@xleddyl/nuxt-cms 0.9.4 → 0.10.1

package/dist/runtime/server/api/settings.get.js

@@ -1,13 +1,15 @@
 import { defineEventHandler } from "h3";
+import cmsConfig from "#cms-config";
 import { useDb } from "#cms-db";
 import { cms_settings } from "#cms-tables";
-import { requireAdmin } from "../utils/require-admin.js";
+import { requireCmsAccess } from "../utils/permissions.js";
 import { parseSettingsValue } from "../utils/settings.js";
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  await requireCmsAccess(event);
   const rows = await useDb().select().from(cms_settings);
   return Object.fromEntries(
     rows.flatMap((row) => {
+      if (!Object.hasOwn(cmsConfig, row.key)) return [];
       const value = parseSettingsValue(row.value);
       return value ? [[row.key, value]] : [];
     })

package/dist/runtime/server/api/settings.put.js

@@ -1,10 +1,10 @@
 import { defineEventHandler, readValidatedBody } from "h3";
 import { useDb } from "#cms-db";
 import { cms_settings } from "#cms-tables";
-import { requireAdmin } from "../utils/require-admin.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 import { entrySettingsSchema, requireSettingsKey } from "../utils/settings.js";
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  await requireCmsPermission(event, "settings.manage");
   const key = requireSettingsKey(event);
   const body = await readValidatedBody(event, entrySettingsSchema.parse);
   const value = JSON.stringify(body);

package/dist/runtime/server/api/site.get.d.ts

@@ -0,0 +1,3 @@
+import type { CmsSiteSettings } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsSiteSettings>>;
+export default _default;

package/dist/runtime/server/api/site.get.js

@@ -0,0 +1,7 @@
+import { defineEventHandler } from "h3";
+import { requireCmsPermission } from "../utils/permissions.js";
+import { readSiteSettings } from "../utils/site.js";
+export default defineEventHandler(async (event) => {
+  await requireCmsPermission(event, "settings.manage");
+  return readSiteSettings();
+});

package/dist/runtime/server/api/site.put.d.ts

@@ -0,0 +1,3 @@
+import type { CmsSiteSettings } from '../../shared/index.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<CmsSiteSettings>>;
+export default _default;

package/dist/runtime/server/api/site.put.js

@@ -0,0 +1,16 @@
+import { defineEventHandler, readValidatedBody } from "h3";
+import { assertKnownMedia } from "../utils/media-references.js";
+import { mediaLookup } from "../utils/media-check.js";
+import { getContentI18n } from "../utils/registry.js";
+import { requireCmsPermission } from "../utils/permissions.js";
+import { siteSettingsSchema, writeSiteSettings } from "../utils/site.js";
+export default defineEventHandler(async (event) => {
+  await requireCmsPermission(event, "settings.manage");
+  const settings = await readValidatedBody(event, siteSettingsSchema(getContentI18n()).parse);
+  if (settings.image) {
+    const lookup = await mediaLookup();
+    if (lookup) await assertKnownMedia([{ field: "image", key: settings.image }], lookup);
+  }
+  await writeSiteSettings(settings);
+  return settings;
+});

package/dist/runtime/server/api/tags.get.js

@@ -3,10 +3,11 @@ import { useDb } from "#cms-db";
 import { distinctTags, entryFieldsFor } from "../../shared/index.js";
 import { readPages } from "../utils/page-storage.js";
 import { getRegistryEntry, tableColumns } from "../utils/registry.js";
-import { requireAdmin } from "../utils/require-admin.js";
+import { assertCmsPermission, requireCmsAccess } from "../utils/permissions.js";
 export default defineEventHandler(async (event) => {
-  await requireAdmin(event);
+  const { access } = await requireCmsAccess(event);
   const { name, entry, table } = getRegistryEntry(event);
+  assertCmsPermission(access, `${name}.read`);
   const key = getRouterParam(event, "field") ?? "";
   const fields = entryFieldsFor(entry);
   const field = Object.hasOwn(fields, key) ? fields[key] : void 0;

