emdash 0.0.0-b → 0.0.1

package/src/astro/types.ts

@@ -0,0 +1,346 @@
+/**
+ * EmDash Astro types
+ *
+ * This file re-exports types from the core package and defines
+ * the locals interface that the middleware provides.
+ */
+
+import type { Element } from "@emdash-cms/blocks";
+import type { Kysely } from "kysely";
+
+// Re-export core types
+export type {
+	ContentItem,
+	MediaItem,
+	ContentListResponse,
+	ContentResponse,
+	MediaListResponse,
+	MediaResponse,
+	Storage,
+	Database,
+} from "../index.js";
+
+/**
+ * Manifest collection definition
+ */
+export interface ManifestCollection {
+	label: string;
+	labelSingular: string;
+	supports: string[];
+	hasSeo: boolean;
+	fields: Record<
+		string,
+		{
+			kind: string;
+			label?: string;
+			required?: boolean;
+			widget?: string;
+			options?: Array<{ value: string; label: string }>;
+		}
+	>;
+}
+
+/**
+ * Plugin manifest entry in the admin manifest
+ */
+export interface ManifestPlugin {
+	version?: string;
+	/** Package name for dynamic import (e.g., "@emdash-cms/plugin-audit-log") */
+	package?: string;
+	/** Whether the plugin is currently enabled */
+	enabled?: boolean;
+	/**
+	 * How this plugin renders its admin UI:
+	 * - "react": Trusted plugin with React components (default for trusted plugins)
+	 * - "blocks": Declarative Block Kit UI via admin route handler
+	 * - "none": No admin UI
+	 */
+	adminMode?: "react" | "blocks" | "none";
+	adminPages?: Array<{
+		path: string;
+		label?: string;
+		icon?: string;
+	}>;
+	dashboardWidgets?: Array<{
+		id: string;
+		title?: string;
+		size?: string;
+	}>;
+	fieldWidgets?: Array<{
+		name: string;
+		label: string;
+		fieldTypes: string[];
+		elements?: Element[];
+	}>;
+	/** Portable Text block types provided by this plugin */
+	portableTextBlocks?: Array<{
+		type: string;
+		label: string;
+		icon?: string;
+		description?: string;
+		placeholder?: string;
+		fields?: Element[];
+	}>;
+}
+
+/**
+ * Auth mode indicator for the admin UI
+ * - "passkey": Built-in passkey authentication (default)
+ * - string: External auth provider type (e.g., "cloudflare-access")
+ */
+export type ManifestAuthMode = string;
+
+/**
+ * The EmDash manifest provided to the admin UI
+ */
+export interface EmDashManifest {
+	version: string;
+	hash: string;
+	collections: Record<string, ManifestCollection>;
+	plugins: Record<string, ManifestPlugin>;
+	/**
+	 * Auth mode for the admin UI. When "passkey", the security settings
+	 * (passkey management, self-signup domains) are shown. When using
+	 * external auth (e.g., "cloudflare-access"), these are hidden since
+	 * authentication is handled externally.
+	 */
+	authMode: ManifestAuthMode;
+	/**
+	 * Whether self-signup is enabled (at least one allowed domain is active).
+	 * Used by the login page to conditionally show the "Sign up" link.
+	 */
+	signupEnabled?: boolean;
+	/**
+	 * i18n configuration from Astro config.
+	 * Only present when i18n is enabled (multiple locales configured).
+	 */
+	i18n?: {
+		defaultLocale: string;
+		locales: string[];
+		prefixDefaultLocale?: boolean;
+	};
+	/**
+	 * Whether the plugin marketplace is configured.
+	 * When true, the admin UI can show marketplace browse/install features.
+	 */
+	marketplace?: boolean;
+}
+
+/**
+ * Standard handler response shape used by all EmDashHandlers methods.
+ *
+ * The error shape matches `ApiResult` from the core package — typing it
+ * here lets route files use `result.error?.code` without unsafe casts while
+ * keeping the data side loosely coupled (defaults to `unknown`).
+ */
+export interface HandlerResponse<T = unknown> {
+	success: boolean;
+	data?: T;
+	error?: {
+		code: string;
+		message: string;
+		details?: Record<string, unknown>;
+	};
+}
+
+/**
+ * The EmDash API handlers provided via Astro.locals
+ *
+ * Data types default to `unknown` to avoid tight coupling with the core
+ * package. Handlers whose data shape is accessed in route files (e.g.
+ * handleContentGet, handleRevisionGet) use narrower types.
+ */
+export interface EmDashHandlers {
+	// Content handlers
+	handleContentList: (
+		collection: string,
+		params: {
+			cursor?: string;
+			limit?: number;
+			status?: string;
+			orderBy?: string;
+			order?: "asc" | "desc";
+			locale?: string;
+		},
+	) => Promise<HandlerResponse>;
+
+	handleContentGet: (
+		collection: string,
+		id: string,
+		locale?: string,
+	) => Promise<
+		HandlerResponse<{
+			item: {
+				id: string;
+				authorId: string | null;
+				[key: string]: unknown;
+			};
+			_rev?: string;
+		}>
+	>;
+
+	handleContentCreate: (
+		collection: string,
+		body: {
+			data: Record<string, unknown>;
+			slug?: string;
+			status?: string;
+			authorId?: string;
