dineway 0.1.8 → 0.1.11

package/src/astro/routes/api/taxonomies/[name]/terms/[slug].ts

@@ -1,232 +0,0 @@
-/**
- * Single term endpoint
- *
- * GET /_dineway/api/taxonomies/:name/terms/:slug - Get a single term
- * PUT /_dineway/api/taxonomies/:name/terms/:slug - Update a term
- * DELETE /_dineway/api/taxonomies/:name/terms/:slug - Delete a term
- */
-
-import type { APIRoute } from "astro";
-import { z } from "zod";
-
-import { requirePerm } from "#api/authorize.js";
-import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
-import { handleTermDelete, handleTermGet, handleTermUpdate } from "#api/handlers/taxonomies.js";
-import {
-	ensureWorkflowHitlRouteRequest,
-	hitlRequiredRouteError,
-	resolveHitlRouteActor,
-} from "#api/hitl-route-helpers.js";
-import { isParseError, parseBody, parseQuery } from "#api/parse.js";
-import { updateTermBody } from "#api/schemas.js";
-import {
-	activityChangedKeys,
-	logTaxonomyActivity,
-	RiskPolicyEvaluator,
-	taxonomyApiRouteSource,
-	TaxonomyHitlPayloadBuilder,
-} from "#site-context/index.js";
-
-export const prerender = false;
-
-const updateTermHitlBody = updateTermBody.extend({
-	hitlRequestId: z.string().min(1).optional(),
-});
-
-const deleteTermQuery = z.object({
-	hitlRequestId: z.string().min(1).optional(),
-});
-
-/**
- * Get a single term
- */
-export const GET: APIRoute = async ({ params, locals }) => {
-	const { dineway, user } = locals;
-	const { name, slug } = params;
-
-	if (!name || !slug) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
-	}
-
-	const dbErr = requireDb(dineway?.db);
-	if (dbErr) return dbErr;
-
-	const denied = requirePerm(user, "taxonomies:read");
-	if (denied) return denied;
-
-	try {
-		const result = await handleTermGet(dineway.db, name, slug);
-		return unwrapResult(result);
-	} catch (error) {
-		return handleError(error, "Failed to get term", "TERM_GET_ERROR");
-	}
-};
-
-/**
- * Update a term
- */
-export const PUT: APIRoute = async ({ params, request, locals }) => {
-	const { dineway, user } = locals;
-	const { name, slug } = params;
-
-	if (!name || !slug) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
-	}
-
-	const dbErr = requireDb(dineway?.db);
-	if (dbErr) return dbErr;
-
-	const denied = requirePerm(user, "taxonomies:manage");
-	if (denied) return denied;
-
-	try {
-		const body = await parseBody(request, updateTermHitlBody);
-		if (isParseError(body)) return body;
-
-		const current = await handleTermGet(dineway.db, name, slug);
-		if (!current.success) return unwrapResult(current);
-
-		const { hitlRequestId, ...termInput } = body;
-		const actor = resolveHitlRouteActor(locals);
-		const evaluator = new RiskPolicyEvaluator({
-			db: dineway.db,
-			handlers: dineway,
-		});
-		let approvedHitlRequestId: string | null = null;
-
-		if (evaluator.requiresWorkflowHitl(actor.identity)) {
-			const payloadBuilder = new TaxonomyHitlPayloadBuilder(dineway.db);
-			const taxonomy = await payloadBuilder.loadTaxonomyDefinition(name);
-			if (!taxonomy) {
-				return apiError("NOT_FOUND", `Taxonomy '${name}' not found`, 404);
-			}
-
-			const action = await payloadBuilder.buildUpdateTermRequest({
-				taxonomy,
-				currentTerm: {
-					id: current.data.term.id,
-					name: current.data.term.name,
-					slug: current.data.term.slug,
-					label: current.data.term.label,
-					parentId: current.data.term.parentId,
-					description: current.data.term.description ?? null,
-				},
-				...termInput,
-			});
-			const decision = await evaluator.evaluateWorkflowHitl({
-				actor: actor.identity,
-				hitlRequestId,
-				action,
