create-pxlr 1.0.0

package/templates/blog/pxlr-cms/packages/api/src/modules/auth/routes.ts

@@ -0,0 +1,256 @@
+import { FastifyPluginAsync } from 'fastify';
+import bcrypt from 'bcryptjs';
+import { z } from 'zod';
+import { db } from '../../database/index.js';
+
+const loginSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(6),
+});
+
+const registerSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(6),
+  name: z.string().min(2),
+});
+
+export const authRoutes: FastifyPluginAsync = async (fastify) => {
+  // Login
+  fastify.post('/login', {
+    schema: {
+      tags: ['Auth'],
+      summary: 'Login to PXLR CMS',
+      body: {
+        type: 'object',
+        required: ['email', 'password'],
+        properties: {
+          email: { type: 'string', format: 'email' },
+          password: { type: 'string', minLength: 6 },
+        },
+      },
+      response: {
+        200: {
+          type: 'object',
+          properties: {
+            token: { type: 'string' },
+            user: {
+              type: 'object',
+              properties: {
+                id: { type: 'string' },
+                email: { type: 'string' },
+                name: { type: 'string' },
+                role: { type: 'string' },
+              },
+            },
+          },
+        },
+      },
+    },
+  }, async (request, reply) => {
+    const body = loginSchema.parse(request.body);
+
+    const result = await db.query(
+      `SELECT id, email, password_hash, name, role, is_active 
+       FROM users WHERE email = $1`,
+      [body.email]
+    );
+
+    const user = result.rows[0];
+
+    if (!user || !user.is_active) {
+      return reply.status(401).send({ error: true, message: 'Invalid credentials' });
+    }
+
+    const validPassword = await bcrypt.compare(body.password, user.password_hash);
+    if (!validPassword) {
+      return reply.status(401).send({ error: true, message: 'Invalid credentials' });
+    }
+
+    // Update last login
+    await db.query(
+      'UPDATE users SET last_login_at = CURRENT_TIMESTAMP WHERE id = $1',
+      [user.id]
+    );
+
+    const token = fastify.jwt.sign({
+      id: user.id,
+      email: user.email,
+      role: user.role,
+    });
+
+    return {
+      token,
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: user.role,
+      },
+    };
+  });
+
+  // Register (admin only in production)
+  fastify.post('/register', {
+    schema: {
+      tags: ['Auth'],
+      summary: 'Register a new user',
+      body: {
+        type: 'object',
+        required: ['email', 'password', 'name'],
+        properties: {
+          email: { type: 'string', format: 'email' },
+          password: { type: 'string', minLength: 6 },
+          name: { type: 'string', minLength: 2 },
+        },
+      },
+    },
+  }, async (request, reply) => {
+    const body = registerSchema.parse(request.body);
+
+    // Check if user exists
+    const existing = await db.query(
+      'SELECT id FROM users WHERE email = $1',
+      [body.email]
+    );
+
+    if (existing.rows.length > 0) {
+      return reply.status(400).send({ error: true, message: 'Email already registered' });
+    }
+
+    const passwordHash = await bcrypt.hash(body.password, 12);
+
+    const result = await db.query(
+      `INSERT INTO users (email, password_hash, name, role) 
+       VALUES ($1, $2, $3, 'editor') 
+       RETURNING id, email, name, role`,
+      [body.email, passwordHash, body.name]
+    );
+
+    const user = result.rows[0];
+
+    const token = fastify.jwt.sign({
+      id: user.id,
+      email: user.email,
+      role: user.role,
+    });
+
+    return {
+      token,
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: user.role,
+      },
+    };
+  });
+
+  // Get current user
+  fastify.get('/me', {
