emdash 0.0.0-b → 0.0.2

package/src/astro/routes/api/import/wordpress-plugin/callback.ts

@@ -0,0 +1,58 @@
+/**
+ * WordPress Application Password OAuth callback
+ *
+ * GET /_emdash/api/import/wordpress-plugin/callback
+ *
+ * WordPress redirects here after user approves the application password.
+ * We receive the credentials and redirect to the admin import UI with a token.
+ */
+
+import type { APIRoute } from "astro";
+
+import { encodeBase64 } from "#utils/base64.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ url, cookies, redirect }) => {
+	// WordPress sends these params on success:
+	// - site_url: The WordPress site URL
+	// - user_login: The username
+	// - password: The newly created application password
+	//
+	// On rejection, it redirects to reject_url (if provided) or just doesn't include credentials
+
+	const siteUrl = url.searchParams.get("site_url");
+	const userLogin = url.searchParams.get("user_login");
+	const password = url.searchParams.get("password");
+
+	// Check if this is a rejection (no credentials)
+	if (!siteUrl || !userLogin || !password) {
+		return redirect("/_emdash/admin/import/wordpress?error=auth_rejected");
+	}
+
+	// Create the Basic Auth token
+	const token = encodeBase64(`${userLogin}:${password}`);
+
+	// Store credentials in a short-lived cookie (5 minutes)
+	// This allows the import UI to retrieve them
+	const authData = JSON.stringify({
+		siteUrl,
+		userLogin,
+		token,
+		timestamp: Date.now(),
+	});
+
+	// Base64 encode the auth data for cookie storage
+	const encodedAuth = encodeBase64(authData);
+
+	cookies.set("emdash_wp_auth", encodedAuth, {
+		path: "/_emdash/",
+		maxAge: 300, // 5 minutes
+		httpOnly: false, // Needs to be readable by JS
+		secure: url.protocol === "https:",
+		sameSite: "lax",
+	});
+
+	// Redirect to import UI - it will pick up the cookie
+	return redirect("/_emdash/admin/import/wordpress?auth=success");
+};

