emdash 0.0.0-b → 0.0.2

package/src/astro/routes/api/search/suggest.ts

@@ -0,0 +1,53 @@
+/**
+ * Search suggestions endpoint - Autocomplete
+ *
+ * GET /_emdash/api/search/suggest?q=hel&limit=5
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseQuery } from "#api/parse.js";
+import { searchSuggestQuery } from "#api/schemas.js";
+import { getSuggestions } from "#search/index.js";
+
+export const prerender = false;
+
+/**
+ * Get search suggestions for autocomplete
+ *
+ * Query parameters:
+ * - q: Partial search query (required)
+ * - collections: Comma-separated list of collection slugs (optional)
+ * - limit: Maximum suggestions (optional, defaults to 5)
+ */
+export const GET: APIRoute = async ({ url, locals }) => {
+	const { emdash, user } = locals;
+
+	const denied = requirePerm(user, "search:read");
+	if (denied) return denied;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash not configured", 500);
+	}
+
+	const query = parseQuery(url, searchSuggestQuery);
+	if (isParseError(query)) return query;
+
+	const collections = query.collections
+		? query.collections.split(",").map((c: string) => c.trim())
+		: undefined;
+
+	try {
+		const suggestions = await getSuggestions(emdash.db, query.q, {
+			collections,
+			locale: query.locale,
+			limit: query.limit,
+		});
+
+		return apiSuccess({ items: suggestions });
+	} catch (error) {
+		return handleError(error, "Failed to get suggestions", "SUGGESTION_ERROR");
+	}
+};

package/src/astro/routes/api/sections/[slug].ts

@@ -0,0 +1,84 @@
+/**
+ * Section by slug endpoints
+ *
+ * GET    /_emdash/api/sections/:slug - Get section
+ * PUT    /_emdash/api/sections/:slug - Update section
+ * DELETE /_emdash/api/sections/:slug - Delete section
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import {
+	handleSectionDelete,
+	handleSectionGet,
+	handleSectionUpdate,
+} from "#api/handlers/sections.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { updateSectionBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+	const { slug } = params;
+
+	const denied = requirePerm(user, "sections:read");
+	if (denied) return denied;
+
+	if (!slug) {
+		return apiError("VALIDATION_ERROR", "slug is required", 400);
+	}
+
+	try {
+		const result = await handleSectionGet(db, slug);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to fetch section", "SECTION_GET_ERROR");
+	}
+};
+
+export const PUT: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+	const { slug } = params;
+
+	const denied = requirePerm(user, "sections:manage");
+	if (denied) return denied;
+
+	if (!slug) {
+		return apiError("VALIDATION_ERROR", "slug is required", 400);
+	}
+
+	try {
+		const body = await parseBody(request, updateSectionBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleSectionUpdate(db, slug, body);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to update section", "SECTION_UPDATE_ERROR");
+	}
+};
+
+export const DELETE: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+	const { slug } = params;
+
+	const denied = requirePerm(user, "sections:manage");
+	if (denied) return denied;
+
+	if (!slug) {
+		return apiError("VALIDATION_ERROR", "slug is required", 400);
+	}
+
+	try {
+		const result = await handleSectionDelete(db, slug);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to delete section", "SECTION_DELETE_ERROR");
+	}
+};

package/src/astro/routes/api/sections/index.ts

@@ -0,0 +1,52 @@
+/**
+ * Sections list and create endpoints
+ *
+ * GET  /_emdash/api/sections - List all sections (with filters)
+ * POST /_emdash/api/sections - Create section
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { handleError, unwrapResult } from "#api/error.js";
+import { handleSectionCreate, handleSectionList } from "#api/handlers/sections.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { createSectionBody, sectionsListQuery } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ url, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+
+	const denied = requirePerm(user, "sections:read");
+	if (denied) return denied;
+
+	try {
+		const query = parseQuery(url, sectionsListQuery);
+		if (isParseError(query)) return query;
+
+		const result = await handleSectionList(db, query);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to fetch sections", "SECTION_LIST_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+
+	const denied = requirePerm(user, "sections:manage");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, createSectionBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleSectionCreate(db, body);
+		return unwrapResult(result, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create section", "SECTION_CREATE_ERROR");
+	}
+};

