domma-cms 0.25.15 → 0.25.16

package/admin/js/templates/docs/api-actions.html

@@ -0,0 +1,146 @@
+<div class="view-header">
+  <h1><span data-icon="code"></span> API · Actions API</h1>
+  <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
+</div>
+<style>
+    .method-badge {
+        display: inline-block;
+        font-size: 11px;
+        font-weight: 700;
+        letter-spacing: 0.5px;
+        padding: 2px 7px;
+        border-radius: 4px;
+        font-family: var(--dm-font-mono, monospace);
+        margin-right: 6px;
+        vertical-align: middle;
+    }
+
+    .method-get {
+        background: #d1fae5;
+        color: #065f46;
+    }
+
+    .method-post {
+        background: #dbeafe;
+        color: #1e40af;
+    }
+
+    .method-put {
+        background: #fef3c7;
+        color: #92400e;
+    }
+
+    .method-patch {
+        background: #ccfbf1;
+        color: #134e4a;
+    }
+
+    .method-delete {
+        background: #fee2e2;
+        color: #991b1b;
+    }
+
+    .endpoint-path {
+        font-family: var(--dm-font-mono, monospace);
+        font-size: 14px;
+    }
+
+    .auth-note {
+        font-size: 12px;
+        color: var(--dm-color-text-muted, #6b7280);
+        margin: 4px 0 12px;
+    }
+
+    .auth-note code {
+        font-size: 11px;
+    }
+
+    .docs-body h3 {
+        margin-top: 24px;
+        margin-bottom: 8px;
+    }
+
+    .docs-body h3:first-child {
+        margin-top: 0;
+    }
+</style>
+
+<div class="row">
+  <div class="col-12">
+    <div class="docs-body">
+
+<p>Actions require a MongoDB connection. All admin endpoints require authentication and the
+                      <code>actions</code> permission. Action configs are stored in <code>cms__actions</code>.</p>
+
+                  <h3 style="margin-top:16px;font-size:15px;text-transform:uppercase;letter-spacing:.5px;opacity:.6">
+                      Admin Endpoints</h3>
+
+                  <h3><span class="method-badge method-get">GET</span><span class="endpoint-path">/api/actions</span>
+                  </h3>
+                  <p class="auth-note">Requires: <code>actions</code> permission</p>
+                  <p>List all action configs.</p>
+
+                  <h3><span class="method-badge method-post">POST</span><span class="endpoint-path">/api/actions</span>
+                  </h3>
+                  <p class="auth-note">Requires: <code>actions</code> permission</p>
+                  <p>Create a new action config. Returns <code>201</code> on success.</p>
+                  <pre class="code-block"><code>{
+  "title": "Approve Application",
+  "slug": "approve-application",
+  "collection": "applications",
+  "trigger": { "type": "manual", "label": "Approve", "icon": "check-circle", "confirmMessage": "Approve this application?" },
+  "steps": [
+    { "type": "updateField", "config": { "field": "status",     "value": "approved" } },
+    { "type": "updateField", "config": { "field": "approvedAt", "value": "{{now}}"  } },
+    { "type": "email",       "config": { "to": "{{entry.data.email}}", "subject": "Application approved",
+                                         "template": "Hi {{entry.data.name}}, your application is approved." } }
+  ],
+  "access": { "roles": ["admin", "manager"] }
+}</code></pre>
+
+                  <h3><span class="method-badge method-get">GET</span><span
+                          class="endpoint-path">/api/actions/:slug</span></h3>
+                  <p class="auth-note">Requires: <code>actions</code> permission</p>
+                  <p>Return a single action config by slug.</p>
+
+                  <h3><span class="method-badge method-put">PUT</span><span
+                          class="endpoint-path">/api/actions/:slug</span></h3>
+                  <p class="auth-note">Requires: <code>actions</code> permission</p>
+                  <p>Update an action config.</p>
+
+                  <h3><span class="method-badge method-delete">DELETE</span><span class="endpoint-path">/api/actions/:slug</span>
+                  </h3>
+                  <p class="auth-note">Requires: <code>actions</code> permission</p>
+                  <p>Delete an action config.</p>
+
+                  <h3><span class="method-badge method-post">POST</span><span class="endpoint-path">/api/actions/:slug/execute</span>
+                  </h3>
+                  <p class="auth-note">Requires: <code>actions</code> permission</p>
+                  <p>Execute an action against a specific entry.</p>
+                  <pre class="code-block"><code>// Request body
+{ "entryId": "uuid-of-the-entry" }
