@xleddyl/nuxt-cms 0.9.4 → 0.10.1

package/dist/runtime/server/api/collection-import.post.js

@@ -6,6 +6,7 @@ import {
   readRawBody
 } from "h3";
 import { z } from "zod";
+import cmsConfig from "#cms-config";
 import { runBatch, useDb } from "#cms-db";
 import { isCollectionKind } from "../../shared/index.js";
 import {
@@ -16,15 +17,21 @@ import {
   TRANSFER_FORMATS
 } from "../../shared/transfer.js";
 import { mapConstraintErrors } from "../utils/db-errors.js";
+import { emitEntryChange } from "../utils/hooks.js";
 import {
+  assignImportIds,
   checkImportRows,
+  existingImportIds,
   importPreview,
   importWriteStatements,
+  planImportRedirects,
   validateImportRows
 } from "../utils/import.js";
+import { invalidateRedirects, redirectPlanStatements } from "../utils/redirects.js";
 import { mediaLookup } from "../utils/media-check.js";
 import { getContentI18n, getRegistryEntry } from "../utils/registry.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { assertCmsPermission, requireCmsAccess } from "../utils/permissions.js";
+import { can } from "../../shared/roles.js";
 const querySchema = z.object({
   format: z.enum(TRANSFER_FORMATS),
   mode: z.enum(IMPORT_MODES).default("create"),
@@ -37,12 +44,15 @@ function tooLarge() {
   });
 }
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user, access } = await requireCmsAccess(event);
   const { name, entry, table } = getRegistryEntry(event);
   if (!isCollectionKind(entry)) {
     throw createError({ statusCode: 405, statusMessage: "Only collections can be imported" });
   }
+  assertCmsPermission(access, `${name}.import`);
   const { format, mode, dryRun } = await getValidatedQuery(event, querySchema.parse);
+  assertCmsPermission(access, `${name}.create`);
+  if (mode === "upsert") assertCmsPermission(access, `${name}.update`);
   if (format === "csv" && !canTransferCsv(entry)) {
     throw createError({
       statusCode: 400,
@@ -56,14 +66,20 @@ export default defineEventHandler(async (event) => {
   const i18n = getContentI18n();
   const source = importSource(entry, format, text, i18n);
   const db = useDb();
-  const rows = await checkImportRows(validateImportRows(entry, source.rows, i18n), {
-    db,
-    name,
-    entry,
-    table,
-    mode,
-    media: source.errors.length ? null : await mediaLookup()
-  });
+  const existing = mode === "upsert" ? await existingImportIds(db, table, source.rows) : null;
+  const isCreate = (id) => !existing || !id || !existing.has(id);
+  const rows = await checkImportRows(
+    validateImportRows(entry, source.rows, i18n, isCreate, cmsConfig),
+    {
+      db,
+      name,
+      entry,
+      table,
+      mode,
+      media: source.errors.length ? null : await mediaLookup(),
+      canPublish: can(access, `${name}.publish`)
+    }
+  );
   const preview = importPreview(entry, rows, {
     format,
     mode,
@@ -78,8 +94,20 @@ export default defineEventHandler(async (event) => {
       data: preview
     });
   }
+  const written = assignImportIds(entry, rows);
+  const redirects = await planImportRedirects(db, entry, table, written);
   await mapConstraintErrors(
-    () => runBatch((tx) => importWriteStatements(tx, name, entry, table, rows))
+    () => runBatch((tx) => [
+      ...importWriteStatements(tx, name, entry, table, written),
+      ...redirects ? redirectPlanStatements(tx, redirects) : []
+    ])
   );
+  if (redirects) invalidateRedirects();
+  emitEntryChange(event, user, {
+    entry: name,
+    kind: entry.kind,
+    action: "import",
+    ids: written.flatMap((row) => row.values && row.id ? [row.id] : [])
+  });
   return { ...preview, imported: true };
 });

