canopycms 0.0.63 → 0.0.65

package/dist/validation/entry-validator.js

@@ -23,8 +23,10 @@
  */
 import { fieldTypes } from '../config/index.js';
 import { isValidCropRect } from '../assets/transform-directives.js';
-import { resolveBlockItem } from './field-traversal.js';
+import { BLOCK_STRUCTURAL_KEYS } from './block-structural-keys.js';
+import { resolveBlockItem, traverseFields } from './field-traversal.js';
 import { findBodyFieldName } from '../utils/body-field.js';
+import { flattenGroupFields } from '../utils/flatten-group-fields.js';
 import { isDataOnlyFormat } from '../utils/format.js';
 const KNOWN_FIELD_TYPES = new Set(fieldTypes);
 /** Field types whose value is a plain string. */
@@ -273,6 +275,37 @@ export function validateEntryFormValue(fields, format, value) {
     }
     return validateEntryData(fields, value);
 }
+/**
+ * Find data keys that have no counterpart in the schema, as canonical field paths
+ * (`author.nickname`, `blocks[2].headline`).
+ *
+ * `validateEntryData` iterates the SCHEMA, so it can only ever report fields the schema knows
+ * about. Nothing reported the inverse: rename or reshape a field and the old key persists on
+ * disk forever, because the editor's form state is the whole record verbatim and every save
+ * posts it back. The only symptom is a component quietly receiving `undefined`.
+ *
+ * Pure — safe in the browser. Reports rather than rejects: a save carrying a stale key still
+ * succeeds (and now the write path even preserves the key and its comments), so this feeds the
+ * non-blocking `validationWarnings` channel, not the 422 path.
+ *
+ * Two things it deliberately does not report:
+ *
+ * - **A container with no fields at all.** `api/content.ts` falls back to `[]` for a collection
+ *   with no configured entry type; "no schema" is not "every key is unknown".
+ * - **Anything inside a `reference` value.** Reads resolve references by default, so a reference
+ *   field's value is `{ ...target data, id, slug, collection, urlPath }`. The traversal only
+ *   descends into `object` and `block`, so it never looks inside one.
+ */
+export function findUnknownKeys(fields, data) {
+    return traverseFields(fields, data, () => [], '', ({ fields: containerFields, data: record, path }) => {
+        if (containerFields.length === 0)
+            return [];
+        const known = new Set(flattenGroupFields(containerFields).map((field) => field.name));
+        return Object.keys(record)
+            .filter((key) => !known.has(key) && !BLOCK_STRUCTURAL_KEYS.has(key))
+            .map((key) => (path ? `${path}.${key}` : key));
+    });
+}
 /**
  * Return a copy of `data` with resolved reference objects (`{ id, ... }`)
  * collapsed back to their id strings, recursing through objects, lists, and
@@ -329,4 +362,3 @@ export function normalizeReferenceValues(fields, data) {
     }
     return result;
 }
-//# sourceMappingURL=entry-validator.js.map

