@yimingliao/cms 0.0.126 → 0.0.127

package/dist/src/constants/paths/main.js

@@ -0,0 +1,28 @@
+import { KEYS } from '../keys/index.js';
+import { CMS_PATH } from './cms-path.js';
+
+const MAIN_PATHS = {
+  dashboard: {
+    path: `${CMS_PATH}/${KEYS.main.dashboard.key}`
+  },
+  cmsSettings: {
+    path: `${CMS_PATH}/${KEYS.main.dashboard.key}/${KEYS.main.cmsSettings.key}`
+  },
+  websitePages: {
+    path: `${CMS_PATH}/${KEYS.main.dashboard.key}/${KEYS.main.websitePages.key}`
+  },
+  storage: {
+    path: `${CMS_PATH}/${KEYS.main.dashboard.key}/${KEYS.main.storage.key}`
+  },
+  postManagement: {
+    path: `${CMS_PATH}/${KEYS.main.dashboard.key}/${KEYS.main.postManagement.key}`
+  },
+  fileManager: {
+    path: `${CMS_PATH}/${KEYS.main.dashboard.key}/${KEYS.main.storage.key}/${KEYS.main.fileManager.key}`
+  },
+  trash: {
+    path: `${CMS_PATH}/${KEYS.main.dashboard.key}/${KEYS.main.storage.key}/${KEYS.main.trash.key}`
+  }
+};
+
+export { MAIN_PATHS };

package/dist/src/constants/paths/resources.js

@@ -0,0 +1,28 @@
+import { KEYS } from '../keys/index.js';
+import { MAIN_PATHS } from './main.js';
+
+const RESOURCES_PATHS = {
+  admin: {
+    path: `${MAIN_PATHS.cmsSettings.path}/${KEYS.resources.admin.key}`
+  },
+  folder: {
+    path: `${MAIN_PATHS.storage.path}/${KEYS.resources.folder.key}`
+  },
+  file: {
+    path: `${MAIN_PATHS.storage.path}/${KEYS.resources.file.key}`
+  },
+  post: {
+    path: (topicSlug = "") => `${MAIN_PATHS.postManagement.path}/${topicSlug}/${KEYS.resources.post.key}`
+  },
+  topic: {
+    path: `${MAIN_PATHS.postManagement.path}/${KEYS.resources.topic.key}`
+  },
+  category: {
+    path: (topicSlug = "") => `${MAIN_PATHS.postManagement.path}/${topicSlug}/${KEYS.resources.category.key}`
+  },
+  tag: {
+    path: `${MAIN_PATHS.postManagement.path}/${KEYS.resources.tag.key}`
+  }
+};
+
+export { RESOURCES_PATHS };

package/dist/src/constants/redirect-paths.js

@@ -0,0 +1,10 @@
+import { PATHS } from './paths/index.js';
+
+const PROTECTED_PATHS = [PATHS.main.dashboard.path];
+const LOGGED_IN_SKIP_PATHS = [
+  PATHS.auth.signIn.path,
+  PATHS.auth.forgotPassword.path,
+  PATHS.auth.resetPassword.path
+];
+
+export { LOGGED_IN_SKIP_PATHS, PROTECTED_PATHS };

package/dist/src/domain/resources/admin/constants.js

@@ -0,0 +1,14 @@
+import { ADMIN_ROLES } from './props.js';
+
+const ADMIN_ROLE_ARRAY = [
+  ADMIN_ROLES.SUPER_ADMIN,
+  ADMIN_ROLES.ADMIN,
+  ADMIN_ROLES.EDITOR
+];
+const ADMIN_ROLE_I18N_MAP = {
+  [ADMIN_ROLES.SUPER_ADMIN]: `resources.admin.role.super-admin.text`,
+  [ADMIN_ROLES.ADMIN]: `resources.admin.role.admin.text`,
+  [ADMIN_ROLES.EDITOR]: `resources.admin.role.editor.text`
+};
+
+export { ADMIN_ROLE_ARRAY, ADMIN_ROLE_I18N_MAP };