package/dist/runtime/server/api/collection.get.js

@@ -2,12 +2,13 @@ import { count } from "drizzle-orm";
 import { defineEventHandler, getValidatedQuery } from "h3";
 import { z } from "zod";
 import { cmsDialect, useDb } from "#cms-db";
-import { pageRoutes } from "../../shared/index.js";
+import { CONTENT_PUBLISHED_AT_FIELD, CONTENT_SLUG_FIELD, pageRoutes } from "../../shared/index.js";
+import { LIST_IDS_MAX } from "../../shared/list-filters.js";
 import { decodeRows, getRegistryEntry, idColumn, tableColumns } from "../utils/registry.js";
 import { listOrderBy, listWhere, readListFilters } from "../utils/list-query.js";
 import { readPages } from "../utils/page-storage.js";
 import { attachManyToMany, relationTitles } from "../utils/relations.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { assertCmsPermission, requireCmsAccess } from "../utils/permissions.js";
 import { singleRowFirst } from "../utils/single-row.js";
 const querySchema = z.object({
   limit: z.coerce.number().int().min(1).max(100).default(50),
@@ -15,18 +16,20 @@ const querySchema = z.object({
   search: z.string().trim().max(200).optional(),
   sort: z.string().trim().max(64).optional(),
   order: z.enum(["asc", "desc"]).default("desc"),
-  light: z.stringbool().default(false)
+  light: z.stringbool().default(false),
+  ids: z.stringbool().default(false)
 });
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { access } = await requireCmsAccess(event);
   const { name, entry, table } = getRegistryEntry(event);
+  assertCmsPermission(access, `${name}.read`);
   const db = useDb();
   if (entry.kind === "single") {
     const rows = await db.select().from(table).orderBy(singleRowFirst(idColumn(table), entry.id)).limit(1);
     await attachManyToMany(db, name, entry, rows);
     return decodeRows(entry, rows)[0] ?? null;
   }
-  const { limit, offset, search, sort, order, light } = await getValidatedQuery(
+  const { limit, offset, search, sort, order, light, ids } = await getValidatedQuery(
     event,
     querySchema.parse
   );
@@ -42,6 +45,11 @@ export default defineEventHandler(async (event) => {
     const matching = term ? items2.filter(
       (item) => item.path.toLowerCase().includes(term) || item.label.toLowerCase().includes(term)
     ) : items2;
+    if (ids)
+      return {
+        ids: matching.slice(0, LIST_IDS_MAX).map((item) => item.id),
+        total: matching.length
+      };
     return {
       items: matching.slice(offset, offset + limit),
       total: matching.length,
@@ -54,20 +62,30 @@ export default defineEventHandler(async (event) => {
     search,
     filters: readListFilters(event, entry)
   });
+  const countRows = async () => {
+    const [counted2] = await (where ? db.select({ total: count() }).from(table).where(where) : db.select({ total: count() }).from(table));
+    return counted2?.total ?? 0;
+  };
+  if (ids) {
+    const base2 = db.select({ id: idColumn(table) }).from(table);
+    const found = await (where ? base2.where(where) : base2).orderBy(...listOrderBy(table, sort, order)).limit(LIST_IDS_MAX);
+    return { ids: found.map((row) => String(row.id)), total: await countRows() };
+  }
   const selection = light ? Object.fromEntries([
     ["id", idColumn(table)],
     ...entry.titleField && titleColumn ? [[entry.titleField, titleColumn]] : [],
-    ...entry.drafts && Object.hasOwn(columns, "status") ? [["status", columns.status]] : []
+    ...entry.drafts && Object.hasOwn(columns, "status") ? [["status", columns.status]] : [],
+    ...entry.kind === "content" ? [CONTENT_SLUG_FIELD, CONTENT_PUBLISHED_AT_FIELD].filter((key) => Object.hasOwn(columns, key)).map((key) => [key, columns[key]]) : []
   ]) : void 0;
   const base = selection ? db.select(selection).from(table) : db.select().from(table);
   const items = await (where ? base.where(where) : base).orderBy(...listOrderBy(table, sort, order)).limit(limit).offset(offset);
-  const [counted] = await (where ? db.select({ total: count() }).from(table).where(where) : db.select({ total: count() }).from(table));
-  if (light) return { items, total: counted?.total ?? 0, relations: {} };
+  const counted = await countRows();
+  if (light) return { items, total: counted, relations: {} };
   await attachManyToMany(db, name, entry, items);
   decodeRows(entry, items);
   return {
     items,
-    total: counted?.total ?? 0,
+    total: counted,
     relations: await relationTitles(db, entry, items)
   };
 });