package/src/astro/routes/api/import/wordpress-plugin/execute.ts

@@ -0,0 +1,347 @@
+/**
+ * WordPress Plugin execute import endpoint
+ *
+ * POST /_emdash/api/import/wordpress-plugin/execute
+ *
+ * Imports content from WordPress via EmDash Exporter plugin API.
+ */
+
+import type { APIRoute } from "astro";
+import { ContentRepository, SchemaRegistry } from "emdash";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { wpPluginExecuteBody } from "#api/schemas.js";
+import { BylineRepository } from "#db/repositories/byline.js";
+import { getSource } from "#import/index.js";
+import { validateExternalUrl, SsrfError } from "#import/ssrf.js";
+import type { ImportConfig, ImportResult, NormalizedItem } from "#import/types.js";
+import { resolveImportByline } from "#import/utils.js";
+import type { FieldType } from "#schema/types.js";
+import type { EmDashHandlers, EmDashManifest } from "#types";
+import { slugify } from "#utils/slugify.js";
+
+export const prerender = false;
+
+export interface WpPluginImportConfig extends ImportConfig {
+	/** Author mappings (WP author login -> EmDash user ID) */
+	authorMappings?: Record<string, string | null>;
+}
+
+export interface WpPluginImportResponse {
+	success: boolean;
+	result?: ImportResult;
+	error?: { message: string };
+}
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, emdashManifest, user } = locals;
+
+	const denied = requirePerm(user, "import:execute");
+	if (denied) return denied;
+
+	if (!emdash?.handleContentCreate) {
+		return apiError("NOT_CONFIGURED", "EmDash not configured", 500);
+	}
+
+	try {
+		const body = await parseBody(request, wpPluginExecuteBody);
+		if (isParseError(body)) return body;
+
+		// SSRF: reject internal/private network targets
+		try {
+			validateExternalUrl(body.url);
+		} catch (e) {
+			const msg = e instanceof SsrfError ? e.message : "Invalid URL";
+			return apiError("SSRF_BLOCKED", msg, 400);
+		}
+
+		// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- Zod schema output narrowed to WpPluginImportConfig
+		const config = body.config as unknown as WpPluginImportConfig;
+
+		// Get the WordPress plugin source
+		const source = getSource("wordpress-plugin");
+		if (!source) {
+			return apiError("NOT_CONFIGURED", "WordPress plugin source not available", 500);
+		}
+
+		// Build the list of post types to fetch
+		const postTypes = Object.entries(config.postTypeMappings)
+			.filter(([_, mapping]) => mapping.enabled)
+			.map(([postType]) => postType);
+
+		if (postTypes.length === 0) {
+			return apiError("VALIDATION_ERROR", "No post types selected for import", 400);
+		}
+
+		console.log("[WP Plugin Import] Starting import for:", body.url);
+		console.log("[WP Plugin Import] Post types:", postTypes);
+
+		// Import content (including drafts since we have auth)
+		const result = await importContent(
+			source.fetchContent(
+				{ type: "url", url: body.url, token: body.token },
+				{ postTypes, includeDrafts: true },
+			),
+			config,
+			emdash,
+			emdashManifest,
+		);
+
+		console.log("[WP Plugin Import] Import result:", JSON.stringify(result, null, 2));
+
+		return apiSuccess({
+			success: true,
+			result,
+		});
+	} catch (error) {
+		return handleError(error, "Failed to import from WordPress", "WP_PLUGIN_IMPORT_ERROR");
+	}
+};
+
+/** Fields that should be auto-created if they don't exist */
+const IMPORT_FIELDS: Array<{
+	slug: string;
+	label: string;
+	type: FieldType;
+	check: (item: NormalizedItem) => boolean;
+}> = [
+	{
+		slug: "title",
+		label: "Title",
+		type: "string",
+		check: () => true,
+	},
+	{
+		slug: "content",
+		label: "Content",
+		type: "portableText",
+		check: () => true,
+	},
+	{
+		slug: "excerpt",
+		label: "Excerpt",
+		type: "text",
+		check: (item) => !!item.excerpt,
+	},
+	{
+		slug: "featured_image",
+		label: "Featured Image",
+		type: "image",
+		check: (item) => !!item.featuredImage,
+	},
+];
+
+async function importContent(
+	items: AsyncGenerator<NormalizedItem>,
+	config: WpPluginImportConfig,
+	emdash: EmDashHandlers,
+	manifest: EmDashManifest,
+): Promise<ImportResult> {
+	const result: ImportResult = {
+		success: true,
+		imported: 0,
+		skipped: 0,
+		errors: [],
+		byCollection: {},
+	};
+
+	// Create content repository for checking existing items
+	const contentRepo = new ContentRepository(emdash.db);
+	const bylineRepo = new BylineRepository(emdash.db);
+	const bylineCache = new Map<string, string>();
+	const schemaRegistry = new SchemaRegistry(emdash.db);
+
+	// Track which collections have had fields ensured
+	const ensuredCollections = new Set<string>();
+
+	// Track source translationGroup -> EmDash item ID for translation linking.
+	// Maps source-side translation group ID to the EmDash ID of the first item
+	// imported for that group (the default-locale item).
+	const translationGroupMap = new Map<string, string>();
+
+	for await (const item of items) {
+		console.log("[WP Plugin Import] Processing item:", {
+			sourceId: item.sourceId,
+			title: item.title,
+			postType: item.postType,
+			status: item.status,
+			contentBlocks: Array.isArray(item.content) ? item.content.length : 0,
+			featuredImage: item.featuredImage,
+			locale: item.locale,
+			translationGroup: item.translationGroup,
+		});
+
