@xleddyl/nuxt-cms 0.9.3 → 0.10.0

package/dist/runtime/server/utils/relations.js

@@ -3,7 +3,7 @@ import { createError } from "h3";
 import cmsConfig from "#cms-config";
 import { useDb } from "#cms-db";
 import * as cmsTables from "#cms-tables";
-import { entryFieldsFor } from "../../shared/index.js";
+import { entryFieldsFor, relationTarget } from "../../shared/index.js";
 import { resolveTable, tableColumns } from "./registry.js";
 import { joinWriteStatements } from "./write-statements.js";
 function manyToManyKeys(entry) {
@@ -37,7 +37,7 @@ export async function assertRelationTargets(entry, lists) {
   for (const [key, ids] of Object.entries(lists)) {
     if (!ids.length) continue;
     const field = entryFieldsFor(entry)[key];
-    const target = resolveTable(field.to);
+    const target = resolveTable(relationTarget(field));
     if (!target) continue;
     const idCol = tableColumns(target).id;
     const rows = await db.select({ id: idCol }).from(target).where(inArray(idCol, ids));
@@ -46,7 +46,9 @@ export async function assertRelationTargets(entry, lists) {
       const missing = ids.filter((id) => !found.has(id));
       throw createError({
         statusCode: 422,
-        statusMessage: `Unknown ${field.to} id(s) for '${key}': ${missing.join(", ")}`
+        statusMessage: `Unknown ${relationTarget(field)} id(s) for '${key}': ${missing.join(
+          ", "
+        )}`
       });
     }
   }
@@ -60,9 +62,10 @@ export async function relationTitles(db, entry, rows) {
   const config = cmsConfig;
   const titles = {};
   for (const [key, field] of Object.entries(entryFieldsFor(entry))) {
-    if (field.type !== "relation" || !field.to) continue;
-    const targetEntry = config[field.to];
-    const target = resolveTable(field.to);
+    const to = relationTarget(field);
+    if (field.type !== "relation" || !to) continue;
+    const targetEntry = config[to];
+    const target = resolveTable(to);
     if (!targetEntry?.titleField || !target) continue;
     const ids = /* @__PURE__ */ new Set();
     for (const row of rows) {
@@ -99,3 +102,19 @@ export async function attachManyToMany(db, name, entry, rows) {
   }
   return rows;
 }
+export async function readBackSaved(name, entry, row) {
+  try {
+    const [attached] = await attachManyToMany(useDb(), name, entry, [row]);
+    return { row: attached ?? row, error: null };
+  } catch (error) {
+    return { row, error };
+  }
+}
+export function savedReadBackError(error) {
+  return createError({
+    statusCode: 500,
+    statusMessage: "The changes were saved, but the saved item could not be read back. Reload it.",
+    data: { saved: true },
+    cause: error
+  });
+}

package/dist/runtime/server/utils/require-admin.d.ts

@@ -2,4 +2,3 @@ import type { H3Event } from 'h3';
 import type { CmsSessionUser } from '../../shared/index.js';
 export declare function isSuperAdminEmail(event: H3Event, email: string): boolean;
 export declare function requireAdmin(event: H3Event): Promise<CmsSessionUser>;
-export declare function requireSuperAdmin(event: H3Event): Promise<CmsSessionUser>;

package/dist/runtime/server/utils/require-admin.js

@@ -23,19 +23,15 @@ export async function requireAdmin(event) {
   if (!row || user.passwordStamp !== passwordStamp(row.passwordHash)) {
     throw createError({ statusCode: 401, statusMessage: "Authentication required" });
   }
+  if (row.role === "superadmin") {
+    throw createError({ statusCode: 403, statusMessage: "Not authorized" });
+  }
   return {
     id: row.id,
     email: row.email,
     name: row.name ?? null,
-    role: "admin",
+    role: row.role,
     firstLogin: !!row.mustChangePassword,
     passwordStamp: user.passwordStamp
   };
 }
-export async function requireSuperAdmin(event) {
-  const user = await requireAdmin(event);
-  if (user.role !== "superadmin") {
-    throw createError({ statusCode: 403, statusMessage: "Only the super admin can manage users" });
-  }
-  return user;
-}