package/dist/runtime/server/api/user.delete.js

@@ -2,10 +2,16 @@ import { eq } from "drizzle-orm";
 import { createError, defineEventHandler, getRouterParam } from "h3";
 import { useDb } from "#cms-db";
 import { cms_users } from "#cms-tables";
-import { requireSuperAdmin } from "../utils/require-admin.js";
+import { forbidden, requireCmsPermission } from "../utils/permissions.js";
+import { assertCanManageAccount } from "../utils/user-management.js";
+import { findUserById } from "../utils/users.js";
 export default defineEventHandler(async (event) => {
-  await requireSuperAdmin(event);
+  const { user, access } = await requireCmsPermission(event, "users.manage");
   const id = getRouterParam(event, "id") ?? "";
+  const target = await findUserById(id);
+  if (!target) throw createError({ statusCode: 404, statusMessage: "User not found" });
+  if (target.id === user.id) forbidden("You cannot delete your own account");
+  assertCanManageAccount(access, target.role);
   const [row] = await useDb().delete(cms_users).where(eq(cms_users.id, id)).returning();
   if (!row) throw createError({ statusCode: 404, statusMessage: "User not found" });
   return { ok: true };

package/dist/runtime/server/api/user.put.js

@@ -5,17 +5,27 @@ import { useDb } from "#cms-db";
 import { cms_users } from "#cms-tables";
 import { MIN_PASSWORD_LENGTH } from "../../shared/index.js";
 import { hashPassword } from "../utils/password.js";
-import { requireSuperAdmin } from "../utils/require-admin.js";
-import { toAccount } from "../utils/users.js";
+import { forbidden, requireCmsPermission } from "../utils/permissions.js";
+import { assertCanGrantRole, assertCanManageAccount } from "../utils/user-management.js";
+import { findUserById, toAccount } from "../utils/users.js";
 const bodySchema = z.object({
   name: z.string().trim().max(120).nullish(),
-  password: z.string().min(MIN_PASSWORD_LENGTH).max(256).optional()
+  password: z.string().min(MIN_PASSWORD_LENGTH).max(256).optional(),
+  role: z.string().trim().min(1).max(64).optional()
 });
 export default defineEventHandler(async (event) => {
-  await requireSuperAdmin(event);
+  const { user, access } = await requireCmsPermission(event, "users.manage");
   const id = getRouterParam(event, "id") ?? "";
   const body = await readValidatedBody(event, bodySchema.parse);
+  const target = await findUserById(id);
+  if (!target) throw createError({ statusCode: 404, statusMessage: "User not found" });
+  assertCanManageAccount(access, target.role);
   const set = { updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  if (body.role !== void 0 && body.role !== target.role) {
+    if (target.id === user.id) forbidden("You cannot change your own role");
+    assertCanGrantRole(access, body.role);
+    set.role = body.role;
+  }
   if (body.name !== void 0) set.name = body.name || null;
   if (body.password) {
     set.passwordHash = await hashPassword(body.password);

package/dist/runtime/server/api/users.get.js

@@ -2,10 +2,10 @@ import { asc } from "drizzle-orm";
 import { defineEventHandler } from "h3";
 import { useDb } from "#cms-db";
 import { cms_users } from "#cms-tables";
-import { requireSuperAdmin } from "../utils/require-admin.js";
+import { requireCmsPermission } from "../utils/permissions.js";
 import { toAccount } from "../utils/users.js";
 export default defineEventHandler(async (event) => {
-  await requireSuperAdmin(event);
+  await requireCmsPermission(event, "users.manage");
   const rows = await useDb().select().from(cms_users).orderBy(asc(cms_users.createdAt));
   return rows.map(toAccount);
 });

