canopycms 0.0.0 → 0.0.1

package/src/content-reader.test.ts

@@ -1,478 +0,0 @@
-import fs from 'node:fs/promises'
-import os from 'node:os'
-import path from 'node:path'
-
-import { describe, expect, it, vi } from 'vitest'
-import { simpleGit } from 'simple-git'
-
-import { createContentReader } from './content-reader'
-import { createTestServices } from './config-test'
-import { defineCanopyTestConfig } from './config-test'
-import { ANONYMOUS_USER } from './user'
-import type { BranchContext } from './types'
-import { ContentStoreError } from './content-store'
-import { unsafeAsLogicalPath, unsafeAsEntrySlug } from './paths/test-utils'
-
-const tmpDir = async () => fs.mkdtemp(path.join(os.tmpdir(), 'canopycms-content-reader-'))
-
-const buildBranchContext = (branchRoot: string, name = 'main'): BranchContext => {
-  const now = new Date().toISOString()
-  return {
-    baseRoot: branchRoot,
-    branchRoot,
-    branch: {
-      name,
-      status: 'editing',
-      access: {},
-      createdBy: 'tester',
-      createdAt: now,
-      updatedAt: now,
-    },
-  }
-}
-
-describe('createContentReader', () => {
-  it('reads content for a provided branch state and returns null when missing', async () => {
-    const root = await tmpDir()
-    const pagesDir = path.join(root, 'content/pages')
-    const postsDir = path.join(root, 'content/posts')
-    await fs.mkdir(pagesDir, { recursive: true })
-    await fs.mkdir(postsDir, { recursive: true })
-    await fs.writeFile(
-      path.join(pagesDir, 'home.json'),
-      JSON.stringify({ hero: { title: 'Hi' } }, null, 2),
-      'utf8',
-    )
-
-    const schema = {
-      collections: [
-        {
-          name: 'posts',
-          path: 'posts',
-          entries: [
-            {
-              name: 'post',
-              format: 'json' as const,
-              schema: [{ name: 'title', type: 'string' as const }],
-            },
-          ],
-        },
-        {
-          name: 'pages',
-          path: 'pages',
-          entries: [
-            {
-              name: 'page',
-              format: 'json' as const,
-              schema: [
-                {
-                  name: 'hero',
-                  type: 'object' as const,
-                  fields: [{ name: 'title', type: 'string' as const }],
-                },
-              ],
-            },
-          ],
-        },
-      ],
-    }
-    const config = defineCanopyTestConfig({
-      defaultBranchAccess: 'allow',
-      defaultPathAccess: 'allow',
-      schema,
-    })
-    const branchContext = buildBranchContext(root)
-    const reader = createContentReader({
-      services: await createTestServices({ ...config, schema }),
-      allowCreateBranch: false,
-      getBranchContext: async (branch) => (branch === 'main' ? branchContext : null),
-    })
-
-    const home = await reader.read<{ hero: { title: string } }>({
-      entryPath: unsafeAsLogicalPath('content/pages'),
-      slug: unsafeAsEntrySlug('home'),
-      branch: 'main',
-      user: ANONYMOUS_USER,
-    })
-    expect(home.path).toBe('/pages/home?branch=main')
-    expect(home.data.hero.title).toBe('Hi')
-
-    await expect(
-      reader.read({
-        entryPath: unsafeAsLogicalPath('content/posts'),
-        slug: unsafeAsEntrySlug('missing'),
-        user: ANONYMOUS_USER,
-      }),
-    ).rejects.toBeInstanceOf(ContentStoreError)
-  })
-
-  it('readDataOrThrow returns data and throws on missing content', async () => {
-    const root = await tmpDir()
-    const pagesDir = path.join(root, 'content/pages')
-    await fs.mkdir(pagesDir, { recursive: true })
-    await fs.writeFile(
-      path.join(pagesDir, 'home.json'),
-      JSON.stringify({ hero: { title: 'Hello' } }, null, 2),
-      'utf8',
-    )
-
-    const schema = {
-      collections: [