package/dist/src/domain/resources/admin/props.js

@@ -0,0 +1,7 @@
+const ADMIN_ROLES = {
+  SUPER_ADMIN: "SUPER_ADMIN",
+  ADMIN: "ADMIN",
+  EDITOR: "EDITOR"
+};
+
+export { ADMIN_ROLES };

package/dist/src/domain/resources/constants.js

@@ -0,0 +1,29 @@
+const ROOT_FOLDER_ID = "01ARZ3NDEKTSV4RRFFQ69G5FAV";
+const ROOT_FOLDER_NAME = "ROOT";
+const ROOT_FOLDER = {
+  id: ROOT_FOLDER_ID,
+  // core
+  name: ROOT_FOLDER_NAME,
+  key: "",
+  // states
+  isLocked: true,
+  // ---------------------------
+  // relations: Folder
+  // ---------------------------
+  parentFolder: null,
+  parentFolderId: null,
+  subFolders: [],
+  // ---------------------------
+  // relations: Folder
+  // ---------------------------
+  files: [],
+  // ---------------------------
+  // timestamps
+  // ---------------------------
+  createdAt: "",
+  updatedAt: ""
+};
+const SIMPLE_UPLOAD_FOLDER_NAME = "simple-upload";
+const SIMPLE_UPLOAD_FOLDER_KEY = `${SIMPLE_UPLOAD_FOLDER_NAME}`;
+
+export { ROOT_FOLDER, ROOT_FOLDER_ID, ROOT_FOLDER_NAME, SIMPLE_UPLOAD_FOLDER_KEY, SIMPLE_UPLOAD_FOLDER_NAME };

package/dist/src/domain/resources/file/props.js

@@ -0,0 +1,10 @@
+const FILE_TYPES = {
+  IMAGE: "IMAGE",
+  AUDIO: "AUDIO",
+  VIDEO: "VIDEO",
+  DOCUMENT: "DOCUMENT",
+  ARCHIVE: "ARCHIVE",
+  OTHER: "OTHER"
+};
+
+export { FILE_TYPES };

package/dist/src/domain/resources/file/utils/is-file-locked.js

@@ -0,0 +1,10 @@
+const isFileLocked = (file) => {
+  if (!file) return false;
+  if (!("adminAsAvatarImage" in file && "postsAsCoverImage" in file && "postsAsContentImage" in file && "postsAsImages1" in file && "postsAsImages2" in file && "postsAsImage1" in file && "postsAsImage2" in file && "postsAsImage3" in file && "postsAsImage4" in file)) {
+    return false;
+  }
+  const locked = file.adminAsAvatarImage.length > 0 || file.postsAsCoverImage.length > 0 || file.postsAsContentImage.length > 0 || file.postsAsImages1.length > 0 || file.postsAsImages2.length > 0 || file.postsAsImage1.length > 0 || file.postsAsImage2.length > 0 || file.postsAsImage3.length > 0 || file.postsAsImage4.length > 0;
+  return locked;
+};
+
+export { isFileLocked };

package/dist/src/domain/resources/folder/utils/file-manager-double-click.js

@@ -0,0 +1,7 @@
+const fileManagerDoubleClick = (item) => {
+  const url = new URL(globalThis.location.href);
+  url.searchParams.set("folderKey", item.key);
+  globalThis.history.pushState({}, "", url);
+};
+
+export { fileManagerDoubleClick };

package/dist/src/domain/resources/folder/utils/is-folder-locked.js

@@ -0,0 +1,8 @@
+const isFolderLocked = (folder) => {
+  if (!folder) return true;
+  if (!("subFolders" in folder)) return false;
+  const locked = folder.subFolders?.length > 0 || folder.files?.length > 0;
+  return locked;
+};
+
+export { isFolderLocked };

package/dist/src/domain/resources/folder/utils/normalize-folder-key.js

@@ -0,0 +1,16 @@
+const normalizeFolderKey = (key) => {
+  if (!key) {
+    return { folderKeys: [], segments: [], parentKey: "" };
+  }
+  const segments = key.split("/").filter(Boolean);
+  const folderKeys = [];
+  segments.reduce((acc, seg) => {
+    const next = acc ? `${acc}/${seg}` : seg;
+    folderKeys.push(next);
+    return next;
+  }, "");
+  const parentKey = segments.slice(0, -1).join("/");
+  return { folderKeys, segments, parentKey };
+};
+
+export { normalizeFolderKey };

