@xleddyl/nuxt-cms 0.9.3 → 0.10.0

package/dist/runtime/server/api/media-folder.post.js

@@ -3,10 +3,11 @@ import { z } from "zod";
 import { normalizeMediaFolder } from "../../shared/index.js";
 import { useMediaStorage } from "../utils/media.js";
 import { writeMediaFolderMarker } from "../utils/media-folders.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { emitMediaChange } from "../utils/hooks.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const bodySchema = z.object({ name: z.string().min(1).max(255) });
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user } = await requireCmsPermission(event, "media.write");
   const { store } = useMediaStorage(event);
   const { name } = await readValidatedBody(event, bodySchema.parse);
   const folder = normalizeMediaFolder(name);
@@ -14,5 +15,6 @@ export default defineEventHandler(async (event) => {
     throw createError({ statusCode: 400, statusMessage: "Invalid folder name" });
   }
   await writeMediaFolderMarker(store, folder);
+  emitMediaChange(event, user, { action: "folder-create", keys: [], folder });
   return { folder };
 });

package/dist/runtime/server/api/media-move.post.js

@@ -7,13 +7,14 @@ import { MEDIA_FOLDER_MARKER, normalizeMediaFolder } from "../../shared/index.js
 import { objectKeySchema } from "../../shared/validation.js";
 import { useMediaStorage } from "../utils/media.js";
 import { keyChunks } from "../utils/media-folders.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { emitMediaChange } from "../utils/hooks.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const bodySchema = z.object({
   keys: z.array(objectKeySchema).min(1).max(1e3),
   folder: z.string().max(255).nullable()
 });
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user } = await requireCmsPermission(event, "media.write");
   useMediaStorage(event);
   const { keys, folder } = await readValidatedBody(event, bodySchema.parse);
   const target = normalizeMediaFolder(folder);
@@ -27,6 +28,8 @@ export default defineEventHandler(async (event) => {
       ).returning({ key: cms_media.key })
     )
   );
-  const moved = results.reduce((total, rows) => total + rows.length, 0);
-  return { folder: target, moved };
+  const keysMoved = results.flatMap((rows) => rows.map((row) => row.key));
+  if (keysMoved.length)
+    emitMediaChange(event, user, { action: "move", keys: keysMoved, folder: target });
+  return { folder: target, moved: keysMoved.length };
 });

package/dist/runtime/server/api/media-presign.post.js

@@ -3,7 +3,7 @@ import { defineEventHandler, readValidatedBody } from "h3";
 import { z } from "zod";
 import { normalizeMediaFolder, slugify } from "../../shared/index.js";
 import { assertUploadContentType, assertUploadSize, useMediaStorage } from "../utils/media.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const MAX_BASE_LENGTH = 80;
 const MAX_EXT_LENGTH = 10;
 const bodySchema = z.object({
@@ -19,7 +19,7 @@ function slugifyFilename(filename) {
   return ext ? `${base}.${ext}` : base;
 }
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  await requireCmsPermission(event, "media.write");
   const { media, store, publicUrl } = useMediaStorage(event);
   const { filename, contentType, size, folder } = await readValidatedBody(event, bodySchema.parse);
   assertUploadContentType(contentType);

package/dist/runtime/server/api/media-upload.put.js

@@ -12,10 +12,10 @@ import { isMediaFolderMarker } from "../../shared/index.js";
 import { objectKeySchema } from "../../shared/validation.js";
 import { requireMediaFilePath, writeMediaFile } from "../utils/media-fs.js";
 import { assertUploadContentType, assertUploadSize, useMediaStorage } from "../utils/media.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const querySchema = z.object({ key: objectKeySchema });
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  await requireCmsPermission(event, "media.write");
   const { media } = useMediaStorage(event);
   if (media.storage !== "filesystem") {
     throw createError({

package/dist/runtime/server/api/media-usage.post.d.ts

@@ -1,5 +1,3 @@
-import type { MediaUsage } from '../../shared/index.js';
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
-    usage: Record<string, MediaUsage[]>;
-}>>;
+import type { MediaUsageReport } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<MediaUsageReport>>;
 export default _default;

