({ statusCode: 404, statusMessage: "Entry not found", fatal: true });
+  const { data, error } = await useFetch(`${endpoint}/${id}`);
+  if (error.value || !data.value) {
+    const statusCode = error.value?.statusCode ?? 404;
+    throw createError({
+      statusCode,
+      statusMessage: statusCode === 404 ? "Entry not found" : "Failed to load entry",
+      fatal: true
+    });
   }
   formState.value = pickFields(data.value);
 }
@@ -117,8 +123,9 @@ watch(dirty, (value) => {
   else window.removeEventListener("beforeunload", onBeforeUnload);
 });
 onBeforeUnmount(() => window.removeEventListener("beforeunload", onBeforeUnload));
-onBeforeRouteLeave(() => {
-  if (dirty.value && !confirm(t("cms.entry.unsavedChanges"))) return false;
+const confirmAction = useCmsConfirm();
+onBeforeRouteLeave(async () => {
+  if (dirty.value && !await confirmAction(t("cms.entry.unsavedChanges"))) return false;
 });
 const published = computed({
   get: () => formState.value.status === "published",

package/dist/runtime/server/api/collection.get.d.ts

@@ -1,6 +1,4 @@
 declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
     [x: string]: any;
-} | {
-    [x: string]: any;
-}[] | null>>;
+} | null>>;
 export default _default;

package/dist/runtime/server/api/collection.get.js

@@ -1,19 +1,45 @@
-import { desc } from "drizzle-orm";
-import { defineEventHandler } from "h3";
+import { count, desc, sql } from "drizzle-orm";
+import { defineEventHandler, getValidatedQuery } from "h3";
+import { z } from "zod";
 import { useDb } from "#cms-db";
 import { getRegistryEntry, idColumn, tableColumns } from "../utils/registry.js";
 import { attachManyToMany } from "../utils/relations.js";
 import { requireAdmin } from "../utils/require-admin.js";
+const querySchema = z.object({
+  limit: z.coerce.number().int().min(1).max(100).default(50),
+  offset: z.coerce.number().int().min(0).default(0),
+  search: z.string().trim().max(200).optional(),
+  light: z.stringbool().default(false)
+});
+function likePattern(term) {
+  return `%${term.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_")}%`;
+}
 export default defineEventHandler(async (event) => {
   await requireAdmin(event);
   const { name, entry, table } = getRegistryEntry(event);
   const db = useDb();
   if (entry.kind === "single") {
-    const rows2 = await db.select().from(table).limit(1);
-    await attachManyToMany(name, entry, rows2);
-    return rows2[0] ?? null;
+    const rows = await db.select().from(table).limit(1);
+    await attachManyToMany(db, name, entry, rows);
+    return rows[0] ?? null;
+  }
+  const { limit, offset, search, light } = await getValidatedQuery(event, querySchema.parse);
+  const columns = tableColumns(table);
+  const titleColumn = entry.titleField && Object.hasOwn(columns, entry.titleField) ? columns[entry.titleField] : void 0;
+  let where;
+  if (search) {
+    const column = titleColumn ?? idColumn(table);
+    where = sql`${column} like ${likePattern(search)} escape '\\'`;
   }
-  const orderBy = tableColumns(table).createdAt ?? idColumn(table);
-  const rows = await db.select().from(table).orderBy(desc(orderBy));
-  return attachManyToMany(name, entry, rows);
+  const selection = light ? Object.fromEntries([
+    ["id", idColumn(table)],
+    ...entry.titleField && titleColumn ? [[entry.titleField, titleColumn]] : [],
+    ...entry.drafts && Object.hasOwn(columns, "status") ? [["status", columns.status]] : []
+  ]) : void 0;
+  const orderBy = columns.createdAt ?? idColumn(table);
+  const base = selection ? db.select(selection).from(table) : db.select().from(table);
+  const items = await (where ? base.where(where) : base).orderBy(desc(orderBy)).limit(limit).offset(offset);
+  const [counted] = await (where ? db.select({ total: count() }).from(table).where(where) : db.select({ total: count() }).from(table));
+  if (!light) await attachManyToMany(db, name, entry, items);
+  return { items, total: counted?.total ?? 0 };
 });