package/dist/runtime/server/utils/search.d.ts

@@ -11,6 +11,7 @@ export interface CmsSearchOptions {
     tables: Record<string, unknown>;
     i18n: CmsI18n;
     query: string;
+    media?: boolean;
 }
 export declare function searchLikeCondition(dialect: SearchDialect, column: AnySQLiteColumn, pattern: string): SQL;
 export declare function searchCmsValues(options: CmsSearchOptions): Promise<{

package/dist/runtime/server/utils/search.js

@@ -1,14 +1,19 @@
 import { desc, inArray, or, sql } from "drizzle-orm";
 import {
   decodeTranslatableValue,
+  formatBlockPath,
+  resolveBlockPath,
+  walkBlocks,
   isMultiSelect,
   isTranslatableField,
+  linkLabelTexts,
   mediaFilename,
   pageColumnFields,
   pageFields,
   pageFieldsTableName,
   pageMediaTableName,
   pageRouteOf,
+  readLinkValue,
   selectOptionLabel,
   selectValuesMatching
 } from "../../shared/index.js";
@@ -17,6 +22,8 @@ import {
   CMS_SEARCH_MIN_LENGTH,
   CMS_SEARCH_ROWS_PER_ENTRY,
   CMS_SEARCH_VALUE_LIMIT,
+  cmsEntryLink,
+  cmsHashLink,
   cmsSearchLink,
   normalizeSearchQuery,
   searchCmsLabels,
@@ -34,6 +41,7 @@ const VALUE_TYPES = /* @__PURE__ */ new Set([
   "select",
   "tags",
   "json",
+  "link",
   "blocks"
 ]);
 function isSearchableField(field) {
@@ -66,6 +74,13 @@ function fieldTexts(field, value, defaultLocale) {
     }).join(", ");
     return [{ locale: null, text }];
   }
+  if (field.type === "link") {
+    const link = readLinkValue(value);
+    if (!link) return [];
+    const texts = linkLabelTexts(link.label);
+    if (link.url) texts.push({ locale: null, text: link.url });
+    return texts;
+  }
   if (field.type === "tags" && Array.isArray(value))
     return value.length ? [{ locale: null, text: value.map(String).join(", ") }] : [];
   if (typeof value === "string") return [{ locale: null, text: plainText(field, value) }];
@@ -88,22 +103,29 @@ function rowHits(fields, row, term, defaultLocale) {
       collect(field, value, { field: key, block: null, fieldLabel: field.label });
       continue;
     }
-    if (!Array.isArray(value)) continue;
-    value.forEach((item, index) => {
-      const block = item ? field.blocks?.[String(item.type)] : void 0;
-      if (!item || !block) return;
+    walkBlocks({ [key]: field }, row, ({ item, block, path }) => {
+      if (hits.length >= CMS_SEARCH_HITS_PER_ROW) return false;
       for (const [blockKey, blockField] of Object.entries(block.fields)) {
-        if (!isSearchableField(blockField)) continue;
+        if (!isSearchableField(blockField) || blockField.type === "blocks") continue;
         collect(blockField, item[blockKey], {
           field: key,
-          block: index,
-          fieldLabel: searchFieldPath(field.label, block.label, blockField.label)
+          block: formatBlockPath(path.slice(1)),
+          fieldLabel: searchFieldPath(...blockLabels(fields, row, path), blockField.label)
         });
       }
     });
   }
   return hits;
 }
+function blockLabels(fields, row, path) {
+  const labels = [];
+  for (let end = 2; end <= path.length; end += 2) {
+    const location = resolveBlockPath(fields, row, path.slice(0, end));
+    if (!location) break;
+    labels.push(location.field.label, location.block?.label ?? String(location.item.type));
+  }
+  return labels;
+}
 function titleOf(entry, row, defaultLocale) {
   if (entry.kind === "single" || !entry.titleField) return null;
   const value = row[entry.titleField];
@@ -162,20 +184,23 @@ async function pageRows(context, name, entry, table) {
   }).where(inArray(pageColumns.id, ids));
   return decodePageRows(entry, rows);
 }
-function itemPath(name, entry, row) {
-  if (entry.kind === "single") return `/cms/${name}`;
+function itemLink(name, entry, row) {
+  if (entry.kind === "single") return (focus) => cmsSearchLink(`/cms/${name}`, focus);
   if (entry.kind === "page") {
     const route = pageRouteOf(entry, String(row.id));
-    return route ? `/cms/${name}/${route.key}` : null;
+    return route ? (focus) => cmsSearchLink(`/cms/${name}/${route.key}`, focus) : null;
   }
-  return row.id == null ? null : `/cms/${name}/${String(row.id)}`;
+  if (row.id == null) return null;
+  const id = String(row.id);
+  if (entry.kind === "collection") return (focus) => cmsEntryLink(name, id, focus);
+  return (focus) => cmsSearchLink(`/cms/${name}/${id}`, focus);
 }
 function entryHits(context, name, entry, rows) {
   const { defaultLocale } = context.i18n;
   const hits = [];
   for (const row of rows) {
-    const path = itemPath(name, entry, row);
-    if (!path) continue;
+    const link = itemLink(name, entry, row);
+    if (!link) continue;
     const route = entry.kind === "page" ? pageRouteOf(entry, String(row.id)) : void 0;
     const fields = route ? pageFields(entry, route.path) : entry.fields;
     const title = route ? route.label : titleOf(entry, row, defaultLocale);
@@ -191,17 +216,14 @@ function entryHits(context, name, entry, rows) {
         fieldLabel: hit.fieldLabel,
         locale: hit.locale,
         snippet: hit.snippet,
-        to: cmsSearchLink(path, {
-          field: hit.field,
-          locale: hit.locale,
-          block: hit.block
-        })
+        to: link({ field: hit.field, locale: hit.locale, block: hit.block })
       });
     }
   }
   return hits;
 }
 async function mediaHits(context) {
+  if (context.media === false) return [];
   const table = context.tables.cms_media;
   const columns = table ? columnsOf(table) : void 0;
   if (!table || !columns?.alt || !columns.key || !columns.folder) return [];
@@ -222,7 +244,10 @@ async function mediaHits(context) {
         fieldLabel: "Alt text",
         locale: null,
         snippet,
-        to: folder ? `/cms/media?${new URLSearchParams({ folder })}` : "/cms/media"
+        to: cmsHashLink(
+          folder ? `/cms/media?${new URLSearchParams({ folder })}` : "/cms/media",
+          { media: row.key }
+        )
       }
     ];
   });