-			});
-			if (!decision.allowed) {
-				const ensured = await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action);
-				return hitlRequiredRouteError(decision, ensured);
-			}
-			approvedHitlRequestId = decision.hitlRequest.id;
-		}
-
-		const result = await handleTermUpdate(dineway.db, name, slug, termInput);
-		if (result.success) {
-			await logTaxonomyActivity(dineway.db, locals, {
-				action: "term_updated",
-				taxonomyName: name,
-				termId: result.data.term.id,
-				termSlug: result.data.term.slug,
-				...taxonomyApiRouteSource("term_updated"),
-				detail: {
-					changedKeys: activityChangedKeys(termInput),
-					label: result.data.term.label,
-					parentId: result.data.term.parentId,
-					description: result.data.term.description ?? null,
-					hitlRequestId: approvedHitlRequestId,
-				},
-			});
-		}
-		return unwrapResult(result);
-	} catch (error) {
-		return handleError(error, "Failed to update term", "TERM_UPDATE_ERROR");
-	}
-};
-
-/**
- * Delete a term
- */
-export const DELETE: APIRoute = async ({ params, request, locals }) => {
-	const { dineway, user } = locals;
-	const { name, slug } = params;
-
-	if (!name || !slug) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name and slug required", 400);
-	}
-
-	const dbErr = requireDb(dineway?.db);
-	if (dbErr) return dbErr;
-
-	const denied = requirePerm(user, "taxonomies:manage");
-	if (denied) return denied;
-
-	const query = parseQuery(new URL(request.url), deleteTermQuery);
-	if (isParseError(query)) return query;
-
-	try {
-		const current = await handleTermGet(dineway.db, name, slug);
-		if (!current.success) return unwrapResult(current);
-
-		const actor = resolveHitlRouteActor(locals);
-		const evaluator = new RiskPolicyEvaluator({
-			db: dineway.db,
-			handlers: dineway,
-		});
-		let approvedHitlRequestId: string | null = null;
-
-		if (evaluator.requiresWorkflowHitl(actor.identity)) {
-			const payloadBuilder = new TaxonomyHitlPayloadBuilder(dineway.db);
-			const taxonomy = await payloadBuilder.loadTaxonomyDefinition(name);
-			if (!taxonomy) {
-				return apiError("NOT_FOUND", `Taxonomy '${name}' not found`, 404);
-			}
-
-			const action = await payloadBuilder.buildDeleteTermRequest({
-				taxonomy,
-				currentTerm: {
-					id: current.data.term.id,
-					name: current.data.term.name,
-					slug: current.data.term.slug,
-					label: current.data.term.label,
-					parentId: current.data.term.parentId,
-					description: current.data.term.description ?? null,
-				},
-			});
-			const decision = await evaluator.evaluateWorkflowHitl({
-				actor: actor.identity,
-				hitlRequestId: query.hitlRequestId,
-				action,
-			});
-			if (!decision.allowed) {
-				const ensured = await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action);
-				return hitlRequiredRouteError(decision, ensured);
-			}
-			approvedHitlRequestId = decision.hitlRequest.id;
-		}
-
-		const result = await handleTermDelete(dineway.db, name, slug);
-		if (result.success) {
-			await logTaxonomyActivity(dineway.db, locals, {
-				action: "term_deleted",
-				taxonomyName: name,
-				termId: current.data.term.id,
-				termSlug: current.data.term.slug,
-				...taxonomyApiRouteSource("term_deleted"),
-				detail: {
-					label: current.data.term.label,
-					parentId: current.data.term.parentId,
-					description: current.data.term.description ?? null,
-					hitlRequestId: approvedHitlRequestId,
-				},
-			});
-		}
-		return unwrapResult(result);
-	} catch (error) {
-		return handleError(error, "Failed to delete term", "TERM_DELETE_ERROR");
-	}
-};