-        {
-          name: 'posts',
-          path: 'posts',
-          entries: [
-            {
-              name: 'post',
-              format: 'json' as const,
-              schema: [{ name: 'title', type: 'string' as const }],
-            },
-          ],
-        },
-        {
-          name: 'pages',
-          path: 'pages',
-          entries: [
-            {
-              name: 'page',
-              format: 'json' as const,
-              schema: [
-                {
-                  name: 'hero',
-                  type: 'object' as const,
-                  fields: [{ name: 'title', type: 'string' as const }],
-                },
-              ],
-            },
-          ],
-        },
-      ],
-    }
-    const config = defineCanopyTestConfig({
-      defaultBranchAccess: 'allow',
-      defaultPathAccess: 'allow',
-      schema,
-    })
-    const branchContext = buildBranchContext(root)
-    const reader = createContentReader({
-      services: await createTestServices({ ...config, schema }),
-      allowCreateBranch: false,
-      getBranchContext: async () => branchContext,
-    })
-
-    const { data } = await reader.read<{ hero: { title: string } }>({
-      entryPath: unsafeAsLogicalPath('content/pages'),
-      slug: unsafeAsEntrySlug('home'),
-      user: ANONYMOUS_USER,
-    })
-    expect(data.hero.title).toBe('Hello')
-
-    await expect(
-      reader.read({
-        entryPath: unsafeAsLogicalPath('content/posts'),
-        slug: unsafeAsEntrySlug('missing'),
-        user: ANONYMOUS_USER,
-      }),
-    ).rejects.toBeInstanceOf(ContentStoreError)
-  })
-
-  it('enforces branch access checks', async () => {
-    const root = await tmpDir()
-    const pagesDir = path.join(root, 'content/pages')
-    await fs.mkdir(pagesDir, { recursive: true })
-    const schema = {
-      collections: [
-        {
-          name: 'pages',
-          path: 'pages',
-          entries: [
-            {
-              name: 'page',
-              format: 'json' as const,
-              schema: [{ name: 'title', type: 'string' as const }],
-            },
-          ],
-        },
-      ],
-    }
-    const config = defineCanopyTestConfig({
-      defaultBranchAccess: 'deny',
-      schema,
-    })
-    const branchContext = buildBranchContext(root)
-    const reader = createContentReader({
-      services: await createTestServices({ ...config, schema }),
-      allowCreateBranch: false,
-      getBranchContext: async () => branchContext,
-    })
-
-    await expect(
-      reader.read({
-        entryPath: unsafeAsLogicalPath('content/pages'),
-        slug: unsafeAsEntrySlug('home'),
-        user: { type: 'authenticated', userId: 'anon', groups: [] },
-      }),
-    ).rejects.toBeInstanceOf(ContentStoreError)
-  })
-
-  it('builds preview paths alongside data', async () => {
-    const root = await tmpDir()
-    const postsDir = path.join(root, 'content/posts')
-    const pagesDir = path.join(root, 'content/pages')
-    await fs.mkdir(postsDir, { recursive: true })
-    await fs.mkdir(pagesDir, { recursive: true })
-    // Create files with embedded IDs: {type}.{slug}.{id}.{ext}
-    // IDs must be valid Base58 (12 chars, excludes 0, O, I, l)
-    await fs.writeFile(
-      path.join(postsDir, 'post.first.abc123def456.json'),
-      JSON.stringify({ title: 'Hello world' }, null, 2),
-      'utf8',
-    )
-    await fs.writeFile(
-      path.join(pagesDir, 'page.home.xyz789uvwABC.json'),
-      JSON.stringify({ title: 'Home' }, null, 2),
-      'utf8',
-    )
-
-    const schema = {
-      collections: [
-        {
-          name: 'posts',
-          path: 'posts',
-          entries: [
-            {
-              name: 'post',
-              format: 'json' as const,
-              schema: [{ name: 'title', type: 'string' as const }],