package/dist/runtime/server/api/media-usage.post.js

@@ -1,15 +1,19 @@
 import { defineEventHandler, readValidatedBody } from "h3";
 import { z } from "zod";
+import { can } from "../../shared/roles.js";
 import { objectKeySchema } from "../../shared/validation.js";
 import { useMediaConfig } from "../utils/media.js";
+import { redactMediaUsage } from "../utils/media-references.js";
 import { loadMediaUsage } from "../utils/media-usage.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const bodySchema = z.object({ keys: z.array(objectKeySchema).min(1).max(1e3) });
-export default defineEventHandler(
-  async (event) => {
-    await requireAdmin(event);
-    useMediaConfig(event);
-    const { keys } = await readValidatedBody(event, bodySchema.parse);
-    return { usage: await loadMediaUsage([...new Set(keys)]) };
-  }
-);
+export default defineEventHandler(async (event) => {
+  const { access } = await requireCmsPermission(event, "media.read");
+  useMediaConfig(event);
+  const { keys } = await readValidatedBody(event, bodySchema.parse);
+  const usage = await loadMediaUsage([...new Set(keys)]);
+  return redactMediaUsage(
+    usage,
+    (item) => can(access, item.kind === "site" ? "settings.manage" : `${item.collection}.read`)
+  );
+});

package/dist/runtime/server/api/media.delete.js

@@ -6,10 +6,11 @@ import { cms_media } from "#cms-tables";
 import { isMediaFolderMarker } from "../../shared/index.js";
 import { objectKeySchema } from "../../shared/validation.js";
 import { useMediaStorage } from "../utils/media.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { emitMediaChange } from "../utils/hooks.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const querySchema = z.object({ key: objectKeySchema });
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user } = await requireCmsPermission(event, "media.delete");
   const { store } = useMediaStorage(event);
   const { key } = await getValidatedQuery(event, querySchema.parse);
   const db = useDb();
@@ -19,5 +20,6 @@ export default defineEventHandler(async (event) => {
   }
   await db.delete(cms_media).where(eq(cms_media.key, key));
   await store.remove(key);
+  emitMediaChange(event, user, { action: "delete", keys: [key], folder: row.folder });
   return { ok: true };
 });

package/dist/runtime/server/api/media.get.js

@@ -5,7 +5,7 @@ import { cms_media } from "#cms-tables";
 import { isMediaFolderMarker } from "../../shared/index.js";
 import { useMediaIndex } from "../utils/media-index.js";
 import { toMediaItem, useMediaConfig } from "../utils/media.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 function foldersOf(items) {
   const folders = /* @__PURE__ */ new Set();
   for (const item of items) {
@@ -14,15 +14,30 @@ function foldersOf(items) {
   return [...folders].sort();
 }
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  await requireCmsPermission(event, "media.read");
   const { media, publicUrl } = useMediaConfig(event);
   if (media.storage === "local") {
     const index = await useMediaIndex();
-    const rows2 = await useDb().select({ key: cms_media.key, alt: cms_media.alt }).from(cms_media);
-    const altByKey = new Map(rows2.map((row) => [row.key, row.alt]));
-    const items2 = index.files.map(
-      (file) => toMediaItem({ ...file, alt: altByKey.get(file.key) ?? null, createdAt: null }, publicUrl)
-    );
+    const rows2 = await useDb().select({
+      key: cms_media.key,
+      alt: cms_media.alt,
+      focalX: cms_media.focalX,
+      focalY: cms_media.focalY
+    }).from(cms_media);
+    const metaByKey = new Map(rows2.map((row) => [row.key, row]));
+    const items2 = index.files.map((file) => {
+      const meta = metaByKey.get(file.key);
+      return toMediaItem(
+        {
+          ...file,
+          alt: meta?.alt ?? null,
+          focalX: meta?.focalX ?? null,
+          focalY: meta?.focalY ?? null,
+          createdAt: null
+        },
+        publicUrl
+      );
+    });
     return { items: items2, folders: foldersOf(items2), source: index.source };
   }
   const rows = await useDb().select().from(cms_media).orderBy(desc(cms_media.createdAt), desc(cms_media.id));