package/src/astro/routes/api/taxonomies/[name]/terms/index.ts

@@ -1,131 +0,0 @@
-/**
- * Taxonomy terms list and create endpoint
- *
- * GET /_dineway/api/taxonomies/:name/terms - List all terms (tree for hierarchical)
- * POST /_dineway/api/taxonomies/:name/terms - Create a new term
- */
-
-import type { APIRoute } from "astro";
-import { z } from "zod";
-
-import { requirePerm } from "#api/authorize.js";
-import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
-import { handleTermCreate, handleTermList } from "#api/handlers/taxonomies.js";
-import {
-	ensureWorkflowHitlRouteRequest,
-	hitlRequiredRouteError,
-	resolveHitlRouteActor,
-} from "#api/hitl-route-helpers.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { createTermBody } from "#api/schemas.js";
-import {
-	logTaxonomyActivity,
-	RiskPolicyEvaluator,
-	taxonomyApiRouteSource,
-	TaxonomyHitlPayloadBuilder,
-} from "#site-context/index.js";
-
-export const prerender = false;
-
-const createTermHitlBody = createTermBody.extend({
-	hitlRequestId: z.string().min(1).optional(),
-});
-
-/**
- * List all terms for a taxonomy
- */
-export const GET: APIRoute = async ({ params, locals }) => {
-	const { dineway, user } = locals;
-	const { name } = params;
-
-	if (!name) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
-	}
-
-	const dbErr = requireDb(dineway?.db);
-	if (dbErr) return dbErr;
-
-	const denied = requirePerm(user, "taxonomies:read");
-	if (denied) return denied;
-
-	try {
-		const result = await handleTermList(dineway.db, name);
-		return unwrapResult(result);
-	} catch (error) {
-		return handleError(error, "Failed to list terms", "TERM_LIST_ERROR");
-	}
-};
-
-/**
- * Create a new term
- */
-export const POST: APIRoute = async ({ params, request, locals }) => {
-	const { dineway, user } = locals;
-	const { name } = params;
-
-	if (!name) {
-		return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
-	}
-
-	const dbErr = requireDb(dineway?.db);
-	if (dbErr) return dbErr;
-
-	const denied = requirePerm(user, "taxonomies:manage");
-	if (denied) return denied;
-
-	try {
-		const body = await parseBody(request, createTermHitlBody);
-		if (isParseError(body)) return body;
-
-		const { hitlRequestId, ...termInput } = body;
-		const actor = resolveHitlRouteActor(locals);
-		const evaluator = new RiskPolicyEvaluator({
-			db: dineway.db,
-			handlers: dineway,
-		});
-		let approvedHitlRequestId: string | null = null;
-
-		if (evaluator.requiresWorkflowHitl(actor.identity)) {
-			const payloadBuilder = new TaxonomyHitlPayloadBuilder(dineway.db);
-			const taxonomy = await payloadBuilder.loadTaxonomyDefinition(name);
-			if (!taxonomy) {
-				return apiError("NOT_FOUND", `Taxonomy '${name}' not found`, 404);
-			}
-
-			const action = await payloadBuilder.buildCreateTermRequest({
-				taxonomy,
-				...termInput,
-			});
-			const decision = await evaluator.evaluateWorkflowHitl({
-				actor: actor.identity,
-				hitlRequestId,
-				action,
-			});
-			if (!decision.allowed) {
-				const ensured = await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action);
-				return hitlRequiredRouteError(decision, ensured);
-			}
-			approvedHitlRequestId = decision.hitlRequest.id;
-		}
-
-		const result = await handleTermCreate(dineway.db, name, termInput);
-		if (result.success) {
-			await logTaxonomyActivity(dineway.db, locals, {
-				action: "term_created",
-				taxonomyName: name,
-				termId: result.data.term.id,
-				termSlug: result.data.term.slug,
-				...taxonomyApiRouteSource("term_created"),
-				detail: {
-					label: result.data.term.label,
-					parentId: result.data.term.parentId,
-					description: result.data.term.description ?? null,
-					hitlRequestId: approvedHitlRequestId,
-				},
-			});
-		}
-		return unwrapResult(result, 201);
-	} catch (error) {
-		return handleError(error, "Failed to create term", "TERM_CREATE_ERROR");
-	}
-};

