@yunsoft/yuncms-api 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunsoft/yuncms-api",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Express API runtime and bundled Studio server for YunCMS.",
   "license": "MIT",
   "type": "module",
@@ -32,7 +32,7 @@
     "test": "node --test"
   },
   "dependencies": {
-    "@yunsoft/yuncms-core": "0.1.0",
+    "@yunsoft/yuncms-core": "0.1.1",
     "express": "5.2.1"
   }
 }

package/src/app.js

@@ -14,9 +14,12 @@ import { createItemsRouter } from './routes/items.js';
 import { createPermissionsRouter } from './routes/permissions.js';
 import { createRolesRouter } from './routes/roles.js';
 import { createSchemaRouter } from './routes/schema.js';
+import { createStudioSettingsRouter } from './routes/studio-settings.js';
 import { createUsersRouter } from './routes/users.js';
 import { createStudioMiddleware } from './studio.js';
 
+const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]{1,64}$/;
+
 function securityHeaders(req, res, next) {
   res.set('x-content-type-options', 'nosniff');
   res.set('x-frame-options', 'DENY');
@@ -43,6 +46,13 @@ function studioCors(config) {
   };
 }
 
+function requestIdentity(req, res, next) {
+  const supplied = req.get('x-request-id');
+  req.id = supplied && REQUEST_ID_PATTERN.test(supplied) ? supplied : randomUUID();
+  res.set('x-request-id', req.id);
+  next();
+}
+
 export function createApp({
   pool,
   config,
@@ -62,14 +72,11 @@ export function createApp({
   const services = serviceRegistry.toObject();
   const app = express();
   app.disable('x-powered-by');
+  if (config.server?.trustProxyHops > 0) app.set('trust proxy', config.server.trustProxyHops);
   app.use(securityHeaders);
   app.use(studioCors(config));
+  app.use(requestIdentity);
   app.use(express.json({ limit: '1mb' }));
-  app.use((req, res, next) => {
-    req.id = req.get('x-request-id') || randomUUID();
-    res.set('x-request-id', req.id);
-    next();
-  });
 
   app.get('/health', (req, res) => {
     res.json({ status: 'ok', request_id: req.id });
@@ -101,9 +108,10 @@ export function createApp({
     emitter,
     storage,
   }));
+  app.use('/studio-settings', createStudioSettingsRouter());
   app.use('/auth', createAuthRouter({ mailer, config, logger }));
   app.use('/items', createItemsRouter());
-  app.use('/schema', createSchemaRouter());
+  app.use('/schema', createSchemaRouter({ schemaCache }));
   app.use('/users', createUsersRouter());
   app.use('/roles', createRolesRouter());
   app.use('/permissions', createPermissionsRouter());
@@ -127,4 +135,4 @@ export function createApp({
   return app;
 }
 
-export { securityHeaders, studioCors };
+export { requestIdentity, securityHeaders, studioCors };

package/src/error-response.js

@@ -87,6 +87,12 @@ const SAFE_DATABASE_MESSAGES = new Map([
 ]);
 
 function normalizeApiError(error) {
+  if (error?.type === 'entity.parse.failed') {
+    const normalized = new Error('Request body contains invalid JSON');
+    normalized.code = 'INVALID_PAYLOAD';
+    normalized.cause = error;
+    return normalized;
+  }
   if (error?.type === 'entity.too.large') {
     const normalized = new Error('Request body exceeds the configured upload limit');
     normalized.code = 'PAYLOAD_TOO_LARGE';

package/src/rate-limit.js

@@ -14,24 +14,29 @@ export function createFixedWindowRateLimit({
 } = {}) {
   if (!Number.isInteger(windowMs) || windowMs < 1000) throw new Error('Rate-limit windowMs must be at least 1000');
   if (!Number.isInteger(max) || max < 1) throw new Error('Rate-limit max must be a positive integer');
+  if (!Number.isInteger(maxBuckets) || maxBuckets < 1) throw new Error('Rate-limit maxBuckets must be a positive integer');
 
   const buckets = new Map();
 
