alinea 2.0.0-preview.3 → 2.0.0-preview.5

package/dist/adapter/next/with-alinea.js

@@ -1,6 +1,7 @@
 import "../../chunks/chunk-CQ52GEHY.js";
 
 // src/adapter/next/with-alinea.ts
+import { join } from "alinea/core/util/Paths";
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { resolve } from "node:path";
@@ -26,23 +27,13 @@ function withAlinea(config = {}) {
   } catch {
     console.warn("Alinea could not determine Next.js version, assuming 15+");
   }
-  const imagesConfig = config.images ?? {};
-  const remotePatterns = [
-    ...imagesConfig.remotePatterns ?? [],
-    {
-      protocol: "https",
-      hostname: "uploads.alinea.cloud"
-    }
-  ];
-  const images = {
-    ...imagesConfig,
-    remotePatterns
-  };
   const redirects = adminPath ? createRedirects(config, adminPath) : config.redirects;
-  const rewrites = adminPath ? createRewrites(config, adminPath) : config.rewrites;
+  const rewrites = adminPath ? createRewrites(config, adminPath, settings.handlerUrl) : config.rewrites;
+  const images = adminPath ? createImages(config, adminPath) : config.images;
   const env = settings ? {
     ...config.env,
-    ALINEA_ADMIN_PATH: settings.adminPath
+    ALINEA_ADMIN_PATH: settings.adminPath,
+    ALINEA_HANDLER_URL: settings.handlerUrl
   } : config.env;
   if (nextVersion < 15)
     return {
@@ -54,9 +45,9 @@ function withAlinea(config = {}) {
           "@alinea/generated"
         ]
       },
-      images,
       redirects,
       rewrites,
+      images,
       env
     };
   return {
@@ -65,12 +56,32 @@ function withAlinea(config = {}) {
       ...config.serverExternalPackages ?? [],
       "@alinea/generated"
     ],
-    images,
     redirects,
     rewrites,
+    images,
     env
   };
 }
+function createImages(config, adminPath) {
+  const filePattern = `${adminPath}/file/**`;
+  const localPatterns = config.images?.localPatterns;
+  if (!localPatterns)
+    return {
+      ...config.images,
+      localPatterns: [{ pathname: filePattern }, { pathname: "/**" }]
+    };
+  if (localPatterns.some((pattern) => pattern.pathname === filePattern))
+    return config.images;
+  return {
+    ...config.images,
+    localPatterns: [
+      ...localPatterns,
+      {
+        pathname: filePattern
+      }
+    ]
+  };
+}
 function createRedirects(config, adminPath) {
   const dev = process.env.ALINEA_DEV_SERVER;
   if (!dev) return config.redirects;
@@ -91,7 +102,7 @@ var emptyRewrites = {
   afterFiles: [],
   fallback: []
 };
-function createRewrites(config, adminPath) {
+function createRewrites(config, adminPath, handlerUrl) {
   return async () => {
     const devServer = process.env.ALINEA_DEV_SERVER;
     const nodeEnv = process.env.NODE_ENV;
@@ -112,6 +123,10 @@ function createRewrites(config, adminPath) {
         ...rewrites,
         beforeFiles: [
           ...rewrites.beforeFiles,
+          {
+            source: `${adminPath}/file/:file*`,
+            destination: `${devServer}/api?file=:file*&delivery=proxy`
+          },
           {
             source: `${adminPath}/:path*`,
             destination: `${devServer}${adminPath}/:path*`
@@ -121,6 +136,14 @@ function createRewrites(config, adminPath) {
     }
     return {
       ...rewrites,
+      beforeFiles: [
+        ...rewrites.beforeFiles,
+        {
+          source: `${adminPath}/file/:file*`,
+          // Next's internal image optimizer does not follow redirects.
+          destination: `${handlerUrl}?file=:file*&delivery=proxy`
+        }
+      ],
       afterFiles: [
         ...rewrites.afterFiles,
         {
@@ -135,11 +158,12 @@ function resolveSettings(config) {
   const adminPath = config.env?.ALINEA_ADMIN_PATH ?? process.env.ALINEA_ADMIN_PATH;
   if (!adminPath) return;
   return {
-    adminPath: normalizeBasePath(adminPath)
+    adminPath: normalizeBasePath(adminPath),
+    handlerUrl: config.env?.ALINEA_HANDLER_URL ?? process.env.ALINEA_HANDLER_URL ?? "/api/cms"
   };
 }
 function normalizeBasePath(value) {
-  return value.startsWith("/") ? value : `/${value}`;
+  return join("/", value, ".");
 }
 export {
   createCMS,