package/dist/runtime/server/api/users.post.js

@@ -6,16 +6,20 @@ import { MIN_PASSWORD_LENGTH } from "../../shared/index.js";
 import { customId } from "../utils/custom-id.js";
 import { mapConstraintErrors } from "../utils/db-errors.js";
 import { hashPassword } from "../utils/password.js";
-import { isSuperAdminEmail, requireSuperAdmin } from "../utils/require-admin.js";
+import { requireCmsPermission } from "../utils/permissions.js";
+import { isSuperAdminEmail } from "../utils/require-admin.js";
+import { assertCanGrantRole } from "../utils/user-management.js";
 import { findUserByEmail, toAccount } from "../utils/users.js";
 const bodySchema = z.object({
   email: z.string().trim().toLowerCase().email().max(254),
   name: z.string().trim().max(120).nullish(),
-  password: z.string().min(MIN_PASSWORD_LENGTH).max(256)
+  password: z.string().min(MIN_PASSWORD_LENGTH).max(256),
+  role: z.string().trim().min(1).max(64).default("admin")
 });
 export default defineEventHandler(async (event) => {
-  await requireSuperAdmin(event);
+  const { access } = await requireCmsPermission(event, "users.manage");
   const body = await readValidatedBody(event, bodySchema.parse);
+  assertCanGrantRole(access, body.role);
   if (isSuperAdminEmail(event, body.email) || await findUserByEmail(body.email)) {
     throw createError({ statusCode: 409, statusMessage: "A user with this email already exists" });
   }
@@ -26,7 +30,7 @@ export default defineEventHandler(async (event) => {
       id: customId("usr"),
       email: body.email,
       name: body.name || null,
-      role: "admin",
+      role: body.role,
       passwordHash,
       createdAt: now,
       updatedAt: now

package/dist/runtime/server/middleware/hidden-site.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/middleware/hidden-site.js

@@ -0,0 +1,8 @@
+import { defineEventHandler, setResponseHeader } from "h3";
+import { HIDDEN_SITE_ROBOTS, hiddenSiteHeaderApplies } from "../../shared/index.js";
+import { readCachedSiteSettings } from "../utils/site.js";
+export default defineEventHandler(async (event) => {
+  if (!hiddenSiteHeaderApplies(event.path)) return;
+  const settings = await readCachedSiteSettings().catch(() => null);
+  if (settings?.hidden) setResponseHeader(event, "x-robots-tag", HIDDEN_SITE_ROBOTS);
+});

package/dist/runtime/server/middleware/preview-links.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, void>;
+export default _default;

package/dist/runtime/server/middleware/preview-links.js

@@ -0,0 +1,6 @@
+import { defineEventHandler } from "h3";
+import { hasPreviewQuery } from "../../shared/index.js";
+import { hasPreviewHeader, markPreviewResponse } from "../utils/preview-links.js";
+export default defineEventHandler((event) => {
+  if (hasPreviewQuery(event.path) || hasPreviewHeader(event)) markPreviewResponse(event);
+});

package/dist/runtime/server/middleware/redirects.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/middleware/redirects.js

@@ -0,0 +1,18 @@
+import { defineEventHandler, sendRedirect } from "h3";
+import { normalizeRedirectPath, redirectApplies, redirectLocation } from "../../shared/index.js";
+import { isLivePath, readRedirectTable } from "../utils/redirects.js";
+export default defineEventHandler(async (event) => {
+  if (event.method !== "GET" && event.method !== "HEAD") return;
+  const [pathname = "/", search = ""] = event.path.split(/\?(.*)/s);
+  if (!redirectApplies(pathname)) return;
+  const table = await readRedirectTable().catch(() => null);
+  if (!table?.size) return;
+  const path = normalizeRedirectPath(pathname);
+  const redirect = table.get(path);
+  if (!redirect || await isLivePath(path).catch(() => false)) return;
+  return sendRedirect(
+    event,
+    redirectLocation(redirect.to, search, redirect.keepQuery),
+    redirect.status
+  );
+});