package/dist/runtime/server/api/collection.post.js

@@ -1,43 +1,60 @@
-import { createError, defineEventHandler, readValidatedBody } from "h3";
-import { runBatch, useDb } from "#cms-db";
+import { createError, defineEventHandler } from "h3";
+import { runBatch } from "#cms-db";
 import { customId } from "../utils/custom-id.js";
 import { mapConstraintErrors } from "../utils/db-errors.js";
+import { emitEntryChange } from "../utils/hooks.js";
+import { assertUniqueValues, readEntryBody } from "../utils/field-rules.js";
 import {
-  buildValidator,
   decodeRows,
   encodeColumnValues,
   getRegistryEntry,
   withContentDefaults,
   withTimestamps
 } from "../utils/registry.js";
+import { entryStatus } from "../../shared/hooks.js";
 import { isCollectionKind } from "../../shared/index.js";
 import {
   assertRelationTargets,
-  attachManyToMany,
+  readBackSaved,
+  savedReadBackError,
   manyToManyStatements,
   splitRelationValues
 } from "../utils/relations.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { assertCmsPermission, assertPublishAllowed, requireCmsAccess } from "../utils/permissions.js";
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user, access } = await requireCmsAccess(event);
   const { name, entry, table } = getRegistryEntry(event);
   if (!isCollectionKind(entry)) {
     throw createError({ statusCode: 405, statusMessage: "Single objects are updated with PUT" });
   }
-  const body = await readValidatedBody(event, buildValidator(entry).parse);
+  assertCmsPermission(access, `${name}.create`);
+  const body = await readEntryBody(event, entry, { create: true });
   const { values, lists } = splitRelationValues(entry, encodeColumnValues(entry, body));
-  await assertRelationTargets(entry, lists);
   if (entry.drafts) values.status ??= "draft";
+  assertPublishAllowed(access, name, entry, null, values.status);
+  await assertRelationTargets(entry, lists);
+  await assertUniqueValues(entry, table, body, null);
   withContentDefaults(entry, values);
   const id = customId(entry.id);
   values.id = id;
-  return mapConstraintErrors(async () => {
+  const saved = await mapConstraintErrors(async () => {
     const [inserted] = await runBatch((db) => [
       db.insert(table).values(withTimestamps(table, values)).returning(),
       ...manyToManyStatements(db, name, id, lists)
     ]);
     const [row] = inserted;
-    const [attached] = await attachManyToMany(useDb(), name, entry, [row]);
-    return decodeRows(entry, [attached])[0];
+    return row;
+  });
+  const readBack = await readBackSaved(name, entry, saved);
+  const item = decodeRows(entry, [readBack.row])[0];
+  emitEntryChange(event, user, {
+    entry: name,
+    kind: entry.kind,
+    action: "create",
+    ids: [id],
+    status: entry.drafts ? entryStatus(item?.status) : null,
+    item: item ?? null
   });
+  if (readBack.error) throw savedReadBackError(readBack.error);
+  return item;
 });