+    schema: {
+      tags: ['Auth'],
+      summary: 'Get current user',
+      security: [{ bearerAuth: [] }],
+    },
+    preHandler: [fastify.authenticate],
+  }, async (request) => {
+    const user = request.user as { id: string };
+
+    const result = await db.query(
+      `SELECT id, email, name, role, avatar_url, created_at 
+       FROM users WHERE id = $1`,
+      [user.id]
+    );
+
+    return { user: result.rows[0] };
+  });
+
+  // Logout (invalidate token - for future implementation with token blacklist)
+  fastify.post('/logout', {
+    schema: {
+      tags: ['Auth'],
+      summary: 'Logout current user',
+      security: [{ bearerAuth: [] }],
+    },
+    preHandler: [fastify.authenticate],
+  }, async () => {
+    return { success: true, message: 'Logged out successfully' };
+  });
+
+  // Update profile
+  fastify.put('/profile', {
+    schema: {
+      tags: ['Auth'],
+      summary: 'Update user profile',
+      security: [{ bearerAuth: [] }],
+    },
+    preHandler: [fastify.authenticate],
+  }, async (request, reply) => {
+    const user = request.user as { id: string };
+    const body = z.object({
+      name: z.string().min(2),
+    }).parse(request.body);
+
+    const result = await db.query(
+      `UPDATE users SET name = $1, updated_at = CURRENT_TIMESTAMP 
+       WHERE id = $2 
+       RETURNING id, email, name, role, avatar_url`,
+      [body.name, user.id]
+    );
+
+    if (result.rows.length === 0) {
+      return reply.status(404).send({ error: true, message: 'User not found' });
+    }
+
+    return { user: result.rows[0] };
+  });
+
+  // Change password
+  fastify.put('/password', {
+    schema: {
+      tags: ['Auth'],
+      summary: 'Change user password',
+      security: [{ bearerAuth: [] }],
+    },
+    preHandler: [fastify.authenticate],
+  }, async (request, reply) => {
+    const user = request.user as { id: string };
+    const body = z.object({
+      currentPassword: z.string().min(6),
+      newPassword: z.string().min(6),
+    }).parse(request.body);
+
+    // Get current password hash
+    const result = await db.query(
+      'SELECT password_hash FROM users WHERE id = $1',
+      [user.id]
+    );
+
+    if (result.rows.length === 0) {
+      return reply.status(404).send({ error: true, message: 'User not found' });
+    }
+
+    // Verify current password
+    const validPassword = await bcrypt.compare(body.currentPassword, result.rows[0].password_hash);
+    if (!validPassword) {
+      return reply.status(400).send({ error: true, message: 'Current password is incorrect' });
+    }
+
+    // Hash new password and update
+    const newPasswordHash = await bcrypt.hash(body.newPassword, 12);
+    await db.query(
+      'UPDATE users SET password_hash = $1, updated_at = CURRENT_TIMESTAMP WHERE id = $2',
+      [newPasswordHash, user.id]
+    );
+
+    return { success: true, message: 'Password changed successfully' };
+  });
+
+};
+
+// Type augmentation for Fastify
+declare module 'fastify' {
+  interface FastifyInstance {
+    authenticate: any;
+  }
+}

package/templates/blog/pxlr-cms/packages/api/src/modules/content/routes.ts

@@ -0,0 +1,385 @@
+import { FastifyPluginAsync } from 'fastify';
+import { z } from 'zod';
+import { v4 as uuid } from 'uuid';
+import { db } from '../../database/index.js';
+import { redis } from '../../database/redis.js';
+
+const createDocumentSchema = z.object({
+  schemaName: z.string().min(1),
+  data: z.record(z.any()),
+  locale: z.string().default('en'),
+  status: z.enum(['draft', 'published']).default('draft'),
+});
+
+const updateDocumentSchema = z.object({
+  data: z.record(z.any()).optional(),
+  locale: z.string().optional(),
+  status: z.enum(['draft', 'published', 'archived']).optional(),
+});
+