package/dist/runtime/server/plugins/session-validate.js

@@ -6,7 +6,10 @@ export default () => {
     const user = session.user;
     if (!user?.id) return;
     const row = await findUserById(user.id);
-    if (row && user.passwordStamp === passwordStamp(row.passwordHash)) return;
+    if (row && user.passwordStamp === passwordStamp(row.passwordHash)) {
+      user.role = row.role;
+      return;
+    }
     await clearUserSession(event);
     throw createError({ statusCode: 401, statusMessage: "Session expired" });
   });

package/dist/runtime/server/plugins/webhooks.d.ts

@@ -0,0 +1,3 @@
+import type { NitroApp } from 'nitropack/types';
+declare const _default: (nitroApp: NitroApp) => void;
+export default _default;

package/dist/runtime/server/plugins/webhooks.js

@@ -0,0 +1,27 @@
+import { useRuntimeConfig } from "#imports";
+import { CMS_ENTRY_CHANGE_HOOK, CMS_MEDIA_CHANGE_HOOK } from "../../shared/hooks.js";
+import {
+  deliverWebhooks,
+  entryWebhookPayload,
+  mediaWebhookPayload,
+  webhookTargets
+} from "../utils/webhooks.js";
+function targetsFor(event) {
+  const { webhooks } = useRuntimeConfig(event).cms;
+  return webhookTargets(webhooks);
+}
+function deliver(payload, { event }) {
+  const targets = targetsFor(event);
+  return targets.length ? deliverWebhooks(targets, payload) : void 0;
+}
+export default (nitroApp) => {
+  const hooks = nitroApp.hooks;
+  hooks.hook(
+    CMS_ENTRY_CHANGE_HOOK,
+    (change, context) => deliver(entryWebhookPayload(change), context)
+  );
+  hooks.hook(
+    CMS_MEDIA_CHANGE_HOOK,
+    (change, context) => deliver(mediaWebhookPayload(change), context)
+  );
+};

package/dist/runtime/server/routes/graphql.js

@@ -3,6 +3,7 @@ import { defineEventHandler } from "h3";
 import { useRuntimeConfig } from "#imports";
 import { buildCmsSchema, createGraphqlContext } from "../utils/graphql.js";
 import { createBreadthRule, createDepthRule, createIntrospectionRule } from "../utils/graphql-depth.js";
+import { readPreviewGrant } from "../utils/preview-links.js";
 import { CMS_GRAPHQL_BATCH_LIMIT } from "../../shared/index.js";
 function buildYoga(options) {
   return createYoga({
@@ -12,7 +13,7 @@ function buildYoga(options) {
     graphiql: options.graphiql,
     cors: false,
     batching: { limit: CMS_GRAPHQL_BATCH_LIMIT },
-    context: () => createGraphqlContext(),
+    context: ({ cmsPreview }) => createGraphqlContext(cmsPreview ?? null),
     plugins: [
       {
         onValidate({
@@ -27,10 +28,11 @@ function buildYoga(options) {
   });
 }
 let yoga = null;
-export default defineEventHandler((event) => {
+export default defineEventHandler(async (event) => {
   if (!yoga) {
     const { graphql } = useRuntimeConfig(event).cms;
     yoga = buildYoga(graphql);
   }
-  return yoga(event.node.req, event.node.res);
+  const cmsPreview = await readPreviewGrant(event);
+  return yoga(event.node.req, event.node.res, { cmsPreview });
 });

package/dist/runtime/server/routes/robots.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<string>>;
+export default _default;

