astro-tractstack 2.0.0-rc.0

package/templates/src/utils/api/resourceHelpers.ts

@@ -0,0 +1,72 @@
+import type {
+  ResourceConfig,
+  ResourceState,
+  FieldErrors,
+} from '@/types/tractstack';
+
+export function convertToLocalState(backend: ResourceConfig): ResourceState {
+  return {
+    id: backend.id || '',
+    title: backend.title || '',
+    slug: backend.slug || '',
+    categorySlug: backend.categorySlug || '',
+    oneliner: backend.oneliner || '',
+    optionsPayload: backend.optionsPayload || {},
+    actionLisp: backend.actionLisp || undefined,
+  };
+}
+
+export function convertToBackendFormat(local: ResourceState): ResourceConfig {
+  return {
+    id: local.id,
+    title: local.title,
+    slug: local.slug,
+    categorySlug: local.categorySlug,
+    oneliner: local.oneliner,
+    optionsPayload: local.optionsPayload || {},
+    actionLisp: local.actionLisp || undefined,
+  };
+}
+
+export function validateResource(state: ResourceState): FieldErrors {
+  const errors: FieldErrors = {};
+
+  if (!state.title?.trim()) {
+    errors.title = 'Title is required';
+  }
+
+  if (!state.slug?.trim()) {
+    errors.slug = 'Slug is required';
+  } else if (!/^[a-z0-9-]+$/.test(state.slug)) {
+    errors.slug =
+      'Slug must contain only lowercase letters, numbers, and hyphens';
+  }
+
+  if (!state.categorySlug?.trim()) {
+    errors.categorySlug = 'Category is required';
+  }
+
+  return errors;
+}
+
+export function resourceStateIntercept(
+  updatedState: ResourceState,
+  fieldName: string
+): ResourceState {
+  const newState = { ...updatedState };
+
+  if (fieldName === 'title' || fieldName === 'categorySlug') {
+    if (newState.title && newState.categorySlug) {
+      const titleSlug = newState.title
+        .toLowerCase()
+        .replace(/[^a-z0-9\s-]/g, '')
+        .replace(/\s+/g, '-')
+        .replace(/-+/g, '-')
+        .trim();
+
+      newState.slug = `${newState.categorySlug}-${titleSlug}`;
+    }
+  }
+
+  return newState;
+}

package/templates/src/utils/api/tenantConfig.ts

@@ -0,0 +1,97 @@
+// Tenant configuration API utilities following TractStack v2 patterns
+import { TractStackAPI } from '../api';
+import type {
+  TenantProvisioningData,
+  TenantCapacity,
+  TenantProvisioningResponse,
+} from '@/types/multiTenant';
+import type { TenantActivationRequest } from '@/types/multiTenant';
+
+/**
+ * Check tenant capacity and existing tenants
+ */
+export async function checkTenantCapacity(
+  tenantId: string
+): Promise<TenantCapacity> {
+  const api = new TractStackAPI(tenantId);
+  try {
+    const response = await api.get<TenantCapacity>('/api/v1/tenant/capacity');
+
+    if (!response.success || !response.data) {
+      throw new Error(response.error || 'No data received from server');
+    }
+
+    const data = response.data;
+
+    // Validate response structure to match backend
+    if (
+      typeof data.available !== 'boolean' ||
+      typeof data.currentTenants !== 'number' ||
+      typeof data.maxTenants !== 'number' ||
+      typeof data.availableSlots !== 'number'
+    ) {
+      throw new Error('Invalid response format from server');
+    }
+
+    return data;
+  } catch (error) {
+    console.error('Failed to fetch tenant capacity:', error);
+    throw new Error('Failed to load tenant capacity information');
+  }
+}
+
+/**
+ * Provision a new tenant with reserved status
+ */
+export async function provisionTenant(
+  tenantId: string,
+  data: TenantProvisioningData
+): Promise<TenantProvisioningResponse> {
+  const api = new TractStackAPI(tenantId);
+  try {
+    const response = await api.post<TenantProvisioningResponse>(
+      '/api/v1/tenant/provision',
+      data
+    );
+
+    if (!response.success || !response.data) {
+      throw new Error(response.error || 'Failed to provision tenant');
+    }
+
+    return response.data;
+  } catch (error) {
+    console.error('Failed to provision tenant:', error);
+
+    if (error instanceof Error) {
+      throw error;
+    }
+
+    throw new Error('Failed to provision tenant');
+  }
+}
+
+/**
+ * Activate a tenant using the activation token
+ */
+export async function activateTenant(
+  tenantId: string,
+  token: string
+): Promise<void> {
+  const api = new TractStackAPI(tenantId);
+  try {
+    const request: TenantActivationRequest = { token };
+    const response = await api.post('/api/v1/activate-tenant', request);
+
+    if (!response.success) {
+      throw new Error(response.error || 'Failed to activate tenant');
+    }
+  } catch (error) {
+    console.error('Failed to activate tenant:', error);
+
+    if (error instanceof Error) {
+      throw error;
+    }
+
+    throw new Error('Failed to activate tenant');
+  }
+}