+const querySchema = z.object({
+  schemaName: z.string().optional(),
+  status: z.enum(['draft', 'published', 'archived']).optional(),
+  locale: z.string().optional(),
+  page: z.coerce.number().min(1).default(1),
+  limit: z.coerce.number().min(1).max(100).default(20),
+  orderBy: z.string().default('created_at'),
+  order: z.enum(['asc', 'desc']).default('desc'),
+  search: z.string().optional(),
+});
+
+export const contentRoutes: FastifyPluginAsync = async (fastify) => {
+  // List documents with filtering
+  fastify.get('/', {
+    schema: {
+      tags: ['Content'],
+      summary: 'List documents with filtering and pagination',
+      querystring: {
+        type: 'object',
+        properties: {
+          schemaName: { type: 'string' },
+          status: { type: 'string' },
+          locale: { type: 'string' },
+          page: { type: 'number' },
+          limit: { type: 'number' },
+          orderBy: { type: 'string' },
+          order: { type: 'string' },
+          search: { type: 'string' },
+        },
+      },
+    },
+  }, async (request) => {
+    const query = querySchema.parse(request.query);
+    const offset = (query.page - 1) * query.limit;
+
+    let whereClause = 'WHERE 1=1';
+    const params: any[] = [];
+    let paramIndex = 1;
+
+    if (query.schemaName) {
+      whereClause += ` AND schema_name = $${paramIndex++}`;
+      params.push(query.schemaName);
+    }
+    if (query.status) {
+      whereClause += ` AND status = $${paramIndex++}`;
+      params.push(query.status);
+    }
+    if (query.locale) {
+      whereClause += ` AND locale = $${paramIndex++}`;
+      params.push(query.locale);
+    }
+    if (query.search) {
+      whereClause += ` AND data::text ILIKE $${paramIndex++}`;
+      params.push(`%${query.search}%`);
+    }
+
+    // Count total
+    const countResult = await db.query(
+      `SELECT COUNT(*) FROM documents ${whereClause}`,
+      params
+    );
+    const total = parseInt(countResult.rows[0].count);
+
+    // Get documents
+    const allowedOrderBy = ['created_at', 'updated_at', 'published_at'];
+    const orderByColumn = allowedOrderBy.includes(query.orderBy) ? query.orderBy : 'created_at';
+    const orderDirection = query.order === 'asc' ? 'ASC' : 'DESC';
+
+    params.push(query.limit, offset);
+
+    const result = await db.query(
+      `SELECT d.*, s.title as schema_title, u.name as created_by_name
+       FROM documents d
+       LEFT JOIN schemas s ON d.schema_name = s.name
+       LEFT JOIN users u ON d.created_by = u.id
+       ${whereClause}
+       ORDER BY d.${orderByColumn} ${orderDirection}
+       LIMIT $${paramIndex++} OFFSET $${paramIndex}`,
+      params
+    );
+
+    return {
+      documents: result.rows,
+      pagination: {
+        page: query.page,
+        limit: query.limit,
+        total,
+        totalPages: Math.ceil(total / query.limit),
+      },
+    };
+  });
+
+  // Get single document
+  fastify.get('/:id', {
+    schema: {
+      tags: ['Content'],
+      summary: 'Get document by ID',
+    },
+  }, async (request, reply) => {
+    const { id } = request.params as { id: string };
+
+    const result = await db.query(
+      `SELECT d.*, s.title as schema_title, s.definition as schema_definition,
+              u1.name as created_by_name, u2.name as updated_by_name
+       FROM documents d
+       LEFT JOIN schemas s ON d.schema_name = s.name
+       LEFT JOIN users u1 ON d.created_by = u1.id
+       LEFT JOIN users u2 ON d.updated_by = u2.id
+       WHERE d.id = $1`,
+      [id]
+    );
+
+    if (result.rows.length === 0) {
+      return reply.status(404).send({ error: true, message: 'Document not found' });
+    }
+
+    return { document: result.rows[0] };
+  });
+
+  // Create document
+  fastify.post('/', {
+    schema: {