package/dist/runtime/server/routes/robots.js

@@ -0,0 +1,16 @@
+import { defineEventHandler, setResponseHeaders } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { SITEMAP_PATH, absoluteUrl, renderRobotsTxt } from "../../shared/index.js";
+import { readSiteSettings, resolveSiteUrl, seoRouteCacheHeader } from "../utils/site.js";
+export default defineEventHandler(async (event) => {
+  const { seo } = useRuntimeConfig(event).cms;
+  const settings = await readSiteSettings();
+  setResponseHeaders(event, {
+    "content-type": "text/plain; charset=utf-8",
+    "cache-control": seoRouteCacheHeader(event)
+  });
+  return renderRobotsTxt({
+    hidden: settings.hidden,
+    sitemapUrl: seo?.robotsSitemap ? absoluteUrl(resolveSiteUrl(event), SITEMAP_PATH) : null
+  });
+});

package/dist/runtime/server/routes/sitemap.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<string | void>>;
+export default _default;

package/dist/runtime/server/routes/sitemap.js

@@ -0,0 +1,67 @@
+import { createError, defineEventHandler, getQuery, sendStream, setResponseHeaders } from "h3";
+import {
+  SITEMAP_MAX_URLS,
+  SITEMAP_URLSET_CLOSE,
+  SITEMAP_URLSET_OPEN,
+  planSitemapChunks,
+  renderSitemap,
+  renderSitemapIndex,
+  renderSitemapUrl,
+  sitemapPartUrl,
+  sitemapUrlCount
+} from "../../shared/index.js";
+import { getContentI18n } from "../utils/registry.js";
+import { readSiteSettings, resolveSiteUrl, seoRouteCacheHeader } from "../utils/site.js";
+import { planSitemap, sitemapChunkUrls } from "../utils/sitemap.js";
+async function* urlsetParts(batches) {
+  yield SITEMAP_URLSET_OPEN;
+  for await (const batch of batches) {
+    if (batch.length) yield batch.map(renderSitemapUrl).join("");
+  }
+  yield SITEMAP_URLSET_CLOSE;
+}
+function textStream(parts) {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    async pull(controller) {
+      const { value, done } = await parts.next();
+      if (done) controller.close();
+      else controller.enqueue(encoder.encode(value));
+    },
+    async cancel() {
+      await parts.return(void 0);
+    }
+  });
+}
+function streamUrlset(event, plan, chunks, context) {
+  return sendStream(event, textStream(urlsetParts(sitemapChunkUrls(plan, chunks, context))));
+}
+function requestedPart(event) {
+  const part = getQuery(event).part;
+  if (part === void 0) return null;
+  const value = Number(part);
+  if (!Number.isInteger(value) || value < 1)
+    throw createError({ statusCode: 404, statusMessage: "Sitemap not found" });
+  return value;
+}
+export default defineEventHandler(async (event) => {
+  const part = requestedPart(event);
+  setResponseHeaders(event, {
+    "content-type": "application/xml; charset=utf-8",
+    "cache-control": seoRouteCacheHeader(event)
+  });
+  const settings = await readSiteSettings();
+  if (settings.hidden) return renderSitemap([]);
+  const context = { siteUrl: resolveSiteUrl(event), i18n: getContentI18n() };
+  const plan = await planSitemap(context);
+  const paged = sitemapUrlCount(plan.sizes) > SITEMAP_MAX_URLS;
+  const chunks = paged ? planSitemapChunks(plan.sizes) : plan.sizes.map((size) => ({ source: size.source, offset: 0, limit: size.count }));
+  if (part === null && paged)
+    return renderSitemapIndex(
+      chunks.map((_, index) => sitemapPartUrl(context.siteUrl, index + 1))
+    );
+  if (part === null || !paged && part === 1) return streamUrlset(event, plan, chunks, context);
+  const chunk = paged ? chunks[part - 1] : void 0;
+  if (!chunk) throw createError({ statusCode: 404, statusMessage: "Sitemap not found" });
+  return streamUrlset(event, plan, [chunk], context);
+});

package/dist/runtime/server/utils/cached-value.d.ts

@@ -0,0 +1,5 @@
+export interface CachedValue<T> {
+    get(): Promise<T>;
+    invalidate(): void;
+}
+export declare function cachedValue<T>(load: () => Promise<T>, ttlMs: number, now?: () => number): CachedValue<T>;