package/dist/validation/field-traversal.d.ts

@@ -5,7 +5,7 @@
  * according to a schema, handling objects, blocks, and arrays with their
  * own schemas.
  */
-import type { FieldConfig, BlockFieldConfig } from '../config';
+import type { FieldConfig, BlockFieldConfig } from '../config/index.js';
 /**
  * Context provided to the visitor function for each field.
  */
@@ -22,6 +22,26 @@ export interface TraversalContext {
  * Return an empty array to skip this field, or return items to collect.
  */
 export type FieldVisitor<T> = (context: TraversalContext) => T[];
+/**
+ * Context for a CONTAINER — one data record together with the field list that governs it.
+ *
+ * The field visitor is driven by the schema, so it can only ever see keys the schema already
+ * knows about. A container visitor sees the record itself, which is what a check on the data's
+ * OWN keys needs (`findUnknownKeys` in entry-validator.ts).
+ */
+export interface ContainerContext {
+    /** The schema fields governing this record. Inline groups are NOT flattened. */
+    fields: readonly FieldConfig[];
+    /** The data record those fields govern. */
+    data: Record<string, unknown>;
+    /** Path to the record itself ('' at the top level, e.g. `blocks[0]` inside a block). */
+    path: string;
+}
+/**
+ * Visitor called once per container, before its fields are walked.
+ * Return an empty array to collect nothing.
+ */
+export type ContainerVisitor<T> = (context: ContainerContext) => T[];
 /**
  * A block item resolved to its template fields and the data record that
  * holds the nested field values.
@@ -58,7 +78,12 @@ export declare function resolveBlockItem(blockField: BlockFieldConfig, item: Rec
  * @param data - The data object to traverse
  * @param visitor - Function called for each field, returns items to collect
  * @param pathPrefix - Current path prefix for nested fields
- * @returns Array of all items returned by the visitor
+ * @param onContainer - Optional, called once per container (this record plus the fields
+ *   governing it) before its fields are walked: the top level, each object value, each
+ *   object-list item, and each block item's resolved data. Inline groups do NOT fire it — a
+ *   group is transparent to the data and shares its parent's record, so its children are already
+ *   covered by the parent's container call.
+ * @returns Array of all items returned by the visitors
  *
  * @example
  * ```ts
@@ -71,7 +96,7 @@ export declare function resolveBlockItem(blockField: BlockFieldConfig, item: Rec
  * })
  * ```
  */
-export declare function traverseFields<T>(fields: readonly FieldConfig[], data: Record<string, unknown>, visitor: FieldVisitor<T>, pathPrefix?: string): T[];
+export declare function traverseFields<T>(fields: readonly FieldConfig[], data: Record<string, unknown>, visitor: FieldVisitor<T>, pathPrefix?: string, onContainer?: ContainerVisitor<T>): T[];
 /**
  * Find all fields of a specific type in the data.
  *
@@ -81,4 +106,3 @@ export declare function traverseFields<T>(fields: readonly FieldConfig[], data:
  * @returns Array of { field, value, path } for matching fields
  */
 export declare function findFieldsByType(fields: readonly FieldConfig[], data: Record<string, unknown>, fieldType: string): TraversalContext[];
-//# sourceMappingURL=field-traversal.d.ts.map

package/dist/validation/field-traversal.js

@@ -50,7 +50,12 @@ export function resolveBlockItem(blockField, item) {
  * @param data - The data object to traverse
  * @param visitor - Function called for each field, returns items to collect
  * @param pathPrefix - Current path prefix for nested fields
- * @returns Array of all items returned by the visitor
+ * @param onContainer - Optional, called once per container (this record plus the fields
+ *   governing it) before its fields are walked: the top level, each object value, each
+ *   object-list item, and each block item's resolved data. Inline groups do NOT fire it — a
+ *   group is transparent to the data and shares its parent's record, so its children are already
+ *   covered by the parent's container call.
+ * @returns Array of all items returned by the visitors
  *
  * @example
  * ```ts
@@ -63,15 +68,28 @@ export function resolveBlockItem(blockField, item) {
  * })
  * ```
  */
-export function traverseFields(fields, data, visitor, pathPrefix = '') {
+export function traverseFields(fields, data, visitor, pathPrefix = '', onContainer) {
+    return walkFields(fields, data, visitor, pathPrefix, onContainer, true);
+}
+/**
+ * The traversal itself. `fireContainer` is what keeps an inline group from being mistaken for a
+ * container: a group re-enters the walk with the SAME data record, so firing the hook there would
+ * report the record twice AND hand the visitor only the group's own field list — under which
+ * every sibling of the group reads as an unknown key. The hook still propagates INTO the group,
+ * so a nested object or block below it is reported normally.
+ */
+function walkFields(fields, data, visitor, pathPrefix, onContainer, fireContainer) {
     const results = [];
+    if (onContainer && fireContainer) {
+        results.push(...onContainer({ fields, data, path: pathPrefix }));
+    }
     for (const field of fields) {
         const fieldPath = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
         const value = data[field.name];
         // Inline groups are transparent to the data — their children live at the parent
         // data level, not under field.name, so skip the null/undefined guard for them.
         if (field.type === 'group') {
-            results.push(...traverseFields(field.fields, data, visitor, pathPrefix));
+            results.push(...walkFields(field.fields, data, visitor, pathPrefix, onContainer, false));
             continue;
         }
         // Skip undefined/null values for all other field types
@@ -87,12 +105,12 @@ export function traverseFields(fields, data, visitor, pathPrefix = '') {
                     // list: true — value is an array of objects
                     value.forEach((item, index) => {
                         if (typeof item === 'object' && item !== null) {
-                            results.push(...traverseFields(objectField.fields, item, visitor, `${fieldPath}[${index}]`));
+                            results.push(...walkFields(objectField.fields, item, visitor, `${fieldPath}[${index}]`, onContainer, true));
                         }
                     });
                 }
                 else if (typeof value === 'object' && value !== null) {
-                    results.push(...traverseFields(objectField.fields, value, visitor, fieldPath));
+                    results.push(...walkFields(objectField.fields, value, visitor, fieldPath, onContainer, true));
                 }
             }
         }
@@ -103,7 +121,7 @@ export function traverseFields(fields, data, visitor, pathPrefix = '') {
                     if (typeof item === 'object' && item !== null) {
                         const resolved = resolveBlockItem(blockField, item);
                         if (resolved) {
-                            results.push(...traverseFields(resolved.fields, resolved.data, visitor, `${fieldPath}[${index}]`));
+                            results.push(...walkFields(resolved.fields, resolved.data, visitor, `${fieldPath}[${index}]`, onContainer, true));
                         }
                     }
                 });
@@ -128,4 +146,3 @@ export function findFieldsByType(fields, data, fieldType) {
         return [];
     });
 }
-//# sourceMappingURL=field-traversal.js.map