package/dist/src/domain/resources/post/props.js

@@ -0,0 +1,9 @@
+const POST_TYPES = {
+  TOPIC: "TOPIC",
+  CATEGORY: "CATEGORY",
+  POST: "POST",
+  TAG: "TAG",
+  PAGE: "PAGE"
+};
+
+export { POST_TYPES };

package/dist/src/server/applications/auth/create-auth-use-cases.js

@@ -0,0 +1,125 @@
+import { ServerError } from '../../server-error.js';
+
+function createAuthUseCases({
+  prisma,
+  adminQueryRepository,
+  adminRefreshTokenCommandRepository,
+  jwtService,
+  argon2Service,
+  cryptoService,
+  cookieService,
+  config
+}) {
+  async function verifyCredentials({
+    email,
+    password
+  }) {
+    const found = await adminQueryRepository.findWithPasswordHash({ email });
+    if (found) {
+      const isValid = await argon2Service.verify(found.passwordHash, password);
+      if (isValid) return found;
+    }
+    throw new ServerError({ i18nKey: "error.credentials-incorrect" });
+  }
+  async function updatePassword({
+    email,
+    password
+  }) {
+    const updatedAdmin = await prisma.admin.update({
+      where: { email },
+      data: { passwordHash: await argon2Service.hash(password) }
+    });
+    return updatedAdmin;
+  }
+  async function createRefreshToken({
+    admin,
+    deviceInfo,
+    ip
+  }) {
+    const token = cryptoService.generateToken();
+    const tokenHash = cryptoService.hash(token);
+    await adminRefreshTokenCommandRepository.create({
+      tokenHash,
+      ip,
+      deviceInfo,
+      expiresAt: new Date(Date.now() + config.refreshTokenTtl * 1e3),
+      adminId: admin.id,
+      email: admin.email
+    });
+    return token;
+  }
+  async function refreshTokens({
+    admin,
+    deviceInfo,
+    ip
+  }) {
+    const token = await createRefreshToken({ admin, deviceInfo, ip });
+    await cookieService.setSignedCookie({
+      name: config.refreshTokenName,
+      value: token,
+      expireSeconds: config.refreshTokenTtl
+    });
+    const accessToken = jwtService.sign({
+      payload: { id: admin.id },
+      secret: cryptoService.hash(config.accessTokenSecret),
+      expiresIn: config.accessTokenTtl
+    });
+    await cookieService.setSignedCookie({
+      name: config.accessTokenName,
+      value: accessToken,
+      expireSeconds: config.accessTokenTtl
+    });
+  }
+  function signPasswordResetToken({ admin }) {
+    const payload = { email: admin.email };
+    const passwordResetToken = jwtService.sign({
+      payload,
+      secret: config.resetPasswordSecret,
+      expiresIn: config.resetPasswordTtl
+    });
+    return passwordResetToken;
+  }
+  function verifyPasswordResetToken({ token }) {
+    const payload = jwtService.verify({
+      token,
+      secret: config.resetPasswordSecret
+    });
+    return payload;
+  }
+  function signEmailVerificationToken() {
+    const emailVerificationToken = jwtService.sign({
+      payload: {},
+      secret: config.verifyEmailSecret,
+      expiresIn: config.verifyEmailTtl
+    });
+    return emailVerificationToken;
+  }
+  async function verifyEmailAndUpdate({
+    token,
+    admin
+  }) {
+    jwtService.verify({
+      token,
+      secret: config.verifyEmailSecret
+    });
+    const updatedAdmin = await prisma.admin.update({
+      where: { email: admin.email },
+      data: { emailVerifiedAt: /* @__PURE__ */ new Date() }
+    });
+    return updatedAdmin;
+  }
+  return {
+    verifyCredentials,
+    updatePassword,
+    createRefreshToken,
+    refreshTokens,
+    // reset password
+    signPasswordResetToken,
+    verifyPasswordResetToken,
+    // verify email
+    signEmailVerificationToken,
+    verifyEmailAndUpdate
+  };
+}
+
+export { createAuthUseCases };