+		const mapping = config.postTypeMappings[item.postType];
+
+		// Skip if not mapped or disabled
+		if (!mapping || !mapping.enabled) {
+			result.skipped++;
+			continue;
+		}
+
+		const collection = mapping.collection;
+
+		// Check if collection exists in manifest
+		if (!manifest?.collections[collection]) {
+			result.errors.push({
+				title: item.title || "Untitled",
+				error: `Collection "${collection}" does not exist`,
+			});
+			continue;
+		}
+
+		try {
+			// Ensure required fields exist in the collection schema (once per collection)
+			if (!ensuredCollections.has(collection)) {
+				for (const field of IMPORT_FIELDS) {
+					if (field.check(item)) {
+						const existingField = await schemaRegistry.getField(collection, field.slug);
+						if (!existingField) {
+							console.log(
+								`[WP Plugin Import] Creating missing field "${field.slug}" in collection "${collection}"`,
+							);
+							try {
+								await schemaRegistry.createField(collection, {
+									slug: field.slug,
+									label: field.label,
+									type: field.type,
+									required: false,
+								});
+							} catch (e) {
+								// Field might already exist from concurrent creation
+								console.log(
+									`[WP Plugin Import] Field "${field.slug}" creation skipped:`,
+									e instanceof Error ? e.message : e,
+								);
+							}
+						}
+					}
+				}
+				ensuredCollections.add(collection);
+			}
+
+			// Generate slug from item slug or title
+			const slug = item.slug || slugify(item.title || `post-${item.sourceId}`);
+
+			// Check if already exists (idempotency) — locale-aware lookup
+			if (config.skipExisting) {
+				const existing = await contentRepo.findBySlug(collection, slug, item.locale);
+				if (existing) {
+					// Still track the translation group mapping for later items
+					if (item.translationGroup) {
+						translationGroupMap.set(item.translationGroup, existing.id);
+					}
+					result.skipped++;
+					continue;
+				}
+			}
+
+			// Map WordPress status to EmDash status
+			const status = mapStatus(item.status);
+
+			// Build data object - add all applicable fields
+			const data: Record<string, unknown> = {};
+
+			// Add standard fields
+			data.title = item.title || "Untitled";
+			data.content = item.content;
+
+			if (item.excerpt) {
+				data.excerpt = item.excerpt;
+			}
+			if (item.featuredImage) {
+				data.featured_image = item.featuredImage;
+				console.log("[WP Plugin Import] Adding featured_image:", item.featuredImage);
+			}
+
+			// Note: ACF/Yoast/RankMath fields are not added automatically
+			// They would need matching fields in the EmDash schema
+
+			// Resolve author ID from mappings
+			let authorId: string | undefined;
+			if (config.authorMappings && item.author) {
+				const mappedUserId = config.authorMappings[item.author];
+				if (mappedUserId !== undefined && mappedUserId !== null) {
+					authorId = mappedUserId;
+				}
+			}
+
+			const bylineId = await resolveImportByline(
+				item.author,
+				item.author, // display name fallback is the login
+				authorId,
+				bylineRepo,
+				bylineCache,
+			);
+
+			// Resolve translation link: if this item has a translationGroup and
+			// we've already imported another item in the same group, link them.
+			let translationOf: string | undefined;
+			if (item.translationGroup) {
+				const existingGroupItem = translationGroupMap.get(item.translationGroup);
+				if (existingGroupItem) {
+					translationOf = existingGroupItem;
+				}
+			}
+
+			// Create the content item
+			const createResult = await emdash.handleContentCreate(collection, {
+				data,
+				slug,
+				status,
+				authorId,
+				bylines: bylineId ? [{ bylineId }] : undefined,
+				locale: item.locale,
+				translationOf,
+			});
+
+			if (createResult.success) {
+				result.imported++;
+				result.byCollection[collection] = (result.byCollection[collection] || 0) + 1;
+
+				// Track translation group: first item in a group establishes the mapping
+				if (item.translationGroup && !translationGroupMap.has(item.translationGroup)) {
+					// eslint-disable-next-line typescript-eslint(no-unsafe-type-assertion) -- handler success data includes id
+					const createdData = createResult.data as { id?: string } | undefined;
+					if (createdData?.id) {
+						translationGroupMap.set(item.translationGroup, createdData.id);
+					}
+				}
+			} else {
+				result.errors.push({
+					title: item.title || "Untitled",
+					error:
+						typeof createResult.error === "object" && createResult.error !== null
+							? (createResult.error as { message?: string }).message || "Unknown error"
+							: String(createResult.error),
+				});
+			}
+		} catch (error) {
+			console.error(`Import error for "${item.title || "Untitled"}":`, error);
+			result.errors.push({
+				title: item.title || "Untitled",
+				error: "Failed to import item",
+			});
+		}
+	}
+
+	result.success = result.errors.length === 0;
+	return result;
+}
+
+function mapStatus(wpStatus: string | undefined): string {
+	switch (wpStatus) {
+		case "publish":
+			return "published";
+		case "draft":
+			return "draft";
+		case "pending":
+			return "draft";
+		case "private":
+			return "draft";
+		default:
+			return "draft";
+	}
+}