package/dist/validation/reference-validator.d.ts

@@ -1,5 +1,5 @@
-import type { ContentIdIndex } from '../content-id-index';
-import type { FieldConfig, ReferenceFieldConfig } from '../config';
+import type { ContentIdIndex } from '../content-id-index.js';
+import type { FieldConfig, ReferenceFieldConfig } from '../config/index.js';
 export interface ValidationError {
     field: string;
     fieldPath: string;
@@ -58,4 +58,3 @@ export declare class ReferenceValidator {
      */
     validateSingle(id: string, field: ReferenceFieldConfig): Promise<ValidationError | null>;
 }
-//# sourceMappingURL=reference-validator.d.ts.map

package/dist/validation/reference-validator.js

@@ -186,4 +186,3 @@ export class ReferenceValidator {
         return null;
     }
 }
-//# sourceMappingURL=reference-validator.js.map

package/dist/worker/cms-worker.d.ts

@@ -1,4 +1,4 @@
-export { workerLog, workerLogWarn, workerLogError, installWorkerLogger } from './log';
+export { workerLog, workerLogWarn, workerLogError, installWorkerLogger } from './log.js';
 /**
  * Auth cache refresh function type.
  * Adopters provide their auth-plugin-specific implementation.
@@ -217,6 +217,28 @@ export declare class CmsWorker {
      * is what makes simple-git reject the promise here.
      */
     private verifyBaseBranchExists;
+    /**
+     * Guarantee a bare repo's config carries NO `remote.origin.url`, and so no
+     * embedded bot token.
+     *
+     * `git clone https://x-access-token:<token>@github.com/...` records that URL
+     * verbatim as `remote.origin.url`, and for `remote.git` that config lives on
+     * shared EFS. The security model in docs/deploying-to-aws.md -- "If Lambda is
+     * compromised, an attacker can read/write content on EFS but cannot push to
+     * GitHub", "Secrets stay on the worker" -- is false while that string is
+     * there: a compromised Lambda could read the token off EFS and, despite
+     * having no egress of its own, exfiltrate it by writing it into branch
+     * content the worker then pushes to GitHub.
+     *
+     * Nothing needs the remote: every push passes the URL explicitly as an
+     * argument (see the `git.push(this.buildGitHubUrl(), ...)` call sites), and
+     * `verifyBaseBranchExists` reads local refs.
+     *
+     * VERIFIES rather than assuming: it re-reads the config and throws if the URL
+     * survives, because the previous code's `.catch(() => {})` meant a failed
+     * scrub was indistinguishable from a successful one.
+     */
+    private scrubPersistedRemote;
     /**
      * Ensure remote.git bare repo exists.
      * On first run, clone from GitHub as a bare repo.
@@ -524,7 +546,14 @@ export declare class CmsWorker {
      * same idiom on the write side.
      */
     protected afterConflictDetectedForTesting(): Promise<void>;
+    /**
+     * Test seam, sibling of {@link afterConflictDetectedForTesting}: runs at the
+     * instant a rebase round has succeeded, before the completion path (cache
+     * invalidation, conflict metadata, [SYNC-H1] marker) executes. Exists so a
+     * test can lose the content-write lock at exactly the point where bailing out
+     * would strand a rewritten history.
+     */
+    protected afterRebaseCompletedForTesting(): Promise<void>;
     private rebaseActiveBranches;
     refreshAuthCache(): Promise<void>;
 }
-//# sourceMappingURL=cms-worker.d.ts.map