create-aphex 0.1.3 → 0.2.0

package/templates/base/src/routes/(protected)/admin/settings/roles/+page.svelte

@@ -1,339 +0,0 @@
-<script lang="ts">
-	import * as Card from '@aphexcms/ui/shadcn/card';
-	import * as Sheet from '@aphexcms/ui/shadcn/sheet';
-	import { Button } from '@aphexcms/ui/shadcn/button';
-	import { Input } from '@aphexcms/ui/shadcn/input';
-	import { Textarea } from '@aphexcms/ui/shadcn/textarea';
-	import { Label } from '@aphexcms/ui/shadcn/label';
-	import { Checkbox } from '@aphexcms/ui/shadcn/checkbox';
-	import { Badge } from '@aphexcms/ui/shadcn/badge';
-	import { Separator } from '@aphexcms/ui/shadcn/separator';
-	import { confirmDialog, usePermissions } from '@aphexcms/cms-core/client';
-	import { ALL_CAPABILITIES } from '@aphexcms/cms-core';
-	import type { Capability, Role } from '@aphexcms/cms-core';
-	import { roles as rolesApi } from '@aphexcms/cms-core/client';
-	import { invalidateAll } from '$app/navigation';
-	import { toast } from 'svelte-sonner';
-	import { Shield, Plus, Pencil, Trash2, Lock } from '@lucide/svelte';
-	import type { PageData } from './$types';
-
-	let { data }: { data: PageData } = $props();
-
-	const roles = $derived(data.roles as Role[]);
-	// Read from the shared permissions context instead of a separate server
-	// flag — single source of truth, stays in sync if the role changes.
-	const perms = usePermissions();
-	const canManageRoles = $derived(perms.can('role.manage'));
-
-	type EditorState = { kind: 'closed' } | { kind: 'create' } | { kind: 'edit'; role: Role };
-
-	let editor = $state<EditorState>({ kind: 'closed' });
-	let form = $state({
-		name: '',
-		description: '',
-		capabilities: new Set<Capability>()
-	});
-	let saving = $state(false);
-
-	// Capability groupings for the picker. Any capability not listed here falls
-	// into "Other" so new additions don't disappear silently.
-	const CAPABILITY_GROUPS: { title: string; prefix: string }[] = [
-		{ title: 'Documents', prefix: 'document.' },
-		{ title: 'Assets', prefix: 'asset.' },
-		{ title: 'Members', prefix: 'member.' },
-		{ title: 'Organization', prefix: 'org.' },
-		{ title: 'Keys & Roles', prefix: '' } // catch-all, resolved below
-	];
-
-	function groupedCapabilities() {
-		const groups: Record<string, Capability[]> = {};
-		for (const cap of ALL_CAPABILITIES) {
-			const match = CAPABILITY_GROUPS.find((g) => g.prefix && cap.startsWith(g.prefix));
-			const title = match?.title ?? 'Keys & Roles';
-			(groups[title] ??= []).push(cap);
-		}
-		return CAPABILITY_GROUPS.map((g) => ({
-			title: g.title,
-			items: groups[g.title] ?? []
-		})).filter((g) => g.items.length > 0);
-	}
-
-	function capabilityLabel(cap: Capability): string {
-		// "document.publish" → "Publish"
-		const suffix = cap.split('.').slice(1).join('.');
-		return suffix.charAt(0).toUpperCase() + suffix.slice(1);
-	}
-
-	function openCreate() {
-		form = { name: '', description: '', capabilities: new Set() };
-		editor = { kind: 'create' };
-	}
-
-	function openEdit(role: Role) {
-		form = {
-			name: role.name,
-			description: role.description ?? '',
-			capabilities: new Set(role.capabilities)
-		};
-		editor = { kind: 'edit', role };
-	}
-
-	function closeEditor() {
-		editor = { kind: 'closed' };
-	}
-
-	// Write caps imply their matching read on the same resource family. Mirror
-	// the server-side normalization visually so users see the read checkbox
-	// light up instead of being surprised by it reappearing post-save.
-	const READ_IMPLIED_BY: Partial<Record<Capability, Capability>> = {
-		'document.create': 'document.read',
-		'document.update': 'document.read',
-		'document.delete': 'document.read',
-		'document.publish': 'document.read',
-		'document.unpublish': 'document.read',
-		'asset.upload': 'asset.read',
-		'asset.delete': 'asset.read'
-	};
-