package/dist/runtime/server/api/collection.post.js

@@ -1,5 +1,5 @@
 import { createError, defineEventHandler, readValidatedBody } from "h3";
-import { useDb } from "#cms-db";
+import { withTransaction } from "#cms-db";
 import { customId } from "../utils/custom-id.js";
 import { mapConstraintErrors } from "../utils/db-errors.js";
 import { buildValidator, getRegistryEntry } from "../utils/registry.js";
@@ -21,10 +21,14 @@ export default defineEventHandler(async (event) => {
   await assertRelationTargets(entry, lists);
   if (entry.drafts) values.status ??= "draft";
   values.id = customId(entry.id);
-  return mapConstraintErrors(async () => {
-    const [row] = await useDb().insert(table).values(values).returning();
-    await saveManyToMany(name, row.id, lists);
-    const [attached] = await attachManyToMany(name, entry, [row]);
-    return attached;
-  });
+  return mapConstraintErrors(
+    () => withTransaction(async (db) => {
+      const [row] = await db.insert(table).values(values).returning();
+      await saveManyToMany(db, name, row.id, lists);
+      const [attached] = await attachManyToMany(db, name, entry, [
+        row
+      ]);
+      return attached;
+    })
+  );
 });

package/dist/runtime/server/api/collection.put.js

@@ -1,5 +1,5 @@
 import { createError, defineEventHandler, readValidatedBody } from "h3";
-import { useDb } from "#cms-db";
+import { withTransaction } from "#cms-db";
 import { mapConstraintErrors } from "../utils/db-errors.js";
 import { buildValidator, getRegistryEntry, idColumn, withUpdatedAt } from "../utils/registry.js";
 import {
@@ -19,10 +19,14 @@ export default defineEventHandler(async (event) => {
   const { values, lists } = splitRelationValues(entry, body);
   await assertRelationTargets(entry, lists);
   const set = withUpdatedAt(table, values);
-  return mapConstraintErrors(async () => {
-    const [row] = await useDb().insert(table).values({ id: entry.id, ...set }).onConflictDoUpdate({ target: idColumn(table), set }).returning();
-    await saveManyToMany(name, entry.id, lists);
-    const [attached] = await attachManyToMany(name, entry, [row]);
-    return attached;
-  });
+  return mapConstraintErrors(
+    () => withTransaction(async (db) => {
+      const [row] = await db.insert(table).values({ id: entry.id, ...set }).onConflictDoUpdate({ target: idColumn(table), set }).returning();
+      await saveManyToMany(db, name, entry.id, lists);
+      const [attached] = await attachManyToMany(db, name, entry, [
+        row
+      ]);
+      return attached;
+    })
+  );
 });

package/dist/runtime/server/api/item.get.js

@@ -11,8 +11,9 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 404, statusMessage: "Single objects have no items" });
   }
   const id = parseId(event);
-  const rows = await useDb().select().from(table).where(eq(idColumn(table), id)).limit(1);
+  const db = useDb();
+  const rows = await db.select().from(table).where(eq(idColumn(table), id)).limit(1);
   if (!rows[0]) throw createError({ statusCode: 404, statusMessage: "Row not found" });
-  const [attached] = await attachManyToMany(name, entry, [rows[0]]);
+  const [attached] = await attachManyToMany(db, name, entry, [rows[0]]);
   return attached;
 });