-            },
-          ],
-        },
-        {
-          name: 'pages',
-          path: 'pages',
-          entries: [
-            {
-              name: 'page',
-              format: 'json' as const,
-              schema: [{ name: 'title', type: 'string' as const }],
-            },
-          ],
-        },
-      ],
-    }
-    const config = defineCanopyTestConfig({
-      defaultBranchAccess: 'allow',
-      defaultPathAccess: 'allow',
-      schema,
-    })
-    const branchContext = buildBranchContext(root)
-    const reader = createContentReader({
-      services: await createTestServices({ ...config, schema }),
-      allowCreateBranch: false,
-      getBranchContext: async () => branchContext,
-    })
-
-    const post = await reader.read<{ title: string }>({
-      entryPath: unsafeAsLogicalPath('content/posts'),
-      slug: unsafeAsEntrySlug('first'),
-      user: ANONYMOUS_USER,
-    })
-    expect(post.data.title).toBe('Hello world')
-    expect(post.path).toBe('/posts/first?branch=main')
-
-    const page = await reader.read<{ title: string }>({
-      entryPath: unsafeAsLogicalPath('content/pages'),
-      slug: unsafeAsEntrySlug('home'),
-      branch: 'feature/foo',
-      user: ANONYMOUS_USER,
-    })
-    expect(page.path).toBe('/pages/home?branch=feature%2Ffoo')
-  })
-
-  it('creates the branch workspace when missing', async () => {
-    const root = await tmpDir()
-    // Mock process.cwd() to isolate test from parent git repo
-    const cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(root)
-
-    const git = simpleGit({ baseDir: root })
-    await git.init()
-    await git.raw(['branch', '-M', 'main'])
-    await fs.mkdir(path.join(root, 'content/pages'), { recursive: true })
-    await fs.writeFile(
-      path.join(root, 'content/pages/home.json'),
-      JSON.stringify({ hero: { title: 'Welcome' } }, null, 2),
-      'utf8',
-    )
-    await git.add(['.'])
-    await git.commit('init')
-
-    const schema = {
-      collections: [
-        {
-          name: 'pages',
-          path: 'pages',
-          entries: [
-            {
-              name: 'page',
-              format: 'json' as const,
-              schema: [
-                {
-                  name: 'hero',
-                  type: 'object' as const,
-                  fields: [{ name: 'title', type: 'string' as const }],
-                },
-              ],
-            },
-          ],
-        },
-      ],
-    }
-    const config = defineCanopyTestConfig({
-      defaultBranchAccess: 'allow',
-      defaultPathAccess: 'allow',
-      mode: 'prod-sim',
-      schema,
-    })
-
-    try {
-      const reader = createContentReader({
-        services: await createTestServices({ ...config, schema }),
-        basePathOverride: root,
-      })
-      const doc = await reader.read<{ hero: { title: string } }>({
-        entryPath: unsafeAsLogicalPath('content/pages'),
-        slug: unsafeAsEntrySlug('home'),
-        user: ANONYMOUS_USER,
-      })
-      expect(doc.path).toBe('/pages/home?branch=main')
-      expect(doc.data.hero.title).toBe('Welcome')
-
-      // In prod-sim, workspace is at .canopy-prod-sim/content-branches/main
-      const metaPath = path.join(
-        root,
-        '.canopy-prod-sim/content-branches/main/.canopy-meta/branch.json',
-      )
-      const metaRaw = await fs.readFile(metaPath, 'utf8')
-      const meta = JSON.parse(metaRaw)
-      expect(meta.branch.name).toBe('main')
-      expect(meta.branch.createdBy).toBe('canopycms-content-reader')
-    } finally {
-      cwdSpy.mockRestore()
-    }
-  })
-
-  it('merges body into data for md format entries', async () => {
-    const root = await tmpDir()
-    const postsDir = path.join(root, 'content/posts')