-	const WRITES_NEEDING: Record<Capability, Capability[]> = Object.entries(READ_IMPLIED_BY).reduce(
-		(acc, [write, read]) => {
-			if (!read) return acc;
-			(acc[read as Capability] ??= []).push(write as Capability);
-			return acc;
-		},
-		{} as Record<Capability, Capability[]>
-	);
-
-	function toggleCapability(cap: Capability, next: boolean) {
-		const updated = new Set(form.capabilities);
-		if (next) {
-			updated.add(cap);
-			const implied = READ_IMPLIED_BY[cap];
-			if (implied) updated.add(implied);
-		} else {
-			// Don't allow unchecking a read cap while a dependent write is selected —
-			// the server would re-add it anyway.
-			const dependents = WRITES_NEEDING[cap] ?? [];
-			if (dependents.some((w) => updated.has(w))) return;
-			updated.delete(cap);
-		}
-		form.capabilities = updated;
-	}
-
-	function isImpliedRead(cap: Capability): boolean {
-		const dependents = WRITES_NEEDING[cap] ?? [];
-		return dependents.some((w) => form.capabilities.has(w));
-	}
-
-	async function save() {
-		saving = true;
-		try {
-			const capabilities = Array.from(form.capabilities);
-			if (editor.kind === 'create') {
-				if (!form.name.trim()) {
-					toast.error('Name is required');
-					return;
-				}
-				const result = await rolesApi.create({
-					name: form.name.trim(),
-					description: form.description.trim() || null,
-					capabilities
-				});
-				if (!result.success) throw new Error(result.error || 'Failed to create role');
-				toast.success(`Role "${form.name.trim()}" created`);
-			} else if (editor.kind === 'edit') {
-				const result = await rolesApi.update(editor.role.name, {
-					description: form.description.trim() || null,
-					capabilities
-				});
-				if (!result.success) throw new Error(result.error || 'Failed to update role');
-				toast.success(`Role "${editor.role.name}" updated`);
-			}
-			closeEditor();
-			await invalidateAll();
-		} catch (err) {
-			toast.error(err instanceof Error ? err.message : 'Failed to save role');
-		} finally {
-			saving = false;
-		}
-	}
-
-	async function remove(role: Role) {
-		const confirmed = await confirmDialog({
-			title: `Delete role "${role.name}"?`,
-			description:
-				'This cannot be undone. Members and pending invitations using this role will block the deletion.',
-			confirmText: 'Delete',
-			variant: 'destructive'
-		});
-		if (!confirmed) return;
-
-		try {
-			const result = await rolesApi.remove(role.name);
-			if (!result.success) throw new Error(result.error || 'Failed to delete role');
-			toast.success(`Role "${role.name}" deleted`);
-			await invalidateAll();
-		} catch (err) {
-			toast.error(err instanceof Error ? err.message : 'Failed to delete role');
-		}
-	}
-</script>
-
-<svelte:head>
-	<title>Aphex CMS - Roles</title>
-</svelte:head>
-
-<div class="grid gap-6">
-	<div class="flex items-start justify-between gap-4">
-		<div class="hidden sm:block">
-			<h2 class="text-xl font-semibold">Roles</h2>
-			<p class="text-muted-foreground text-sm">
-				Define which members can do what. Built-in roles are always available; add custom roles to
-				match how your team works.
-			</p>
-		</div>
-		{#if canManageRoles}
-			<Button onclick={openCreate} class="shrink-0">
-				<Plus class="mr-1 h-4 w-4" /> New role
-			</Button>
-		{/if}
-	</div>
-
-	<div class="grid gap-3">
-		{#each roles as role (role.id)}
-			<Card.Root>
-				<Card.Content class="flex items-center gap-4 py-4">
-					<div class="bg-muted flex h-10 w-10 items-center justify-center rounded-md">
-						{#if role.isBuiltIn}
-							<Lock class="text-muted-foreground h-4 w-4" />
-						{:else}
-							<Shield class="text-muted-foreground h-4 w-4" />
-						{/if}
-					</div>
-					<div class="min-w-0 flex-1">
-						<div class="flex items-center gap-2">
-							<p class="truncate text-sm font-semibold capitalize">{role.name}</p>
-							{#if role.isBuiltIn}
-								<Badge variant="secondary" class="text-[10px]">Built-in</Badge>
