dineway 0.1.9 → 0.1.11

package/dist/public-url-BB_umF5G.mjs

@@ -0,0 +1,71 @@
+//#region src/api/public-url.ts
+/**
+* Resolve siteUrl from runtime environment variables.
+*
+* Uses process.env (not import.meta.env) because Vite statically replaces
+* import.meta.env at build time, baking out any env vars not present during
+* the build. Container deployments set env vars at runtime, so we must read
+* process.env which Vite leaves untouched.
+*
+* On runtimes without `process.env`, the fallback chain
+* continues to url.origin.
+*
+* Caches after first call.
+*/
+let _envSiteUrl = null;
+let _envAllowedOrigins = null;
+function getEnvSiteUrl() {
+	if (_envSiteUrl !== null) return _envSiteUrl || void 0;
+	try {
+		const value = typeof process !== "undefined" && process.env?.DINEWAY_SITE_URL || typeof process !== "undefined" && process.env?.SITE_URL || "";
+		if (value) {
+			const parsed = new URL(value);
+			if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+				_envSiteUrl = "";
+				return;
+			}
+			_envSiteUrl = parsed.origin;
+		} else _envSiteUrl = "";
+	} catch {
+		_envSiteUrl = "";
+	}
+	return _envSiteUrl || void 0;
+}
+function getEnvAllowedOrigins() {
+	if (_envAllowedOrigins !== null) return _envAllowedOrigins;
+	const envSource = typeof process !== "undefined" && process.env?.DINEWAY_ALLOWED_ORIGINS ? "DINEWAY_ALLOWED_ORIGINS" : "ALLOWED_ORIGINS";
+	const raw = typeof process !== "undefined" && process.env?.DINEWAY_ALLOWED_ORIGINS || typeof process !== "undefined" && process.env?.ALLOWED_ORIGINS || "";
+	const parsed = [];
+	for (const entry of raw.split(",")) {
+		const trimmed = entry.trim();
+		if (!trimmed) continue;
+		let url;
+		try {
+			url = new URL(trimmed);
+		} catch (error) {
+			throw new Error(`Dineway config error in ${envSource}: invalid URL: "${trimmed}"`, { cause: error });
+		}
+		if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`Dineway config error in ${envSource}: origin must be http or https: "${trimmed}" (got ${url.protocol})`);
+		parsed.push(url.origin);
+	}
+	_envAllowedOrigins = parsed;
+	return parsed;
+}
+/**
+* Return the public-facing origin for the site.
+*
+* Resolution order:
+*   1. `config.siteUrl` (set in astro.config.mjs, origin-normalized at startup)
+*   2. `DINEWAY_SITE_URL` or `SITE_URL` env var (resolved at runtime for containers)
+*   3. `url.origin` (internal request URL — correct when no proxy)
+*
+* @param url  The request URL (`new URL(request.url)` or `Astro.url`)
+* @param config  The Dineway config (from `locals.dineway?.config`)
+* @returns Origin string, e.g. `"https://mysite.example.com"`
+*/
+function getPublicOrigin(url, config) {
+	return config?.siteUrl || getEnvSiteUrl() || url.origin;
+}
+
+//#endregion
+export { getPublicOrigin as n, getEnvAllowedOrigins as t };

package/dist/{query-kDmwCsHh.mjs → query-RiobVwB5.mjs}

@@ -1,8 +1,10 @@
 import { t as __exportAll } from "./chunk-ClPoSABd.mjs";
 import { getRequestContext } from "./request-context.mjs";
-import { n as getI18nConfig, r as isI18nEnabled, t as getFallbackChain } from "./config-BXwuX8Bx.mjs";
-import { n as requestCached } from "./request-cache-Dk5qPSOx.mjs";
-import { t as isMissingTableError } from "./db-errors-CEqD7qH9.mjs";
+import { r as encodeCursor } from "./types-Bs6lTBBW.mjs";
+import { n as getI18nConfig, r as isI18nEnabled, t as getFallbackChain } from "./config-CAMFxGaV.mjs";
+import { t as CURSOR_RAW_VALUES } from "./loader-PZnPxFLc.mjs";
+import { n as requestCached } from "./request-cache-DHMRr2Lf.mjs";
+import { t as isMissingTableError } from "./db-errors-DKUg_NgF.mjs";
 