+			locale?: string;
+			translationOf?: string;
+		},
+	) => Promise<HandlerResponse>;
+
+	handleContentUpdate: (
+		collection: string,
+		id: string,
+		body: {
+			data?: Record<string, unknown>;
+			slug?: string;
+			status?: string;
+			authorId?: string | null;
+			_rev?: string;
+		},
+	) => Promise<HandlerResponse>;
+
+	handleContentDelete: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	// Trash handlers
+	handleContentListTrashed: (
+		collection: string,
+		params?: { cursor?: string; limit?: number },
+	) => Promise<HandlerResponse>;
+
+	handleContentRestore: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	handleContentPermanentDelete: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	handleContentCountTrashed: (collection: string) => Promise<HandlerResponse>;
+
+	handleContentGetIncludingTrashed: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	handleContentDuplicate: (
+		collection: string,
+		id: string,
+		authorId?: string,
+	) => Promise<HandlerResponse>;
+
+	// Publishing & Scheduling handlers
+	handleContentPublish: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	handleContentUnpublish: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	handleContentSchedule: (
+		collection: string,
+		id: string,
+		scheduledAt: string,
+	) => Promise<HandlerResponse>;
+
+	handleContentUnschedule: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	handleContentCountScheduled: (collection: string) => Promise<HandlerResponse>;
+
+	handleContentDiscardDraft: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	handleContentCompare: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	handleContentTranslations: (collection: string, id: string) => Promise<HandlerResponse>;
+
+	// Media handlers
+	handleMediaList: (params: {
+		cursor?: string;
+		limit?: number;
+		mimeType?: string;
+	}) => Promise<HandlerResponse>;
+
+	handleMediaGet: (id: string) => Promise<HandlerResponse>;
+
+	handleMediaCreate: (input: {
+		filename: string;
+		mimeType: string;
+		size?: number;
+		width?: number;
+		height?: number;
+		storageKey: string;
+		contentHash?: string;
+		blurhash?: string;
+		dominantColor?: string;
+		authorId?: string;
+	}) => Promise<HandlerResponse>;
+
+	handleMediaUpdate: (
+		id: string,
+		input: { alt?: string; caption?: string; width?: number; height?: number },
+	) => Promise<HandlerResponse>;
+
+	handleMediaDelete: (id: string) => Promise<HandlerResponse>;
+
+	// Revision handlers
+	handleRevisionList: (
+		collection: string,
+		entryId: string,
+		params?: { limit?: number },
+	) => Promise<HandlerResponse>;
+
+	handleRevisionGet: (revisionId: string) => Promise<
+		HandlerResponse<{
+			item: {
+				id: string;
+				collection: string;
+				entryId: string;
+				authorId: string | null;
+				[key: string]: unknown;
+			};
+		}>
+	>;
+
+	handleRevisionRestore: (revisionId: string, callerUserId: string) => Promise<HandlerResponse>;
+
+	// Plugin API route handler
+	handlePluginApiRoute: (
+		pluginId: string,
+		method: string,
+		path: string,
+		request: Request,
+	) => Promise<HandlerResponse>;
+
+	// Plugin route metadata (for auth decisions before dispatch)
+	getPluginRouteMeta: (pluginId: string, path: string) => { public: boolean } | null;
+
+	// Media provider handlers
+	getMediaProvider: (providerId: string) => import("../media/types.js").MediaProvider | undefined;
+	getMediaProviderList: () => Array<{
+		id: string;
+		name: string;
+		icon?: string;
+		capabilities: import("../media/types.js").MediaProviderCapabilities;
+	}>;
+
+	// Direct access to storage and database for advanced use cases
+	storage: import("../index.js").Storage | null;
+	db: Kysely<import("../index.js").Database>;
+
+	// Hook pipeline for plugin integrations
+	hooks: import("../plugins/hooks.js").HookPipeline;
+
+	// Email pipeline for sending emails through the plugin system
+	email: import("../plugins/email.js").EmailPipeline | null;
+
+	// Configured plugins (for plugin management)
+	configuredPlugins: import("../plugins/types.js").ResolvedPlugin[];
+
+	// Configuration (for checking database type, auth mode, etc.)
+	config: import("./integration/runtime.js").EmDashConfig;
+
+	// Manifest invalidation (call after schema changes)
+	invalidateManifest: () => void;
+
+	// Sandbox runner (for marketplace plugin install/update)
+	getSandboxRunner: () => import("../plugins/sandbox/types.js").SandboxRunner | null;
+
+	// Sync marketplace plugin states (after install/update/uninstall)
+	syncMarketplacePlugins: () => Promise<void>;
+
+	// Update plugin enabled/disabled status and rebuild hook pipeline
+	setPluginStatus: (pluginId: string, status: "active" | "inactive") => Promise<void>;
+}