-							{/if}
-							<Badge variant="outline" class="text-[10px]">
-								{role.capabilities.length} capabilit{role.capabilities.length === 1 ? 'y' : 'ies'}
-							</Badge>
-						</div>
-						{#if role.description}
-							<p class="text-muted-foreground mt-0.5 truncate text-xs">{role.description}</p>
-						{/if}
-					</div>
-					{#if canManageRoles}
-						<div class="flex items-center gap-2">
-							<Button variant="outline" size="sm" onclick={() => openEdit(role)}>
-								<Pencil class="mr-1 h-3.5 w-3.5" /> Edit
-							</Button>
-							{#if !role.isBuiltIn}
-								<Button variant="outline" size="sm" onclick={() => remove(role)}>
-									<Trash2 class="text-destructive mr-1 h-3.5 w-3.5" /> Delete
-								</Button>
-							{/if}
-						</div>
-					{/if}
-				</Card.Content>
-			</Card.Root>
-		{/each}
-	</div>
-</div>
-
-<Sheet.Root
-	open={editor.kind !== 'closed'}
-	onOpenChange={(o) => {
-		if (!o) closeEditor();
-	}}
->
-	<Sheet.Content class="flex w-full flex-col gap-0 p-0 sm:max-w-lg">
-		<Sheet.Header class="border-b p-6">
-			<Sheet.Title>
-				{editor.kind === 'create'
-					? 'Create role'
-					: `Edit "${editor.kind === 'edit' ? editor.role.name : ''}"`}
-			</Sheet.Title>
-			<Sheet.Description>
-				{#if editor.kind === 'edit' && editor.role.isBuiltIn}
-					Built-in role. Capabilities can be tuned; the name is fixed.
-				{:else}
-					Pick the capabilities this role grants. Members assigned to this role will gain every
-					checked permission.
-				{/if}
-			</Sheet.Description>
-		</Sheet.Header>
-
-		<div class="flex-1 space-y-6 overflow-y-auto p-6">
-			<div class="space-y-2">
-				<Label for="role-name">Name</Label>
-				<Input
-					id="role-name"
-					bind:value={form.name}
-					disabled={editor.kind === 'edit'}
-					placeholder="e.g. translator"
-				/>
-				{#if editor.kind === 'create'}
-					<p class="text-muted-foreground text-xs">
-						Letters, numbers, spaces, hyphens, or underscores. Used when assigning members.
-					</p>
-				{/if}
-			</div>
-
-			<div class="space-y-2">
-				<Label for="role-description">Description</Label>
-				<Textarea
-					id="role-description"
-					bind:value={form.description}
-					placeholder="What does this role do?"
-					rows={2}
-				/>
-			</div>
-
-			<Separator />
-
-			<div class="space-y-4">
-				<div class="flex items-center justify-between">
-					<Label>Capabilities</Label>
-					<span class="text-muted-foreground text-xs">
-						{form.capabilities.size} of {ALL_CAPABILITIES.length} selected
-					</span>
-				</div>
-
-				{#each groupedCapabilities() as group (group.title)}
-					<div class="space-y-2">
-						<p class="text-muted-foreground text-xs font-semibold tracking-wider uppercase">
-							{group.title}
-						</p>
-						<div class="grid gap-2">
-							{#each group.items as cap (cap)}
-								{@const implied = isImpliedRead(cap)}
-								<label
-									class="hover:bg-muted flex cursor-pointer items-center gap-3 rounded-md border px-3 py-2"
-								>
-									<Checkbox
-										checked={form.capabilities.has(cap)}
-										disabled={implied}
-										onCheckedChange={(v) => toggleCapability(cap, v === true)}
-									/>
-									<div class="flex-1">
-										<p class="text-sm font-medium">{capabilityLabel(cap)}</p>
-										<p class="text-muted-foreground font-mono text-[10px]">{cap}</p>
-									</div>
-								</label>
-							{/each}
-						</div>
-					</div>
-				{/each}
-			</div>
-		</div>
-
-		<div class="flex items-center justify-end gap-2 border-t p-6">
-			<Button variant="outline" onclick={closeEditor} disabled={saving}>Cancel</Button>
-			<Button onclick={save} disabled={saving}>
-				{saving ? 'Saving...' : editor.kind === 'create' ? 'Create role' : 'Save changes'}
-			</Button>
-		</div>
-	</Sheet.Content>
-</Sheet.Root>