+      tags: ['Content'],
+      summary: 'Create a new document',
+      security: [{ bearerAuth: [] }],
+    },
+    preHandler: [fastify.authenticate],
+  }, async (request, reply) => {
+    const body = createDocumentSchema.parse(request.body);
+    const user = request.user as { id: string };
+
+    // Verify schema exists
+    const schemaResult = await db.query(
+      'SELECT id, is_singleton FROM schemas WHERE name = $1',
+      [body.schemaName]
+    );
+
+    if (schemaResult.rows.length === 0) {
+      return reply.status(400).send({ error: true, message: 'Schema not found' });
+    }
+
+    const schema = schemaResult.rows[0];
+
+    // Check singleton
+    if (schema.is_singleton) {
+      const existingDoc = await db.query(
+        'SELECT id FROM documents WHERE schema_name = $1 AND locale = $2',
+        [body.schemaName, body.locale]
+      );
+      if (existingDoc.rows.length > 0) {
+        return reply.status(400).send({ 
+          error: true, 
+          message: 'Singleton document already exists for this locale' 
+        });
+      }
+    }
+
+    const documentId = uuid();
+    const publishedAt = body.status === 'published' ? new Date() : null;
+
+    const result = await db.query(
+      `INSERT INTO documents (id, schema_name, data, locale, status, published_at, created_by, updated_by) 
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $7) 
+       RETURNING *`,
+      [documentId, body.schemaName, body.data, body.locale, body.status, publishedAt, user.id]
+    );
+
+    // Create initial version
+    await db.query(
+      `INSERT INTO document_versions (document_id, version, data, locale, created_by) 
+       VALUES ($1, 1, $2, $3, $4)`,
+      [documentId, body.data, body.locale, user.id]
+    );
+
+    // Publish event for real-time
+    await redis.publish('content:created', {
+      documentId,
+      schemaName: body.schemaName,
+      userId: user.id,
+    });
+
+    return { document: result.rows[0] };
+  });
+
+  // Update document
+  fastify.put('/:id', {
+    schema: {
+      tags: ['Content'],
+      summary: 'Update a document',
+      security: [{ bearerAuth: [] }],
+    },
+    preHandler: [fastify.authenticate],
+  }, async (request, reply) => {
+    const { id } = request.params as { id: string };
+    const body = updateDocumentSchema.parse(request.body);
+    const user = request.user as { id: string };
+
+    // Get current document
+    const currentDoc = await db.query(
+      'SELECT * FROM documents WHERE id = $1',
+      [id]
+    );
+
+    if (currentDoc.rows.length === 0) {
+      return reply.status(404).send({ error: true, message: 'Document not found' });
+    }
+
+    const doc = currentDoc.rows[0];
+
+    // Build update query
+    const updates: string[] = ['updated_by = $1'];
+    const values: any[] = [user.id];
+    let paramIndex = 2;
+
+    if (body.data) {
+      updates.push(`data = $${paramIndex++}`);
+      values.push(body.data);
+    }
+    if (body.locale) {
+      updates.push(`locale = $${paramIndex++}`);
+      values.push(body.locale);
+    }
+    if (body.status) {
+      updates.push(`status = $${paramIndex++}`);
+      values.push(body.status);
+      if (body.status === 'published' && doc.status !== 'published') {
+        updates.push(`published_at = CURRENT_TIMESTAMP`);
+      }
+    }
+
+    values.push(id);
+
+    const result = await db.query(
+      `UPDATE documents SET ${updates.join(', ')} WHERE id = $${paramIndex} RETURNING *`,
+      values
+    );
+
+    // Create new version if data changed
+    if (body.data) {
+      const versionResult = await db.query(
+        'SELECT MAX(version) as max_version FROM document_versions WHERE document_id = $1',
+        [id]
+      );
+      const newVersion = (versionResult.rows[0].max_version || 0) + 1;