package/dist/src/server/applications/emails/create-email-verification-email.js

@@ -0,0 +1,29 @@
+function createEmailVerificationEmail({
+  renderEmailTemplate,
+  sendEmail,
+  authUseCases,
+  webUrl
+}) {
+  async function generateHtml(replacements) {
+    return await renderEmailTemplate("auth/verify-email", replacements);
+  }
+  async function send({ translator, admin, newEmail }) {
+    const email = newEmail ?? admin.email;
+    const emailVerificationToken = authUseCases.signEmailVerificationToken();
+    const emailVerificationUrl = `${webUrl}/cms/verify-email?email=${email}&emailVerificationToken=${emailVerificationToken}`;
+    const html = await generateHtml({
+      emailVerificationUrl
+    });
+    return sendEmail({
+      to: email,
+      subject: translator.t("email.verify-email.text"),
+      html
+    });
+  }
+  return {
+    generateHtml,
+    send
+  };
+}
+
+export { createEmailVerificationEmail };

package/dist/src/server/applications/emails/create-forgot-password-email.js

@@ -0,0 +1,26 @@
+function createForgotPasswordEmail({
+  renderEmailTemplate,
+  sendEmail,
+  authUseCases,
+  webUrl
+}) {
+  async function generateHtml(replacements) {
+    return await renderEmailTemplate("auth/forgot-password", replacements);
+  }
+  async function send({ translator, admin }) {
+    const passwordResetToken = authUseCases.signPasswordResetToken({ admin });
+    const passwordResetUrl = `${webUrl}/cms/reset-password?passwordResetToken=${passwordResetToken}`;
+    const html = await generateHtml({ passwordResetUrl });
+    return sendEmail({
+      to: admin.email,
+      subject: translator.t("email.forgot-password.text"),
+      html
+    });
+  }
+  return {
+    generateHtml,
+    send
+  };
+}
+
+export { createForgotPasswordEmail };

package/dist/src/server/infrastructure/argon2/argon2.service.js

@@ -0,0 +1,23 @@
+import argon2 from 'argon2';
+
+const DEFAULT_OPTIONS = {
+  type: argon2.argon2id,
+  memoryCost: 19456,
+  // ~19MB
+  timeCost: 2,
+  parallelism: 1
+};
+function createArgon2Service() {
+  async function hash(password) {
+    return await argon2.hash(password, DEFAULT_OPTIONS);
+  }
+  async function verify(digest, password) {
+    return await argon2.verify(digest, password);
+  }
+  return {
+    hash,
+    verify
+  };
+}
+
+export { createArgon2Service };

package/dist/src/server/infrastructure/cache/cache-key-delimiter.js

@@ -0,0 +1,3 @@
+const CACHE_KEY_DELIMITER = "|";
+
+export { CACHE_KEY_DELIMITER };

package/dist/src/server/infrastructure/cache/create-cache-result.js

@@ -0,0 +1,39 @@
+import { normalizeCacheKey } from './normalize-cache-key.js';
+
+const DAY = 1e3 * 60 * 60 * 24;
+function createCacheResult(cache, logger) {
+  return async function cacheResult({
+    key: rawKey,
+    ttl = DAY,
+    load
+  }) {
+    const key = normalizeCacheKey(rawKey);
+    if (!key) {
+      logger.error("Cache skipped due to invalid key", {
+        rawKey,
+        scope: "cacheResult"
+      });
+      return load();
+    }
+    try {
+      const cached = await cache.get(key);
+      if (cached !== void 0) {
+        return cached;
+      }
+      const data = await load();
+      if (data !== void 0) {
+        await cache.set(key, data, ttl);
+      }
+      return data;
+    } catch (error) {
+      logger.error("Cache failure, falling back to loader", {
+        key,
+        error,
+        scope: "cacheResult"
+      });
+      return load();
+    }
+  };
+}
+
+export { createCacheResult };