package/templates/src/utils/api/tenantHelpers.ts

@@ -0,0 +1,172 @@
+// Tenant form validation and state helpers following TractStack v2 patterns
+import type { TenantProvisioningData } from '@/types/multiTenant';
+import type {
+  TenantRegistrationState,
+  TenantValidationErrors,
+} from '@/types/multiTenant';
+
+/**
+ * Convert tenant provisioning data to local form state
+ */
+export function convertToLocalState(
+  data?: TenantProvisioningData
+): TenantRegistrationState {
+  if (!data) {
+    return {
+      tenantId: '',
+      adminPassword: '',
+      confirmPassword: '',
+      name: '',
+      email: '',
+      tursoEnabled: false,
+      tursoDatabaseURL: '',
+      tursoAuthToken: '',
+    };
+  }
+
+  return {
+    tenantId: data.tenantId,
+    adminPassword: data.adminPassword,
+    confirmPassword: '',
+    name: data.name,
+    email: data.adminEmail,
+    tursoEnabled: data.tursoEnabled,
+    tursoDatabaseURL: data.tursoDatabaseURL || '',
+    tursoAuthToken: data.tursoAuthToken || '',
+  };
+}
+
+/**
+ * Convert local form state to backend format
+ */
+export function convertToBackendFormat(
+  state: TenantRegistrationState
+): TenantProvisioningData {
+  const data: TenantProvisioningData = {
+    tenantId: state.tenantId.trim(),
+    adminPassword: state.adminPassword.trim(),
+    name: state.name.trim(),
+    adminEmail: state.email.trim(),
+    tursoEnabled: state.tursoEnabled,
+  };
+
+  // Only include Turso credentials if enabled
+  if (state.tursoEnabled) {
+    data.tursoDatabaseURL = state.tursoDatabaseURL.trim();
+    data.tursoAuthToken = state.tursoAuthToken.trim();
+  }
+
+  return data;
+}
+
+/**
+ * Validate tenant registration form
+ */
+export function validateTenantRegistration(
+  state: TenantRegistrationState,
+  existingTenants?: string[],
+  isInitMode?: boolean
+): TenantValidationErrors {
+  const errors: TenantValidationErrors = {};
+
+  // Skip ALL tenant ID validation in init mode
+  if (!isInitMode) {
+    const tenantId = state.tenantId.trim();
+    if (!tenantId) {
+      errors.tenantId = 'Tenant ID is required';
+    } else if (tenantId.length < 3 || tenantId.length > 12) {
+      errors.tenantId = 'Tenant ID must be 3-12 characters long';
+    } else if (tenantId !== tenantId.toLowerCase()) {
+      errors.tenantId = 'Tenant ID must be lowercase';
+    } else if (!/^[a-z0-9-]+$/.test(tenantId)) {
+      errors.tenantId =
+        'Tenant ID can only contain lowercase letters, numbers, and dashes';
+    } else if (tenantId === 'default') {