package/dist/adapter/vite/plugin.js

@@ -3,6 +3,7 @@ import "../../chunks/chunk-CQ52GEHY.js";
 // src/adapter/vite/plugin.ts
 import { nodeHandler } from "alinea/backend/router/NodeHandler";
 import { createDevServer } from "alinea/cli/serve/DevServer";
+import { Config } from "alinea/core/Config";
 function createFallbackUrl(server) {
   const address = server.httpServer?.address();
   const protocol = server.config.server.https ? "https" : "http";
@@ -28,19 +29,23 @@ function waitForServerUrl(server) {
     server.httpServer?.once("listening", resolveUrl);
   });
 }
-function isAlineaRequest(request) {
+function isAlineaRequest(request, adminPath) {
   const url = new URL(request.url);
-  return url.pathname === "/admin" || url.pathname.startsWith("/admin/") || url.pathname === "/api" || url.pathname.startsWith("/api/") || url.pathname === "/~dev" || url.pathname.startsWith("/~dev/") || url.search.startsWith("?/upload");
+  return url.pathname === adminPath || url.pathname.startsWith(`${adminPath}/`) || url.pathname === "/api" || url.pathname.startsWith("/api/") || url.pathname === "/~dev" || url.pathname.startsWith("/~dev/") || url.search.startsWith("?/upload");
 }
 function alineaPlugin(dir) {
   let devServer;
+  let adminPath = "/admin";
   return {
     name: "alinea-plugin",
     configureServer(server) {
       const serverUrl = waitForServerUrl(server);
       const devServerPromise = createDevServer(dir, {
         cmd: "dev",
-        dashboardUrl: serverUrl
+        dashboardUrl: serverUrl,
+        onAfterGenerate(_, config) {
+          adminPath = Config.adminPath(config);
+        }
       }).then((result) => {
         devServer = result;
         return result;
@@ -50,7 +55,7 @@ function alineaPlugin(dir) {
       });
       server.middlewares.use(
         nodeHandler(async (request) => {
-          if (!isAlineaRequest(request)) return void 0;
+          if (!isAlineaRequest(request, adminPath)) return void 0;
           const localServer = await devServerPromise;
           return localServer.handle(request);
         })