package/dist/runtime/server/utils/single-row.d.ts

@@ -0,0 +1,3 @@
+import type { SQL } from 'drizzle-orm';
+import type { AnySQLiteColumn } from 'drizzle-orm/sqlite-core';
+export declare function singleRowFirst(idColumn: AnySQLiteColumn, id: string): SQL;

package/dist/runtime/server/utils/single-row.js

@@ -0,0 +1,4 @@
+import { sql } from "drizzle-orm";
+export function singleRowFirst(idColumn, id) {
+  return sql`case when ${idColumn} = ${id} then 0 else 1 end`;
+}

package/dist/runtime/server/utils/site.d.ts

@@ -0,0 +1,23 @@
+import type { H3Event } from 'h3';
+import { z } from 'zod';
+import type { CmsI18n, CmsSiteSettings } from '../../shared/index.js';
+export declare function siteSettingsSchema(i18n: CmsI18n): z.ZodObject<{
+    name: z.ZodPipe<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodString>>, z.ZodTransform<{
+        [k: string]: string;
+    } | null, Record<string, string> | null>>;
+    titleTemplate: z.ZodPipe<z.ZodNullable<z.ZodString>, z.ZodTransform<string | null, string | null>>;
+    description: z.ZodPipe<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodString>>, z.ZodTransform<{
+        [k: string]: string;
+    } | null, Record<string, string> | null>>;
+    image: z.ZodNullable<z.ZodString>;
+    hidden: z.ZodBoolean;
+}, z.core.$strict>;
+export declare function parseSiteSettings(raw: string | null | undefined): CmsSiteSettings;
+export declare function readSiteSettings(): Promise<CmsSiteSettings>;
+export declare const SITE_SETTINGS_CACHE_TTL_MS = 30000;
+export declare function readCachedSiteSettings(): Promise<CmsSiteSettings>;
+export declare function writeSiteSettings(settings: CmsSiteSettings): Promise<void>;
+export declare function configuredSiteUrl(event: H3Event): string;
+export declare function trustsForwardedHost(event: H3Event): boolean;
+export declare function resolveSiteUrl(event: H3Event): string;
+export declare function seoRouteCacheHeader(event: H3Event): string;

