emdash 0.0.0-b → 0.0.2

package/src/database/migrations/021_remove_section_categories.ts

@@ -0,0 +1,43 @@
+import { type Kysely, sql } from "kysely";
+
+/**
+ * Migration: Remove section categories
+ *
+ * Section categories had a complete backend but no UI to create or manage them.
+ * Rather than building the missing UI for a feature with very little need at this stage,
+ * we're removing the feature entirely.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// Drop index before column — SQLite requires this order
+	await db.schema.dropIndex("idx_sections_category").ifExists().execute();
+
+	await db.schema.alterTable("_emdash_sections").dropColumn("category_id").execute();
+
+	await db.schema.dropTable("_emdash_section_categories").execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	// Recreate section categories table
+	await db.schema
+		.createTable("_emdash_section_categories")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("slug", "text", (col) => col.notNull().unique())
+		.addColumn("label", "text", (col) => col.notNull())
+		.addColumn("sort_order", "integer", (col) => col.defaultTo(0))
+		.addColumn("created_at", "text", (col) => col.defaultTo(sql`CURRENT_TIMESTAMP`))
+		.execute();
+
+	// Re-add category_id column to sections
+	await db.schema
+		.alterTable("_emdash_sections")
+		.addColumn("category_id", "text", (col) =>
+			col.references("_emdash_section_categories.id").onDelete("set null"),
+		)
+		.execute();
+
+	await db.schema
+		.createIndex("idx_sections_category")
+		.on("_emdash_sections")
+		.columns(["category_id"])
+		.execute();
+}

package/src/database/migrations/022_marketplace_plugin_state.ts

@@ -0,0 +1,46 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+/**
+ * Migration: Add marketplace fields to _plugin_state
+ *
+ * Adds `source` and `marketplace_version` columns to track
+ * whether a plugin was installed from config or marketplace,
+ * and which marketplace version is installed.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// source: 'config' (declared in astro.config) or 'marketplace' (installed from registry)
+	await sql`
+		ALTER TABLE _plugin_state
+		ADD COLUMN source TEXT NOT NULL DEFAULT 'config'
+	`.execute(db);
+
+	// marketplace_version: tracks installed version for update checking
+	await sql`
+		ALTER TABLE _plugin_state
+		ADD COLUMN marketplace_version TEXT
+	`.execute(db);
+
+	// Index for efficient marketplace plugin queries on cold start
+	await sql`
+		CREATE INDEX idx_plugin_state_source
+		ON _plugin_state (source)
+		WHERE source = 'marketplace'
+	`.execute(db);
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await sql`
+		DROP INDEX IF EXISTS idx_plugin_state_source
+	`.execute(db);
+
+	await sql`
+		ALTER TABLE _plugin_state
+		DROP COLUMN marketplace_version
+	`.execute(db);
+
+	await sql`
+		ALTER TABLE _plugin_state
+		DROP COLUMN source
+	`.execute(db);
+}

package/src/database/migrations/023_plugin_metadata.ts

@@ -0,0 +1,33 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+/**
+ * Migration: Add display metadata to _plugin_state
+ *
+ * Stores display_name and description for marketplace plugins
+ * so the admin UI can show meaningful info without re-fetching
+ * from the marketplace on every page load.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await sql`
+		ALTER TABLE _plugin_state
+		ADD COLUMN display_name TEXT
+	`.execute(db);
+
+	await sql`
+		ALTER TABLE _plugin_state
+		ADD COLUMN description TEXT
+	`.execute(db);
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await sql`
+		ALTER TABLE _plugin_state
+		DROP COLUMN description
+	`.execute(db);
+
+	await sql`
+		ALTER TABLE _plugin_state
+		DROP COLUMN display_name
+	`.execute(db);
+}

package/src/database/migrations/024_media_placeholders.ts

@@ -0,0 +1,32 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+/**
+ * Migration: Add placeholder columns to media table
+ *
+ * Stores blurhash and dominant_color for LQIP (Low Quality Image Placeholder)
+ * support. Generated at upload time from image pixel data.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await sql`
+		ALTER TABLE media
+		ADD COLUMN blurhash TEXT
+	`.execute(db);
+
+	await sql`
+		ALTER TABLE media
+		ADD COLUMN dominant_color TEXT
+	`.execute(db);
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await sql`
+		ALTER TABLE media
+		DROP COLUMN dominant_color
+	`.execute(db);
+
+	await sql`
+		ALTER TABLE media
+		DROP COLUMN blurhash
+	`.execute(db);
+}