-    await fs.mkdir(postsDir, { recursive: true })
-    // Write a markdown file with frontmatter + body (gray-matter format)
-    await fs.writeFile(
-      path.join(postsDir, 'post.hello.abc123def456.md'),
-      '---\ntitle: Hello World\ntags:\n  - typed\n---\nSome **markdown** content.\n',
-      'utf8',
-    )
-
-    const schema = {
-      collections: [
-        {
-          name: 'posts',
-          path: 'posts',
-          entries: [
-            {
-              name: 'post',
-              format: 'md' as const,
-              schema: [
-                { name: 'title', type: 'string' as const },
-                { name: 'tags', type: 'string' as const, list: true },
-              ],
-            },
-          ],
-        },
-      ],
-    }
-    const config = defineCanopyTestConfig({
-      defaultBranchAccess: 'allow',
-      defaultPathAccess: 'allow',
-      schema,
-    })
-    const branchContext = buildBranchContext(root)
-    const reader = createContentReader({
-      services: await createTestServices({ ...config, schema }),
-      allowCreateBranch: false,
-      getBranchContext: async () => branchContext,
-    })
-
-    const result = await reader.read<{
-      title: string
-      tags: string[]
-      body: string
-    }>({
-      entryPath: unsafeAsLogicalPath('content/posts'),
-      slug: unsafeAsEntrySlug('hello'),
-      user: ANONYMOUS_USER,
-    })
-
-    expect(result.data.title).toBe('Hello World')
-    expect(result.data.tags).toEqual(['typed'])
-    expect(result.data.body).toContain('Some **markdown** content.')
-  })
-
-  it('checks permissions BEFORE reading file (security)', async () => {
-    const root = await tmpDir()
-    const pagesDir = path.join(root, 'content/pages')
-    await fs.mkdir(pagesDir, { recursive: true })
-    await fs.writeFile(
-      path.join(pagesDir, 'home.json'),
-      JSON.stringify({ title: 'Secret' }, null, 2),
-      'utf8',
-    )
-
-    const schema = {
-      collections: [
-        {
-          name: 'pages',
-          path: 'pages',
-          entries: [
-            {
-              name: 'page',
-              format: 'json' as const,
-              schema: [{ name: 'title', type: 'string' as const }],
-            },
-          ],
-        },
-      ],
-    }
-    const config = defineCanopyTestConfig({
-      defaultBranchAccess: 'allow',
-      defaultPathAccess: 'deny', // Deny by default
-      schema,
-    })
-
-    const branchContext = buildBranchContext(root)
-    const reader = createContentReader({
-      services: await createTestServices({ ...config, schema }),
-      allowCreateBranch: false,
-      getBranchContext: async () => branchContext,
-    })
-
-    // Spy on fs.readFile to verify content file is NOT read when permission is denied
-    const readFileSpy = vi.spyOn(fs, 'readFile')
-
-    // Attempt unauthorized read
-    await expect(
-      reader.read({
-        entryPath: unsafeAsLogicalPath('content/pages'),
-        slug: unsafeAsEntrySlug('home'),
-        user: { type: 'authenticated', userId: 'unauthorized', groups: [] },
-      }),
-    ).rejects.toThrow(/Forbidden/)
-
-    // CRITICAL: Content file should NOT have been accessed (permissions.json is OK)
-    const contentFileCalls = readFileSpy.mock.calls.filter((call) =>
-      call[0].toString().includes('content/pages/home.json'),
-    )
-    expect(contentFileCalls).toHaveLength(0)
-
-    readFileSpy.mockRestore()
-  })
-})

package/src/content-reader.ts

@@ -1,214 +0,0 @@
-import { BranchWorkspaceManager, loadBranchContext } from './branch-workspace'
-import { ContentStore, ContentStoreError } from './content-store'
-import { resolveBranchPaths, type LogicalPath, type PhysicalPath, type EntrySlug } from './paths'
-import { type OperatingMode } from './operating-mode'
-import type { CanopyServices } from './services'