+      errors.tenantId = "'default' is a reserved tenant ID";
+    } else if (existingTenants && existingTenants.includes(tenantId)) {
+      errors.tenantId = 'This tenant ID is already taken';
+    }
+  }
+
+  // Admin password validation
+  if (!state.adminPassword.trim()) {
+    errors.adminPassword = 'Admin password is required';
+  } else if (state.adminPassword.length < 8) {
+    errors.adminPassword = 'Admin password must be at least 8 characters long';
+  }
+
+  // Password confirmation validation - only if main password is valid
+  if (!errors.adminPassword && state.adminPassword !== state.confirmPassword) {
+    errors.confirmPassword = 'Passwords do not match';
+  }
+
+  // Name validation
+  if (!state.name.trim()) {
+    errors.name = 'Name is required';
+  }
+
+  // Email validation
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  if (!state.email.trim()) {
+    errors.email = 'Email is required';
+  } else if (!emailRegex.test(state.email.trim())) {
+    errors.email = 'Please enter a valid email address';
+  }
+
+  // Turso validation (if enabled)
+  if (state.tursoEnabled) {
+    if (!state.tursoDatabaseURL.trim()) {
+      errors.tursoDatabaseURL =
+        'Turso Database URL is required when Turso is enabled';
+    } else if (!state.tursoDatabaseURL.startsWith('libsql://')) {
+      errors.tursoDatabaseURL =
+        'Turso Database URL must start with "libsql://"';
+    }
+
+    if (!state.tursoAuthToken.trim()) {
+      errors.tursoAuthToken =
+        'Turso Auth Token is required when Turso is enabled';
+    }
+  }
+
+  return errors;
+}
+
+/**
+ * State interceptor for cross-field logic
+ */
+export function tenantStateIntercept(
+  newState: TenantRegistrationState,
+  field: keyof TenantRegistrationState,
+  value: any
+): TenantRegistrationState {
+  // Clear Turso fields when disabled
+  if (field === 'tursoEnabled' && !value) {
+    return {
+      ...newState,
+      tursoEnabled: false,
+      tursoDatabaseURL: '',
+      tursoAuthToken: '',
+    };
+  }
+
+  // Clear confirmation password when main password changes
+  if (field === 'adminPassword') {
+    return {
+      ...newState,
+      adminPassword: value,
+      confirmPassword: '', // Clear confirmation to force re-entry
+    };
+  }
+
+  // Normalize tenant ID
+  if (field === 'tenantId' && typeof value === 'string') {
+    return {
+      ...newState,
+      tenantId: value.toLowerCase().replace(/[^a-z0-9-]/g, ''),
+    };
+  }
+
+  // Default behavior
+  return newState;
+}