package/dist/runtime/server/utils/site.js

@@ -0,0 +1,79 @@
+import { eq } from "drizzle-orm";
+import { getRequestURL } from "h3";
+import { z } from "zod";
+import { useDb } from "#cms-db";
+import { cms_settings } from "#cms-tables";
+import { useRuntimeConfig } from "#imports";
+import { cachedValue } from "./cached-value.js";
+import {
+  CMS_SITE_SETTINGS_KEY,
+  EMPTY_SITE_SETTINGS,
+  SITE_TEXT_LIMITS,
+  coerceSiteSettings,
+  isForwardedHostTrusted,
+  normalizeSiteUrl,
+  seoRouteCacheControl,
+  titleTemplateErrors
+} from "../../shared/index.js";
+function localeTextSchema(max, locales) {
+  return z.record(z.string(), z.string().max(max)).nullable().superRefine((value, context) => {
+    for (const locale of Object.keys(value ?? {})) {
+      if (!locales.includes(locale))
+        context.addIssue({ code: "custom", message: `Unknown locale: ${locale}` });
+    }
+  }).transform((value) => {
+    const entries = Object.entries(value ?? {}).map(([locale, text]) => [locale, text.trim()]).filter(([, text]) => text);
+    return entries.length ? Object.fromEntries(entries) : null;
+  });
+}
+export function siteSettingsSchema(i18n) {
+  const locales = i18n.locales.length ? i18n.locales : [i18n.defaultLocale];
+  return z.object({
+    name: localeTextSchema(SITE_TEXT_LIMITS.name, locales),
+    titleTemplate: z.string().max(SITE_TEXT_LIMITS.titleTemplate).nullable().transform((value) => value?.trim() || null).superRefine((value, context) => {
+      for (const message of value ? titleTemplateErrors(value) : [])
+        context.addIssue({ code: "custom", message });
+    }),
+    description: localeTextSchema(SITE_TEXT_LIMITS.description, locales),
+    image: z.string().min(1).max(1024).nullable(),
+    hidden: z.boolean()
+  }).strict();
+}
+export function parseSiteSettings(raw) {
+  if (!raw) return { ...EMPTY_SITE_SETTINGS };
+  try {
+    return coerceSiteSettings(JSON.parse(raw));
+  } catch {
+    return { ...EMPTY_SITE_SETTINGS };
+  }
+}
+export async function readSiteSettings() {
+  const [row] = await useDb().select({ value: cms_settings.value }).from(cms_settings).where(eq(cms_settings.key, CMS_SITE_SETTINGS_KEY)).limit(1);
+  return parseSiteSettings(row?.value);
+}
+export const SITE_SETTINGS_CACHE_TTL_MS = 3e4;
+const siteSettingsCache = cachedValue(readSiteSettings, SITE_SETTINGS_CACHE_TTL_MS);
+export function readCachedSiteSettings() {
+  return siteSettingsCache.get();
+}
+export async function writeSiteSettings(settings) {
+  const value = JSON.stringify(settings);
+  const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  await useDb().insert(cms_settings).values({ key: CMS_SITE_SETTINGS_KEY, value, updatedAt }).onConflictDoUpdate({ target: cms_settings.key, set: { value, updatedAt } });
+  siteSettingsCache.invalidate();
+}
+export function configuredSiteUrl(event) {
+  const { siteUrl } = useRuntimeConfig(event).public;
+  return normalizeSiteUrl(siteUrl);
+}
+export function trustsForwardedHost(event) {
+  const config = useRuntimeConfig(event).public;
+  return isForwardedHostTrusted(config.cmsTrustForwardedHost);
+}
+export function resolveSiteUrl(event) {
+  const trusted = trustsForwardedHost(event);
+  return configuredSiteUrl(event) || getRequestURL(event, { xForwardedHost: trusted, xForwardedProto: trusted }).origin;
+}
+export function seoRouteCacheHeader(event) {
+  return seoRouteCacheControl(configuredSiteUrl(event));
+}

package/dist/runtime/server/utils/sitemap.d.ts

@@ -0,0 +1,12 @@
+import type { CmsI18n, SitemapChunk, SitemapSourceSize, SitemapUrl } from '../../shared/index.js';
+export declare const PAGES_SOURCE = "";
+export interface SitemapContext {
+    siteUrl: string;
+    i18n: CmsI18n;
+}
+export interface SitemapPlan {
+    pages: SitemapUrl[];
+    sizes: SitemapSourceSize[];
+}
+export declare function planSitemap(context: SitemapContext): Promise<SitemapPlan>;
+export declare function sitemapChunkUrls(plan: SitemapPlan, chunks: readonly SitemapChunk[], context: SitemapContext): AsyncGenerator<SitemapUrl[]>;