 //#region src/visual-editing/editable.ts
 /**
@@ -74,12 +76,14 @@ function createNoop() {
 * and sets the context; query functions read it automatically.
 */
 var query_exports = /* @__PURE__ */ __exportAll({
+	bucketFilter: () => bucketFilter,
 	getDinewayCollection: () => getDinewayCollection,
 	getDinewayEntry: () => getDinewayEntry,
 	getEditMeta: () => getEditMeta,
 	getTranslations: () => getTranslations,
 	invalidateUrlPatternCache: () => invalidateUrlPatternCache,
-	resolveDinewayPath: () => resolveDinewayPath
+	resolveDinewayPath: () => resolveDinewayPath,
+	sliceCollectionResult: () => sliceCollectionResult
 });
 const COLLECTION_NAME = "_dineway";
 /** Symbol key for edit metadata on PT arrays — avoids collision with user data */
@@ -172,15 +176,16 @@ async function getDinewayCollection(type, filter) {
 	const ctx = getRequestContext();
 	const i18nConfig = getI18nConfig();
 	const resolvedLocale = filter?.locale ?? ctx?.locale ?? (isI18nEnabled() ? i18nConfig.defaultLocale : void 0);
-	return requestCached(collectionCacheKey(type, filter, resolvedLocale), async () => {
+	const bucketed = bucketFilter(filter);
+	const cached = await requestCached(collectionCacheKey(type, bucketed.fetchFilter, resolvedLocale), async () => {
 		const { getLiveCollection } = await import("astro:content");
 		const result = await getLiveCollection(COLLECTION_NAME, {
 			type,
-			status: filter?.status,
-			limit: filter?.limit,
-			cursor: filter?.cursor,
-			where: filter?.where,
-			orderBy: filter?.orderBy,
+			status: bucketed.fetchFilter?.status,
+			limit: bucketed.fetchFilter?.limit,
+			cursor: bucketed.fetchFilter?.cursor,
+			where: bucketed.fetchFilter?.where,
+			orderBy: bucketed.fetchFilter?.orderBy,
 			locale: resolvedLocale
 		});
 		const { entries, error, cacheHint } = result;
@@ -207,6 +212,68 @@ async function getDinewayCollection(type, filter) {
 			cacheHint: cacheHint ?? {}
 		};
 	});
+	return bucketed.requestedLimit === void 0 ? cached : sliceCollectionResult(cached, bucketed.requestedLimit, filter?.orderBy);
+}
+const BUCKET_LIMIT_THRESHOLD = 10;
+/** @internal exported for unit tests; not part of the public API. */
+function bucketFilter(filter) {
+	const limit = filter?.limit;
+	if (limit === void 0 || limit >= BUCKET_LIMIT_THRESHOLD || limit <= 0 || filter?.cursor !== void 0) return {
+		fetchFilter: filter,
+		requestedLimit: void 0
+	};
+	return {
+		fetchFilter: {
+			...filter,
+			limit: BUCKET_LIMIT_THRESHOLD
+		},
+		requestedLimit: limit
+	};
+}
+/** @internal exported for unit tests; not part of the public API. */
+function sliceCollectionResult(cached, limit, orderBy) {
+	if (cached.error) return cached;
+	if (cached.entries.length <= limit) return cached;
+	const entries = cached.entries.slice(0, limit);
+	const lastEntry = entries.at(-1);
+	const nextCursor = lastEntry ? encodeEntryCursor(lastEntry, orderBy) : void 0;
+	return {
+		...cached,
+		entries,
+		nextCursor
+	};
+}
+const ENTRY_DATA_KEY_MAP = {
+	created_at: "createdAt",
+	updated_at: "updatedAt",
+	published_at: "publishedAt",
+	scheduled_at: "scheduledAt",
+	author_id: "authorId",
+	primary_byline_id: "primaryBylineId"
+};
+const FIELD_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+function encodeEntryCursor(entry, orderBy) {
+	const data = entryData(entry);
+	const id = dataStr(data, "id");
+	if (!id) return void 0;
+	let dbField = "created_at";
+	if (orderBy) {
+		for (const field of Object.keys(orderBy)) if (FIELD_NAME_PATTERN.test(field)) {
+			dbField = field;
+			break;