package/dist/runtime/server/api/item.put.js

@@ -1,6 +1,6 @@
 import { eq } from "drizzle-orm";
 import { createError, defineEventHandler, readValidatedBody } from "h3";
-import { useDb } from "#cms-db";
+import { withTransaction } from "#cms-db";
 import {
   buildValidator,
   getRegistryEntry,
@@ -30,11 +30,15 @@ export default defineEventHandler(async (event) => {
   const { values, lists } = splitRelationValues(entry, body);
   await assertRelationTargets(entry, lists);
   const set = withUpdatedAt(table, values);
-  return mapConstraintErrors(async () => {
-    const [row] = await useDb().update(table).set(set).where(eq(idColumn(table), id)).returning();
-    if (!row) throw createError({ statusCode: 404, statusMessage: "Row not found" });
-    await saveManyToMany(name, id, lists);
-    const [attached] = await attachManyToMany(name, entry, [row]);
-    return attached;
-  });
+  return mapConstraintErrors(
+    () => withTransaction(async (db) => {
+      const [row] = await db.update(table).set(set).where(eq(idColumn(table), id)).returning();
+      if (!row) throw createError({ statusCode: 404, statusMessage: "Row not found" });
+      await saveManyToMany(db, name, id, lists);
+      const [attached] = await attachManyToMany(db, name, entry, [
+        row
+      ]);
+      return attached;
+    })
+  );
 });

package/dist/runtime/server/api/media-presign.post.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { createError, defineEventHandler, readValidatedBody } from "h3";
 import { z } from "zod";
 import { slugify } from "../../shared/index.js";
-import { useMediaStorage } from "../utils/media.js";
+import { assertUploadContentType, useMediaStorage } from "../utils/media.js";
 import { requireAdmin } from "../utils/require-admin.js";
 const MAX_BASE_LENGTH = 80;
 const MAX_EXT_LENGTH = 10;
@@ -22,6 +22,7 @@ export default defineEventHandler(async (event) => {
   await requireAdmin(event);
   const { media, client, bucketUrl, publicUrl } = useMediaStorage(event);
   const { filename, contentType, size } = await readValidatedBody(event, bodySchema.parse);
+  assertUploadContentType(contentType);
   if (size > MAX_FILE_SIZE) {
     throw createError({
       statusCode: 413,

package/dist/runtime/server/api/media.post.js

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { useDb } from "#cms-db";
 import { cms_media } from "#cms-tables";
 import { objectKeySchema } from "../../shared/validation.js";
-import { toMediaItem, useMediaConfig } from "../utils/media.js";
+import { assertUploadContentType, toMediaItem, useMediaConfig } from "../utils/media.js";
 import { requireAdmin } from "../utils/require-admin.js";
 const bodySchema = z.object({
   key: objectKeySchema,
@@ -18,6 +18,7 @@ export default defineEventHandler(async (event) => {
   await requireAdmin(event);
   const { publicUrl } = useMediaConfig(event);
   const body = await readValidatedBody(event, bodySchema.parse);
+  if (body.mime) assertUploadContentType(body.mime);
   const values = {
     key: body.key,
     mime: body.mime ?? null,

package/dist/runtime/server/plugins/migrate-postgres.js

@@ -1,9 +1,17 @@
 import { existsSync } from "node:fs";
 import { migrate } from "drizzle-orm/node-postgres/migrator";
+import cmsConfig from "#cms-config";
 import { useRuntimeConfig } from "#imports";
 import { useDb } from "../utils/db-postgres.js";
 export default async () => {
   const { migrationsDir } = useRuntimeConfig().cms;
-  if (!existsSync(migrationsDir)) return;
+  if (!existsSync(migrationsDir)) {
+    if (Object.keys(cmsConfig).length) {
+      console.error(
+        `[nuxt-cms] Migrations folder not found: ${migrationsDir}. CMS tables may be missing \u2014 run the dev server once and deploy the generated server/db/migrations folder.`
+      );
+    }
+    return;
+  }
   await migrate(useDb(), { migrationsFolder: migrationsDir });
 };

package/dist/runtime/server/plugins/migrate-sqlite.js

@@ -1,9 +1,17 @@
 import { existsSync } from "node:fs";
 import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+import cmsConfig from "#cms-config";
 import { useRuntimeConfig } from "#imports";
 import { useDb } from "../utils/db-sqlite.js";
 export default () => {
   const { migrationsDir } = useRuntimeConfig().cms;
-  if (!existsSync(migrationsDir)) return;
+  if (!existsSync(migrationsDir)) {
+    if (Object.keys(cmsConfig).length) {
+      console.error(
+        `[nuxt-cms] Migrations folder not found: ${migrationsDir}. CMS tables may be missing \u2014 run the dev server once and deploy the generated server/db/migrations folder.`
+      );
+    }
+    return;
+  }
   migrate(useDb(), { migrationsFolder: migrationsDir });
 };