package/dist/backend/Handler.js

@@ -17,16 +17,20 @@ import {
   BLOB_SEQUENCE_CONTENT_TYPE,
   encodeBlobSequence
 } from "alinea/core/BlobTransport";
+import { Config } from "alinea/core/Config";
 import { developmentKeyHeader } from "alinea/core/Connection";
 import { ErrorCode, HttpError } from "alinea/core/HttpError";
+import { MediaLocation } from "alinea/core/media/MediaLocation";
 import { assertUploadSize } from "alinea/core/media/UploadLimits";
 import { Permission, Policy } from "alinea/core/Role";
 import { getScope } from "alinea/core/Scope";
 import { ShaMismatchError } from "alinea/core/source/ShaMismatchError";
 import { base64 } from "alinea/core/util/Encoding";
 import { isRecord } from "alinea/core/util/Objects";
+import { isAbsolute, normalize } from "alinea/core/util/Paths";
 import { InvalidCredentialsError, MissingCredentialsError } from "./Auth.js";
 import { HandleAction } from "./HandleAction.js";
+import { isRedirectStatus, proxyMediaUrl } from "./api/ProxyMedia.js";
 import { applyPreview, decodePreviewRequest } from "./resolver/ParsePreview.js";
 import { compressResponse } from "./router/Router.js";
 import { createThrottledSync } from "./util/Syncable.js";
@@ -59,12 +63,89 @@ function createHandler({
       let cnx = remote(context);
       let userCtx;
       if (auth) {
-        return cnx.authenticate(request, {
-          enrichUser(user) {
-            return cnx.enrichUser(user);
+        return await cnx.authenticate(request, {
+          async authenticated(user) {
+            try {
+              return {
+                user: await cnx.enrichUser(user),
+                capabilities: await cnx.capabilities()
+              };
+            } catch (cause) {
+              if (cause instanceof HttpError) throw cause;
+              throw new HttpError(500, "Failed to complete authentication", {
+                cause
+              });
+            }
           }
         });
       }
+      if (!params.has("action") && params.has("file") && (request.method === "GET" || request.method === "HEAD")) {
+        const file = string(params.get("file"));
+        const proxy = params.get("delivery") === "proxy";
+        const normalized = normalize(file);
+        if (isAbsolute(normalized) || normalized === ".." || normalized.startsWith("../"))
+          throw new HttpError(400, "Invalid file path");
+        await periodicSync(cnx);
+        const requestedUrl = Config.filePathname(cms.config, normalized);
+        const entry = local.index.findByUrl(
+          requestedUrl,
+          (entry2) => entry2.type === "MediaFile" && entry2.status === "published" && entry2.main
+        );
+        if (!entry) return new Response("Not found", { status: 404 });
+        if (entry.url !== requestedUrl && !proxy)
+          return new Response(null, {
+            status: 308,
+            headers: { location: entry.url }
+          });
+        const wasBuilt = local.index.initialSync?.has(entry.filePath) ?? false;
+        const previewUrl = entry.data.previewUrl;
+        const location = entry.data.location;
+        if (typeof location !== "string")
+          return new Response("Not found", { status: 404 });
+        const previewSource = typeof previewUrl === "string" && previewUrl ? new URL(previewUrl, request.url).href : void 0;
+        async function proxyMedia(source2, cacheControl, isAllowed) {
+          const previewEntryId = uploadPreviewEntryId(
+            source2,
+            context.handlerUrl
+          );
+          let response;
+          if (previewEntryId && cnx.previewUpload) {
+            response = await cnx.previewUpload(previewEntryId);
+          } else {
+            response = await proxyMediaUrl(
+              request,
+              new URL(source2, request.url),
+              isAllowed
+            );
+          }
+          return mediaResponse(request, response, cacheControl);
+        }
+        if (!wasBuilt && previewSource) {
+          if (proxy) return proxyMedia(previewSource, "private, no-store");
+          return redirectFile(previewSource, "private, no-store");
+        }
+        const source = MediaLocation.sourceUrl(
+          cms.config,
+          entry.workspace,
+          location
+        );
+        if (!source || source === requestedUrl)
+          return new Response("Not found", { status: 404 });
+        if (!proxy) return redirectFile(source, "public, max-age=60");
+        const configuredBase = Config.baseUrl(
+          cms.config,
+          context.isDev ? "development" : "production"
+        );
+        const deliveryBase = configuredBase ?? context.handlerUrl;
+        const sourceUrl = new URL(source, deliveryBase);
+        const deliveryOrigin = new URL(deliveryBase).origin;
+        const handlerPath = context.handlerUrl.pathname;
+        return proxyMedia(
+          sourceUrl.href,
+          "public, max-age=60",
+          (url2) => url2.origin === deliveryOrigin && url2.pathname !== handlerPath && !url2.pathname.startsWith(`${handlerPath}/`)
+        );
+      }
       const action = params.get("action");
       const expectJson = () => {
         const acceptsJson = request.headers.get("accept")?.includes("application/json");
@@ -72,10 +153,7 @@ function createHandler({
       };
       if (action === HandleAction.Capabilities && request.method === "GET") {
         expectJson();
-        const capabilities = cnx.capabilities;
-        return Response.json(
-          capabilities ? await capabilities() : { users: typeof cnx.listUsers === "function" }
-        );
+        return Response.json(await cnx.capabilities());
       }
       if (action === HandleAction.Upload && request.method === "GET") {
         const entryId = url.searchParams.get("entryId");
@@ -340,6 +418,41 @@ function createHandler({
     }
   };
 }
+function redirectFile(location, cacheControl) {
+  return new Response(null, {
+    status: 307,
+    headers: { "cache-control": cacheControl, location }
+  });
+}
+function uploadPreviewEntryId(previewSource, handlerUrl) {
+  const previewUrl = new URL(previewSource);
+  if (previewUrl.origin !== handlerUrl.origin || previewUrl.pathname !== handlerUrl.pathname || previewUrl.searchParams.get("action") !== HandleAction.Upload)
+    return;
+  return previewUrl.searchParams.get("entryId") ?? void 0;
+}
+function mediaResponse(request, upstream, cacheControl) {
+  if (isRedirectStatus(upstream.status))
+    return new Response("Media backend returned a redirect", { status: 502 });
+  const responseHeaders = new Headers({
+    "cache-control": upstream.ok || upstream.status === 304 ? cacheControl : "no-store"
+  });
+  for (const name of [
+    "accept-ranges",
+    "content-disposition",
+    "content-length",
+    "content-range",
+    "content-type",
+    "etag",
+    "last-modified"
+  ]) {
+    const value = upstream.headers.get(name);
+    if (value) responseHeaders.set(name, value);
+  }
+  return new Response(request.method === "HEAD" ? null : upstream.body, {
+    status: upstream.status,
+    headers: responseHeaders
+  });
+}
 function parseUser(input) {
   if (!isRecord(input)) throw new HttpError(400, "Expected user object");
   const { sub, name, email, roles } = input;