+		}
+	}
+	const rawDateValuesRaw = Reflect.get(data, CURSOR_RAW_VALUES);
+	if (rawDateValuesRaw !== null && typeof rawDateValuesRaw === "object") {
+		const raw = Reflect.get(rawDateValuesRaw, dbField);
+		if (typeof raw === "string") return encodeCursor(raw, id);
+	}
+	const value = data[ENTRY_DATA_KEY_MAP[dbField] ?? dbField];
+	let orderValue;
+	if (value instanceof Date) orderValue = value.toISOString();
+	else if (typeof value === "string" || typeof value === "number") orderValue = String(value);
+	else orderValue = "";
+	return encodeCursor(orderValue, id);
 }
 function collectionCacheKey(type, filter, locale) {
 	return `collection:${type}:${[
@@ -369,10 +436,17 @@ async function getDinewayEntry(type, id, options) {
 async function hydrateEntryBylines(type, entries) {
 	if (entries.length === 0) return;
 	try {
-		const { getBylinesForEntries } = await import("./bylines-BGpD9_hy.mjs").then((n) => n.t);
-		const ids = entries.map((e) => dataStr(entryData(e), "id")).filter(Boolean);
-		if (ids.length === 0) return;
-		const bylinesMap = await getBylinesForEntries(type, ids);
+		const { getBylinesForEntries } = await import("./bylines-BcOPh6Ej.mjs").then((n) => n.t);
+		const refs = entries.map((entry) => {
+			const data = entryData(entry);
+			const id = dataStr(data, "id");
+			return id ? {
+				id,
+				authorId: dataStr(data, "authorId") || null
+			} : null;
+		}).filter((ref) => ref !== null);
+		if (refs.length === 0) return;
+		const bylinesMap = await getBylinesForEntries(type, refs);
 		for (const entry of entries) {
 			const data = entryData(entry);
 			const dbId = dataStr(data, "id");
@@ -391,7 +465,7 @@ async function hydrateEntryBylines(type, entries) {
 async function hydrateEntryTerms(type, entries) {
 	if (entries.length === 0) return;
 	try {
-		const { getAllTermsForEntries } = await import("./taxonomies-1s5PaS_8.mjs").then((n) => n.c);
+		const { getAllTermsForEntries } = await import("./taxonomies-BvBgfzn3.mjs").then((n) => n.l);
 		const ids = entries.map((entry) => dataStr(entryData(entry), "id")).filter(Boolean);
 		if (ids.length === 0) return;
 		const termsMap = await getAllTermsForEntries(type, ids);
@@ -425,9 +499,9 @@ async function hydrateEntryTerms(type, entries) {
 */
 async function getTranslations(type, id) {
 	try {
-		const db = (await import("./loader-sMG4TZ-u.mjs").then((n) => n.r)).getDb;
+		const db = (await import("./loader-PZnPxFLc.mjs").then((n) => n.i)).getDb;
 		const dbInstance = await db();
-		const { ContentRepository } = await import("./content-DWi4d0rT.mjs").then((n) => n.n);
+		const { ContentRepository } = await import("./content-CyLkb-qH.mjs").then((n) => n.n);
 		const repo = new ContentRepository(dbInstance);
 		const item = await repo.findByIdOrSlug(type, id);
 		if (!item) return {
@@ -494,8 +568,8 @@ async function resolveDinewayPath(path) {
 	const hasDbOverride = !!getRequestContext()?.db;
 	let patterns = !hasDbOverride ? cachedUrlPatterns : null;
 	if (!patterns) {
-		const { getDb } = await import("./loader-sMG4TZ-u.mjs").then((n) => n.r);
-		const { SchemaRegistry } = await import("./registry-C0zjeB9P.mjs").then((n) => n.r);
+		const { getDb } = await import("./loader-PZnPxFLc.mjs").then((n) => n.i);
+		const { SchemaRegistry } = await import("./registry-C-_hxLqa.mjs").then((n) => n.r);
 		patterns = (await new SchemaRegistry(await getDb()).listCollections()).filter((collection) => collection.urlPattern).map((collection) => {
 			const { regex, paramNames } = patternToRegex(collection.urlPattern);
 			return {