package/src/astro/routes/api/taxonomies/index.ts

@@ -1,114 +0,0 @@
-/**
- * Taxonomy definitions endpoint
- *
- * GET  /_dineway/api/taxonomies - List all taxonomy definitions
- * POST /_dineway/api/taxonomies - Create a custom taxonomy definition
- */
-
-import type { APIRoute } from "astro";
-import { z } from "zod";
-
-import { requirePerm } from "#api/authorize.js";
-import { handleError, requireDb, unwrapResult } from "#api/error.js";
-import { handleTaxonomyCreate, handleTaxonomyList } from "#api/handlers/taxonomies.js";
-import {
-	ensureWorkflowHitlRouteRequest,
-	hitlRequiredRouteError,
-	resolveHitlRouteActor,
-} from "#api/hitl-route-helpers.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { createTaxonomyDefBody } from "#api/schemas.js";
-import {
-	logTaxonomyActivity,
-	RiskPolicyEvaluator,
-	taxonomyApiRouteSource,
-	TaxonomyHitlPayloadBuilder,
-} from "#site-context/index.js";
-
-export const prerender = false;
-
-const createTaxonomyHitlBody = createTaxonomyDefBody.extend({
-	hitlRequestId: z.string().min(1).optional(),
-});
-
-/**
- * List taxonomy definitions
- */
-export const GET: APIRoute = async ({ locals }) => {
-	const { dineway, user } = locals;
-
-	const dbErr = requireDb(dineway?.db);
-	if (dbErr) return dbErr;
-
-	const denied = requirePerm(user, "taxonomies:read");
-	if (denied) return denied;
-
-	try {
-		const result = await handleTaxonomyList(dineway.db);
-		return unwrapResult(result);
-	} catch (error) {
-		return handleError(error, "Failed to list taxonomies", "TAXONOMY_LIST_ERROR");
-	}
-};
-
-/**
- * Create a custom taxonomy definition
- */
-export const POST: APIRoute = async ({ request, locals }) => {
-	const { dineway, user } = locals;
-
-	const dbErr = requireDb(dineway?.db);
-	if (dbErr) return dbErr;
-
-	const denied = requirePerm(user, "taxonomies:manage");
-	if (denied) return denied;
-
-	try {
-		const body = await parseBody(request, createTaxonomyHitlBody);
-		if (isParseError(body)) return body;
-
-		const { hitlRequestId, ...taxonomyInput } = body;
-		const actor = resolveHitlRouteActor(locals);
-		const evaluator = new RiskPolicyEvaluator({
-			db: dineway.db,
-			handlers: dineway,
-		});
-		let approvedHitlRequestId: string | null = null;
-
-		if (evaluator.requiresWorkflowHitl(actor.identity)) {
-			const action = await new TaxonomyHitlPayloadBuilder(dineway.db).buildCreateTaxonomyRequest(
-				taxonomyInput,
-			);
-			const decision = await evaluator.evaluateWorkflowHitl({
-				actor: actor.identity,
-				hitlRequestId,
-				action,
-			});
-			if (!decision.allowed) {
-				const ensured = await ensureWorkflowHitlRouteRequest(dineway.db, locals, decision.action);
-				return hitlRequiredRouteError(decision, ensured);
-			}
-			approvedHitlRequestId = decision.hitlRequest.id;
-		}
-
-		const result = await handleTaxonomyCreate(dineway.db, taxonomyInput);
-		if (result.success) dineway.invalidateManifest();
-		if (result.success) {
-			await logTaxonomyActivity(dineway.db, locals, {
-				action: "created",
-				taxonomyId: result.data.taxonomy.id,
-				taxonomyName: result.data.taxonomy.name,
-				...taxonomyApiRouteSource("created"),
-				detail: {
-					label: result.data.taxonomy.label,
-					hierarchical: result.data.taxonomy.hierarchical,
-					collections: result.data.taxonomy.collections,
-					hitlRequestId: approvedHitlRequestId,
-				},
-			});
-		}
-		return unwrapResult(result, 201);
-	} catch (error) {
-		return handleError(error, "Failed to create taxonomy", "TAXONOMY_CREATE_ERROR");
-	}
-};

package/src/astro/routes/api/themes/preview.ts

@@ -1,78 +0,0 @@
-/**
- * Theme preview signing endpoint
- *
- * POST /_dineway/api/themes/preview
- *
- * Generates a signed preview URL for the "Try with my data" feature.
- * The PREVIEW_SECRET must be set in the environment (shared with the preview sidecar).
- */
-
-import type { APIRoute } from "astro";
-
-import { requirePerm } from "#api/authorize.js";
-import { apiError, apiSuccess } from "#api/error.js";
-import { getPublicOrigin } from "#api/public-url.js";
-
-export const prerender = false;
-
-export const POST: APIRoute = async ({ request, url, locals }) => {
-	const { dineway, user } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
-	}
-
-	const denied = requirePerm(user, "plugins:read");
-	if (denied) return denied;
-
-	const secret = import.meta.env.DINEWAY_PREVIEW_SECRET || import.meta.env.PREVIEW_SECRET || "";
-	if (!secret) {
-		return apiError("NOT_CONFIGURED", "PREVIEW_SECRET is not configured", 500);
-	}
-
-	let body: { previewUrl: string };
-	try {
-		body = await request.json();
-	} catch {
-		return apiError("INVALID_REQUEST", "Invalid JSON body", 400);
-	}
-
-	if (!body.previewUrl || typeof body.previewUrl !== "string") {
-		return apiError("INVALID_REQUEST", "previewUrl is required", 400);
-	}
-
-	// Validate previewUrl is a valid HTTPS URL
-	let parsedPreviewUrl: URL;
-	try {
-		parsedPreviewUrl = new URL(body.previewUrl);
-	} catch {
-		return apiError("INVALID_REQUEST", "previewUrl must be a valid URL", 400);
-	}
-
-	if (parsedPreviewUrl.protocol !== "https:") {
-		return apiError("INVALID_REQUEST", "previewUrl must use HTTPS", 400);
-	}
-
-	const source = getPublicOrigin(url, dineway?.config);
-	const ttl = 3600; // 1 hour
-	const exp = Math.floor(Date.now() / 1000) + ttl;
-
-	// HMAC-SHA256 sign: message = "source:exp"
-	const encoder = new TextEncoder();
-	const key = await crypto.subtle.importKey(
-		"raw",
-		encoder.encode(secret),
-		{ name: "HMAC", hash: "SHA-256" },
-		false,
-		["sign"],
-	);
-	const buffer = await crypto.subtle.sign("HMAC", key, encoder.encode(`${source}:${exp}`));
-	const sig = Array.from(new Uint8Array(buffer), (b) => b.toString(16).padStart(2, "0")).join("");
-
-	const previewUrl = new URL(body.previewUrl);
-	previewUrl.searchParams.set("source", source);
-	previewUrl.searchParams.set("exp", String(exp));
-	previewUrl.searchParams.set("sig", sig);
-
-	return apiSuccess({ url: previewUrl.toString() });
-};