package/src/auth/api-tokens.ts

@@ -0,0 +1,25 @@
+/**
+ * API token generation and hashing utilities.
+ *
+ * Re-exports from @emdash-cms/auth which owns the implementations.
+ * Uses Oslo.js (@oslojs/crypto, @oslojs/encoding) for all crypto.
+ *
+ * Token format: `ec_pat_<base64url>` (Personal Access Tokens)
+ *               `ec_oat_<base64url>` (OAuth Access Tokens)
+ *               `ec_ort_<base64url>` (OAuth Refresh Tokens)
+ *
+ * Prefix makes tokens identifiable in logs and secret scanners.
+ * Only the SHA-256 hash is stored server-side.
+ */
+
+export {
+	TOKEN_PREFIXES,
+	generatePrefixedToken,
+	hashPrefixedToken,
+	hashPrefixedToken as hashApiToken,
+	VALID_SCOPES,
+	validateScopes,
+	hasScope,
+	computeS256Challenge,
+	type ApiTokenScope,
+} from "@emdash-cms/auth";

package/src/auth/challenge-store.ts

@@ -0,0 +1,80 @@
+/**
+ * Challenge store for WebAuthn
+ *
+ * Stores WebAuthn challenges in a dedicated table with automatic expiration.
+ */
+
+import type { ChallengeStore, ChallengeData } from "@emdash-cms/auth/passkey";
+import type { Kysely } from "kysely";
+
+import type { Database } from "../database/types.js";
+
+export function createChallengeStore(db: Kysely<Database>): ChallengeStore {
+	return {
+		async set(challenge: string, data: ChallengeData): Promise<void> {
+			const expiresAt = new Date(data.expiresAt).toISOString();
+
+			await db
+				.insertInto("auth_challenges")
+				.values({
+					challenge,
+					type: data.type,
+					user_id: data.userId ?? null,
+					data: null, // Could store additional context if needed
+					expires_at: expiresAt,
+				})
+				.onConflict((oc) =>
+					oc.column("challenge").doUpdateSet({
+						type: data.type,
+						user_id: data.userId ?? null,
+						expires_at: expiresAt,
+					}),
+				)
+				.execute();
+		},
+
+		async get(challenge: string): Promise<ChallengeData | null> {
+			const row = await db
+				.selectFrom("auth_challenges")
+				.selectAll()
+				.where("challenge", "=", challenge)
+				.executeTakeFirst();
+
+			if (!row) return null;
+
+			const expiresAt = new Date(row.expires_at).getTime();
+
+			// Check expiration
+			if (expiresAt < Date.now()) {
+				// Expired, delete and return null
+				await this.delete(challenge);
+				return null;
+			}
+
+			return {
+				type: row.type === "registration" ? "registration" : "authentication",
+				userId: row.user_id ?? undefined,
+				expiresAt,
+			};
+		},
+
+		async delete(challenge: string): Promise<void> {
+			await db.deleteFrom("auth_challenges").where("challenge", "=", challenge).execute();
+		},
+	};
+}
+
+/**
+ * Clean up expired challenges.
+ * Should be called periodically (e.g., on startup, or via cron).
+ */
+export async function cleanupExpiredChallenges(db: Kysely<Database>): Promise<number> {