package/dist/rate-limit-CbJoj_fT.mjs

@@ -0,0 +1,112 @@
+import { t as apiError } from "./error-DEGjx2Xw.mjs";
+import { n as normalizeTrustedHeaders } from "./trusted-proxy-Bi0Cuk5n.mjs";
+import { sql } from "kysely";
+
+//#region src/auth/rate-limit.ts
+/** Loose validation for IPv4 and IPv6 addresses. */
+const IP_PATTERN = /^[\da-fA-F.:]+$/;
+/**
+* Check (and increment) the rate limit for a given IP + endpoint.
+*
+* If `ip` is null (no trusted IP available), rate limiting is skipped
+* and the request is allowed. There's no meaningful key to rate limit
+* on when the IP is unknown.
+*
+* Returns whether the request is allowed. The counter is always
+* incremented — even when the limit is exceeded — so that repeated
+* abuse doesn't reset the window.
+*
+* Piggybacks cleanup of expired entries with a 1% probability
+* to prevent unbounded table growth.
+*/
+async function checkRateLimit(db, ip, endpoint, maxRequests, windowSeconds) {
+	if (!ip) return {
+		allowed: true,
+		count: 0,
+		limit: maxRequests
+	};
+	const windowStart = (/* @__PURE__ */ new Date(Math.floor(Date.now() / (windowSeconds * 1e3)) * windowSeconds * 1e3)).toISOString();
+	const count = (await sql`
+		INSERT INTO _dineway_rate_limits (key, window, count)
+		VALUES (${`${ip}:${endpoint}`}, ${windowStart}, 1)
+		ON CONFLICT (key, window)
+		DO UPDATE SET count = _dineway_rate_limits.count + 1
+		RETURNING count
+	`.execute(db)).rows[0]?.count ?? 1;
+	if (Math.random() < .01) cleanupExpiredRateLimits(db).catch(() => {});
+	return {
+		allowed: count <= maxRequests,
+		count,
+		limit: maxRequests
+	};
+}
+/**
+* Build a 429 Too Many Requests response with standard headers.
+*/
+function rateLimitResponse(retryAfterSeconds) {
+	const response = apiError("RATE_LIMITED", "Too many requests. Please try again later.", 429);
+	response.headers.set("Retry-After", String(retryAfterSeconds));
+	return response;
+}
+/**
+* Extract client IP from a Request.
+*
+* Resolution order:
+* 1. `CF-Connecting-IP` — trusted only when a runtime `cf` object is present.
+* 2. `X-Forwarded-For` (first entry) — also trusted only when that runtime
+*    metadata is present.
+* 3. Operator-declared trusted proxy headers — used for self-hosted Node
+*    deployments behind a reverse proxy the operator controls.
+* 4. `null` — no trusted IP available. Callers must handle this gracefully
+*    (e.g. skip rate limiting).
+*
+* Aligned with `extractRequestMeta` in `plugins/request-meta.ts`.
+*/
+function getClientIp(request, trustedHeaders = []) {
+	const headers = request.headers;
+	if (request.cf) {
+		const cfIp = headers.get("cf-connecting-ip")?.trim();
+		if (cfIp && IP_PATTERN.test(cfIp)) return cfIp;
+		const xff = headers.get("x-forwarded-for");
+		if (xff) {
+			const first = xff.split(",")[0]?.trim();
+			if (first && IP_PATTERN.test(first)) return first;
+		}
+	}
+	for (const name of normalizeTrustedHeaders(trustedHeaders)) {
+		const ip = readIpFromHeader(headers, name);
+		if (ip) return ip;
+	}
+	return null;
+}
+/**
+* Read an IP from an operator-declared trusted header. Forwarded-for style
+* headers are parsed as comma-separated lists and the first entry is used.
+*/
+function readIpFromHeader(headers, name) {
+	const value = headers.get(name);
+	if (!value) return null;
+	if (name.endsWith("forwarded-for")) {
+		const first = value.split(",")[0]?.trim();
+		if (!first) return null;
+		return IP_PATTERN.test(first) ? first : null;
+	}
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	return IP_PATTERN.test(trimmed) ? trimmed : null;
+}
+/**
+* Delete expired rate limit entries.
+*
+* Entries with a window timestamp older than `maxAgeSeconds` are removed.
+* Safe to call periodically (e.g., from cron cleanup or on-request piggyback).
+*/
+async function cleanupExpiredRateLimits(db, maxAgeSeconds = 3600) {
+	const result = await sql`
+		DELETE FROM _dineway_rate_limits WHERE window < ${(/* @__PURE__ */ new Date(Date.now() - maxAgeSeconds * 1e3)).toISOString()}
+	`.execute(db);
+	return Number(result.numAffectedRows ?? 0);
+}
+
+//#endregion
+export { getClientIp as n, rateLimitResponse as r, checkRateLimit as t };