package/src/astro/routes/api/typegen.ts

@@ -1,114 +0,0 @@
-/**
- * Typegen endpoint - generates dineway-env.d.ts content
- *
- * POST /_dineway/api/typegen - Generate types and return as JSON
- * GET /_dineway/api/typegen - Return types as text (for preview/debugging)
- *
- * The caller (integration or CLI) is responsible for writing the file to disk.
- * This endpoint only generates the content — it has no filesystem access, so it
- * stays portable across runtimes where the project root or Node filesystem APIs
- * are not available here.
- *
- * Dev-only endpoint - disabled in production.
- */
-
-import type { APIRoute } from "astro";
-
-import { apiError, apiSuccess, handleError } from "#api/error.js";
-import type { SchemaRegistry } from "#schema/registry.js";
-
-export const prerender = false;
-
-/**
- * Safely list collections, returning empty array if tables don't exist yet
- */
-async function safeListCollections(registry: SchemaRegistry) {
-	try {
-		return await registry.listCollections();
-	} catch (error) {
-		// Handle missing tables for new sites that haven't run setup yet
-		if (error instanceof Error && error.message.includes("no such table")) {
-			return [];
-		}
-		throw error;
-	}
-}
-
-/**
- * Generate types content and metadata from the current schema.
- */
-async function generateTypes(registry: SchemaRegistry) {
-	const { generateTypesFile, generateSchemaHash } = await import("#schema/zod-generator.js");
-
-	const collections = await safeListCollections(registry);
-	const collectionsWithFields = await Promise.all(
-		collections.map(async (c) => {
-			const fields = await registry.listFields(c.id);
-			return { ...c, fields };
-		}),
-	);
-
-	const types = generateTypesFile(collectionsWithFields);
-	const hash: string = await generateSchemaHash(collectionsWithFields);
-
-	return { types, hash, collections: collections.length };
-}
-
-/**
- * GET - Return types as plain text (for preview/debugging)
- */
-export const GET: APIRoute = async ({ locals }) => {
-	if (!import.meta.env.DEV) {
-		return apiError("FORBIDDEN", "Typegen is only available in development", 403);
-	}
-
-	const { dineway } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not configured", 500);
-	}
-
-	try {
-		const { SchemaRegistry } = await import("#schema/registry.js");
-		const registry = new SchemaRegistry(dineway.db);
-		const { types } = await generateTypes(registry);
-
-		return new Response(types, {
-			status: 200,
-			headers: {
-				"Content-Type": "text/typescript",
-				"Cache-Control": "private, no-store",
-			},
-		});
-	} catch (error) {
-		return handleError(error, "Typegen failed", "TYPEGEN_ERROR");
-	}
-};
-
-/**
- * POST - Generate types and return as JSON
- *
- * The caller writes the file to disk. Response shape:
- * { types: string, hash: string, collections: number }
- */
-export const POST: APIRoute = async ({ locals }) => {
-	if (!import.meta.env.DEV) {
-		return apiError("FORBIDDEN", "Typegen is only available in development", 403);
-	}
-
-	const { dineway } = locals;
-
-	if (!dineway?.db) {
-		return apiError("NOT_CONFIGURED", "Dineway is not configured", 500);
-	}
-
-	try {
-		const { SchemaRegistry } = await import("#schema/registry.js");
-		const registry = new SchemaRegistry(dineway.db);
-		const result = await generateTypes(registry);
-
-		return apiSuccess(result);
-	} catch (error) {
-		return handleError(error, "Typegen failed", "TYPEGEN_ERROR");
-	}
-};