+	const now = new Date().toISOString();
+
+	const result = await db
+		.deleteFrom("auth_challenges")
+		.where("expires_at", "<", now)
+		.executeTakeFirst();
+
+	return Number(result.numDeletedRows ?? 0);
+}

package/src/auth/mode.ts

@@ -0,0 +1,96 @@
+/**
+ * Auth Mode Detection
+ *
+ * Determines which authentication provider is active based on config.
+ * Supports both passkey (default) and external auth providers via AuthDescriptor.
+ */
+
+import type { EmDashConfig } from "../astro/integration/runtime.js";
+import type { AuthDescriptor, AuthResult, ExternalAuthConfig } from "./types.js";
+
+export type { AuthDescriptor, AuthResult, ExternalAuthConfig };
+
+/**
+ * Passkey auth mode (default)
+ */
+export interface PasskeyAuthMode {
+	type: "passkey";
+}
+
+/**
+ * External auth provider mode (Cloudflare Access, etc.)
+ */
+export interface ExternalAuthMode {
+	type: "external";
+	/** Provider type identifier (e.g., "cloudflare-access") */
+	providerType: string;
+	/** Module to import for authentication */
+	entrypoint: string;
+	/** Provider-specific configuration */
+	config: unknown;
+}
+
+/**
+ * Union of all auth modes
+ */
+export type AuthMode = PasskeyAuthMode | ExternalAuthMode;
+
+/**
+ * Extended config type with auth.
+ *
+ * This is the same as `EmDashConfig` with an optional `auth` field.
+ * Kept for backwards compatibility — prefer `EmDashConfig` in new code
+ * since `getAuthMode` now accepts `EmDashConfig` directly.
+ */
+export interface EmDashConfigWithAuth extends EmDashConfig {
+	auth?: AuthDescriptor;
+}
+
+/**
+ * Determine the active auth mode from config.
+ *
+ * Accepts `EmDashConfig` (or subtype) — checks for `auth` field via duck typing.
+ *
+ * @param config EmDash configuration
+ * @returns The active auth mode
+ */
+export function getAuthMode(
+	config: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,
+): AuthMode {
+	const auth = config?.auth;
+
+	// Check for AuthDescriptor (new style)
+	if (auth && "entrypoint" in auth && auth.entrypoint) {
+		return {
+			type: "external",
+			providerType: auth.type,
+			entrypoint: auth.entrypoint,
+			config: auth.config,
+		};
+	}
+
+	// Default to passkey
+	return { type: "passkey" };
+}
+
+/**
+ * Check if an external auth provider is active
+ */
+export function isExternalAuthEnabled(
+	config: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,
+): boolean {
+	return getAuthMode(config).type === "external";
+}
+
+/**
+ * Get external auth config if enabled
+ */
+export function getExternalAuthConfig(
+	config: (EmDashConfig & { auth?: AuthDescriptor }) | null | undefined,
+): ExternalAuthMode | null {
+	const mode = getAuthMode(config);
+	if (mode.type === "external") {
+		return mode;
+	}
+	return null;
+}