+
+// Response
+{ "success": true, "stepsCompleted": 4, "results": [ { "type": "updateField", "success": true, ... } ] }
+
+// Partial failure
+{ "success": false, "stepsCompleted": 2, "results": [ ..., { "type": "webhook", "success": false, "error": "Webhook returned HTTP 500" } ] }</code></pre>
+
+                  <h3><span class="method-badge method-get">GET</span><span class="endpoint-path">/api/actions/collection/:slug</span>
+                  </h3>
+                  <p class="auth-note">Requires: <code>actions</code> permission</p>
+                  <p>List all action configs targeting a given collection slug. Used by the entry list view to populate
+                      per-row trigger buttons.</p>
+
+                  <h3 style="margin-top:24px;font-size:15px;text-transform:uppercase;letter-spacing:.5px;opacity:.6">
+                      Public Endpoint</h3>
+
+                  <h3><span class="method-badge method-post">POST</span><span class="endpoint-path">/api/actions/:slug/public</span>
+                  </h3>
+                  <p class="auth-note">Requires: JWT + role in <code>access.roles</code></p>
+                  <p>Execute an action publicly. Always requires a valid JWT — the role is checked against <code>access.roles</code>.
+                      Request body and response shape are identical to the admin <code>/execute</code> endpoint.</p>
+
+    </div>
+  </div>
+</div>

package/admin/js/templates/docs/api-authentication.html

@@ -0,0 +1,202 @@
+<div class="view-header">
+  <h1><span data-icon="code"></span> API · Authentication</h1>
+  <a href="#/api-reference" class="btn btn-ghost btn-sm"><span data-icon="arrow-left"></span> API overview</a>
+</div>
+<style>
+    .method-badge {
+        display: inline-block;
+        font-size: 11px;
+        font-weight: 700;
+        letter-spacing: 0.5px;
+        padding: 2px 7px;
+        border-radius: 4px;
+        font-family: var(--dm-font-mono, monospace);
+        margin-right: 6px;
+        vertical-align: middle;
+    }
+
+    .method-get {
+        background: #d1fae5;
+        color: #065f46;
+    }
+
+    .method-post {
+        background: #dbeafe;
+        color: #1e40af;
+    }
+
+    .method-put {
+        background: #fef3c7;
+        color: #92400e;
+    }
+
+    .method-patch {
+        background: #ccfbf1;
+        color: #134e4a;
+    }
+
+    .method-delete {
+        background: #fee2e2;
+        color: #991b1b;
+    }
+
+    .endpoint-path {
+        font-family: var(--dm-font-mono, monospace);
+        font-size: 14px;
+    }
+
+    .auth-note {
+        font-size: 12px;
+        color: var(--dm-color-text-muted, #6b7280);
+        margin: 4px 0 12px;
+    }
+
+    .auth-note code {
+        font-size: 11px;
+    }
+
+    .docs-body h3 {
+        margin-top: 24px;
+        margin-bottom: 8px;
+    }
+
+    .docs-body h3:first-child {
+        margin-top: 0;
+    }
+</style>
+
+<div class="row">
+  <div class="col-12">
+    <div class="docs-body">
+
+<h3><span class="method-badge method-get">GET</span><span
+                          class="endpoint-path">/api/auth/setup-status</span></h3>
+                  <p class="auth-note">No authentication required.</p>
+                  <p>Check whether the CMS has been set up. Returns <code>{ needsSetup: true }</code> when no users
+                      exist.</p>
+                  <pre class="code-block"><code>// Response
+{ "needsSetup": false }</code></pre>
+
+                  <h3><span class="method-badge method-post">POST</span><span
+                          class="endpoint-path">/api/auth/setup</span></h3>
+                  <p class="auth-note">No authentication required. Only succeeds when zero users exist.</p>
+                  <p>Create the initial admin account. Blocked once any user exists (returns 403).</p>
+                  <table class="table table-sm">
+                      <thead>
+                      <tr>
+                          <th>Field</th>
+                          <th>Type</th>
+                          <th>Description</th>
+                      </tr>
+                      </thead>
+                      <tbody>
+                      <tr>
+                          <td><code>name</code></td>
+                          <td>string</td>
+                          <td>Display name</td>
+                      </tr>
+                      <tr>
+                          <td><code>email</code></td>
+                          <td>string</td>
+                          <td>Email address</td>
+                      </tr>
