@xleddyl/nuxt-cms 0.1.9 → 0.1.11

package/dist/runtime/server/utils/db-sqlite.d.ts

@@ -2,3 +2,5 @@ import Database from 'better-sqlite3';
 export declare function useDb(): import("drizzle-orm/better-sqlite3").BetterSQLite3Database<Record<string, unknown>> & {
     $client: Database.Database;
 };
+export type CmsDb = ReturnType<typeof useDb>;
+export declare function withTransaction<T>(fn: (db: CmsDb) => Promise<T>): Promise<T>;

package/dist/runtime/server/utils/db-sqlite.js

@@ -1,6 +1,7 @@
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import Database from "better-sqlite3";
+import { sql } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
 import { useRuntimeConfig } from "#imports";
 let _db = null;
@@ -15,3 +16,21 @@ export function useDb() {
   }
   return _db;
 }
+let txQueue = Promise.resolve();
+export function withTransaction(fn) {
+  const db = useDb();
+  const run = txQueue.then(async () => {
+    await db.run(sql`begin immediate`);
+    try {
+      const result = await fn(db);
+      await db.run(sql`commit`);
+      return result;
+    } catch (error) {
+      await db.run(sql`rollback`);
+      throw error;
+    }
+  });
+  txQueue = run.catch(() => {
+  });
+  return run;
+}

package/dist/runtime/server/utils/graphql.js

@@ -8,7 +8,6 @@ import {
   inArray,
   isNotNull,
   isNull,
-  like,
   lt,
   lte,
   ne,
@@ -100,15 +99,22 @@ const OPERATORS = {
   gte: (column, value) => gte(column, value),
   lt: (column, value) => lt(column, value),
   lte: (column, value) => lte(column, value),
-  like: (column, value) => like(column, String(value).replaceAll("*", "%")),
+  like: (column, value) => {
+    const pattern = String(value).replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_").replaceAll("*", "%");
+    return sql`${column} like ${pattern} escape '\\'`;
+  },
   in: (column, value) => inArray(column, value)
 };
+function columnFor(table, key) {
+  const columns = tableColumns(table);
+  return Object.hasOwn(columns, key) ? columns[key] : void 0;
+}
 function filterConditions(table, filters) {
   if (!filters) return [];
   const conditions = [];
   for (const [key, ops] of Object.entries(filters)) {
     if (!ops) continue;
-    const column = tableColumns(table)[key];
+    const column = columnFor(table, key);
     if (!column) throw new GraphQLError(`Unknown filter field: ${key}`);
     for (const [op, value] of Object.entries(ops)) {
       if (value === void 0) continue;
@@ -130,7 +136,7 @@ function filterConditions(table, filters) {
 function sortOrder(table, sort) {
   const order = [];
   for (const part of sort ?? []) {
-    const column = tableColumns(table)[part.field];
+    const column = columnFor(table, part.field);
     if (!column) throw new GraphQLError(`Unknown sort field: ${part.field}`);
     order.push(part.direction === "desc" ? desc(column) : asc(column));
   }

package/dist/runtime/server/utils/media.d.ts

@@ -9,6 +9,7 @@ interface MediaConfig {
     accessKeyId: string;
     secretAccessKey: string;
 }
+export declare function assertUploadContentType(contentType: string): void;
 export declare function encodeKey(key: string): string;
 export declare function useMediaConfig(event: H3Event): {
     media: MediaConfig;

package/dist/runtime/server/utils/media.js

@@ -2,6 +2,33 @@ import { AwsClient } from "aws4fetch";
 import { createError } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { mediaPublicUrl, mediaTypeFor } from "../../shared/index.js";
+const UPLOAD_TYPE_PREFIXES = ["image/", "video/", "audio/", "font/"];
+const UPLOAD_TYPE_BLOCKLIST = /* @__PURE__ */ new Set(["image/svg+xml"]);
+const UPLOAD_TYPES = /* @__PURE__ */ new Set([
+  "application/pdf",
+  "application/zip",
+  "application/gzip",
+  "application/json",
+  "text/plain",
+  "text/csv",
+  "text/markdown",
+  "application/msword",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.ms-excel",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "application/vnd.ms-powerpoint",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation"
+]);
+export function assertUploadContentType(contentType) {
+  const type = contentType.toLowerCase();
+  const allowed = !UPLOAD_TYPE_BLOCKLIST.has(type) && (UPLOAD_TYPES.has(type) || UPLOAD_TYPE_PREFIXES.some((prefix) => type.startsWith(prefix)));
+  if (!allowed) {
+    throw createError({
+      statusCode: 415,
+      statusMessage: `Unsupported content type: ${contentType}`
+    });
+  }
+}
 export function encodeKey(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }

package/dist/runtime/server/utils/relations.d.ts

@@ -1,3 +1,4 @@
+import type { CmsDb } from '#cms-db';
 import type { CmsEntry } from '../../shared/index.js';
 type Row = Record<string, unknown>;
 export declare function splitRelationValues(entry: CmsEntry, body: Row): {
@@ -7,6 +8,6 @@ export declare function splitRelationValues(entry: CmsEntry, body: Row): {
     lists: Record<string, string[]>;
 };
 export declare function assertRelationTargets(entry: CmsEntry, lists: Record<string, string[]>): Promise<void>;
-export declare function saveManyToMany(name: string, sourceId: string, lists: Record<string, string[]>): Promise<void>;
-export declare function attachManyToMany<T extends Row>(name: string, entry: CmsEntry, rows: T[]): Promise<T[]>;
+export declare function saveManyToMany(db: CmsDb, name: string, sourceId: string, lists: Record<string, string[]>): Promise<void>;
+export declare function attachManyToMany<T extends Row>(db: CmsDb, name: string, entry: CmsEntry, rows: T[]): Promise<T[]>;
 export {};

package/dist/runtime/server/utils/relations.js

@@ -48,8 +48,7 @@ export async function assertRelationTargets(entry, lists) {
     }
   }
 }
-export async function saveManyToMany(name, sourceId, lists) {
-  const db = useDb();
+export async function saveManyToMany(db, name, sourceId, lists) {
   for (const [key, ids] of Object.entries(lists)) {
     const join = joinTable(name, key);
     await db.delete(join.table).where(eq(join.sourceId, sourceId));
@@ -58,11 +57,10 @@ export async function saveManyToMany(name, sourceId, lists) {
     }
   }
 }
-export async function attachManyToMany(name, entry, rows) {
+export async function attachManyToMany(db, name, entry, rows) {
   const keys = manyToManyKeys(entry);
   const ids = rows.map((row) => row.id).filter((id) => id != null);
   if (!keys.length || !ids.length) return rows;
-  const db = useDb();
   for (const key of keys) {
     const join = joinTable(name, key);
     const links = await db.select().from(join.table).where(inArray(join.sourceId, ids)).orderBy(asc(join.position));

package/dist/runtime/server/utils/require-admin.js

@@ -1,6 +1,20 @@
-import { createError } from "h3";
+import { createError, getRequestHeader, getRequestHost } from "h3";
 import { getUserSession, useRuntimeConfig } from "#imports";
+function assertSameOrigin(event) {
+  const origin = getRequestHeader(event, "origin");
+  if (!origin) return;
+  let originHost;
+  try {
+    originHost = new URL(origin).host;
+  } catch {
+    originHost = void 0;
+  }
+  if (!originHost || originHost !== getRequestHost(event, { xForwardedHost: true })) {
+    throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
+  }
+}
 export async function requireAdmin(event) {
+  assertSameOrigin(event);
   const session = await getUserSession(event);
   const email = session.user?.email;
   if (!email) {