package/dist/{redirect-DnEWAkVg.mjs → redirect-CGl64yOX.mjs}

@@ -1,6 +1,6 @@
 import { r as currentTimestampValue } from "./dialect-helpers-DhTzaUxP.mjs";
-import { n as decodeCursor, r as encodeCursor } from "./types-BawVha09.mjs";
-import { i as matchPattern, n as interpolateDestination, r as isPattern, t as compilePattern } from "./patterns-CrCYkMBb.mjs";
+import { n as decodeCursor, r as encodeCursor } from "./types-Bs6lTBBW.mjs";
+import { i as matchPattern, n as interpolateDestination, r as isPattern, t as compilePattern } from "./patterns-K0DLqWir.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 
@@ -14,6 +14,7 @@ const MAX_404_LOG_ROWS = 1e4;
 const REFERRER_MAX_LENGTH = 512;
 /** Max stored length for the `User-Agent` header. */
 const USER_AGENT_MAX_LENGTH = 256;
+const LIKE_ESCAPE_RE = /[\\%_]/g;
 function truncateOrNull(value, max) {
 	if (value === null || value === void 0) return null;
 	return value.length > max ? value.slice(0, max) : value;
@@ -50,8 +51,8 @@ var RedirectRepository = class {
 		const limit = Math.min(Math.max(opts.limit ?? 50, 1), 100);
 		let query = this.db.selectFrom("_dineway_redirects").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
 		if (opts.search) {
-			const term = `%${opts.search}%`;
-			query = query.where((eb) => eb.or([eb("source", "like", term), eb("destination", "like", term)]));
+			const term = `%${opts.search.replace(LIKE_ESCAPE_RE, (ch) => `\\${ch}`)}%`;
+			query = query.where((eb) => eb.or([sql`source LIKE ${term} ESCAPE '\\'`, sql`destination LIKE ${term} ESCAPE '\\'`]));
 		}
 		if (opts.group !== void 0) query = query.where("group_name", "=", opts.group);
 		if (opts.enabled !== void 0) query = query.where("enabled", "=", opts.enabled ? 1 : 0);
@@ -210,7 +211,10 @@ var RedirectRepository = class {
 	async find404s(opts) {
 		const limit = Math.min(Math.max(opts.limit ?? 50, 1), 100);
 		let query = this.db.selectFrom("_dineway_404_log").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
-		if (opts.search) query = query.where("path", "like", `%${opts.search}%`);
+		if (opts.search) {
+			const term = `%${opts.search.replace(LIKE_ESCAPE_RE, (ch) => `\\${ch}`)}%`;
+			query = query.where(sql`path LIKE ${term} ESCAPE '\\'`);
+		}
 		if (opts.cursor) {
 			const decoded = decodeCursor(opts.cursor);
 			if (decoded) query = query.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));

package/dist/redirect-ClSmMOtC.mjs

@@ -0,0 +1,16 @@
+//#region src/api/redirect.ts
+/**
+* Validate that a redirect URL is a safe local path.
+*
+* Rejects:
+* - Protocol-relative URLs (`//evil.com`)
+* - Backslash bypass (`/\evil.com` — browsers normalize `\` to `/` in Location headers)
+* - Absolute URLs (`https://evil.com`)
+* - Empty / nullish values
+*/
+function isSafeRedirect(url) {
+	return typeof url === "string" && url.startsWith("/") && !url.startsWith("//") && !url.includes("\\");
+}
+
+//#endregion
+export { isSafeRedirect as t };