package/dist/runtime/server/api/media.post.js

@@ -14,7 +14,8 @@ import {
   toMediaItem,
   useMediaConfig
 } from "../utils/media.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { emitMediaChange } from "../utils/hooks.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const bodySchema = z.object({
   key: objectKeySchema,
   mime: z.string().max(255).nullish(),
@@ -25,7 +26,7 @@ const bodySchema = z.object({
   folder: z.string().max(255).nullish()
 });
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user } = await requireCmsPermission(event, "media.write");
   const { media, publicUrl } = useMediaConfig(event);
   assertMediaWritable(media);
   const body = await readValidatedBody(event, bodySchema.parse);
@@ -43,5 +44,6 @@ export default defineEventHandler(async (event) => {
     folder: normalizeMediaFolder(body.folder)
   };
   const [row] = await useDb().insert(cms_media).values({ ...values, createdAt: nowTimestamp() }).onConflictDoUpdate({ target: cms_media.key, set: values }).returning();
+  emitMediaChange(event, user, { action: "upload", keys: [body.key], folder: values.folder });
   return toMediaItem(row, publicUrl);
 });

package/dist/runtime/server/api/media.put.js

@@ -1,23 +1,28 @@
 import { eq } from "drizzle-orm";
 import { createError, defineEventHandler, readValidatedBody } from "h3";
-import { z } from "zod";
 import { useDb } from "#cms-db";
 import { cms_media } from "#cms-tables";
-import { normalizeMediaFolder } from "../../shared/index.js";
+import { normalizeMediaFolder, roundFocalCoordinate } from "../../shared/index.js";
 import { nowTimestamp } from "../../shared/timestamps.js";
-import { objectKeySchema } from "../../shared/validation.js";
+import { mediaUpdateSchema } from "../../shared/validation.js";
 import { useMediaIndex } from "../utils/media-index.js";
 import { assertMediaWritable, toMediaItem, useMediaConfig } from "../utils/media.js";
-import { requireAdmin } from "../utils/require-admin.js";
-const bodySchema = z.object({
-  key: objectKeySchema,
-  alt: z.string().max(1024).nullish(),
-  folder: z.string().max(255).nullish()
-});
+import { emitMediaChange } from "../utils/hooks.js";
+import { requireCmsPermission } from "../utils/permissions.js";
+function metaUpdates(body) {
+  const updates = {};
+  if (body.alt !== void 0) updates.alt = body.alt;
+  if (body.focalX !== void 0 && body.focalY !== void 0) {
+    updates.focalX = body.focalX === null ? null : roundFocalCoordinate(body.focalX);
+    updates.focalY = body.focalY === null ? null : roundFocalCoordinate(body.focalY);
+  }
+  return updates;
+}
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user } = await requireCmsPermission(event, "media.write");
   const { media, publicUrl } = useMediaConfig(event);
-  const body = await readValidatedBody(event, bodySchema.parse);
+  const body = await readValidatedBody(event, mediaUpdateSchema.parse);
+  const meta = metaUpdates(body);
   if (media.storage === "local") {
     if (body.folder !== void 0) {
       throw createError({
@@ -29,13 +34,24 @@ export default defineEventHandler(async (event) => {
     if (!file) {
       throw createError({ statusCode: 404, statusMessage: "Media not found" });
     }
-    const alt = body.alt ?? null;
-    await useDb().insert(cms_media).values({ key: body.key, alt, createdAt: nowTimestamp() }).onConflictDoUpdate({ target: cms_media.key, set: { alt } });
-    return toMediaItem({ ...file, alt, createdAt: null }, publicUrl);
+    if (Object.keys(meta).length === 0) {
+      throw createError({ statusCode: 400, statusMessage: "No fields to update" });
+    }
+    const [row2] = await useDb().insert(cms_media).values({ key: body.key, ...meta, createdAt: nowTimestamp() }).onConflictDoUpdate({ target: cms_media.key, set: meta }).returning();
+    emitMediaChange(event, user, { action: "update", keys: [body.key], folder: file.folder });
+    return toMediaItem(
+      {
+        ...file,
+        alt: row2?.alt ?? null,
+        focalX: row2?.focalX ?? null,
+        focalY: row2?.focalY ?? null,
+        createdAt: null
+      },
+      publicUrl
+    );
   }
   assertMediaWritable(media);
-  const updates = {};
-  if (body.alt !== void 0) updates.alt = body.alt;
+  const updates = { ...meta };
   if (body.folder !== void 0) updates.folder = normalizeMediaFolder(body.folder);
   if (Object.keys(updates).length === 0) {
     throw createError({ statusCode: 400, statusMessage: "No fields to update" });
@@ -44,5 +60,6 @@ export default defineEventHandler(async (event) => {
   if (!row) {
     throw createError({ statusCode: 404, statusMessage: "Media not found" });
   }
+  emitMediaChange(event, user, { action: "update", keys: [body.key], folder: row.folder });
   return toMediaItem(row, publicUrl);
 });

package/dist/runtime/server/api/preset.delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/api/preset.delete.js