package/dist/runtime/server/utils/sitemap.js

@@ -0,0 +1,109 @@
+import { and, asc, eq, gt, isNull, or, sql } from "drizzle-orm";
+import cmsConfig from "#cms-config";
+import { useDb } from "#cms-db";
+import {
+  CONTENT_NOINDEX_FIELD,
+  CONTENT_PUBLISHED_AT_FIELD,
+  CONTENT_SLUG_FIELD,
+  contentItemPaths,
+  contentRouteLocales,
+  contentRoutePatterns,
+  isRoutedContent,
+  pageRoutes,
+  pageSitemapUrls,
+  sitemapLastmod,
+  sitemapUrlsForPaths
+} from "../../shared/index.js";
+import { readPages } from "./page-storage.js";
+import { resolveTable, tableColumns } from "./registry.js";
+import { visibilityConditions } from "./visibility.js";
+const BATCH_SIZE = 1e3;
+export const PAGES_SOURCE = "";
+function contentWhere(entry, table) {
+  const columns = tableColumns(table);
+  const conditions = visibilityConditions(entry, columns);
+  const noindex = columns[CONTENT_NOINDEX_FIELD];
+  if (noindex) conditions.push(or(isNull(noindex), eq(noindex, false)));
+  return conditions;
+}
+function routedEntries() {
+  const entries = [];
+  for (const [name, entry] of Object.entries(cmsConfig)) {
+    const table = isRoutedContent(entry) ? resolveTable(name) : void 0;
+    if (table) entries.push([name, entry, table]);
+  }
+  return entries;
+}
+async function readPageUrls(siteUrl) {
+  const found = Object.entries(cmsConfig).find(([, entry2]) => entry2.kind === "page");
+  if (!found) return [];
+  const [name, entry] = found;
+  const table = resolveTable(name);
+  if (!table) return [];
+  const rows = await readPages(name, entry, table);
+  return pageSitemapUrls(
+    pageRoutes(entry).map((route) => route.path),
+    rows,
+    siteUrl
+  );
+}
+async function countContent(entry, table) {
+  const where = contentWhere(entry, table);
+  const [counted] = await useDb().select({ total: sql`count(*)` }).from(table).where(where.length ? and(...where) : void 0);
+  return Number(counted?.total ?? 0);
+}
+export async function planSitemap(context) {
+  const pages = await readPageUrls(context.siteUrl);
+  const sizes = [
+    { source: PAGES_SOURCE, count: pages.length, urlsPerItem: 1 }
+  ];
+  for (const [name, entry, table] of routedEntries()) {
+    sizes.push({
+      source: name,
+      count: await countContent(entry, table),
+      urlsPerItem: contentRoutePatterns(entry.route).length
+    });
+  }
+  return { pages, sizes: sizes.filter((size) => size.count > 0) };
+}
+async function* contentUrls(name, context, offset, limit) {
+  const entry = cmsConfig[name];
+  const table = resolveTable(name);
+  if (!entry || !table) return;
+  const columns = tableColumns(table);
+  const where = contentWhere(entry, table);
+  const locales = contentRouteLocales(context.i18n);
+  let lastId = null;
+  let remaining = limit;
+  while (remaining > 0) {
+    const conditions = lastId === null ? where : [...where, gt(columns.id, lastId)];
+    const query = useDb().select({
+      id: columns.id,
+      slug: columns[CONTENT_SLUG_FIELD],
+      publishedAt: columns[CONTENT_PUBLISHED_AT_FIELD],
+      updatedAt: columns.updatedAt
+    }).from(table).where(conditions.length ? and(...conditions) : void 0).orderBy(asc(columns.id)).limit(Math.min(BATCH_SIZE, remaining));
+    const rows = await (lastId === null && offset ? query.offset(offset) : query);
+    if (!rows.length) return;
+    remaining -= rows.length;
+    lastId = String(rows.at(-1).id);
+    yield rows.flatMap(
+      (row) => sitemapUrlsForPaths(
+        contentItemPaths(entry, row, locales),
+        context.siteUrl,
+        context.i18n.defaultLocale,
+        sitemapLastmod(row.updatedAt)
+      )
+    );
+    if (rows.length < BATCH_SIZE) return;
+  }
+}
+export async function* sitemapChunkUrls(plan, chunks, context) {
+  for (const chunk of chunks) {
+    if (chunk.source === PAGES_SOURCE) {
+      yield plan.pages.slice(chunk.offset, chunk.offset + chunk.limit);
+      continue;
+    }
+    yield* contentUrls(chunk.source, context, chunk.offset, chunk.limit);
+  }
+}