package/templates/src/utils/api.ts

@@ -0,0 +1,183 @@
+export interface APIResponse<T = any> {
+  success: boolean;
+  data?: T;
+  error?: string;
+  message?: string;
+}
+
+export interface TractStackEvent {
+  type: 'page_view' | 'click' | 'form_submit' | 'custom';
+  target?: string;
+  data?: Record<string, any>;
+  timestamp?: number;
+  sessionId?: string;
+  userId?: string;
+}
+
+function getConfig() {
+  // Server-side safety check
+  if (typeof window === 'undefined') {
+    return {
+      goBackend: import.meta.env.PUBLIC_GO_BACKEND || 'http://localhost:8080',
+      tenantId: import.meta.env.PUBLIC_TENANTID || 'default',
+    };
+  }
+
+  return {
+    goBackend: import.meta.env.PUBLIC_GO_BACKEND || 'http://localhost:8080',
+    tenantId:
+      window.TRACTSTACK_CONFIG?.tenantId ||
+      import.meta.env.PUBLIC_TENANTID ||
+      'default',
+  };
+}
+
+//function getTenantFromDomain(): string {
+//  if (typeof window === 'undefined') return 'default';
+//
+//  const hostname = window.location.hostname;
+//
+//  //if (hostname === 'localhost' || hostname === '127.0.0.1') {
+//  //  return 'default';
+//  //}
+//
+//  const parts = hostname.split('.');
+//  if (
+//    parts.length >= 4 &&
+//    parts[1] === 'sandbox' &&
+//    ['tractstack', 'freewebpress'].includes(parts[2]) &&
+//    parts[3] === 'com'
+//  ) {
+//    return parts[0];
+//  }
+//
+//  return 'default';
+//}
+
+export class TractStackAPI {
+  private baseUrl: string;
+  private tenantId: string;
+
+  constructor(tenantId?: string) {
+    const config = getConfig();
+    this.baseUrl = config.goBackend;
+    this.tenantId = tenantId || config.tenantId;
+  }
+
+  async request<T = any>(
+    endpoint: string,
+    options: RequestInit = {}
+  ): Promise<APIResponse<T>> {
+    const url = `${this.baseUrl}${endpoint.startsWith('/') ? endpoint : `/${endpoint}`}`;
+
+    const defaultHeaders = {
+      'Content-Type': 'application/json',
+      'X-Tenant-ID': this.tenantId,
+    };
+
+    try {
+      const response = await fetch(url, {
+        ...options,
+        credentials: 'include',
+        headers: {
+          ...defaultHeaders,
+          ...options.headers,
+        },
+      });
+
+      const data = await response.json();
+
+      if (!response.ok) {
+        return {
+          success: false,
+          error: data.error || `HTTP ${response.status}`,
+          data: data.data,
+        };
+      }
+
+      return {
+        success: true,
+        data: data.data || data,
+        message: data.message,
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: error instanceof Error ? error.message : 'Network error',
+      };
+    }
+  }
+
+  async get<T = any>(endpoint: string): Promise<APIResponse<T>> {
+    return this.request<T>(endpoint, { method: 'GET' });
+  }
+
+  async post<T = any>(endpoint: string, data?: any): Promise<APIResponse<T>> {
+    return this.request<T>(endpoint, {
+      method: 'POST',
+      body: data ? JSON.stringify(data) : undefined,
+    });
+  }
+
+  async put<T = any>(endpoint: string, data?: any): Promise<APIResponse<T>> {
+    return this.request<T>(endpoint, {
+      method: 'PUT',
+      body: data ? JSON.stringify(data) : undefined,
+    });
+  }
+
+  async trackEvent(event: TractStackEvent): Promise<APIResponse> {
+    return this.post('/api/v1/events', {
+      ...event,
+      timestamp: event.timestamp || Date.now(),
+    });
+  }
+
+  async getContent(slug: string): Promise<APIResponse> {
+    return this.get(`/api/v1/content/${slug}`);
+  }
+
+  async getFragment(fragmentId: string): Promise<APIResponse> {
+    return this.get(`/api/v1/fragments/${fragmentId}`);
+  }
+
+  getTenantId(): string {
+    return this.tenantId;
+  }
+
+  setTenantId(tenantId: string): void {
+    this.tenantId = tenantId;
+  }
+
+  async getContentMapWithTimestamp(
+    lastUpdated?: number
+  ): Promise<APIResponse<{ data: any[]; lastUpdated: number }>> {
+    let endpoint = 'api/v1/content/full-map';
+    if (lastUpdated) {
+      endpoint += `?lastUpdated=${lastUpdated}`;
+    }
+
+    // Use the raw request method to get the full response
+    const response = await this.request(endpoint);
+
+    // For this endpoint, the backend returns {data: [...], lastUpdated: 123} directly
+    // So response.data IS the {data: [...], lastUpdated: 123} object
+    return response as APIResponse<{ data: any[]; lastUpdated: number }>;
+  }
+}
+
+export function handleAPIResponse<T>(
+  response: APIResponse<T>,
+  onSuccess?: (data: T) => void,
+  onError?: (error: string) => void
+): boolean {
+  if (response.success && response.data) {
+    onSuccess?.(response.data);
+    return true;
+  } else {
+    const error = response.error || 'Unknown error occurred';
+    onError?.(error);
+    console.error('TractStack API Error:', error);
+    return false;
+  }
+}