package/src/auth/oauth-state-store.ts

@@ -0,0 +1,96 @@
+/**
+ * OAuth state store
+ *
+ * Stores OAuth state in the auth_challenges table with automatic expiration.
+ * Uses the existing table but with type="oauth" to distinguish from WebAuthn challenges.
+ */
+
+import type { StateStore, OAuthState } from "@emdash-cms/auth";
+import type { Kysely } from "kysely";
+
+import type { Database } from "../database/types.js";
+
+const OAUTH_STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+
+export function createOAuthStateStore(db: Kysely<Database>): StateStore {
+	return {
+		async set(state: string, data: OAuthState): Promise<void> {
+			const expiresAt = new Date(Date.now() + OAUTH_STATE_TTL_MS).toISOString();
+
+			await db
+				.insertInto("auth_challenges")
+				.values({
+					challenge: state,
+					type: "oauth",
+					user_id: null,
+					data: JSON.stringify(data),
+					expires_at: expiresAt,
+				})
+				.onConflict((oc) =>
+					oc.column("challenge").doUpdateSet({
+						type: "oauth",
+						data: JSON.stringify(data),
+						expires_at: expiresAt,
+					}),
+				)
+				.execute();
+		},
+
+		async get(state: string): Promise<OAuthState | null> {
+			const row = await db
+				.selectFrom("auth_challenges")
+				.selectAll()
+				.where("challenge", "=", state)
+				.where("type", "=", "oauth")
+				.executeTakeFirst();
+
+			if (!row) return null;
+
+			const expiresAt = new Date(row.expires_at).getTime();
+
+			// Check expiration
+			if (expiresAt < Date.now()) {
+				// Expired, delete and return null
+				await this.delete(state);
+				return null;
+			}
+
+			if (!row.data) return null;
+
+			try {
+				const parsed: unknown = JSON.parse(row.data);
+				if (
+					typeof parsed !== "object" ||
+					parsed === null ||
+					!("provider" in parsed) ||
+					typeof parsed.provider !== "string" ||
+					!("redirectUri" in parsed) ||
+					typeof parsed.redirectUri !== "string"
+				) {
+					return null;
+				}
+				const oauthState: OAuthState = {
+					provider: parsed.provider,
+					redirectUri: parsed.redirectUri,
+				};
+				if ("codeVerifier" in parsed && typeof parsed.codeVerifier === "string") {
+					oauthState.codeVerifier = parsed.codeVerifier;
+				}
+				if ("nonce" in parsed && typeof parsed.nonce === "string") {
+					oauthState.nonce = parsed.nonce;
+				}
+				return oauthState;
+			} catch {
+				return null;
+			}
+		},
+
+		async delete(state: string): Promise<void> {
+			await db
+				.deleteFrom("auth_challenges")
+				.where("challenge", "=", state)
+				.where("type", "=", "oauth")
+				.execute();
+		},
+	};
+}

package/src/auth/passkey-config.ts

@@ -0,0 +1,27 @@
+/**
+ * Passkey configuration helper
+ *
+ * Extracts passkey configuration from the request URL.
+ * This ensures the rpId and origin are correctly set for both
+ * localhost development and production deployments.
+ */
+
+export interface PasskeyConfig {
+	rpName: string;
+	rpId: string;
+	origin: string;
+}
+
+/**
+ * Get passkey configuration from request URL
+ *
+ * @param url The request URL
+ * @param siteName Optional site name for rpName (defaults to hostname)
+ */
+export function getPasskeyConfig(url: URL, siteName?: string): PasskeyConfig {
+	return {
+		rpName: siteName || url.hostname,
+		rpId: url.hostname,
+		origin: url.origin,
+	};
+}