package/dist/runtime/server/utils/user-management.d.ts

@@ -0,0 +1,4 @@
+import type { CmsAccess } from '../../shared/roles.js';
+export declare function assertKnownRole(role: string): void;
+export declare function assertCanGrantRole(access: CmsAccess, role: string): void;
+export declare function assertCanManageAccount(access: CmsAccess, role: string): void;

package/dist/runtime/server/utils/user-management.js

@@ -0,0 +1,20 @@
+import { createError } from "h3";
+import cmsConfig from "#cms-config";
+import cmsRoles from "#cms-roles";
+import { canGrantRole, canManageAccount, cmsRoleOptions } from "../../shared/roles.js";
+import { forbidden } from "./permissions.js";
+export function assertKnownRole(role) {
+  if (cmsRoleOptions(cmsRoles).some((option) => option.key === role)) return;
+  throw createError({ statusCode: 400, statusMessage: `Unknown role: ${role}` });
+}
+export function assertCanGrantRole(access, role) {
+  assertKnownRole(role);
+  if (!canGrantRole(access, role, cmsRoles, cmsConfig)) {
+    forbidden(`You cannot grant the role '${role}': it has permissions you do not hold`);
+  }
+}
+export function assertCanManageAccount(access, role) {
+  if (!canManageAccount(access, role, cmsRoles, cmsConfig)) {
+    forbidden("You cannot manage this account: its role has permissions you do not hold");
+  }
+}

package/dist/runtime/server/utils/users.d.ts

@@ -8,7 +8,7 @@ export declare function sessionUserFor(row: CmsUserRow): {
     id: string;
     email: string;
     name: string | null;
-    role: "admin";
+    role: string;
     firstLogin: boolean;
     passwordStamp: string;
 };

package/dist/runtime/server/utils/users.js

@@ -18,7 +18,7 @@ export function sessionUserFor(row) {
     id: row.id,
     email: row.email,
     name: row.name ?? null,
-    role: "admin",
+    role: row.role,
     firstLogin: !!row.mustChangePassword,
     passwordStamp: passwordStamp(row.passwordHash)
   };

package/dist/runtime/server/utils/visibility.d.ts

@@ -2,3 +2,4 @@ import type { SQL } from 'drizzle-orm';
 import type { AnySQLiteColumn } from 'drizzle-orm/sqlite-core';
 import type { CmsEntry } from '../../shared/index.js';
 export declare function visibilityConditions(entry: Pick<CmsEntry, 'kind' | 'drafts'>, columns: Record<string, AnySQLiteColumn>, now?: string): SQL[];
+export declare function visibleOrPreviewConditions(entry: Pick<CmsEntry, 'kind' | 'drafts'>, columns: Record<string, AnySQLiteColumn>, previewId?: string, now?: string): SQL[];

package/dist/runtime/server/utils/visibility.js

@@ -1,4 +1,4 @@
-import { eq, isNotNull, lte } from "drizzle-orm";
+import { and, eq, isNotNull, lte, or } from "drizzle-orm";
 import { CONTENT_PUBLISHED_AT_FIELD } from "../../shared/index.js";
 import { nowTimestamp } from "../../shared/timestamps.js";
 export function visibilityConditions(entry, columns, now = nowTimestamp()) {
@@ -10,3 +10,8 @@ export function visibilityConditions(entry, columns, now = nowTimestamp()) {
     conditions.push(isNotNull(publishedAt), lte(publishedAt, now));
   return conditions;
 }
+export function visibleOrPreviewConditions(entry, columns, previewId, now = nowTimestamp()) {
+  const visible = visibilityConditions(entry, columns, now);
+  if (!visible.length || previewId === void 0 || !columns.id) return visible;
+  return [or(and(...visible), eq(columns.id, previewId))];
+}