package/dist/runtime/server/api/collection.put.js

@@ -1,42 +1,64 @@
-import { createError, defineEventHandler, readValidatedBody } from "h3";
+import { eq } from "drizzle-orm";
+import { createError, defineEventHandler } from "h3";
 import { runBatch, useDb } from "#cms-db";
 import { mapConstraintErrors } from "../utils/db-errors.js";
+import { emitEntryChange } from "../utils/hooks.js";
+import { entryStatus, entryWriteAction } from "../../shared/hooks.js";
+import { assertImmutableValues, immutableSelection, readEntryBody } from "../utils/field-rules.js";
 import {
-  buildValidator,
   decodeRows,
   encodeColumnValues,
   getRegistryEntry,
   idColumn,
+  tableColumns,
   withTimestamps,
   withUpdatedAt
 } from "../utils/registry.js";
 import {
   assertRelationTargets,
-  attachManyToMany,
+  readBackSaved,
+  savedReadBackError,
   manyToManyStatements,
   splitRelationValues
 } from "../utils/relations.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { assertCmsPermission, requireCmsAccess } from "../utils/permissions.js";
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user, access } = await requireCmsAccess(event);
   const { name, entry, table } = getRegistryEntry(event);
   if (entry.kind !== "single") {
     throw createError({ statusCode: 405, statusMessage: "Collections are updated with PUT /:id" });
   }
-  const body = await readValidatedBody(event, buildValidator(entry).parse);
-  const { values, lists } = splitRelationValues(
-    entry,
-    encodeColumnValues(entry, body)
-  );
+  assertCmsPermission(access, `${name}.update`);
+  const statusColumn = entry.drafts ? tableColumns(table).status : void 0;
+  const [previous] = await useDb().select({
+    ...immutableSelection(entry, table),
+    id: idColumn(table),
+    ...statusColumn ? { status: statusColumn } : {}
+  }).from(table).where(eq(idColumn(table), entry.id)).limit(1);
+  const body = await readEntryBody(event, entry, { create: !previous });
+  assertImmutableValues(entry, previous, body);
+  const { values, lists } = splitRelationValues(entry, encodeColumnValues(entry, body));
   await assertRelationTargets(entry, lists);
   const set = withUpdatedAt(table, values);
-  return mapConstraintErrors(async () => {
+  const saved = await mapConstraintErrors(async () => {
     const [upserted] = await runBatch((db) => [
       db.insert(table).values(withTimestamps(table, { id: entry.id, ...set })).onConflictDoUpdate({ target: idColumn(table), set }).returning(),
       ...manyToManyStatements(db, name, entry.id, lists)
     ]);
     const [row] = upserted;
-    const [attached] = await attachManyToMany(useDb(), name, entry, [row]);
-    return decodeRows(entry, [attached])[0];
+    return row;
   });
+  const readBack = await readBackSaved(name, entry, saved);
+  const item = decodeRows(entry, [readBack.row])[0];
+  const status = entry.drafts ? entryStatus(item?.status) : null;
+  emitEntryChange(event, user, {
+    entry: name,
+    kind: entry.kind,
+    action: entryWriteAction(!previous, entryStatus(previous?.status), status),
+    ids: [entry.id],
+    status,
+    item: item ?? null
+  });
+  if (readBack.error) throw savedReadBackError(readBack.error);
+  return item;
 });

package/dist/runtime/server/api/item.delete.js

@@ -1,23 +1,35 @@
 import { eq } from "drizzle-orm";
 import { createError, defineEventHandler } from "h3";
-import { useDb } from "#cms-db";
+import { runBatch, useDb } from "#cms-db";
 import { mapConstraintErrors } from "../utils/db-errors.js";
+import { emitEntryChange } from "../utils/hooks.js";
+import { deleteItemPreviewLinksStatement } from "../utils/preview-links.js";
 import { getRegistryEntry, idColumn, parseId } from "../utils/registry.js";
 import { isCollectionKind } from "../../shared/index.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { assertCmsPermission, assertDeleteAllowed, requireCmsAccess } from "../utils/permissions.js";
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
-  const { entry, table } = getRegistryEntry(event);
+  const { user, access } = await requireCmsAccess(event);
+  const { name, entry, table } = getRegistryEntry(event);
   if (!isCollectionKind(entry)) {
     throw createError({
       statusCode: 405,
       statusMessage: "Only collection entries can be deleted"
     });
   }
+  assertCmsPermission(access, `${name}.delete`);
   const id = parseId(event);
-  return mapConstraintErrors(async () => {
-    const [row] = await useDb().delete(table).where(eq(idColumn(table), id)).returning();
-    if (!row) throw createError({ statusCode: 404, statusMessage: "Row not found" });
+  const [existing] = await useDb().select().from(table).where(eq(idColumn(table), id)).limit(1);
+  if (!existing) throw createError({ statusCode: 404, statusMessage: "Row not found" });
+  assertDeleteAllowed(access, name, entry, existing.status);
+  const result = await mapConstraintErrors(async () => {
+    const [deleted] = await runBatch((db) => [
+      db.delete(table).where(eq(idColumn(table), id)).returning(),
+      ...entry.kind === "content" ? [deleteItemPreviewLinksStatement(db, name, id)] : []
+    ]);
+    if (!deleted.length)
+      throw createError({ statusCode: 404, statusMessage: "Row not found" });
     return { deleted: true };
   });
+  emitEntryChange(event, user, { entry: name, kind: entry.kind, action: "delete", ids: [id] });
+  return result;
 });