package/src/database/migrations/025_oauth_clients.ts

@@ -0,0 +1,28 @@
+import type { Kysely } from "kysely";
+
+import { currentTimestamp } from "../dialect-helpers.js";
+
+/**
+ * Migration: Create OAuth clients table
+ *
+ * Implements the oauth_clients registry so that the authorization endpoint
+ * can validate client_id and enforce a per-client redirect URI allowlist.
+ *
+ * Each client has a set of pre-registered redirect URIs (JSON array).
+ * The authorize endpoint rejects any redirect_uri not in the client's list.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createTable("_emdash_oauth_clients")
+		.addColumn("id", "text", (col) => col.primaryKey()) // Client ID (e.g. URL or opaque string)
+		.addColumn("name", "text", (col) => col.notNull()) // Human-readable name
+		.addColumn("redirect_uris", "text", (col) => col.notNull()) // JSON array of allowed redirect URIs
+		.addColumn("scopes", "text") // JSON array of allowed scopes (null = all)
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addColumn("updated_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("_emdash_oauth_clients").execute();
+}

package/src/database/migrations/026_cron_tasks.ts

@@ -0,0 +1,49 @@
+import type { Kysely } from "kysely";
+
+import { currentTimestamp } from "../dialect-helpers.js";
+
+/**
+ * Migration: Create cron tasks table for plugin scheduled tasks.
+ *
+ * Each plugin can register cron tasks (recurring or one-shot) which are
+ * stored here and executed by the platform-specific scheduler.
+ *
+ * The `next_run_at` + `status` + `enabled` index drives the "find overdue
+ * tasks" query used by CronExecutor.tick().
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createTable("_emdash_cron_tasks")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("plugin_id", "text", (col) => col.notNull())
+		.addColumn("task_name", "text", (col) => col.notNull())
+		.addColumn("schedule", "text", (col) => col.notNull())
+		.addColumn("is_oneshot", "integer", (col) => col.notNull().defaultTo(0))
+		.addColumn("data", "text") // JSON
+		.addColumn("next_run_at", "text", (col) => col.notNull())
+		.addColumn("last_run_at", "text")
+		.addColumn("status", "text", (col) => col.notNull().defaultTo("idle"))
+		.addColumn("locked_at", "text")
+		.addColumn("enabled", "integer", (col) => col.notNull().defaultTo(1))
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addUniqueConstraint("uq_cron_tasks_plugin_task", ["plugin_id", "task_name"])
+		.execute();
+
+	// Equality columns first (enabled, status), then range column (next_run_at)
+	// for optimal B-tree index usage in the tick query.
+	await db.schema
+		.createIndex("idx_cron_tasks_due")
+		.on("_emdash_cron_tasks")
+		.columns(["enabled", "status", "next_run_at"])
+		.execute();
+
+	await db.schema
+		.createIndex("idx_cron_tasks_plugin")
+		.on("_emdash_cron_tasks")
+		.column("plugin_id")
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("_emdash_cron_tasks").execute();
+}

package/src/database/migrations/027_comments.ts

@@ -0,0 +1,87 @@
+import type { Kysely } from "kysely";
+
+import { currentTimestamp } from "../dialect-helpers.js";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// Create the comments table
+	await db.schema
+		.createTable("_emdash_comments")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("collection", "text", (col) => col.notNull())
+		.addColumn("content_id", "text", (col) => col.notNull())
+		.addColumn("parent_id", "text", (col) =>
+			col.references("_emdash_comments.id").onDelete("cascade"),
+		)
+		.addColumn("author_name", "text", (col) => col.notNull())
+		.addColumn("author_email", "text", (col) => col.notNull())
+		.addColumn("author_url", "text")
+		.addColumn("author_user_id", "text", (col) => col.references("users.id").onDelete("set null"))
+		.addColumn("body", "text", (col) => col.notNull())
+		.addColumn("status", "text", (col) => col.notNull().defaultTo("pending"))
+		.addColumn("ip_hash", "text")
+		.addColumn("user_agent", "text")
+		.addColumn("moderation_metadata", "text") // JSON
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addColumn("updated_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+
+	// Indexes
+	await db.schema
+		.createIndex("idx_comments_content")
+		.on("_emdash_comments")
+		.columns(["collection", "content_id", "status"])
+		.execute();
+
+	await db.schema
+		.createIndex("idx_comments_parent")
+		.on("_emdash_comments")
+		.column("parent_id")
+		.execute();
+
+	await db.schema
+		.createIndex("idx_comments_status")
+		.on("_emdash_comments")
+		.columns(["status", "created_at"])
+		.execute();
+
+	await db.schema
+		.createIndex("idx_comments_author_email")
+		.on("_emdash_comments")
+		.column("author_email")
+		.execute();
+
+	await db.schema
+		.createIndex("idx_comments_author_user")
+		.on("_emdash_comments")
+		.column("author_user_id")
+		.execute();
+
+	// Add collection-level comment settings columns
+	await db.schema
+		.alterTable("_emdash_collections")
+		.addColumn("comments_enabled", "integer", (col) => col.defaultTo(0))
+		.execute();
+
+	await db.schema
+		.alterTable("_emdash_collections")
+		.addColumn("comments_moderation", "text", (col) => col.defaultTo("first_time"))
+		.execute();
+
+	await db.schema
+		.alterTable("_emdash_collections")
+		.addColumn("comments_closed_after_days", "integer", (col) => col.defaultTo(90))
+		.execute();
+
+	await db.schema
+		.alterTable("_emdash_collections")
+		.addColumn("comments_auto_approve_users", "integer", (col) => col.defaultTo(1))
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("_emdash_comments").execute();
+
+	// Note: SQLite doesn't support DROP COLUMN before 3.35.0.
+	// For down migrations on the collection settings columns, the table
+	// would need to be rebuilt. Skipping for simplicity in v0.
+}

