domma-cms 0.33.0 → 0.33.1

package/admin/js/templates/api-endpoint-editor.html

@@ -119,7 +119,7 @@
             <div class="form-group">
                 <label class="form-label" for="tryit-query">Extra query string (optional)</label>
                 <input type="text" class="form-input" id="tryit-query" placeholder="nation=France&status=published">
-                <p class="text-muted" style="font-size:.8rem;margin:.25rem 0 0;">Applied as extra filters <em>on top of</em> the definition's own filters (which always win). Only fields this endpoint returns can be filtered; <code>page</code>, <code>limit</code>, <code>sort</code>, <code>order</code>, <code>search</code> are reserved. Operators work too — e.g. <code>title_contains=cup</code>.</p>
+                <p class="text-muted" style="font-size:.8rem;margin:.25rem 0 0;">Applied as extra filters <em>on top of</em> the definition's own filters (which always win). Only fields this endpoint returns can be filtered; operators work too — e.g. <code>title_contains=cup</code>. <code>page</code>, <code>limit</code>, <code>sort</code> and <code>order</code> control pagination/sort instead (<code>limit</code> is capped at the endpoint's own limit); <code>search</code> is reserved.</p>
             </div>
             <button class="btn btn-primary" id="tryit-send" style="width:100%;"><span data-icon="play"></span> Send</button>
             <div id="tryit-result" style="display:none;margin-top:.75rem;">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.33.0",
+  "version": "0.33.1",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/services/apiEndpoints.js

@@ -452,15 +452,35 @@ function collectAdHocFilter(query, exposed, declaredFields) {
  */
 export async function executeEndpoint(def, params, query) {
     const q = query || {};
+    const exposed = await exposedFieldSet(def);
     const declared = substituteFilter(def.filter, params, q);
     const declaredFields = new Set(Object.keys(def.filter || {}).map(k => parseFilterKey(k).field));
-    const adhoc = collectAdHocFilter(q, await exposedFieldSet(def), declaredFields);
+    const adhoc = collectAdHocFilter(q, exposed, declaredFields);
     const filter = {...adhoc, ...declared}; // declared wins on any key collision
+
+    // Envelope controls — the reserved query keys tune pagination and sort
+    // rather than filter (list mode only). The definition's own limit is the
+    // ceiling: a caller may page/shrink within it but never pull more than the
+    // endpoint intends; sort is restricted to exposed fields.
+    let page = 1;
+    let limit = Number.isInteger(def.limit) ? def.limit : 50;
+    let sort = def.sort || 'createdAt';
+    let order = ORDERS.includes(def.order) ? def.order : 'desc';
+    if (def.mode !== 'single') {
+        const cap = limit > 0 ? limit : 500;
+        const qLimit = Number.parseInt(q.limit, 10);
+        if (Number.isInteger(qLimit) && qLimit >= 1) limit = Math.min(qLimit, cap);
+        const qPage = Number.parseInt(q.page, 10);
+        if (Number.isInteger(qPage) && qPage >= 1) page = qPage;
+        if (q.order === 'asc' || q.order === 'desc') order = q.order;
+        if (typeof q.sort === 'string' && q.sort && exposed.has(q.sort.split('.')[0])) sort = q.sort;
+    }
+
     const result = await listEntries(def.collection, {
-        page: 1,
-        limit: def.mode === 'single' ? 1 : (def.limit ?? 50),
-        sort: def.sort || 'createdAt',
-        order: def.order || 'desc',
+        page,
+        limit: def.mode === 'single' ? 1 : limit,
+        sort,
+        order,
         filter: Object.keys(filter).length ? filter : undefined
     });
     if (def.mode === 'single') return result.entries[0] || null;