@xleddyl/nuxt-cms 0.2.0 → 0.2.1

package/dist/runtime/server/api/users.post.js

@@ -4,6 +4,7 @@ import { useDb } from "#cms-db";
 import { cms_users } from "#cms-tables";
 import { MIN_PASSWORD_LENGTH } from "../../shared/index.js";
 import { customId } from "../utils/custom-id.js";
+import { mapConstraintErrors } from "../utils/db-errors.js";
 import { hashPassword } from "../utils/password.js";
 import { isSuperAdminEmail, requireSuperAdmin } from "../utils/require-admin.js";
 import { findUserByEmail, toAccount } from "../utils/users.js";
@@ -19,14 +20,17 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 409, statusMessage: "A user with this email already exists" });
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const [row] = await useDb().insert(cms_users).values({
-    id: customId("usr"),
-    email: body.email,
-    name: body.name || null,
-    role: "admin",
-    passwordHash: await hashPassword(body.password),
-    createdAt: now,
-    updatedAt: now
-  }).returning();
+  const passwordHash = await hashPassword(body.password);
+  const [row] = await mapConstraintErrors(
+    () => useDb().insert(cms_users).values({
+      id: customId("usr"),
+      email: body.email,
+      name: body.name || null,
+      role: "admin",
+      passwordHash,
+      createdAt: now,
+      updatedAt: now
+    }).returning()
+  );
   return toAccount(row);
 });

package/dist/runtime/server/routes/auth/login.post.js

@@ -9,8 +9,8 @@ import { verifyNothing, verifyPassword } from "../../utils/password.js";
 import { assertSameOrigin } from "../../utils/same-origin.js";
 import { findUserByEmail, sessionUserFor } from "../../utils/users.js";
 const credentialsSchema = z.object({
-  email: z.string().trim().min(1),
-  password: z.string().min(1)
+  email: z.string().trim().min(1).max(254),
+  password: z.string().min(1).max(256)
 });
 const RATE_WINDOW_MS = 15 * 6e4;
 const RATE_MAX_FAILURES = 10;

package/dist/runtime/server/utils/graphql-depth.js

@@ -1,24 +1,31 @@
 import { GraphQLError, Kind } from "graphql";
 const DEFAULT_MAX_DEPTH = 8;
 const DEFAULT_MAX_FIELDS = 500;
-function measure(selectionSet, fragments, visited) {
+function measure(selectionSet, fragments, visited, fragmentDepths) {
   let max = 0;
   for (const selection of selectionSet.selections) {
     if (selection.kind === Kind.FIELD) {
       if (selection.name.value.startsWith("__")) continue;
-      const depth = selection.selectionSet ? 1 + measure(selection.selectionSet, fragments, visited) : 1;
+      const depth = selection.selectionSet ? 1 + measure(selection.selectionSet, fragments, visited, fragmentDepths) : 1;
       max = Math.max(max, depth);
     } else if (selection.kind === Kind.FRAGMENT_SPREAD) {
       const name = selection.name.value;
       if (visited.has(name)) continue;
+      const known = fragmentDepths.get(name);
+      if (known !== void 0) {
+        max = Math.max(max, known);
+        continue;
+      }
       const fragment = fragments.get(name);
       if (fragment) {
         visited.add(name);
-        max = Math.max(max, measure(fragment.selectionSet, fragments, visited));
+        const depth = measure(fragment.selectionSet, fragments, visited, fragmentDepths);
         visited.delete(name);
+        fragmentDepths.set(name, depth);
+        max = Math.max(max, depth);
       }
     } else if (selection.kind === Kind.INLINE_FRAGMENT) {
-      max = Math.max(max, measure(selection.selectionSet, fragments, visited));
+      max = Math.max(max, measure(selection.selectionSet, fragments, visited, fragmentDepths));
     }
   }
   return max;
@@ -32,7 +39,7 @@ export function createDepthRule(maxDepth) {
         if (definition.kind === Kind.FRAGMENT_DEFINITION)
           fragments.set(definition.name.value, definition);
       }
-      const depth = measure(node.selectionSet, fragments, /* @__PURE__ */ new Set());
+      const depth = measure(node.selectionSet, fragments, /* @__PURE__ */ new Set(), /* @__PURE__ */ new Map());
       if (depth > limit) {
         context.reportError(
           new GraphQLError(`Query is too deep: depth ${depth} exceeds the maximum of ${limit}`)

package/dist/runtime/server/utils/graphql.js

@@ -16,7 +16,7 @@ import {
 import { GraphQLError, GraphQLScalarType, valueFromASTUntyped } from "graphql";
 import { createSchema } from "graphql-yoga";
 import cmsConfig from "#cms-config";
-import { useDb } from "#cms-db";
+import { cmsDialect, useDb } from "#cms-db";
 import * as cmsTables from "#cms-tables";
 import { useRuntimeConfig } from "#imports";
 import {
@@ -129,7 +129,7 @@ const OPERATORS = {
   lte: (column, value) => lte(column, value),
   like: (column, value) => {
     const pattern = String(value).replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_").replaceAll("*", "%");
-    return sql`${column} like ${pattern} escape '\\'`;
+    return cmsDialect === "postgres" ? sql`cast(${column} as text) ilike ${pattern} escape '\\'` : sql`${column} like ${pattern} escape '\\'`;
   },
   in: (column, value) => inArray(column, value)
 };