package/dist/backend/api/BasicAuth.d.ts

@@ -7,6 +7,6 @@ export interface Verifier {
 export declare class BasicAuth implements AuthApi {
     #private;
     constructor(context: RequestContext, verify: Verifier);
-    authenticate(request: Request, options?: AuthOptions): Promise<Response>;
+    authenticate(request: Request, options: AuthOptions): Promise<Response>;
     verify(request: Request): Promise<AuthedContext>;
 }

package/dist/backend/api/BasicAuth.js

@@ -16,24 +16,24 @@ var BasicAuth = class {
     this.#verify = verify;
   }
   async authenticate(request, options) {
+    let verified;
     try {
-      const verified = await this.verify(request);
-      const url = new URL(request.url);
-      const action = url.searchParams.get("auth");
-      switch (action) {
-        case AuthAction.Status: {
-          const user = options?.enrichUser ? await options.enrichUser(verified.user) : verified.user;
-          return Response.json({
-            type: AuthResultType.Authenticated,
-            user
-          });
-        }
-        default:
-          return new Response("Bad request", { status: 400 });
-      }
+      verified = await this.verify(request);
     } catch {
       return unauthorized();
     }
+    const url = new URL(request.url);
+    const action = url.searchParams.get("auth");
+    switch (action) {
+      case AuthAction.Status: {
+        return Response.json({
+          type: AuthResultType.Authenticated,
+          ...await options.authenticated(verified.user)
+        });
+      }
+      default:
+        return new Response("Bad request", { status: 400 });
+    }
   }
   async verify(request) {
     const ctx = this.#context;

package/dist/backend/api/OAuth2.d.ts

@@ -38,14 +38,14 @@ export interface OAuth2Options {
      */
     revocationEndpoint?: string;
     /**
-     * Extra claims to validate, such as `iss` or `aud`,
+     * Validate provider-specific claims, including `iss` and `aud`.
      * If the claims are invalid, an error should be thrown.
      */
-    validateClaims?(claims: JWTPayload): void;
+    validateClaims(claims: JWTPayload): void | Promise<void>;
 }
 export declare class OAuth2 implements AuthApi {
     #private;
     constructor(context: RequestContext, config: Config, options: OAuth2Options);
-    authenticate(request: Request, options?: AuthOptions): Promise<Response>;
+    authenticate(request: Request, options: AuthOptions): Promise<Response>;
     verify(request: Request): Promise<AuthedContext>;
 }