package/dist/runtime/server/utils/webhooks.d.ts

@@ -0,0 +1,24 @@
+import type { CmsEntryChange, CmsMediaChange } from '../../shared/hooks.js';
+import type { CmsWebhookEntryPayload, CmsWebhookMediaPayload, CmsWebhookPayload } from '../../webhooks.js';
+export interface CmsWebhookTarget {
+    name: string;
+    url: string;
+    secret: string;
+    events: string[];
+    timeout: number;
+}
+export type CmsWebhookFetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+    signal: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+}>;
+export declare function entryWebhookPayload(change: CmsEntryChange): CmsWebhookEntryPayload;
+export declare function mediaWebhookPayload(change: CmsMediaChange): CmsWebhookMediaPayload;
+export declare function webhookWants(events: readonly string[], event: string): boolean;
+export declare function webhookTargets(config: unknown): CmsWebhookTarget[];
+export declare function deliverWebhook(target: CmsWebhookTarget, payload: CmsWebhookPayload, fetcher?: CmsWebhookFetch): Promise<void>;
+export declare function deliverWebhooks(targets: CmsWebhookTarget[], payload: CmsWebhookPayload, fetcher?: CmsWebhookFetch, log?: (message: string) => void): Promise<void>;

package/dist/runtime/server/utils/webhooks.js

@@ -0,0 +1,90 @@
+import {
+  CMS_WEBHOOK_DELIVERY_HEADER,
+  CMS_WEBHOOK_EVENT_HEADER,
+  CMS_WEBHOOK_SIGNATURE_HEADER,
+  signCmsWebhook
+} from "../../webhooks.js";
+const DEFAULT_TIMEOUT = 5e3;
+export function entryWebhookPayload(change) {
+  return {
+    event: `entry:${change.action}`,
+    action: change.action,
+    entry: change.entry,
+    kind: change.kind,
+    ids: change.ids,
+    path: change.path,
+    status: change.status,
+    at: change.at
+  };
+}
+export function mediaWebhookPayload(change) {
+  return {
+    event: `media:${change.action}`,
+    action: change.action,
+    keys: change.keys,
+    folder: change.folder,
+    from: change.from,
+    at: change.at
+  };
+}
+export function webhookWants(events, event) {
+  if (!events.length) return true;
+  const group = event.slice(0, event.indexOf(":"));
+  return events.includes(event) || events.includes(group);
+}
+export function webhookTargets(config) {
+  if (!config || typeof config !== "object") return [];
+  return Object.entries(config).flatMap(
+    ([name, value]) => {
+      const url = value?.url == null ? "" : String(value.url);
+      if (!url) return [];
+      const timeout = Number(value?.timeout);
+      return [
+        {
+          name,
+          url,
+          secret: value?.secret == null ? "" : String(value.secret),
+          events: Array.isArray(value?.events) ? value.events.map(String) : [],
+          timeout: Number.isInteger(timeout) && timeout > 0 ? timeout : DEFAULT_TIMEOUT
+        }
+      ];
+    }
+  );
+}
+function describeTarget(target) {
+  try {
+    return `'${target.name}' (${new URL(target.url).host})`;
+  } catch {
+    return `'${target.name}'`;
+  }
+}
+export async function deliverWebhook(target, payload, fetcher = globalThis.fetch) {
+  const body = JSON.stringify(payload);
+  const headers = {
+    "content-type": "application/json",
+    "user-agent": "nuxt-cms-webhooks",
+    [CMS_WEBHOOK_EVENT_HEADER]: payload.event,
+    [CMS_WEBHOOK_DELIVERY_HEADER]: globalThis.crypto.randomUUID()
+  };
+  if (target.secret)
+    headers[CMS_WEBHOOK_SIGNATURE_HEADER] = await signCmsWebhook(body, target.secret);
+  const response = await fetcher(target.url, {
+    method: "POST",
+    headers,
+    body,
+    signal: AbortSignal.timeout(target.timeout)
+  });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+}
+export async function deliverWebhooks(targets, payload, fetcher, log = (message) => console.warn(message)) {
+  await Promise.all(
+    targets.filter((target) => webhookWants(target.events, payload.event)).map(
+      (target) => deliverWebhook(target, payload, fetcher).catch((error) => {
+        const reason = error instanceof Error ? error.name === "TimeoutError" ? `timed out after ${target.timeout} ms` : error.message : String(error);
+        log(
+          `[nuxt-cms] webhook ${describeTarget(target)} failed on ${payload.event}: ${reason}`
+        );
+      })
+    )
+  );
+}