+
+      await db.query(
+        `INSERT INTO document_versions (document_id, version, data, locale, created_by) 
+         VALUES ($1, $2, $3, $4, $5)`,
+        [id, newVersion, body.data, body.locale || doc.locale, user.id]
+      );
+    }
+
+    // Publish event for real-time
+    await redis.publish('content:updated', {
+      documentId: id,
+      schemaName: doc.schema_name,
+      userId: user.id,
+    });
+
+    return { document: result.rows[0] };
+  });
+
+  // Delete document
+  fastify.delete('/:id', {
+    schema: {
+      tags: ['Content'],
+      summary: 'Delete a document',
+      security: [{ bearerAuth: [] }],
+    },
+    preHandler: [fastify.authenticate],
+  }, async (request, reply) => {
+    const { id } = request.params as { id: string };
+    const user = request.user as { id: string };
+
+    const doc = await db.query(
+      'SELECT schema_name FROM documents WHERE id = $1',
+      [id]
+    );
+
+    if (doc.rows.length === 0) {
+      return reply.status(404).send({ error: true, message: 'Document not found' });
+    }
+
+    await db.query('DELETE FROM documents WHERE id = $1', [id]);
+
+    // Publish event for real-time
+    await redis.publish('content:deleted', {
+      documentId: id,
+      schemaName: doc.rows[0].schema_name,
+      userId: user.id,
+    });
+
+    return { success: true, message: 'Document deleted' };
+  });
+
+  // Get document versions
+  fastify.get('/:id/versions', {
+    schema: {
+      tags: ['Content'],
+      summary: 'Get document version history',
+    },
+  }, async (request, reply) => {
+    const { id } = request.params as { id: string };
+
+    const doc = await db.query('SELECT id FROM documents WHERE id = $1', [id]);
+    if (doc.rows.length === 0) {
+      return reply.status(404).send({ error: true, message: 'Document not found' });
+    }
+
+    const result = await db.query(
+      `SELECT v.*, u.name as created_by_name 
+       FROM document_versions v
+       LEFT JOIN users u ON v.created_by = u.id
+       WHERE v.document_id = $1 
+       ORDER BY v.version DESC`,
+      [id]
+    );
+
+    return { versions: result.rows };
+  });
+
+  // Restore document version
+  fastify.post('/:id/versions/:version/restore', {
+    schema: {
+      tags: ['Content'],
+      summary: 'Restore document to a specific version',
+      security: [{ bearerAuth: [] }],
+    },
+    preHandler: [fastify.authenticate],
+  }, async (request, reply) => {
+    const { id, version } = request.params as { id: string; version: string };
+    const user = request.user as { id: string };
+
+    const versionResult = await db.query(
+      'SELECT * FROM document_versions WHERE document_id = $1 AND version = $2',
+      [id, parseInt(version)]
+    );
+
+    if (versionResult.rows.length === 0) {
+      return reply.status(404).send({ error: true, message: 'Version not found' });
+    }
+
+    const versionData = versionResult.rows[0];
+
+    // Update document with version data
+    const result = await db.query(
+      `UPDATE documents SET data = $1, updated_by = $2 WHERE id = $3 RETURNING *`,
+      [versionData.data, user.id, id]
+    );
+
+    // Create new version for the restore action
+    const maxVersionResult = await db.query(
+      'SELECT MAX(version) as max_version FROM document_versions WHERE document_id = $1',
+      [id]
+    );
+    const newVersion = (maxVersionResult.rows[0].max_version || 0) + 1;
+
+    await db.query(
+      `INSERT INTO document_versions (document_id, version, data, locale, change_summary, created_by) 
+       VALUES ($1, $2, $3, $4, $5, $6)`,
+      [id, newVersion, versionData.data, versionData.locale, `Restored to version ${version}`, user.id]
+    );
+
+    return { document: result.rows[0] };
+  });
+};