-  function prune(timestamp) {
-    if (buckets.size < maxBuckets) return;
+  function ensureCapacity(timestamp) {
     for (const [bucketKey, bucket] of buckets) {
       if (bucket.resetAt <= timestamp) buckets.delete(bucketKey);
-      if (buckets.size < maxBuckets) break;
+    }
+
+    while (buckets.size >= maxBuckets) {
+      const oldestKey = buckets.keys().next().value;
+      if (oldestKey === undefined) break;
+      buckets.delete(oldestKey);
     }
   }
 
   return (req, res, next) => {
     const timestamp = now();
-    prune(timestamp);
     const bucketKey = String(key(req));
     let bucket = buckets.get(bucketKey);
 
     if (!bucket || bucket.resetAt <= timestamp) {
+      if (!bucket) ensureCapacity(timestamp);
       bucket = { count: 0, resetAt: timestamp + windowMs };
       buckets.set(bucketKey, bucket);
     }

package/src/routes/schema.js

@@ -34,15 +34,20 @@ async function auditSchema(req, { action, collection = null, itemKey = null, pay
   }
 }
 
-export function createSchemaRouter() {
+export function createSchemaRouter({ schemaCache = null } = {}) {
   const router = express.Router();
 
+  function clearSchemaCache() {
+    schemaCache?.clear();
+  }
+
   router.get('/collections', async (req, res) => {
     res.json({ data: await service(req, 'CollectionsService').readMany() });
   });
 
   router.post('/collections', async (req, res) => {
     const data = await service(req, 'CollectionsService').createOne(req.body ?? {});
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.collection.create',
       collection: data.collection,
@@ -66,6 +71,7 @@ export function createSchemaRouter() {
     const collections = service(req, 'CollectionsService');
     const before = await collections.readOne(req.params.collection);
     const data = await collections.updateOne(req.params.collection, req.body ?? {});
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.collection.update',
       collection: req.params.collection,
@@ -81,6 +87,7 @@ export function createSchemaRouter() {
     await collections.deleteOne(req.params.collection, {
       destructive: destructiveRequested(req),
     });
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.collection.delete',
       collection: req.params.collection,
@@ -99,6 +106,7 @@ export function createSchemaRouter() {
       req.params.collection,
       req.body ?? {},
     );
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.field.create',
       collection: req.params.collection,
@@ -129,6 +137,7 @@ export function createSchemaRouter() {
       req.params.field,
       req.body ?? {},
     );
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.field.update',
       collection: req.params.collection,
@@ -146,6 +155,7 @@ export function createSchemaRouter() {
       req.params.field,
       req.body ?? {},
     );
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.field.alter',
       collection: req.params.collection,
@@ -163,6 +173,7 @@ export function createSchemaRouter() {
       req.params.field,
       { destructive: destructiveRequested(req) },
     );
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.field.delete',
       collection: req.params.collection,
@@ -197,6 +208,7 @@ export function createSchemaRouter() {
 
   router.post('/relations/m2o', async (req, res) => {
     const data = await service(req, 'RelationsService').createM2O(req.body ?? {});
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.relation.create',
       collection: data.many_collection,
@@ -213,6 +225,7 @@ export function createSchemaRouter() {
       req.params.manyCollection,
       req.params.manyField,
     );
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.relation.delete',
       collection: req.params.manyCollection,
@@ -224,6 +237,7 @@ export function createSchemaRouter() {
 
   router.post('/relations/m2m', async (req, res) => {
     const data = await service(req, 'RelationsService').createM2M(req.body ?? {});
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.relation.m2m.create',
       collection: data.junctionCollection,
@@ -244,6 +258,7 @@ export function createSchemaRouter() {
       junctionCollection: req.params.junctionCollection,
       destructive: destructiveRequested(req),
     });
+    clearSchemaCache();
     await auditSchema(req, {
       action: 'schema.relation.m2m.delete',
       collection: req.params.junctionCollection,

package/src/routes/studio-settings.js

@@ -0,0 +1,22 @@
+import express from 'express';
+
+import { serviceOptionsFromRequest } from '../service-options.js';
+
+function settingsService(req) {
+  const Service = req.context.services.StudioSettingsService;
+  return new Service(serviceOptionsFromRequest(req));
+}
+
+export function createStudioSettingsRouter() {
+  const router = express.Router();
+
+  router.get('/', async (req, res) => {
+    res.json({ data: await settingsService(req).readPublic() });
+  });
+
+  router.patch('/', async (req, res) => {
+    res.json({ data: await settingsService(req).updateOne(req.body ?? {}) });
+  });
+
+  return router;
+}