package/src/database/migrations/028_drop_author_url.ts

@@ -0,0 +1,9 @@
+import { sql, type Kysely } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await sql`ALTER TABLE _emdash_comments DROP COLUMN author_url`.execute(db);
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.alterTable("_emdash_comments").addColumn("author_url", "text").execute();
+}

package/src/database/migrations/029_redirects.ts

@@ -0,0 +1,67 @@
+import type { Kysely } from "kysely";
+
+import { currentTimestamp } from "../dialect-helpers.js";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// Redirect rules table
+	await db.schema
+		.createTable("_emdash_redirects")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("source", "text", (col) => col.notNull())
+		.addColumn("destination", "text", (col) => col.notNull())
+		.addColumn("type", "integer", (col) => col.notNull().defaultTo(301))
+		.addColumn("is_pattern", "integer", (col) => col.notNull().defaultTo(0))
+		.addColumn("enabled", "integer", (col) => col.notNull().defaultTo(1))
+		.addColumn("hits", "integer", (col) => col.notNull().defaultTo(0))
+		.addColumn("last_hit_at", "text")
+		.addColumn("group_name", "text")
+		.addColumn("auto", "integer", (col) => col.notNull().defaultTo(0))
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addColumn("updated_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+
+	// Unique source for exact (non-pattern) rules
+	// SQLite doesn't support partial indexes with WHERE on all versions,
+	// so we use a regular index and enforce uniqueness in the application layer
+	await db.schema
+		.createIndex("idx_redirects_source")
+		.on("_emdash_redirects")
+		.column("source")
+		.execute();
+
+	await db.schema
+		.createIndex("idx_redirects_enabled")
+		.on("_emdash_redirects")
+		.column("enabled")
+		.execute();
+
+	await db.schema
+		.createIndex("idx_redirects_group")
+		.on("_emdash_redirects")
+		.column("group_name")
+		.execute();
+
+	// 404 log table
+	await db.schema
+		.createTable("_emdash_404_log")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("path", "text", (col) => col.notNull())
+		.addColumn("referrer", "text")
+		.addColumn("user_agent", "text")
+		.addColumn("ip", "text")
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+
+	await db.schema.createIndex("idx_404_log_path").on("_emdash_404_log").column("path").execute();
+
+	await db.schema
+		.createIndex("idx_404_log_created")
+		.on("_emdash_404_log")
+		.column("created_at")
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("_emdash_404_log").execute();
+	await db.schema.dropTable("_emdash_redirects").execute();
+}

package/src/database/migrations/030_widen_scheduled_index.ts

@@ -0,0 +1,48 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+import { listTablesLike } from "../dialect-helpers.js";
+
+/**
+ * Migration: Widen scheduled publishing index
+ *
+ * The original partial index (013) only covered status='scheduled'.
+ * Published posts can now have scheduled draft changes, so widen the
+ * index to cover all rows where scheduled_at IS NOT NULL.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	const tableNames = await listTablesLike(db, "ec_%");
+
+	for (const tableName of tableNames) {
+		const table = { name: tableName };
+
+		await sql`
+			DROP INDEX IF EXISTS ${sql.ref(`idx_${table.name}_scheduled`)}
+		`.execute(db);
+
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${table.name}_scheduled`)}
+			ON ${sql.ref(table.name)} (scheduled_at)
+			WHERE scheduled_at IS NOT NULL
+		`.execute(db);
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	const tableNames = await listTablesLike(db, "ec_%");
+
+	for (const tableName of tableNames) {
+		const table = { name: tableName };
+
+		await sql`
+			DROP INDEX IF EXISTS ${sql.ref(`idx_${table.name}_scheduled`)}
+		`.execute(db);
+
+		// Restore the original narrower index
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${table.name}_scheduled`)}
+			ON ${sql.ref(table.name)} (scheduled_at)
+			WHERE scheduled_at IS NOT NULL AND status = 'scheduled'
+		`.execute(db);
+	}
+}