package/templates/base/src/routes/+layout.svelte

@@ -1,12 +0,0 @@
-<script lang="ts">
-	import '../app.css';
-	import favicon from '$lib/assets/favicon.svg';
-
-	let { children } = $props();
-</script>
-
-<svelte:head>
-	<link rel="icon" href={favicon} />
-</svelte:head>
-
-{@render children?.()}

package/templates/base/src/routes/+page.svelte

@@ -1,2 +0,0 @@
-<h1>Welcome to SvelteKit</h1>
-<p>Visit <a href="https://svelte.dev/docs/kit">svelte.dev/docs/kit</a> to read the documentation</p>

package/templates/base/src/routes/api/[...slug]/+server.ts

@@ -1,35 +0,0 @@
-import type { RequestHandler } from '@sveltejs/kit';
-
-/**
- * Catch-all forwarder: any `/api/**` request that doesn't match a specific
- * `+server.ts` falls through here and gets handed to the Aphex Hono app.
- *
- * SvelteKit prefers specific routes over catch-alls, so existing per-endpoint
- * shims continue to win during the migration. Once a route is ported into
- * the Hono app, deleting its specific `+server.ts` flips traffic over.
- */
-const handler: RequestHandler = ({ request, locals, getClientAddress }) => {
-	const apiApp = locals.aphexCMS?.apiApp;
-	if (!apiApp) {
-		return new Response('CMS not initialized', { status: 503 });
-	}
-
-	try {
-		request.headers.set('x-forwarded-for', getClientAddress());
-	} catch {
-		// Some runtimes expose immutable Request headers; non-fatal.
-	}
-
-	return apiApp.fetch(request, {
-		aphexCMS: locals.aphexCMS,
-		auth: locals.auth ?? null
-	});
-};
-
-export const GET = handler;
-export const POST = handler;
-export const PUT = handler;
-export const DELETE = handler;
-export const PATCH = handler;
-export const OPTIONS = handler;
-export const HEAD = handler;

package/templates/base/src/routes/api/instance-settings/+server.ts

@@ -1,70 +0,0 @@
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from '@sveltejs/kit';
-
-// GET /api/instance-settings — Get instance settings
-export const GET: RequestHandler = async ({ locals }) => {
-	try {
-		const { databaseAdapter } = locals.aphexCMS;
-		const auth = locals.auth;
-
-		if (!auth || auth.type !== 'session') {
-			return json(
-				{ success: false, error: 'Unauthorized', message: 'Session authentication required' },
-				{ status: 401 }
-			);
-		}
-
-		const settings = await databaseAdapter.getInstanceSettings();
-		return json({ success: true, data: settings });
-	} catch (error) {
-		console.error('Failed to fetch instance settings:', error);
-		return json(
-			{
-				success: false,
-				error: 'Failed to fetch instance settings',
-				message: error instanceof Error ? error.message : 'Unknown error'
-			},
-			{ status: 500 }
-		);
-	}
-};
-
-// PATCH /api/instance-settings — Update instance settings (super_admin only)
-export const PATCH: RequestHandler = async ({ request, locals }) => {
-	try {
-		const { databaseAdapter } = locals.aphexCMS;
-		const auth = locals.auth;
-
-		if (!auth || auth.type !== 'session') {
-			return json(
-				{ success: false, error: 'Unauthorized', message: 'Session authentication required' },
-				{ status: 401 }
-			);
-		}
-
-		if (auth.user.role !== 'super_admin') {
-			return json(
-				{
-					success: false,
-					error: 'Forbidden',
-					message: 'Only super admins can update instance settings'
-				},
-				{ status: 403 }
-			);
-		}
-
-		const body = await request.json();
-		const updated = await databaseAdapter.updateInstanceSettings(body);
-		return json({ success: true, data: updated });
-	} catch (error) {
-		console.error('Failed to update instance settings:', error);
-		return json(
-			{
-				success: false,
-				error: 'Failed to update instance settings',
-				message: error instanceof Error ? error.message : 'Unknown error'
-			},
-			{ status: 500 }
-		);
-	}
-};