package/src/astro/routes/api/manifest.ts

@@ -0,0 +1,62 @@
+/**
+ * Admin manifest endpoint - injected by EmDash integration
+ *
+ * GET /_emdash/api/manifest
+ *
+ * Returns the admin manifest with collection definitions and plugin info.
+ * The manifest is generated from the user's live.config.ts at runtime.
+ */
+
+import type { APIRoute } from "astro";
+
+import { getAuthMode } from "#auth/mode.js";
+
+import type { EmDashManifest } from "../../types.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdashManifest, emdash } = locals;
+
+	// Determine auth mode from config
+	const authMode = getAuthMode(emdash?.config);
+
+	// Check if self-signup is enabled (any allowed domain with enabled = 1)
+	// Only relevant for passkey auth — external auth providers handle their own signup
+	let signupEnabled = false;
+	if (emdash?.db && authMode.type === "passkey") {
+		try {
+			const { sql } = await import("kysely");
+			const result = await sql<{ cnt: unknown }>`
+				SELECT COUNT(*) as cnt FROM allowed_domains WHERE enabled = 1
+			`.execute(emdash.db);
+			signupEnabled = Number(result.rows[0]?.cnt ?? 0) > 0;
+		} catch {
+			// Table may not exist yet, that's fine
+		}
+	}
+
+	const manifest: EmDashManifest = emdashManifest
+		? {
+				...emdashManifest,
+				authMode: authMode.type === "external" ? authMode.providerType : "passkey",
+				signupEnabled,
+			}
+		: {
+				version: "0.1.0",
+				hash: "default",
+				collections: {},
+				plugins: {},
+				authMode: "passkey",
+				signupEnabled,
+			};
+
+	return Response.json(
+		{ data: manifest },
+		{
+			headers: {
+				"Cache-Control": "private, no-store",
+			},
+		},
+	);
+};

package/src/astro/routes/api/mcp.ts

@@ -0,0 +1,124 @@
+/**
+ * MCP Streamable HTTP endpoint
+ *
+ * Exposes an MCP server at /_emdash/api/mcp using the Streamable HTTP
+ * transport (Web Standard variant). The server runs stateless — each
+ * request creates a fresh transport, so no session tracking is needed.
+ * Authentication is handled by the existing EmDash auth middleware.
+ *
+ * POST /_emdash/api/mcp — JSON-RPC tool calls
+ * GET  /_emdash/api/mcp — SSE stream (not used in stateless mode)
+ * DELETE /_emdash/api/mcp — Session close (not used in stateless mode)
+ */
+
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import type { APIRoute } from "astro";
+
+import { apiError } from "#api/error.js";
+import { createMcpServer } from "#mcp/server.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+
+	if (!emdash) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	if (!user) {
+		return apiError("UNAUTHORIZED", "Authentication required", 401);
+	}
+
+	const server = createMcpServer();
+
+	try {
+		const transport = new WebStandardStreamableHTTPServerTransport({
+			// Stateless: no session management
+			sessionIdGenerator: undefined,
+		});
+
+		await server.connect(transport);
+
+		return await transport.handleRequest(request, {
+			authInfo: {
+				token: "",
+				clientId: "emdash-admin",
+				scopes: [],
+				extra: {
+					emdash,
+					userId: user.id,
+					userRole: user.role,
+					tokenScopes: locals.tokenScopes,
+				},
+			},
+		});
+	} catch (error) {
+		console.error("[MCP]", error);
+		await server.close().catch(() => {});
+
+		return new Response(
+			JSON.stringify({
+				jsonrpc: "2.0",
+				error: {
+					code: -32603,
+					message: "Internal server error",
+				},
+				id: null,
+			}),
+			{
+				status: 500,
+				headers: {
+					"Content-Type": "application/json",
+					"Cache-Control": "private, no-store",
+				},
+			},
+		);
+	}
+};
+
+/**
+ * GET — SSE stream. Not used in stateless mode.
+ */
+export const GET: APIRoute = async () => {
+	return new Response(
+		JSON.stringify({
+			jsonrpc: "2.0",
+			error: {
+				code: -32000,
+				message: "Method not allowed. This is a stateless MCP endpoint — use POST.",
+			},
+			id: null,
+		}),
+		{
+			status: 405,
+			headers: {
+				"Content-Type": "application/json",
+				"Cache-Control": "private, no-store",
+			},
+		},
+	);
+};
+
+/**
+ * DELETE — Session close. Not used in stateless mode.
+ */
+export const DELETE: APIRoute = async () => {
+	return new Response(
+		JSON.stringify({
+			jsonrpc: "2.0",
+			error: {
+				code: -32000,
+				message: "Method not allowed. This is a stateless MCP endpoint.",
+			},
+			id: null,
+		}),
+		{
+			status: 405,
+			headers: {
+				"Content-Type": "application/json",
+				"Cache-Control": "private, no-store",
+			},
+		},
+	);
+};