package/src/database/migrations/031_bylines.ts

@@ -0,0 +1,90 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+import { currentTimestamp, listTablesLike } from "../dialect-helpers.js";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createTable("_emdash_bylines")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("slug", "text", (col) => col.notNull().unique())
+		.addColumn("display_name", "text", (col) => col.notNull())
+		.addColumn("bio", "text")
+		.addColumn("avatar_media_id", "text", (col) => col.references("media.id").onDelete("set null"))
+		.addColumn("website_url", "text")
+		.addColumn("user_id", "text", (col) => col.references("users.id").onDelete("set null"))
+		.addColumn("is_guest", "integer", (col) => col.notNull().defaultTo(0))
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addColumn("updated_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.execute();
+
+	await sql`
+		CREATE UNIQUE INDEX ${sql.ref("idx_bylines_user_id_unique")}
+		ON ${sql.ref("_emdash_bylines")} (user_id)
+		WHERE user_id IS NOT NULL
+	`.execute(db);
+
+	await db.schema.createIndex("idx_bylines_slug").on("_emdash_bylines").column("slug").execute();
+
+	await db.schema
+		.createIndex("idx_bylines_display_name")
+		.on("_emdash_bylines")
+		.column("display_name")
+		.execute();
+
+	await db.schema
+		.createTable("_emdash_content_bylines")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("collection_slug", "text", (col) => col.notNull())
+		.addColumn("content_id", "text", (col) => col.notNull())
+		.addColumn("byline_id", "text", (col) =>
+			col.notNull().references("_emdash_bylines.id").onDelete("cascade"),
+		)
+		.addColumn("sort_order", "integer", (col) => col.notNull().defaultTo(0))
+		.addColumn("role_label", "text")
+		.addColumn("created_at", "text", (col) => col.defaultTo(currentTimestamp(db)))
+		.addUniqueConstraint("content_bylines_unique", ["collection_slug", "content_id", "byline_id"])
+		.execute();
+
+	await db.schema
+		.createIndex("idx_content_bylines_content")
+		.on("_emdash_content_bylines")
+		.columns(["collection_slug", "content_id", "sort_order"])
+		.execute();
+
+	await db.schema
+		.createIndex("idx_content_bylines_byline")
+		.on("_emdash_content_bylines")
+		.column("byline_id")
+		.execute();
+
+	const tableNames = await listTablesLike(db, "ec_%");
+	for (const tableName of tableNames) {
+		await sql`
+			ALTER TABLE ${sql.ref(tableName)}
+			ADD COLUMN primary_byline_id TEXT
+		`.execute(db);
+
+		await sql`
+			CREATE INDEX ${sql.ref(`idx_${tableName}_primary_byline`)}
+			ON ${sql.ref(tableName)} (primary_byline_id)
+		`.execute(db);
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	const tableNames = await listTablesLike(db, "ec_%");
+	for (const tableName of tableNames) {
+		await sql`
+			DROP INDEX IF EXISTS ${sql.ref(`idx_${tableName}_primary_byline`)}
+		`.execute(db);
+
+		await sql`
+			ALTER TABLE ${sql.ref(tableName)}
+			DROP COLUMN primary_byline_id
+		`.execute(db);
+	}
+
+	await db.schema.dropTable("_emdash_content_bylines").execute();
+	await db.schema.dropTable("_emdash_bylines").execute();
+}

package/src/database/migrations/032_rate_limits.ts

@@ -0,0 +1,39 @@
+import type { Kysely } from "kysely";
+
+/**
+ * Migration: Rate limits table + device code polling tracking.
+ *
+ * 1. Create _emdash_rate_limits for database-backed rate limiting
+ *    of unauthenticated endpoints (device code, magic link, passkey).
+ *
+ * 2. Add last_polled_at column to _emdash_device_codes for
+ *    RFC 8628 slow_down enforcement.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// ── Rate limits table ────────────────────────────────────────────
+	await db.schema
+		.createTable("_emdash_rate_limits")
+		.addColumn("key", "text", (col) => col.notNull())
+		.addColumn("window", "text", (col) => col.notNull())
+		.addColumn("count", "integer", (col) => col.notNull().defaultTo(1))
+		.addPrimaryKeyConstraint("pk_rate_limits", ["key", "window"])
+		.execute();
+
+	// Index on window for efficient cleanup of expired entries
+	await db.schema
+		.createIndex("idx_rate_limits_window")
+		.on("_emdash_rate_limits")
+		.column("window")
+		.execute();
+
+	// ── Device code polling tracking ─────────────────────────────────
+	await db.schema.alterTable("_emdash_device_codes").addColumn("last_polled_at", "text").execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("_emdash_rate_limits").execute();
+
+	// SQLite doesn't support DROP COLUMN before 3.35.0, but since this is
+	// dev-only (v0, no migrations in production), we accept the limitation.
+	await db.schema.alterTable("_emdash_device_codes").dropColumn("last_polled_at").execute();
+}