package/templates/base/src/routes/api/invitations/+server.ts

@@ -1,54 +0,0 @@
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from '@sveltejs/kit';
-
-// GET /api/invitations — List all pending invitations for the authenticated user
-export const GET: RequestHandler = async ({ locals }) => {
-	try {
-		const { databaseAdapter } = locals.aphexCMS;
-		const auth = locals.auth;
-
-		if (!auth || auth.type === 'api_key') {
-			return json(
-				{ success: false, error: 'Unauthorized', message: 'Session authentication required' },
-				{ status: 401 }
-			);
-		}
-
-		const allInvitations = await databaseAdapter.findInvitationsByEmail(auth.user.email);
-
-		// Filter to only pending (not accepted, not expired)
-		const now = new Date();
-		const pending = allInvitations.filter(
-			(inv) => inv.acceptedAt === null && new Date(inv.expiresAt) > now
-		);
-
-		// Enrich with organization names
-		const enriched = await Promise.all(
-			pending.map(async (inv) => {
-				const org = await databaseAdapter.findOrganizationById(inv.organizationId);
-				return {
-					id: inv.id,
-					organizationId: inv.organizationId,
-					organizationName: org?.name ?? 'Unknown',
-					organizationSlug: org?.slug ?? '',
-					role: inv.role,
-					email: inv.email,
-					expiresAt: inv.expiresAt,
-					createdAt: inv.createdAt
-				};
-			})
-		);
-
-		return json({ success: true, data: enriched });
-	} catch (error) {
-		console.error('Failed to fetch invitations:', error);
-		return json(
-			{
-				success: false,
-				error: 'Failed to fetch invitations',
-				message: error instanceof Error ? error.message : 'Unknown error'
-			},
-			{ status: 500 }
-		);
-	}
-};

package/templates/base/src/routes/api/invitations/[id]/accept/+server.ts

@@ -1,54 +0,0 @@
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from '@sveltejs/kit';
-
-// POST /api/invitations/[id]/accept — Accept a pending invitation
-export const POST: RequestHandler = async ({ params, locals }) => {
-	try {
-		const { databaseAdapter } = locals.aphexCMS;
-		const auth = locals.auth;
-
-		if (!auth || auth.type === 'api_key') {
-			return json(
-				{ success: false, error: 'Unauthorized', message: 'Session authentication required' },
-				{ status: 401 }
-			);
-		}
-
-		const invitationId = params.id;
-
-		// Find the invitation by looking up user's invitations and matching ID
-		const allInvitations = await databaseAdapter.findInvitationsByEmail(auth.user.email);
-		const invitation = allInvitations.find((inv) => inv.id === invitationId);
-
-		if (!invitation) {
-			return json({ success: false, error: 'Invitation not found' }, { status: 404 });
-		}
-
-		if (invitation.acceptedAt !== null) {
-			return json({ success: false, error: 'Invitation already accepted' }, { status: 400 });
-		}
-
-		if (new Date(invitation.expiresAt) < new Date()) {
-			return json({ success: false, error: 'Invitation has expired' }, { status: 400 });
-		}
-
-		// Accept the invitation (creates membership)
-		await databaseAdapter.acceptInvitation(invitation.token, auth.user.id);
-
-		return json({
-			success: true,
-			data: { organizationId: invitation.organizationId },
-			message: 'Invitation accepted'
-		});
-	} catch (error) {
-		console.error('Failed to accept invitation:', error);
-		return json(
-			{
-				success: false,
-				error: 'Failed to accept invitation',
-				message: error instanceof Error ? error.message : 'Unknown error'
-			},
-			{ status: 500 }
-		);
-	}
-};