package/dist/runtime/server/routes/auth/login.post.js

@@ -24,7 +24,7 @@ function safeEqual(a, b) {
   return timingSafeEqual(hashA, hashB);
 }
 export default defineEventHandler(async (event) => {
-  const ip = getRequestIP(event) ?? "unknown";
+  const ip = getRequestIP(event, { xForwardedFor: true }) ?? "unknown";
   const now = Date.now();
   pruneFailures(now);
   if (globalFailures.resetAt > now && globalFailures.count >= RATE_GLOBAL_MAX_FAILURES) {

package/dist/runtime/server/utils/db-postgres.d.ts

@@ -1,3 +1,7 @@
 export declare function useDb(): import("drizzle-orm/node-postgres").NodePgDatabase<Record<string, unknown>> & {
     $client: import("pg").Pool;
 };
+type Db = ReturnType<typeof useDb>;
+export type CmsDb = Db | Parameters<Parameters<Db['transaction']>[0]>[0];
+export declare function withTransaction<T>(fn: (db: CmsDb) => Promise<T>): Promise<T>;
+export {};

package/dist/runtime/server/utils/db-postgres.js

@@ -14,3 +14,6 @@ export function useDb() {
   }
   return _db;
 }
+export function withTransaction(fn) {
+  return useDb().transaction((tx) => fn(tx));
+}

package/dist/runtime/server/utils/db-sqlite.d.ts

@@ -2,3 +2,5 @@ import Database from 'better-sqlite3';
 export declare function useDb(): import("drizzle-orm/better-sqlite3").BetterSQLite3Database<Record<string, unknown>> & {
     $client: Database.Database;
 };
+export type CmsDb = ReturnType<typeof useDb>;
+export declare function withTransaction<T>(fn: (db: CmsDb) => Promise<T>): Promise<T>;

package/dist/runtime/server/utils/db-sqlite.js

@@ -1,6 +1,7 @@
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import Database from "better-sqlite3";
+import { sql } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { useRuntimeConfig } from "#imports";
 let _db = null;
@@ -15,3 +16,21 @@ export function useDb() {
   }
   return _db;
 }
+let txQueue = Promise.resolve();
+export function withTransaction(fn) {
+  const db = useDb();
+  const run = txQueue.then(async () => {
+    await db.run(sql`begin immediate`);
+    try {
+      const result = await fn(db);
+      await db.run(sql`commit`);
+      return result;
+    } catch (error) {
+      await db.run(sql`rollback`);
+      throw error;
+    }
+  });
+  txQueue = run.catch(() => {
+  });
+  return run;
+}

package/dist/runtime/server/utils/graphql.js

@@ -8,7 +8,6 @@ import {
   inArray,
   isNotNull,
   isNull,
-  like,
   lt,
   lte,
   ne,
@@ -100,15 +99,22 @@ const OPERATORS = {
   gte: (column, value) => gte(column, value),
   lt: (column, value) => lt(column, value),
   lte: (column, value) => lte(column, value),
-  like: (column, value) => like(column, String(value).replaceAll("*", "%")),
+  like: (column, value) => {
+    const pattern = String(value).replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_").replaceAll("*", "%");
+    return sql`${column} like ${pattern} escape '\\'`;
+  },
   in: (column, value) => inArray(column, value)
 };
+function columnFor(table, key) {
+  const columns = tableColumns(table);
+  return Object.hasOwn(columns, key) ? columns[key] : void 0;
+}
 function filterConditions(table, filters) {
   if (!filters) return [];
   const conditions = [];
   for (const [key, ops] of Object.entries(filters)) {
     if (!ops) continue;
-    const column = tableColumns(table)[key];
+    const column = columnFor(table, key);
     if (!column) throw new GraphQLError(`Unknown filter field: ${key}`);
     for (const [op, value] of Object.entries(ops)) {
       if (value === void 0) continue;
@@ -130,7 +136,7 @@ function filterConditions(table, filters) {
 function sortOrder(table, sort) {
   const order = [];
   for (const part of sort ?? []) {
-    const column = tableColumns(table)[part.field];
+    const column = columnFor(table, part.field);
     if (!column) throw new GraphQLError(`Unknown sort field: ${part.field}`);
     order.push(part.direction === "desc" ? desc(column) : asc(column));
   }