@@ -0,0 +1,9 @@
+import { defineEventHandler } from "h3";
+import { deletePreset, presetIdParam, readPreset, requirePresetAccess } from "../utils/presets.js";
+export default defineEventHandler(async (event) => {
+  await requirePresetAccess(event, "manage");
+  const id = presetIdParam(event);
+  await readPreset(id);
+  await deletePreset(id);
+  return { ok: true };
+});

package/dist/runtime/server/api/preset.put.d.ts

@@ -0,0 +1,3 @@
+import type { CmsBlockPreset } from '../../shared/presets.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsBlockPreset>>;
+export default _default;

package/dist/runtime/server/api/preset.put.js

@@ -0,0 +1,23 @@
+import { createError, defineEventHandler } from "h3";
+import { presetUpdateSchema, renamePreset } from "../../shared/presets.js";
+import {
+  presetIdParam,
+  readPreset,
+  readPresetBody,
+  requirePresetAccess,
+  writePreset
+} from "../utils/presets.js";
+export default defineEventHandler(async (event) => {
+  await requirePresetAccess(event, "manage");
+  const id = presetIdParam(event);
+  const parsed = presetUpdateSchema.safeParse(await readPresetBody(event));
+  if (!parsed.success) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: parsed.error.issues[0]?.message ?? "Invalid preset"
+    });
+  }
+  const preset = renamePreset(await readPreset(id), parsed.data, (/* @__PURE__ */ new Date()).toISOString());
+  await writePreset(preset);
+  return preset;
+});

package/dist/runtime/server/api/presets-field.get.d.ts

@@ -0,0 +1,3 @@
+import type { CmsBlockPreset } from '../../shared/presets.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsBlockPreset[]>>;
+export default _default;

package/dist/runtime/server/api/presets-field.get.js

@@ -0,0 +1,13 @@
+import { defineEventHandler } from "h3";
+import { presetFits, presetReadable, sortPresets } from "../../shared/presets.js";
+import { can } from "../../shared/roles.js";
+import { presetBlocksField, readPresets, requirePresetAccess } from "../utils/presets.js";
+export default defineEventHandler(async (event) => {
+  const { access } = await requirePresetAccess(event, "use");
+  const { source, field } = presetBlocksField(event);
+  return sortPresets(
+    (await readPresets()).filter(
+      (preset) => presetFits(preset, field, source) && presetReadable(preset, (permission) => can(access, permission))
+    )
+  );
+});

package/dist/runtime/server/api/presets-field.post.d.ts

@@ -0,0 +1,3 @@
+import type { CmsBlockPreset } from '../../shared/presets.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsBlockPreset>>;
+export default _default;

package/dist/runtime/server/api/presets-field.post.js

@@ -0,0 +1,36 @@
+import { createError, defineEventHandler } from "h3";
+import { CMS_PRESET_MAX_COUNT, buildPreset, presetCreateSchema } from "../../shared/presets.js";
+import { customId } from "../utils/custom-id.js";
+import {
+  presetBlocksField,
+  readPresetBody,
+  readPresets,
+  requirePresetAccess,
+  writePreset
+} from "../utils/presets.js";
+import { getContentI18n } from "../utils/registry.js";
+export default defineEventHandler(async (event) => {
+  await requirePresetAccess(event, "use");
+  const { source, field } = presetBlocksField(event);
+  const parsed = presetCreateSchema.safeParse(await readPresetBody(event));
+  if (!parsed.success) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: parsed.error.issues[0]?.message ?? "Invalid preset"
+    });
+  }
+  if ((await readPresets()).length >= CMS_PRESET_MAX_COUNT) {
+    throw createError({
+      statusCode: 409,
+      statusMessage: `There are already ${CMS_PRESET_MAX_COUNT} presets, delete one first`
+    });
+  }
+  const built = buildPreset(parsed.data, field, getContentI18n(), {
+    id: customId("preset"),
+    source,
+    now: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  if ("error" in built) throw createError({ statusCode: 400, statusMessage: built.error });
+  await writePreset(built.preset);
+  return built.preset;
+});

package/dist/runtime/server/api/presets.get.d.ts

@@ -0,0 +1,3 @@
+import type { CmsBlockPreset } from '../../shared/presets.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsBlockPreset[]>>;
+export default _default;

package/dist/runtime/server/api/presets.get.js

@@ -0,0 +1,7 @@
+import { defineEventHandler } from "h3";
+import { sortPresets } from "../../shared/presets.js";
+import { readPresets, requirePresetAccess } from "../utils/presets.js";
+export default defineEventHandler(async (event) => {
+  await requirePresetAccess(event, "manage");
+  return sortPresets(await readPresets());
+});

package/dist/runtime/server/api/preview-link.delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/api/preview-link.delete.js