package/templates/base/src/routes/api/invitations/[id]/reject/+server.ts

@@ -1,49 +0,0 @@
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from '@sveltejs/kit';
-
-// POST /api/invitations/[id]/reject — Reject/decline a pending invitation
-export const POST: RequestHandler = async ({ params, locals }) => {
-	try {
-		const { databaseAdapter } = locals.aphexCMS;
-		const auth = locals.auth;
-
-		if (!auth || auth.type === 'api_key') {
-			return json(
-				{ success: false, error: 'Unauthorized', message: 'Session authentication required' },
-				{ status: 401 }
-			);
-		}
-
-		const invitationId = params.id;
-
-		// Verify this invitation belongs to the current user
-		const allInvitations = await databaseAdapter.findInvitationsByEmail(auth.user.email);
-		const invitation = allInvitations.find((inv) => inv.id === invitationId);
-
-		if (!invitation) {
-			return json({ success: false, error: 'Invitation not found' }, { status: 404 });
-		}
-
-		if (invitation.acceptedAt !== null) {
-			return json({ success: false, error: 'Invitation already accepted' }, { status: 400 });
-		}
-
-		// Delete the invitation
-		await databaseAdapter.deleteInvitation(invitationId!);
-
-		return json({
-			success: true,
-			message: 'Invitation declined'
-		});
-	} catch (error) {
-		console.error('Failed to reject invitation:', error);
-		return json(
-			{
-				success: false,
-				error: 'Failed to reject invitation',
-				message: error instanceof Error ? error.message : 'Unknown error'
-			},
-			{ status: 500 }
-		);
-	}
-};

package/templates/base/src/routes/api/settings/api-keys/+server.ts

@@ -1,57 +0,0 @@
-import { json } from '@sveltejs/kit';
-import type { RequestHandler } from './$types';
-import { authService } from '$lib/server/auth/service';
-import { createApiKeyRequest } from '@aphexcms/cms-core/api/schemas/api-keys';
-import { hasCapability } from '@aphexcms/cms-core';
-
-// GET - List user's API keys
-export const GET: RequestHandler = async ({ locals }) => {
-	if (!locals.auth || locals.auth.type !== 'session') {
-		return json({ error: 'Unauthorized' }, { status: 401 });
-	}
-
-	try {
-		const { databaseAdapter } = locals.aphexCMS;
-		const apiKeys = await authService.listApiKeys(databaseAdapter, locals.auth.user.id);
-		return json({ success: true, data: apiKeys });
-	} catch (error) {
-		console.error('Error fetching API keys:', error);
-		return json({ error: 'Failed to fetch API keys' }, { status: 500 });
-	}
-};
-
-// POST - Create new API key
-export const POST: RequestHandler = async ({ request, locals }) => {
-	if (!locals.auth || locals.auth.type !== 'session') {
-		return json({ error: 'Unauthorized' }, { status: 401 });
-	}
-
-	const auth = locals.auth;
-
-	try {
-		// Capability-driven — custom roles with apiKey.manage are welcome.
-		if (!hasCapability(auth, 'apiKey.manage')) {
-			return json(
-				{
-					error: 'Forbidden',
-					message: 'You do not have permission to create API keys'
-				},
-				{ status: 403 }
-			);
-		}
-
-		const rawBody = await request.json();
-		const parsed = createApiKeyRequest.safeParse(rawBody);
-		if (!parsed.success) {
-			return json({ error: 'Invalid input', issues: parsed.error.issues }, { status: 400 });
-		}
-
-		// Create API key bound to the user's current active organization
-		const apiKey = await authService.createApiKey(auth.user.id, auth.organizationId, parsed.data);
-
-		return json({ success: true, data: { apiKey } });
-	} catch (error) {
-		console.error('Error creating API key:', error);
-		return json({ error: 'Failed to create API key' }, { status: 500 });
-	}
-};