package/dist/src/server/infrastructure/cache/create-cache.js

@@ -0,0 +1,20 @@
+import KeyvRedis from '@keyv/redis';
+import Keyv from 'keyv';
+import { CACHE_KEY_DELIMITER } from './cache-key-delimiter.js';
+
+function createCache({
+  redisUrl,
+  namespace,
+  keyDelimiter = CACHE_KEY_DELIMITER
+}) {
+  const redisStore = new KeyvRedis(redisUrl, {
+    keyPrefixSeparator: keyDelimiter
+  });
+  return new Keyv({
+    store: redisStore,
+    namespace,
+    useKeyPrefix: false
+  });
+}
+
+export { createCache };

package/dist/src/server/infrastructure/cache/create-ip-rate-limiter.js

@@ -0,0 +1,42 @@
+import { normalizeCacheKey } from './normalize-cache-key.js';
+
+const DEFAULT_MAX_ATTEMPTS = 10;
+const DEFAULT_TIME_WINDOW = 60;
+const lua = `
+    local current = redis.call('INCR', KEYS[1])
+    if current == 1 then
+      redis.call('EXPIRE', KEYS[1], ARGV[1])
+    end
+    return current
+  `;
+function createIpRateLimiter({
+  appName,
+  cache,
+  headers
+}) {
+  return async function ipRateLimiter({
+    key: rawKey,
+    maxAttempts = DEFAULT_MAX_ATTEMPTS,
+    timeWindow = DEFAULT_TIME_WINDOW
+  }) {
+    const secondaryStore = cache.store;
+    const redis = await secondaryStore.getClient();
+    if (!redis) return true;
+    const headersStore = await headers();
+    const ip = headersStore.get("cf-connecting-ip")?.trim() || headersStore.get("x-forwarded-for")?.split(",")[0]?.trim() || "unknown";
+    const key = normalizeCacheKey([
+      appName,
+      "ip-rate-limiter",
+      ...Array.isArray(rawKey) ? rawKey : [rawKey],
+      ip
+    ]);
+    const currentRaw = await redis.eval(lua, {
+      keys: [key],
+      arguments: [timeWindow.toString()]
+    });
+    const current = typeof currentRaw === "number" ? currentRaw : Number(currentRaw);
+    return current <= maxAttempts;
+  };
+}
+
+export { createIpRateLimiter };

package/dist/src/server/infrastructure/cache/normalize-cache-key.js

@@ -0,0 +1,20 @@
+import { CACHE_KEY_DELIMITER } from './cache-key-delimiter.js';
+
+const sanitize = (k) => k.replaceAll(/[\u200B-\u200D\uFEFF]/g, "").replaceAll(/[\r\n]/g, "").trim();
+const normalizeCacheKey = (key, delimiter = CACHE_KEY_DELIMITER) => {
+  if (!key) return null;
+  if (Array.isArray(key)) {
+    if (key.length === 0) return null;
+    const normalized = key.map((k) => {
+      if (k === null) return "__null";
+      if (k === void 0) return "__undefined";
+      if (typeof k === "boolean") return k ? "__true" : "__false";
+      return sanitize(String(k));
+    });
+    return normalized.join(delimiter);
+  }
+  if (typeof key === "boolean") return key ? "__true" : "__false";
+  return String(key);
+};
+
+export { normalizeCacheKey };