package/dist/runtime/server/api/item.get.js

@@ -10,13 +10,14 @@ import {
 } from "../utils/registry.js";
 import { readPages } from "../utils/page-storage.js";
 import { attachManyToMany } from "../utils/relations.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { assertCmsPermission, requireCmsAccess } from "../utils/permissions.js";
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { access } = await requireCmsAccess(event);
   const { name, entry, table } = getRegistryEntry(event);
   if (entry.kind === "single") {
     throw createError({ statusCode: 404, statusMessage: "Single objects have no items" });
   }
+  assertCmsPermission(access, `${name}.read`);
   const id = parseId(event);
   if (entry.kind === "page") {
     const route = requirePageRoute(entry, id);

package/dist/runtime/server/api/item.put.js

@@ -1,8 +1,8 @@
 import { eq } from "drizzle-orm";
-import { createError, defineEventHandler, readValidatedBody } from "h3";
+import { createError, defineEventHandler } from "h3";
 import { runBatch, useDb } from "#cms-db";
+import { assertImmutableValues, assertUniqueValues, readEntryBody } from "../utils/field-rules.js";
 import {
-  buildValidator,
   decodeRows,
   encodeColumnValues,
   getRegistryEntry,
@@ -12,19 +12,28 @@ import {
   withContentDefaults,
   withUpdatedAt
 } from "../utils/registry.js";
-import { pageFields } from "../../shared/index.js";
+import { isRoutedContent, pageFields, rowAfterUpdate } from "../../shared/index.js";
 import { assertMediaExists } from "../utils/media-check.js";
 import { writePage } from "../utils/page-storage.js";
 import {
   assertRelationTargets,
-  attachManyToMany,
   manyToManyStatements,
+  readBackSaved,
+  savedReadBackError,
   splitRelationValues
 } from "../utils/relations.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { assertCmsPermission, assertPublishAllowed, requireCmsAccess } from "../utils/permissions.js";
+import {
+  contentMovesOf,
+  invalidateRedirects,
+  planContentRedirects,
+  redirectPlanStatements
+} from "../utils/redirects.js";
 import { mapConstraintErrors } from "../utils/db-errors.js";
+import { emitEntryChange } from "../utils/hooks.js";
+import { entryStatus, entryWriteAction } from "../../shared/hooks.js";
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user, access } = await requireCmsAccess(event);
   const { name, entry, table } = getRegistryEntry(event);
   if (entry.kind === "single") {
     throw createError({
@@ -32,34 +41,59 @@ export default defineEventHandler(async (event) => {
       statusMessage: "Single objects are updated with PUT without id"
     });
   }
+  assertCmsPermission(access, `${name}.update`);
   const id = parseId(event);
   if (entry.kind === "page") {
     const route = requirePageRoute(entry, id);
-    const body2 = await readValidatedBody(event, buildValidator(entry, route.path).parse);
+    const body2 = await readEntryBody(event, entry, { path: route.path });
     await assertMediaExists(pageFields(entry, route.path), body2);
     const values2 = encodeColumnValues(entry, body2);
     const set2 = withUpdatedAt(table, values2);
-    return mapConstraintErrors(
+    const page = await mapConstraintErrors(
       async () => decodeRows(entry, [await writePage(name, entry, table, route, set2)])[0]
     );
+    emitEntryChange(event, user, {
+      entry: name,
+      kind: entry.kind,
+      action: "update",
+      ids: [id],
+      path: route.path,
+      item: page ?? null
+    });
+    return page;
   }
-  const body = await readValidatedBody(event, buildValidator(entry).parse);
-  const { values, lists } = splitRelationValues(
-    entry,
-    encodeColumnValues(entry, body)
-  );
+  const body = await readEntryBody(event, entry);
+  const { values, lists } = splitRelationValues(entry, encodeColumnValues(entry, body));
   await assertRelationTargets(entry, lists);
   const set = withUpdatedAt(table, withContentDefaults(entry, values));
-  const [existing] = await useDb().select({ id: idColumn(table) }).from(table).where(eq(idColumn(table), id)).limit(1);
+  const [existing] = await useDb().select().from(table).where(eq(idColumn(table), id)).limit(1);
   if (!existing) throw createError({ statusCode: 404, statusMessage: "Row not found" });
-  return mapConstraintErrors(async () => {
+  assertImmutableValues(entry, existing, body);
+  await assertUniqueValues(entry, table, body, id);
+  assertPublishAllowed(access, name, entry, existing.status, values.status ?? existing.status);
+  const redirects = isRoutedContent(entry) ? await planContentRedirects(contentMovesOf(entry, existing, rowAfterUpdate(existing, set))) : null;
+  const saved = await mapConstraintErrors(async () => {
     const [updated] = await runBatch((db) => [
       db.update(table).set(set).where(eq(idColumn(table), id)).returning(),
-      ...manyToManyStatements(db, name, id, lists)
+      ...manyToManyStatements(db, name, id, lists),
+      ...redirects ? redirectPlanStatements(db, redirects) : []
     ]);
+    if (redirects) invalidateRedirects();
     const [row] = updated;
     if (!row) throw createError({ statusCode: 404, statusMessage: "Row not found" });
-    const [attached] = await attachManyToMany(useDb(), name, entry, [row]);
-    return decodeRows(entry, [attached])[0];
+    return row;
+  });
+  const readBack = await readBackSaved(name, entry, saved);
+  const item = decodeRows(entry, [readBack.row])[0];
+  const status = entry.drafts ? entryStatus(item?.status) : null;
+  emitEntryChange(event, user, {
+    entry: name,
+    kind: entry.kind,
+    action: entryWriteAction(false, entryStatus(existing.status), status),
+    ids: [id],
+    status,
+    item: item ?? null
   });
+  if (readBack.error) throw savedReadBackError(readBack.error);
+  return item;
 });