@@ -0,0 +1,15 @@
+import { defineEventHandler, getRouterParam } from "h3";
+import { requirePreviewLinkAccess, revokePreviewLink } from "../utils/preview-links.js";
+export default defineEventHandler(async (event) => {
+  const access = await requirePreviewLinkAccess(
+    event,
+    getRouterParam(event, "collection") ?? "",
+    "update"
+  );
+  await revokePreviewLink(
+    access,
+    getRouterParam(event, "id") ?? "",
+    getRouterParam(event, "linkId") ?? ""
+  );
+  return { ok: true };
+});

package/dist/runtime/server/api/preview-links.get.d.ts

@@ -0,0 +1,3 @@
+import type { CmsPreviewLink } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsPreviewLink[]>>;
+export default _default;

package/dist/runtime/server/api/preview-links.get.js

@@ -0,0 +1,10 @@
+import { defineEventHandler, getRouterParam } from "h3";
+import { listPreviewLinks, requirePreviewLinkAccess } from "../utils/preview-links.js";
+export default defineEventHandler(async (event) => {
+  const access = await requirePreviewLinkAccess(
+    event,
+    getRouterParam(event, "collection") ?? "",
+    "read"
+  );
+  return listPreviewLinks(access, getRouterParam(event, "id") ?? "");
+});

package/dist/runtime/server/api/preview-links.post.d.ts

@@ -0,0 +1,3 @@
+import type { CmsCreatedPreviewLink } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsCreatedPreviewLink>>;
+export default _default;

package/dist/runtime/server/api/preview-links.post.js

@@ -0,0 +1,17 @@
+import { defineEventHandler, getRouterParam, readValidatedBody } from "h3";
+import {
+  createPreviewLink,
+  markPreviewResponse,
+  previewLinkInputSchema,
+  requirePreviewLinkAccess
+} from "../utils/preview-links.js";
+export default defineEventHandler(async (event) => {
+  const access = await requirePreviewLinkAccess(
+    event,
+    getRouterParam(event, "collection") ?? "",
+    "update"
+  );
+  const input = await readValidatedBody(event, previewLinkInputSchema.parse);
+  markPreviewResponse(event);
+  return createPreviewLink(access, getRouterParam(event, "id") ?? "", input);
+});

package/dist/runtime/server/api/preview.get.d.ts

@@ -0,0 +1,3 @@
+import type { CmsPreviewMode } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsPreviewMode | null>>;
+export default _default;

package/dist/runtime/server/api/preview.get.js

@@ -0,0 +1,7 @@
+import { defineEventHandler } from "h3";
+import { markPreviewResponse, readPreviewGrant } from "../utils/preview-links.js";
+export default defineEventHandler(async (event) => {
+  markPreviewResponse(event);
+  const grant = await readPreviewGrant(event);
+  return grant ? { entry: grant.entry, id: grant.itemId, expiresAt: grant.expiresAt } : null;
+});

package/dist/runtime/server/api/redirect.delete.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/api/redirect.delete.js

@@ -0,0 +1,10 @@
+import { createError, defineEventHandler, getRouterParam } from "h3";
+import { deleteRedirects } from "../utils/redirects.js";
+import { requireCmsPermission } from "../utils/permissions.js";
+export default defineEventHandler(async (event) => {
+  await requireCmsPermission(event, "redirects.manage");
+  const id = getRouterParam(event, "id") ?? "";
+  if (!await deleteRedirects([id]))
+    throw createError({ statusCode: 404, statusMessage: "Redirect not found" });
+  return { ok: true };
+});

package/dist/runtime/server/api/redirect.put.d.ts

@@ -0,0 +1,3 @@
+import type { CmsRedirect } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsRedirect>>;
+export default _default;