package/dist/runtime/server/utils/media.d.ts

@@ -9,6 +9,7 @@ interface MediaConfig {
     accessKeyId: string;
     secretAccessKey: string;
 }
+export declare function assertUploadContentType(contentType: string): void;
 export declare function encodeKey(key: string): string;
 export declare function useMediaConfig(event: H3Event): {
     media: MediaConfig;

package/dist/runtime/server/utils/media.js

@@ -2,6 +2,33 @@ import { AwsClient } from "aws4fetch";
 import { createError } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { mediaPublicUrl, mediaTypeFor } from "../../shared/index.js";
+const UPLOAD_TYPE_PREFIXES = ["image/", "video/", "audio/", "font/"];
+const UPLOAD_TYPE_BLOCKLIST = /* @__PURE__ */ new Set(["image/svg+xml"]);
+const UPLOAD_TYPES = /* @__PURE__ */ new Set([
+  "application/pdf",
+  "application/zip",
+  "application/gzip",
+  "application/json",
+  "text/plain",
+  "text/csv",
+  "text/markdown",
+  "application/msword",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.ms-excel",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "application/vnd.ms-powerpoint",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation"
+]);
+export function assertUploadContentType(contentType) {
+  const type = contentType.toLowerCase();
+  const allowed = !UPLOAD_TYPE_BLOCKLIST.has(type) && (UPLOAD_TYPES.has(type) || UPLOAD_TYPE_PREFIXES.some((prefix) => type.startsWith(prefix)));
+  if (!allowed) {
+    throw createError({
+      statusCode: 415,
+      statusMessage: `Unsupported content type: ${contentType}`
+    });
+  }
+}
 export function encodeKey(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }

package/dist/runtime/server/utils/relations.d.ts

@@ -1,3 +1,4 @@
+import type { CmsDb } from '#cms-db';
 import type { CmsEntry } from '../../shared/index.js';
 type Row = Record<string, unknown>;
 export declare function splitRelationValues(entry: CmsEntry, body: Row): {
@@ -7,6 +8,6 @@ export declare function splitRelationValues(entry: CmsEntry, body: Row): {
     lists: Record<string, string[]>;
 };
 export declare function assertRelationTargets(entry: CmsEntry, lists: Record<string, string[]>): Promise<void>;
-export declare function saveManyToMany(name: string, sourceId: string, lists: Record<string, string[]>): Promise<void>;
-export declare function attachManyToMany<T extends Row>(name: string, entry: CmsEntry, rows: T[]): Promise<T[]>;
+export declare function saveManyToMany(db: CmsDb, name: string, sourceId: string, lists: Record<string, string[]>): Promise<void>;
+export declare function attachManyToMany<T extends Row>(db: CmsDb, name: string, entry: CmsEntry, rows: T[]): Promise<T[]>;
 export {};

package/dist/runtime/server/utils/relations.js

@@ -48,8 +48,7 @@ export async function assertRelationTargets(entry, lists) {
     }
   }
 }
-export async function saveManyToMany(name, sourceId, lists) {
-  const db = useDb();
+export async function saveManyToMany(db, name, sourceId, lists) {
   for (const [key, ids] of Object.entries(lists)) {
     const join = joinTable(name, key);
     await db.delete(join.table).where(eq(join.sourceId, sourceId));
@@ -58,11 +57,10 @@ export async function saveManyToMany(name, sourceId, lists) {
     }
   }
 }
-export async function attachManyToMany(name, entry, rows) {
+export async function attachManyToMany(db, name, entry, rows) {
   const keys = manyToManyKeys(entry);
   const ids = rows.map((row) => row.id).filter((id) => id != null);
   if (!keys.length || !ids.length) return rows;
-  const db = useDb();
   for (const key of keys) {
     const join = joinTable(name, key);
     const links = await db.select().from(join.table).where(inArray(join.sourceId, ids)).orderBy(asc(join.position));