package/dist/backend/api/OAuth2.js

@@ -469,6 +469,10 @@ var OAuth2 = class {
   #jwks;
   #validateClaims;
   constructor(context, config, options) {
+    assert(
+      typeof options.validateClaims === "function",
+      "OAuth2 validateClaims is required"
+    );
     this.#context = context;
     this.#config = config;
     this.#validateClaims = options.validateClaims;
@@ -514,10 +518,9 @@ var OAuth2 = class {
           const [ctx, err] = await outcome(this.verify(request));
           if (err instanceof Response) return err;
           if (ctx) {
-            const user = options?.enrichUser ? await options.enrichUser(ctx.user) : ctx.user;
             return Response.json({
               type: AuthResultType.Authenticated,
-              user
+              ...await options.authenticated(ctx.user)
             });
           }
           const codeVerifier = await generateCodeVerifier();
@@ -615,7 +618,7 @@ var OAuth2 = class {
         throw new MissingCredentialsError("Missing access token cookie");
       const key = selectKey(jwks, accessToken);
       const user = await verify(accessToken, key);
-      this.#validateClaims?.(user);
+      await this.#validateClaims(user);
       assert(user.exp, "Missing exp claim in access token");
       const expiresSoon = user.exp - Math.floor(Date.now() / 1e3) < 30;
       if (expiresSoon && refreshToken)
@@ -637,7 +640,7 @@ var OAuth2 = class {
           cause: [cause, error]
         });
       });
-      this.#validateClaims?.(user);
+      await this.#validateClaims(user);
       throw Response.json(
         { type: AuthResultType.NeedsRefresh },
         {

package/dist/backend/api/ProxyMedia.d.ts

@@ -0,0 +1,3 @@
+import { type Request, Response } from '@alinea/iso';
+export declare function proxyMediaUrl(request: Request, source: URL, isAllowed?: (url: URL) => boolean): Promise<Response>;
+export declare function isRedirectStatus(status: number): boolean;

package/dist/backend/api/ProxyMedia.js

@@ -0,0 +1,39 @@
+import "../../chunks/chunk-CQ52GEHY.js";
+
+// src/backend/api/ProxyMedia.ts
+import { Headers, Response } from "@alinea/iso";
+async function proxyMediaUrl(request, source, isAllowed = (url) => url.origin === source.origin) {
+  const headers = new Headers();
+  for (const name of [
+    "range",
+    "if-range",
+    "if-none-match",
+    "if-modified-since"
+  ]) {
+    const value = request.headers.get(name);
+    if (value) headers.set(name, value);
+  }
+  let current = source;
+  for (let redirects = 0; ; redirects++) {
+    if (!isAllowed(current))
+      return new Response("Invalid media source", { status: 502 });
+    const response = await fetch(current, {
+      method: request.method,
+      headers,
+      redirect: "manual",
+      signal: request.signal
+    });
+    const location = response.headers.get("location");
+    if (!isRedirectStatus(response.status) || !location) return response;
+    if (redirects === 3)
+      return new Response("Too many media redirects", { status: 502 });
+    current = new URL(location, current);
+  }
+}
+function isRedirectStatus(status) {
+  return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+export {
+  isRedirectStatus,
+  proxyMediaUrl
+};

package/dist/backend/api/S3Uploads.d.ts

@@ -13,7 +13,7 @@ export interface S3UploadsOptions {
     previewExpiresIn?: number;
 }
 interface S3PresignOptions {
-    method: 'GET' | 'PUT';
+    method: 'GET' | 'HEAD' | 'PUT';
     url: URL;
     region: string;
     accessKeyId: string;

package/dist/backend/router/Router.js

@@ -195,6 +195,8 @@ function callHandler(handler, input) {
 function compressResponse(request, response) {
   const body = response.body;
   if (!body) return response;
+  if (response.status === 206 || response.headers.has("content-range"))
+    return response;
   const isCompressed = response.headers.get("content-encoding");
   if (isCompressed) return response;
   const accept = request.headers.get("accept-encoding");

package/dist/backend/util/Syncable.js

@@ -5,7 +5,7 @@ import "../../chunks/chunk-CQ52GEHY.js";
 
 // src/backend/util/Syncable.ts
 function createThrottledSync() {
-  let lastSync = Date.now();
+  let lastSync = 0;
   const limit = pLimit(1);
   return async function throttle(sync, intervalSeconds = 60) {
     return limit(async () => {