package/dist/runtime/server/api/redirect.put.js

@@ -0,0 +1,8 @@
+import { defineEventHandler, getRouterParam, readValidatedBody } from "h3";
+import { redirectInputSchema, updateRedirect } from "../utils/redirects.js";
+import { requireCmsPermission } from "../utils/permissions.js";
+export default defineEventHandler(async (event) => {
+  await requireCmsPermission(event, "redirects.manage");
+  const id = getRouterParam(event, "id") ?? "";
+  return updateRedirect(id, await readValidatedBody(event, redirectInputSchema.parse));
+});

package/dist/runtime/server/api/redirects-import.post.d.ts

@@ -0,0 +1,3 @@
+import type { RedirectImportResult } from '../utils/redirects.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<RedirectImportResult>>;
+export default _default;

package/dist/runtime/server/api/redirects-import.post.js

@@ -0,0 +1,13 @@
+import { defineEventHandler, readValidatedBody } from "h3";
+import { z } from "zod";
+import { REDIRECT_IMPORT_MAX_ROWS } from "../../shared/index.js";
+import { requireCmsPermission } from "../utils/permissions.js";
+import { importRedirects, redirectInputSchema } from "../utils/redirects.js";
+const bodySchema = z.object({
+  redirects: z.array(redirectInputSchema).min(1).max(REDIRECT_IMPORT_MAX_ROWS)
+});
+export default defineEventHandler(async (event) => {
+  await requireCmsPermission(event, "redirects.manage");
+  const { redirects } = await readValidatedBody(event, bodySchema.parse);
+  return importRedirects(redirects);
+});

package/dist/runtime/server/api/redirects.get.d.ts

@@ -0,0 +1,3 @@
+import type { CmsRedirect } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsRedirect[]>>;
+export default _default;

package/dist/runtime/server/api/redirects.get.js

@@ -0,0 +1,7 @@
+import { defineEventHandler } from "h3";
+import { listRedirects } from "../utils/redirects.js";
+import { requireCmsPermission } from "../utils/permissions.js";
+export default defineEventHandler(async (event) => {
+  await requireCmsPermission(event, "redirects.manage");
+  return listRedirects();
+});

package/dist/runtime/server/api/redirects.post.d.ts

@@ -0,0 +1,3 @@
+import type { CmsRedirect } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsRedirect>>;
+export default _default;

package/dist/runtime/server/api/redirects.post.js

@@ -0,0 +1,7 @@
+import { defineEventHandler, readValidatedBody } from "h3";
+import { createRedirect, redirectInputSchema } from "../utils/redirects.js";
+import { requireCmsPermission } from "../utils/permissions.js";
+export default defineEventHandler(async (event) => {
+  await requireCmsPermission(event, "redirects.manage");
+  return createRedirect(await readValidatedBody(event, redirectInputSchema.parse));
+});

package/dist/runtime/server/api/search.get.js

@@ -5,18 +5,23 @@ import { cmsDialect, useDb } from "#cms-db";
 import * as cmsTables from "#cms-tables";
 import { CMS_SEARCH_MAX_LENGTH } from "../../shared/search.js";
 import { getContentI18n } from "../utils/registry.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { requireCmsAccess } from "../utils/permissions.js";
+import { can } from "../../shared/roles.js";
 import { searchCms } from "../utils/search.js";
 const querySchema = z.object({
   q: z.string().max(CMS_SEARCH_MAX_LENGTH).default("")
 });
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { access } = await requireCmsAccess(event);
   const { q } = await getValidatedQuery(event, querySchema.parse);
+  const readable = Object.fromEntries(
+    Object.entries(cmsConfig).filter(([name]) => can(access, `${name}.read`))
+  );
   return searchCms({
     db: useDb(),
     dialect: cmsDialect,
-    config: cmsConfig,
+    config: readable,
+    media: can(access, "media.read"),
     tables: cmsTables,
     i18n: getContentI18n(),
     query: q

package/dist/runtime/server/api/settings.delete.js

@@ -2,10 +2,10 @@ import { eq } from "drizzle-orm";
 import { defineEventHandler } from "h3";
 import { useDb } from "#cms-db";
 import { cms_settings } from "#cms-tables";
-import { requireAdmin } from "../utils/require-admin.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 import { requireSettingsKey } from "../utils/settings.js";
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  await requireCmsPermission(event, "settings.manage");
   const key = requireSettingsKey(event);
   await useDb().delete(cms_settings).where(eq(cms_settings.key, key));
   return { ok: true };