package/dist/runtime/server/utils/cached-value.js

@@ -0,0 +1,24 @@
+export function cachedValue(load, ttlMs, now = Date.now) {
+  let value = null;
+  let pending = null;
+  let generation = 0;
+  return {
+    async get() {
+      if (value && value.expiresAt > now()) return value.data;
+      if (pending) return pending;
+      const started = generation;
+      pending = load().then((data) => {
+        if (started === generation) value = { data, expiresAt: now() + ttlMs };
+        return data;
+      }).finally(() => {
+        if (started === generation) pending = null;
+      });
+      return pending;
+    },
+    invalidate() {
+      generation += 1;
+      value = null;
+      pending = null;
+    }
+  };
+}

package/dist/runtime/server/utils/content-routes.d.ts

@@ -0,0 +1,5 @@
+export interface FindContentByPathOptions {
+    includeDrafts?: boolean;
+    previewId?: string;
+}
+export declare function findContentByPath(name: string, path: string, locale: string, options?: FindContentByPathOptions): Promise<Record<string, unknown> | null>;

package/dist/runtime/server/utils/content-routes.js

@@ -0,0 +1,29 @@
+import { and, eq } from "drizzle-orm";
+import cmsConfig from "#cms-config";
+import { useDb } from "#cms-db";
+import {
+  CONTENT_SLUG_FIELD,
+  contentPathParamsMatch,
+  contentRoutePattern,
+  isRoutedContent,
+  matchContentPattern
+} from "../../shared/index.js";
+import { resolveTable, tableColumns } from "./registry.js";
+import { visibleOrPreviewConditions } from "./visibility.js";
+export async function findContentByPath(name, path, locale, options = {}) {
+  const entry = cmsConfig[name];
+  if (!entry || !isRoutedContent(entry)) return null;
+  const pattern = contentRoutePattern(entry.route, locale);
+  const params = pattern ? matchContentPattern(pattern, path) : null;
+  const table = resolveTable(name);
+  if (!params || !table) return null;
+  const columns = tableColumns(table);
+  const conditions = [];
+  if (params.slug) conditions.push(eq(columns[CONTENT_SLUG_FIELD], params.slug));
+  if (params.id) conditions.push(eq(columns.id, params.id));
+  if (!options.includeDrafts)
+    conditions.push(...visibleOrPreviewConditions(entry, columns, options.previewId));
+  const [row] = await useDb().select().from(table).where(and(...conditions)).limit(1);
+  const found = row;
+  return found && contentPathParamsMatch(params, found) ? found : null;
+}

package/dist/runtime/server/utils/field-rules.d.ts

@@ -0,0 +1,19 @@
+import type { SQLiteTable } from 'drizzle-orm/sqlite-core';
+import type { H3Event } from 'h3';
+import type { CmsEntry } from '../../shared/index.js';
+export interface CmsFieldIssue {
+    path: (string | number)[];
+    message: string;
+}
+export declare function fieldIssuesError(statusCode: number, statusMessage: string, issues: CmsFieldIssue[]): import("h3").H3Error<{
+    issues: CmsFieldIssue[];
+}>;
+export declare function readEntryBody(event: H3Event, entry: CmsEntry, options?: {
+    path?: string;
+    create?: boolean;
+}): Promise<Record<string, unknown>>;
+export declare function immutableSelection(entry: CmsEntry, table: SQLiteTable): {
+    [k: string]: import("drizzle-orm/sqlite-core").AnySQLiteColumn;
+};
+export declare function assertImmutableValues(entry: CmsEntry, saved: Record<string, unknown> | null | undefined, values: Record<string, unknown>): void;
+export declare function assertUniqueValues(entry: CmsEntry, table: SQLiteTable, values: Record<string, unknown>, id: string | null): Promise<void>;