package/dist/runtime/server/api/link-usage.post.d.ts

@@ -0,0 +1,5 @@
+import type { MediaUsage } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    usage: Record<string, MediaUsage[]>;
+}>>;
+export default _default;

package/dist/runtime/server/api/link-usage.post.js

@@ -0,0 +1,21 @@
+import { defineEventHandler, readValidatedBody } from "h3";
+import { z } from "zod";
+import { linkTargetKey } from "../../shared/index.js";
+import { loadLinkUsage } from "../utils/link-usage.js";
+import { assertCmsPermission, requireCmsAccess } from "../utils/permissions.js";
+import { can } from "../../shared/roles.js";
+const targetSchema = z.object({
+  entry: z.string().min(1).max(128),
+  id: z.string().min(1).max(256)
+});
+const bodySchema = z.object({ targets: z.array(targetSchema).min(1).max(1e3) });
+export default defineEventHandler(
+  async (event) => {
+    const { access } = await requireCmsAccess(event);
+    const { targets } = await readValidatedBody(event, bodySchema.parse);
+    for (const entry of new Set(targets.map((target) => target.entry)))
+      assertCmsPermission(access, `${entry}.read`);
+    const keys = [...new Set(targets.map((target) => linkTargetKey(target.entry, target.id)))];
+    return { usage: await loadLinkUsage(keys, (name) => can(access, `${name}.read`)) };
+  }
+);