package/dist/src/server/infrastructure/cookie/cookie.service.js

@@ -0,0 +1,81 @@
+import { timingSafeEqual } from 'node:crypto';
+
+const DEFAULT_OPTIONS = {
+  httpOnly: true,
+  secure: process.env["NODE_ENV"] === "production",
+  sameSite: "strict",
+  path: "/"
+};
+function createCookieService(nextCookies, cryptoService) {
+  async function set({
+    name,
+    value,
+    expireSeconds
+  }) {
+    const cookieStore = await nextCookies();
+    cookieStore.set(name, value, { ...DEFAULT_OPTIONS, maxAge: expireSeconds });
+  }
+  async function setSignedCookie({
+    name,
+    value,
+    expireSeconds
+  }) {
+    const createdAt = Date.now();
+    const { signed } = cryptoService.sign({
+      value,
+      expireSeconds,
+      createdAt
+    });
+    await set({ name, value: signed, expireSeconds });
+  }
+  async function get({ name }) {
+    const cookieStore = await nextCookies();
+    const cookieValue = cookieStore.get(name)?.value;
+    return cookieValue;
+  }
+  async function getSignedCookie({ name }) {
+    const signed = await get({ name });
+    const value = verifySignedCookie({ signed });
+    return value;
+  }
+  function verifySignedCookie({ signed }) {
+    if (!signed) throw new Error("Invalid cookie");
+    const parts = signed.split("|");
+    if (parts.length !== 4) throw new Error("Invalid cookie");
+    const [value, expireSecondsStr, createdAtStr, signature] = parts;
+    const expireSeconds = Number.parseInt(expireSecondsStr, 10);
+    const createdAt = Number.parseInt(createdAtStr, 10);
+    if (Number.isNaN(expireSeconds) || Number.isNaN(createdAt)) {
+      throw new TypeError("Invalid cookie");
+    }
+    const now = Date.now();
+    if (now > createdAt + expireSeconds * 1e3) {
+      throw new Error("Cookie expired");
+    }
+    const { signature: generatedSignature } = cryptoService.sign({
+      value,
+      expireSeconds,
+      createdAt
+    });
+    const sig = Buffer.from(signature);
+    const gen = Buffer.from(generatedSignature);
+    if (sig.length !== gen.length || !timingSafeEqual(sig, gen)) {
+      throw new Error("Invalid cookie signature");
+    }
+    return value;
+  }
+  async function deleteCokkie({ name }) {
+    const cookieStore = await nextCookies();
+    cookieStore.delete(name);
+  }
+  return {
+    set,
+    setSignedCookie,
+    get,
+    getSignedCookie,
+    verifySignedCookie,
+    delete: deleteCokkie
+  };
+}
+
+export { createCookieService };

package/dist/src/server/infrastructure/crypto/crypto.service.js

@@ -0,0 +1,66 @@
+import crypto from 'node:crypto';
+
+function createCryptoService({
+  defaultSecret
+}) {
+  const SECRET = crypto.createHash("sha256").update(defaultSecret).digest();
+  const ALGORITHM = "aes-256-gcm";
+  const IV_LENGTH = 12;
+  function generateToken() {
+    return crypto.randomBytes(32).toString("base64url");
+  }
+  function hash(value) {
+    return crypto.createHash("sha256").update(value).digest("hex");
+  }
+  function hashBuffer(value) {
+    return crypto.createHash("sha256").update(value).digest();
+  }
+  function encrypt(data) {
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipheriv(ALGORITHM, SECRET, iv);
+    const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [
+      iv.toString("hex"),
+      encrypted.toString("hex"),
+      tag.toString("hex")
+    ].join(":");
+  }
+  function decrypt(data) {
+    const parts = data.split(":");
+    if (parts.length !== 3 || !parts.every(Boolean)) {
+      throw new Error("Invalid encrypted payload");
+    }
+    const [ivHex, encryptedHex, tagHex] = parts;
+    const iv = Buffer.from(ivHex, "hex");
+    const encrypted = Buffer.from(encryptedHex, "hex");
+    const tag = Buffer.from(tagHex, "hex");
+    const decipher = crypto.createDecipheriv(ALGORITHM, SECRET, iv);
+    decipher.setAuthTag(tag);
+    const decrypted = Buffer.concat([
+      decipher.update(encrypted),
+      decipher.final()
+    ]);
+    return decrypted.toString("utf8");
+  }
+  function sign({
+    value,
+    expireSeconds,
+    createdAt
+  }) {
+    const payload = `${value}|${expireSeconds}|${createdAt ?? Date.now()}`;
+    const signature = crypto.createHmac("sha256", SECRET).update(payload).digest("hex");
+    const signed = `${payload}|${signature}`;
+    return { signed, signature };
+  }
+  return {
+    generateToken,
+    hash,
+    hashBuffer,
+    encrypt,
+    decrypt,
+    sign
+  };
+}
+
+export { createCryptoService };