-import type { BranchContext } from './types'
-import type { CanopyUser } from './user'
-import { isBuildMode } from './build-mode'
-import { isNotFoundError } from './utils/error'
-
-export interface ContentReaderOptions {
-  services: CanopyServices
-  workspaceManager?: BranchWorkspaceManager
-  basePathOverride?: string
-  defaultBranch?: string
-  createdBy?: string
-  allowCreateBranch?: boolean
-  getBranchContext?: (branch: string) => Promise<BranchContext | null>
-}
-
-export interface ReadContentInput {
-  /** Resolved schema path (e.g., content/posts or content/home). */
-  entryPath: LogicalPath
-  slug?: EntrySlug
-  branch?: string
-  /** User making the request. Required - use ANONYMOUS_USER for public access. */
-  user: CanopyUser
-  /** Whether to automatically resolve reference fields. Defaults to true. */
-  resolveReferences?: boolean
-}
-
-export interface ContentReader {
-  read: <T = unknown>(
-    input: ReadContentInput,
-    message?: string,
-  ) => Promise<{ data: T; path: string }>
-}
-
-/**
- * Server-side helper to read content directly from a branch workspace.
- * Falls back to creating the branch workspace (metadata + checkout) if missing.
- */
-export const createContentReader = (options: ContentReaderOptions): ContentReader => {
-  const services = options.services
-  const operatingMode: OperatingMode = services.config.mode
-  const basePathOverride = options.basePathOverride
-  const workspaceManager = options.workspaceManager ?? new BranchWorkspaceManager(services.config)
-  const defaultBranch = options.defaultBranch ?? services.config.defaultBaseBranch ?? 'main'
-  const allowCreateBranch = options.allowCreateBranch ?? true
-  const createdBy = options.createdBy ?? 'canopycms-content-reader'
-
-  const resolveBranchContext = async (branchName: string): Promise<BranchContext> => {
-    const existing = options.getBranchContext
-      ? await options.getBranchContext(branchName)
-      : await loadBranchContext({
-          branchName,
-          mode: operatingMode,
-          basePathOverride,
-        })
-    if (existing) {
-      return existing
-    }
-    if (!allowCreateBranch) {
-      throw new ContentStoreError(`Branch not found: ${branchName}`)
-    }
-    return await workspaceManager.openOrCreateBranch({
-      branchName,
-      mode: operatingMode,
-      basePathOverride,
-      createdBy,
-      remoteUrl: services.config.defaultRemoteUrl,
-    })
-  }
-
-  const resolveStore = async (branchName: string) => {
-    const context = await resolveBranchContext(branchName)
-    const { branchRoot } = resolveBranchPaths(context, operatingMode, basePathOverride)
-
-    // Load per-branch schema dynamically
-    const branchSchemaCache = services.branchSchemaCache
-    const contentRootName = services.config.contentRoot || 'content'
-    const { flatSchema: branchFlatSchema } = await branchSchemaCache.getSchema(
-      branchRoot,
-      services.entrySchemaRegistry,
-      contentRootName,
-    )
-
-    return {
-      context,
-      branchRoot,
-      store: new ContentStore(branchRoot, branchFlatSchema),
-    }
-  }
-
-  const resolveTarget = (input: ReadContentInput) => {
-    const entryPath = input.entryPath
-    if (!entryPath) {
-      throw new ContentStoreError('entryPath is required')
-    }
-    const branchName = input.branch ?? defaultBranch
-    return { entryPath, slug: input.slug, branchName, user: input.user }
-  }
-
-  const encodeSlug = (value?: string): string =>
-    (value ?? '')
-      .split('/')
-      .filter(Boolean)
-      .map((segment) => encodeURIComponent(segment))
-      .join('/')
-
-  // Build preview paths using simple path construction
-  const contentRoot = (services.config.contentRoot ?? 'content').replace(/^\/+|\/+$/g, '')