package/dist/runtime/server/utils/field-rules.js

@@ -0,0 +1,72 @@
+import { and, eq, ne, sql } from "drizzle-orm";
+import { createError, readBody } from "h3";
+import { useDb } from "#cms-db";
+import { pageFields } from "../../shared/index.js";
+import {
+  changedImmutableKeys,
+  immutableFieldKeys,
+  isCaseInsensitiveUnique,
+  isUniqueValueField,
+  uniqueCompareValue,
+  withEntryDefaults
+} from "../../shared/field-options.js";
+import { validationMessages } from "../../shared/validation.js";
+import { buildValidator, getContentI18n, idColumn, tableColumns } from "./registry.js";
+export function fieldIssuesError(statusCode, statusMessage, issues) {
+  return createError({
+    statusCode,
+    statusMessage,
+    message: issues.map(
+      (issue) => issue.path.length ? `${issue.path.join(".")}: ${issue.message}` : issue.message
+    ).join("; "),
+    data: { issues }
+  });
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+export async function readEntryBody(event, entry, options = {}) {
+  const raw = await readBody(event);
+  const fields = options.path ? pageFields(entry, options.path) : entry.fields;
+  const input = options.create && isPlainObject(raw) ? withEntryDefaults(fields, raw, getContentI18n()) : raw;
+  const result = buildValidator(entry, options.path).safeParse(input);
+  if (result.success) return result.data;
+  throw fieldIssuesError(
+    400,
+    "Validation Error",
+    result.error.issues.map((issue) => ({
+      path: issue.path.map((part) => typeof part === "number" ? part : String(part)),
+      message: issue.message
+    }))
+  );
+}
+export function immutableSelection(entry, table) {
+  const columns = tableColumns(table);
+  return Object.fromEntries(
+    immutableFieldKeys(entry.fields).filter((key) => columns[key]).map((key) => [key, columns[key]])
+  );
+}
+export function assertImmutableValues(entry, saved, values) {
+  const keys = changedImmutableKeys(entry.fields, saved, values);
+  if (!keys.length) return;
+  const message = validationMessages().immutable;
+  throw fieldIssuesError(
+    400,
+    "A field cannot be changed once saved",
+    keys.map((key) => ({ path: [key], message }))
+  );
+}
+export async function assertUniqueValues(entry, table, values, id) {
+  const columns = tableColumns(table);
+  const message = validationMessages().unique;
+  const issues = [];
+  for (const [key, field] of Object.entries(entry.fields)) {
+    const column = columns[key];
+    const value = values[key];
+    if (!isUniqueValueField(field) || !column || value === null || value === void 0) continue;
+    const same = isCaseInsensitiveUnique(field) ? sql`lower(${column}) = ${uniqueCompareValue(field, value)}` : eq(column, value);
+    const [match] = await useDb().select({ id: idColumn(table) }).from(table).where(id === null ? same : and(same, ne(idColumn(table), id))).limit(1);
+    if (match) issues.push({ path: [key], message });
+  }
+  if (issues.length) throw fieldIssuesError(409, "Duplicate value for a unique field", issues);
+}

package/dist/runtime/server/utils/graphql.d.ts

@@ -1,5 +1,7 @@
+import type { CmsPreviewGrant } from '../../shared/index.js';
 interface Ctx {
     loaders: Map<string, BatchLoader<unknown, unknown>>;
+    preview: CmsPreviewGrant | null;
 }
 declare class BatchLoader<K, V> {
     private batchFn;
@@ -10,5 +12,5 @@ declare class BatchLoader<K, V> {
     private flush;
 }
 export declare function buildCmsSchema(): import("graphql-yoga").GraphQLSchemaWithContext<Ctx & import("graphql-yoga").YogaInitialContext>;
-export declare function createGraphqlContext(): Ctx;
+export declare function createGraphqlContext(preview?: CmsPreviewGrant | null): Ctx;
 export {};