package/dist/runtime/server/utils/media-folders.js

@@ -1,8 +1,11 @@
-import { inArray, like, or } from "drizzle-orm";
+import { eq, inArray, or, sql } from "drizzle-orm";
 import { useDb } from "#cms-db";
 import { cms_media } from "#cms-tables";
 import { mediaFolderMarkerKey } from "../../shared/index.js";
 const KEY_CHUNK = 90;
+function escapeLike(value) {
+  return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
+}
 export async function writeMediaFolderMarker(store, folder) {
   const key = mediaFolderMarkerKey(folder);
   await store.write(key, new Uint8Array(), "application/x-empty");
@@ -18,7 +21,12 @@ export async function writeMediaFolderMarker(store, folder) {
   await useDb().insert(cms_media).values(values).onConflictDoUpdate({ target: cms_media.key, set: values });
 }
 export function mediaRowsInFolder(folder) {
-  return useDb().select({ key: cms_media.key, folder: cms_media.folder }).from(cms_media).where(or(like(cms_media.folder, `${folder}/%`), like(cms_media.folder, folder)));
+  return useDb().select({ key: cms_media.key, folder: cms_media.folder }).from(cms_media).where(
+    or(
+      sql`${cms_media.folder} like ${`${escapeLike(folder)}/%`} escape '\\'`,
+      eq(cms_media.folder, folder)
+    )
+  );
 }
 export async function deleteMediaRows(store, keys) {
   for (const key of keys) {

package/dist/runtime/server/utils/media.d.ts

@@ -20,6 +20,7 @@ export interface MediaStore {
     write: (key: string, body: Uint8Array<ArrayBuffer>, contentType: string) => Promise<void>;
     remove: (key: string) => Promise<void>;
 }
+export declare function baseContentType(contentType: string): string;
 export declare function isAllowedUploadType(contentType: string): boolean;
 export declare function assertUploadContentType(contentType: string): void;
 export declare function assertUploadSize(size: number, maxFileSize: number): void;

package/dist/runtime/server/utils/media.js

@@ -20,8 +20,11 @@ const UPLOAD_TYPES = /* @__PURE__ */ new Set([
   "application/vnd.ms-powerpoint",
   "application/vnd.openxmlformats-officedocument.presentationml.presentation"
 ]);
+export function baseContentType(contentType) {
+  return contentType.split(";")[0].trim().toLowerCase();
+}
 export function isAllowedUploadType(contentType) {
-  const type = contentType.toLowerCase();
+  const type = baseContentType(contentType);
   return !UPLOAD_TYPE_BLOCKLIST.has(type) && (UPLOAD_TYPES.has(type) || UPLOAD_TYPE_PREFIXES.some((prefix) => type.startsWith(prefix)));
 }
 export function assertUploadContentType(contentType) {

package/dist/runtime/server/utils/migrate.js

@@ -18,7 +18,7 @@ async function pendingMigrations() {
   const migrations = await readMigrations(migrationsDir);
   if (!migrations.length && Object.keys(cmsConfig).length) {
     console.error(
-      `[nuxt-cms] No migrations were found for this build (expected in ${migrationsDir}). CMS tables may be missing \u2014 run the dev server once to generate them, commit server/db/migrations, and rebuild.`
+      `[nuxt-cms] No migrations were found for this build (expected in ${migrationsDir}). CMS tables may be missing. Run the dev server once to generate them, commit server/db/migrations, and rebuild.`
     );
   }
   return migrations;

package/dist/runtime/server/utils/require-admin.d.ts

@@ -1,7 +1,5 @@
 import type { H3Event } from 'h3';
 import type { CmsSessionUser } from '../../shared/index.js';
-import { assertSameOrigin } from './same-origin.js';
-export { assertSameOrigin };
 export declare function isSuperAdminEmail(event: H3Event, email: string): boolean;
 export declare function requireAdmin(event: H3Event): Promise<CmsSessionUser>;
 export declare function requireSuperAdmin(event: H3Event): Promise<CmsSessionUser>;

package/dist/runtime/server/utils/require-admin.js

@@ -2,7 +2,6 @@ import { createError } from "h3";
 import { getUserSession, useRuntimeConfig } from "#imports";
 import { assertSameOrigin } from "./same-origin.js";
 import { findUserById, passwordStamp } from "./users.js";
-export { assertSameOrigin };
 export function isSuperAdminEmail(event, email) {
   const { adminEmail } = useRuntimeConfig(event).cms;
   return !!adminEmail && email.toLowerCase() === adminEmail.toLowerCase();

package/dist/runtime/shared/layout.d.ts

@@ -26,7 +26,6 @@ export interface CmsEntrySettings {
 }
 export type CmsSettingsMap = Record<string, CmsEntrySettings>;
 export declare function layoutFromConfig(input: CmsLayoutBlock[] | undefined): CmsFormLayout;
-export declare function layoutKeys(input: CmsLayoutBlock[] | undefined): string[];
 export declare function resolveFormLayout(fields: Record<string, FieldConfig>, layout: CmsFormLayout | undefined): CmsFormLayout;
 export declare function defaultListColumns(fields: Record<string, FieldConfig>, list: CmsListInput | undefined, extra?: string[]): string[];
 export declare function resolveListColumns(fields: Record<string, FieldConfig>, saved: string[] | undefined, list: CmsListInput | undefined, extra?: string[]): string[];

package/dist/runtime/shared/layout.js

@@ -30,9 +30,6 @@ function sectionsFromBlocks(blocks) {
 export function layoutFromConfig(input) {
   return { main: sectionsFromBlocks(input) };
 }
-export function layoutKeys(input) {
-  return layoutFromConfig(input).main.flatMap((section) => section.rows.flat());
-}
 function cloneSection(section) {
   return { ...section, rows: section.rows.map((row) => [...row]) };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xleddyl/nuxt-cms",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Lightweight CMS that ships with your Nuxt app: runs on the Nitro server, content types defined in code, /cms admin panel, GraphQL API, SQLite or Postgres. No external CMS needed!",
   "license": "MIT",
   "author": "Edoardo Alberti (https://github.com/xleddyl)",