package/src/astro/routes/api/media/[id]/confirm.ts

@@ -0,0 +1,93 @@
+/**
+ * Confirm media upload endpoint
+ *
+ * POST /_emdash/api/media/{id}/confirm
+ *
+ * Confirms that the client has successfully uploaded the file to storage.
+ * Marks the media record as ready and optionally updates metadata.
+ */
+
+import type { APIRoute } from "astro";
+import { MediaRepository } from "emdash";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
+import { mediaConfirmBody } from "#api/schemas.js";
+import type { MediaItem } from "#types";
+
+export const prerender = false;
+
+/**
+ * Add URL to media item (relative URL for portability)
+ */
+function addUrlToMedia(item: MediaItem): MediaItem & { url: string } {
+	return {
+		...item,
+		url: `/_emdash/api/media/file/${item.storageKey}`,
+	};
+}
+
+/**
+ * Confirm upload completion
+ */
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	const denied = requirePerm(user, "media:upload");
+	if (denied) return denied;
+
+	if (!id) {
+		return apiError("INVALID_REQUEST", "Media ID is required", 400);
+	}
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	try {
+		const body = await parseOptionalBody(request, mediaConfirmBody, {});
+		if (isParseError(body)) return body;
+
+		const repo = new MediaRepository(emdash.db);
+
+		// Get the media item first to check status
+		const existing = await repo.findById(id);
+		if (!existing) {
+			return apiError("NOT_FOUND", `Media item not found: ${id}`, 404);
+		}
+
+		if (existing.status !== "pending") {
+			return apiError("INVALID_STATE", `Media item is not pending: ${existing.status}`, 400);
+		}
+
+		// Optionally verify the file exists in storage
+		if (emdash.storage) {
+			const exists = await emdash.storage.exists(existing.storageKey);
+			if (!exists) {
+				// Mark as failed
+				await repo.markFailed(id);
+				return apiError("FILE_NOT_FOUND", "File was not uploaded to storage", 400);
+			}
+		}
+
+		// Confirm the upload
+		const item = await repo.confirmUpload(id, {
+			size: body.size,
+			width: body.width,
+			height: body.height,
+		});
+
+		if (!item) {
+			return apiError("CONFIRM_FAILED", "Failed to confirm upload", 500);
+		}
+
+		// Add URL to the response (relative URL for portability)
+		const itemWithUrl = addUrlToMedia(item);
+
+		return apiSuccess({ item: itemWithUrl });
+	} catch (error) {
+		return handleError(error, "Failed to confirm upload", "CONFIRM_ERROR");
+	}
+};