package/dist/runtime/shared/index.d.ts

@@ -59,4 +59,72 @@ export interface CmsEntry {
     table?: CmsTable;
 }
 export type CmsConfig = Record<string, CmsEntry>;
-export declare function defineCmsConfig<T extends CmsConfig>(config: T): T;
+interface FieldInputBase {
+    label: string;
+    required?: boolean;
+}
+export interface TextFieldInput extends FieldInputBase {
+    type: 'text';
+    textarea?: boolean;
+    translatable?: boolean;
+}
+export interface RichtextFieldInput extends FieldInputBase {
+    type: 'richtext';
+    translatable?: boolean;
+}
+export interface NumberFieldInput extends FieldInputBase {
+    type: 'number';
+    integer?: boolean;
+}
+export interface BooleanFieldInput extends FieldInputBase {
+    type: 'boolean';
+}
+export interface DateFieldInput extends FieldInputBase {
+    type: 'date';
+}
+export interface EmailFieldInput extends FieldInputBase {
+    type: 'email';
+}
+export interface SlugFieldInput extends FieldInputBase {
+    type: 'slug';
+    from: string;
+}
+export interface SelectFieldInput extends FieldInputBase {
+    type: 'select';
+    options: string[];
+}
+export interface JsonFieldInput extends FieldInputBase {
+    type: 'json';
+}
+export interface MediaFieldInput extends FieldInputBase {
+    type: 'media';
+    mediaType?: MediaType;
+    accept?: string[];
+}
+export interface RelationFieldInput extends FieldInputBase {
+    type: 'relation';
+    to: string;
+    cardinality?: 'many-to-one' | 'one-to-one' | 'many-to-many';
+    onDelete?: 'set null' | 'cascade' | 'restrict';
+}
+export type BlockFieldInput = Omit<TextFieldInput, 'translatable'> | Omit<RichtextFieldInput, 'translatable'> | NumberFieldInput | BooleanFieldInput | DateFieldInput | EmailFieldInput | SelectFieldInput | JsonFieldInput | MediaFieldInput;
+export interface BlockInput {
+    label: string;
+    fields: Record<string, BlockFieldInput>;
+}
+export interface BlocksFieldInput extends FieldInputBase {
+    type: 'blocks';
+    blocks: Record<string, BlockInput>;
+}
+export type CmsFieldInput = TextFieldInput | RichtextFieldInput | NumberFieldInput | BooleanFieldInput | DateFieldInput | EmailFieldInput | SlugFieldInput | SelectFieldInput | JsonFieldInput | MediaFieldInput | RelationFieldInput | BlocksFieldInput;
+export interface CmsEntryInput {
+    id: string;
+    label: string;
+    kind: 'collection' | 'single';
+    titleField?: string;
+    drafts?: boolean;
+    fields: Record<string, CmsFieldInput>;
+}
+export type CmsConfigInput = Record<string, CmsEntryInput>;
+export declare function defineCmsConfig<T extends CmsConfigInput>(config: T): T;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xleddyl/nuxt-cms",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Lightweight CMS that ships with your Nuxt app: runs on the Nitro server, content types defined in code, /cms admin panel, GraphQL API, SQLite or Postgres. No external CMS needed!",
   "license": "MIT",
   "author": "Edoardo Alberti (https://github.com/xleddyl)",
@@ -20,6 +20,8 @@
     "headless-cms",
     "self-hosted",
     "sqlite",
+    "libsql",
+    "turso",
     "postgres",
     "drizzle",
     "graphql"
@@ -50,6 +52,7 @@
     "dist"
   ],
   "dependencies": {
+    "@libsql/client": "^0.17.4",
     "@nuxt/kit": "^4.4.8",
     "@nuxt/ui": "^4.0.0",
     "@nuxtjs/i18n": "^10.4.0",
@@ -75,10 +78,12 @@
     "@types/node": "latest",
     "@types/pg": "^8.11.0",
     "changelogen": "^0.6.0",
+    "h3": "^1.15.11",
     "nuxt": "^4.4.8",
     "prettier": "3.1.1",
     "prettier-plugin-tailwindcss": "0.6.11",
     "typescript": "~6.0.3",
+    "vitest": "^4.1.9",
     "vue-tsc": "^3.3.3"
   },
   "scripts": {
@@ -86,6 +91,7 @@
     "dev:build": "nuxt build playground",
     "dev:prepare": "nuxt-module-build build --stub && nuxt-module-build prepare && nuxt prepare playground",
     "db:studio": "drizzle-kit studio --config=playground/.nuxt/cms/drizzle.config.ts",
+    "test": "vitest run",
     "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit",
     "format": "prettier --write \"**/*.{ts,tsx,js,jsx,md,html,json,sql,vue}\" --log-level error",
     "release": "changelogen --release --push"