-  const stripRoot = (val: string) =>
-    contentRoot && val.startsWith(`${contentRoot}/`) ? val.slice(contentRoot.length + 1) : val
-
-  const buildEntryPath = (opts: {
-    collectionPath: LogicalPath
-    slug?: string
-    branch?: string
-  }) => {
-    // Construct preview path from collectionPath
-    const stripped = stripRoot(opts.collectionPath)
-    const base = stripped ? `/${stripped}` : '/'
-
-    const appendBranch = (url: string) =>
-      opts.branch
-        ? `${url}${url.includes('?') ? '&' : '?'}branch=${encodeURIComponent(opts.branch)}`
-        : url
-    const trimmed = base.endsWith('/') ? base.slice(0, -1) : base
-    const encodedSlug = encodeSlug(opts.slug)
-    const url = encodedSlug ? `${trimmed}/${encodedSlug}` : trimmed || '/'
-    return appendBranch(url)
-  }
-
-  const readDocument = async (input: ReadContentInput) => {
-    const { entryPath, slug, branchName, user } = resolveTarget(input)
-    const { context, branchRoot, store } = await resolveStore(branchName)
-
-    // Get the path WITHOUT reading the file
-    let relativePath: PhysicalPath
-    try {
-      const resolved = await store.resolveDocumentPath(entryPath, slug ?? '')
-      relativePath = resolved.relativePath
-    } catch (err) {
-      const message = err instanceof ContentStoreError ? err.message : 'Invalid content request'
-      throw new ContentStoreError(message)
-    }
-
-    // Check permissions BEFORE reading the file (security)
-    const shouldCheckPermissions = !isBuildMode()
-    if (shouldCheckPermissions) {
-      const access = await services.checkContentAccess(
-        context,
-        branchRoot,
-        relativePath,
-        user,
-        'read',
-      )
-      if (!access.allowed) {
-        if (services.config.mode === 'dev' || services.config.mode === 'prod-sim') {
-          const reasons: string[] = []
-          if (!access.branch.allowed) {
-            reasons.push(`branch access denied (${access.branch.reason})`)
-          }
-          if (!access.path.allowed) {
-            reasons.push(`path access denied (${access.path.reason ?? 'unknown'})`)
-          }
-          const detail = reasons.length > 0 ? `: ${reasons.join(', ')}` : ''
-          const groupsHint =
-            user.groups.length === 0
-              ? ' (user has no group memberships — is CANOPY_BOOTSTRAP_ADMIN_IDS configured?)'
-              : ''
-          throw new ContentStoreError(`Forbidden${detail}${groupsHint}`)
-        }
-        throw new ContentStoreError('Forbidden')
-      }
-    }
-
-    // ONLY if permissions pass, read the file
-    try {
-      return await store.read(entryPath, slug ?? '', {
-        resolveReferences: input.resolveReferences ?? true,
-      })
-    } catch (err: unknown) {
-      if (isNotFoundError(err)) return null
-      throw err
-    }
-  }
-
-  const read: ContentReader['read'] = async <T = unknown>(
-    input: ReadContentInput,
-    message?: string,
-  ) => {
-    const { entryPath, slug, branchName } = resolveTarget(input)
-    const doc = await readDocument(input)
-    if (!doc || typeof doc !== 'object' || !('data' in doc)) {
-      const defaultMessage = `Content not found for ${entryPath}${slug ? `/${slug}` : ''} on branch ${branchName}`
-      throw new ContentStoreError(message ?? defaultMessage)
-    }
-    // For md/mdx format, merge the body into the data so callers get a complete object
-    const docRecord = doc as Record<string, unknown>
-    const rawData = docRecord.data as Record<string, unknown>
-    const body = docRecord.body as string | undefined
-    const data = (body != null ? { ...rawData, body } : rawData) as T
-    const path = buildEntryPath({
-      collectionPath: entryPath,
-      slug,
-      branch: branchName,
-    })
-    return { data, path }
-  }
-
-  return { read }
-}