package/templates/src/utils/auth.ts

@@ -0,0 +1,150 @@
+/**
+ * Admin/Editor Authentication Utilities
+ * Uses role-specific cookies for secure admin authentication
+ */
+
+export interface AdminAuthClaims {
+  role: 'admin' | 'editor';
+  tenantId: string;
+  type: 'admin_auth';
+  iat: number;
+  exp: number;
+}
+
+/**
+ * Check if user is authenticated (either admin or editor)
+ */
+export function isAuthenticated(astro: any): boolean {
+  const adminCookie = astro.cookies.get('admin_auth');
+  const editorCookie = astro.cookies.get('editor_auth');
+
+  if (adminCookie?.value) {
+    const claims = validateAdminToken(adminCookie.value);
+    if (claims && claims.role === 'admin') return true;
+  }
+
+  if (editorCookie?.value) {
+    const claims = validateAdminToken(editorCookie.value);
+    if (claims && claims.role === 'editor') return true;
+  }
+
+  return false;
+}
+
+/**
+ * Check if user has admin role
+ */
+export function isAdmin(astro: any): boolean {
+  const adminCookie = astro.cookies.get('admin_auth');
+  if (!adminCookie?.value) return false;
+
+  const claims = validateAdminToken(adminCookie.value);
+  return claims?.role === 'admin';
+}
+
+/**
+ * Check if user has editor role
+ */
+export function isEditor(astro: any): boolean {
+  const editorCookie = astro.cookies.get('editor_auth');
+  if (!editorCookie?.value) return false;
+
+  const claims = validateAdminToken(editorCookie.value);
+  return claims?.role === 'editor';
+}
+
+/**
+ * Get user role (admin, editor, or null)
+ */
+export function getUserRole(astro: any): 'admin' | 'editor' | null {
+  const adminCookie = astro.cookies.get('admin_auth');
+  if (adminCookie?.value) {
+    const claims = validateAdminToken(adminCookie.value);
+    if (claims?.role === 'admin') return 'admin';
+  }
+
+  const editorCookie = astro.cookies.get('editor_auth');
+  if (editorCookie?.value) {
+    const claims = validateAdminToken(editorCookie.value);
+    if (claims?.role === 'editor') return 'editor';
+  }
+
+  return null;
+}
+
+/**
+ * Page-level protection: Require admin role
+ * Returns redirect response if unauthorized, undefined if authorized
+ */
+export function requireAdmin(astro: any): Response | undefined {
+  if (!isAdmin(astro)) {
+    return astro.redirect('/storykeep/login');
+  }
+}
+
+/**
+ * Page-level protection: Require editor role
+ * Returns redirect response if unauthorized, undefined if authorized
+ */
+export function requireEditor(astro: any): Response | undefined {
+  if (!isEditor(astro)) {
+    return astro.redirect('/storykeep/login');
+  }
+}
+
+/**
+ * Page-level protection: Require admin OR editor role
+ * Returns redirect response if unauthorized, undefined if authorized
+ */
+export function requireAdminOrEditor(astro: any): Response | undefined {
+  if (!isAuthenticated(astro)) {
+    return astro.redirect('/storykeep/login');
+  }
+}
+
+/**
+ * Get admin token for API requests
+ * Returns the JWT token from the appropriate cookie
+ */
+export function getAdminToken(astro: any): string | null {
+  const adminCookie = astro.cookies.get('admin_auth');
+  if (adminCookie?.value) {
+    const claims = validateAdminToken(adminCookie.value);
+    if (claims?.role === 'admin') return adminCookie.value;
+  }
+
+  const editorCookie = astro.cookies.get('editor_auth');
+  if (editorCookie?.value) {
+    const claims = validateAdminToken(editorCookie.value);
+    if (claims?.role === 'editor') return editorCookie.value;
+  }
+
+  return null;
+}
+
+/**
+ * Validate JWT token and extract claims
+ * Note: This is a simplified client-side validation
+ * Real validation happens on the backend
+ */
+function validateAdminToken(token: string): AdminAuthClaims | null {
+  try {
+    // Split JWT token
+    const parts = token.split('.');
+    if (parts.length !== 3) return null;
+
+    // Decode payload (base64url)
+    const payload = parts[1];
+    const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
+    const claims = JSON.parse(decoded) as AdminAuthClaims;
+
+    // Basic validation
+    if (claims.type !== 'admin_auth') return null;
+    if (!claims.role || !['admin', 'editor'].includes(claims.role)) return null;
+    if (Date.now() / 1000 > claims.exp) return null; // Token expired
+
+    return claims;
+  } catch {
+    return null;
+  }
+}