package/dist/runtime/server/api/media-delete.post.js

@@ -7,10 +7,11 @@ import { isMediaFolderMarker } from "../../shared/index.js";
 import { objectKeySchema } from "../../shared/validation.js";
 import { useMediaStorage } from "../utils/media.js";
 import { deleteMediaRows, keyChunks } from "../utils/media-folders.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { emitMediaChange } from "../utils/hooks.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const bodySchema = z.object({ keys: z.array(objectKeySchema).min(1).max(1e3) });
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user } = await requireCmsPermission(event, "media.delete");
   const { store } = useMediaStorage(event);
   const { keys } = await readValidatedBody(event, bodySchema.parse);
   const found = [];
@@ -19,5 +20,6 @@ export default defineEventHandler(async (event) => {
     found.push(...rows.map((row) => row.key).filter((key) => !isMediaFolderMarker(key)));
   }
   await deleteMediaRows(store, found);
+  if (found.length) emitMediaChange(event, user, { action: "delete", keys: found });
   return { deleted: found.length };
 });

package/dist/runtime/server/api/media-download.get.js

@@ -21,7 +21,7 @@ import { attachmentDisposition } from "../utils/media-download.js";
 import { mediaFilePath } from "../utils/media-fs.js";
 import { useMediaIndex } from "../utils/media-index.js";
 import { mediaMimeForKey } from "../utils/media-sync.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const querySchema = z.object({ key: objectKeySchema });
 function notFound() {
   throw createError({ statusCode: 404, statusMessage: "Media not found" });
@@ -66,7 +66,7 @@ async function sendRemoteFile(event, baseUrl, key, disposition) {
   return sendStream(event, upstream.body);
 }
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  await requireCmsPermission(event, "media.read");
   const { media } = useMediaConfig(event);
   const { key } = await getValidatedQuery(event, querySchema.parse);
   if (isMediaFolderMarker(key)) notFound();

package/dist/runtime/server/api/media-folder.delete.js

@@ -3,13 +3,14 @@ import { z } from "zod";
 import { isMediaFolderMarker, normalizeMediaFolder } from "../../shared/index.js";
 import { useMediaStorage } from "../utils/media.js";
 import { deleteMediaRows, mediaRowsInFolder } from "../utils/media-folders.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { emitMediaChange } from "../utils/hooks.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 const querySchema = z.object({
   name: z.string().min(1).max(255),
   recursive: z.stringbool().default(false)
 });
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user } = await requireCmsPermission(event, "media.delete");
   const { store } = useMediaStorage(event);
   const { name, recursive } = await getValidatedQuery(event, querySchema.parse);
   const folder = normalizeMediaFolder(name);
@@ -28,5 +29,10 @@ export default defineEventHandler(async (event) => {
     store,
     rows.map((row) => row.key)
   );
+  emitMediaChange(event, user, {
+    action: "folder-delete",
+    keys: files.map((row) => row.key),
+    folder
+  });
   return { deleted: rows.length };
 });

package/dist/runtime/server/api/media-folder.patch.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { runBatch } from "#cms-db";
 import { cms_media } from "#cms-tables";
 import {
+  isMediaFolderMarker,
   isWithinMediaFolder,
   MEDIA_FOLDER_MAX_DEPTH,
   mediaFolderDepth,
@@ -13,7 +14,8 @@ import {
 } from "../../shared/index.js";
 import { useMediaStorage } from "../utils/media.js";
 import { mediaRowsInFolder } from "../utils/media-folders.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { emitMediaChange } from "../utils/hooks.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 import { mediaFolderRenameStatements, planMediaFolderRename } from "../utils/write-statements.js";
 const bodySchema = z.object({
   from: z.string().min(1).max(255),
@@ -26,7 +28,7 @@ function tooDeep() {
   });
 }
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { user } = await requireCmsPermission(event, "media.write");
   const { store } = useMediaStorage(event);
   const body = await readValidatedBody(event, bodySchema.parse);
   const from = normalizeMediaFolder(body.from);
@@ -58,5 +60,11 @@ export default defineEventHandler(async (event) => {
   for (const key of plan.staleMarkers) {
     await store.remove(key);
   }
+  emitMediaChange(event, user, {
+    action: "folder-rename",
+    keys: rows.flatMap((row) => isMediaFolderMarker(row.key) ? [] : [row.key]),
+    folder: to,
+    from
+  });
   return { folder: to, moved: rows.length };
 });