+                      <tr>
+                          <td><code>password</code></td>
+                          <td>string</td>
+                          <td>Minimum 8 characters</td>
+                      </tr>
+                      </tbody>
+                  </table>
+                  <pre class="code-block"><code>// Response 201
+{ "token": "eyJ...", "refreshToken": "eyJ...", "user": { "id": "...", "name": "...", "email": "...", "role": "admin" } }</code></pre>
+
+                  <h3><span class="method-badge method-post">POST</span><span
+                          class="endpoint-path">/api/auth/login</span></h3>
+                  <p class="auth-note">No authentication required.</p>
+                  <p>Authenticate with email and password. Returns access and refresh tokens.</p>
+                  <table class="table table-sm">
+                      <thead>
+                      <tr>
+                          <th>Field</th>
+                          <th>Type</th>
+                          <th>Description</th>
+                      </tr>
+                      </thead>
+                      <tbody>
+                      <tr>
+                          <td><code>email</code></td>
+                          <td>string</td>
+                          <td>User email</td>
+                      </tr>
+                      <tr>
+                          <td><code>password</code></td>
+                          <td>string</td>
+                          <td>User password</td>
+                      </tr>
+                      </tbody>
+                  </table>
+                  <pre class="code-block"><code>// Response 200
+{ "token": "eyJ...", "refreshToken": "eyJ...", "user": { "id": "uuid", "name": "Alice", "email": "alice@example.com", "role": "admin" } }
+
+// Error 401
+{ "error": "Invalid credentials" }</code></pre>
+
+                  <h3><span class="method-badge method-get">GET</span><span class="endpoint-path">/api/auth/me</span>
+                  </h3>
+                  <p class="auth-note">Requires Bearer token.</p>
+                  <p>Return the authenticated user's profile.</p>
+                  <pre class="code-block"><code>// Response 200
+{ "id": "uuid", "name": "Alice", "email": "alice@example.com", "role": "admin", "isActive": true }</code></pre>
+
+                  <h3><span class="method-badge method-post">POST</span><span
+                          class="endpoint-path">/api/auth/logout</span></h3>
+                  <p class="auth-note">No authentication required. Safe to call without a token.</p>
+                  <p>Blacklists the provided refresh token. The in-memory blacklist is cleared on server restart.</p>
+                  <table class="table table-sm">
+                      <thead>
+                      <tr>
+                          <th>Field</th>
+                          <th>Type</th>
+                          <th>Description</th>
+                      </tr>
+                      </thead>
+                      <tbody>
+                      <tr>
+                          <td><code>refreshToken</code></td>
+                          <td>string</td>
+                          <td>The refresh token to revoke (optional)</td>
+                      </tr>
+                      </tbody>
+                  </table>
+                  <pre class="code-block"><code>// Response 200
+{ "ok": true }</code></pre>
+
+                  <h3><span class="method-badge method-post">POST</span><span
+                          class="endpoint-path">/api/auth/refresh</span></h3>
+                  <p class="auth-note">No authentication required. Provide a valid refresh token.</p>
+                  <p>Exchange a refresh token for a new access token.</p>
+                  <table class="table table-sm">
+                      <thead>
+                      <tr>
+                          <th>Field</th>
+                          <th>Type</th>
+                          <th>Description</th>
+                      </tr>
+                      </thead>
+                      <tbody>
+                      <tr>
+                          <td><code>refreshToken</code></td>
+                          <td>string</td>
+                          <td>A valid, non-revoked refresh token</td>
+                      </tr>
+                      </tbody>
+                  </table>
+                  <pre class="code-block"><code>// Response 200
+{ "token": "eyJ..." }
+
+// Error 401
+{ "error": "Invalid or expired refresh token" }</code></pre>
+
+    </div>
+  </div>
+</div>