package/src/astro/routes/api/settings/email.ts

@@ -0,0 +1,150 @@
+/**
+ * Email Settings API endpoint
+ *
+ * GET  /_emdash/api/settings/email      — current provider, available providers, middleware
+ * POST /_emdash/api/settings/email/test — send a test email through the full pipeline
+ */
+
+import { escapeHtml } from "@emdash-cms/auth";
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+export const prerender = false;
+
+const EMAIL_DELIVER_HOOK = "email:deliver";
+const EMAIL_BEFORE_SEND_HOOK = "email:beforeSend";
+const EMAIL_AFTER_SEND_HOOK = "email:afterSend";
+
+/**
+ * GET /_emdash/api/settings/email
+ *
+ * Returns the email configuration state:
+ * - Current provider selection
+ * - Available providers (plugins with email:deliver)
+ * - Active middleware (email:beforeSend / email:afterSend plugins)
+ * - Whether email is available
+ */
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+
+	try {
+		const pipeline = emdash.hooks;
+		const optionsRepo = new OptionsRepository(emdash.db);
+
+		// Get email:deliver providers and current selection
+		const providers = pipeline.getExclusiveHookProviders(EMAIL_DELIVER_HOOK);
+		const selectedProviderId = await optionsRepo.get<string>(
+			`emdash:exclusive_hook:${EMAIL_DELIVER_HOOK}`,
+		);
+
+		// Get middleware hooks (beforeSend / afterSend)
+		const beforeSendPlugins = pipeline
+			.getExclusiveHookProviders(EMAIL_BEFORE_SEND_HOOK)
+			.map((p) => p.pluginId);
+		const afterSendPlugins = pipeline
+			.getExclusiveHookProviders(EMAIL_AFTER_SEND_HOOK)
+			.map((p) => p.pluginId);
+
+		// Note: beforeSend/afterSend are NOT exclusive hooks, but getExclusiveHookProviders
+		// only finds exclusive ones. We need all hooks for those names.
+		// For now, report what we can from the exclusive hook system.
+		// Middleware is non-exclusive so we'd need a different query.
+		// TODO: Add getHookProviders() for non-exclusive hooks to the pipeline.
+
+		return apiSuccess({
+			available: emdash.email?.isAvailable() ?? false,
+			providers: providers.map((p) => ({
+				pluginId: p.pluginId,
+			})),
+			selectedProviderId: selectedProviderId ?? null,
+			middleware: {
+				beforeSend: beforeSendPlugins,
+				afterSend: afterSendPlugins,
+			},
+		});
+	} catch (error) {
+		return handleError(error, "Failed to get email settings", "EMAIL_SETTINGS_READ_ERROR");
+	}
+};
+
+/**
+ * POST /_emdash/api/settings/email/test
+ *
+ * Send a test email through the full pipeline.
+ * Validates the pipeline is configured and the provider works.
+ */
+const testEmailBody = z.object({
+	to: z.string().email(),
+});
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+
+	if (!emdash.email?.isAvailable()) {
+		return apiError(
+			"EMAIL_NOT_CONFIGURED",
+			"No email provider is configured. Install and activate an email provider plugin.",
+			503,
+		);
+	}
+
+	try {
+		const body = await parseBody(request, testEmailBody);
+		if (isParseError(body)) return body;
+
+		const optionsRepo = new OptionsRepository(emdash.db);
+		const siteName = (await optionsRepo.get<string>("emdash:site_title")) ?? "EmDash";
+		const safeName = escapeHtml(siteName);
+
+		await emdash.email.send(
+			{
+				to: body.to,
+				subject: `Test email from ${siteName}`,
+				text: `This is a test email from ${siteName}.\n\nIf you received this, your email provider is working correctly.`,
+				html: `
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.5; color: #333; max-width: 600px; margin: 0 auto; padding: 20px;">
+  <h1 style="font-size: 24px; margin-bottom: 20px;">Test Email</h1>
+  <p>This is a test email from <strong>${safeName}</strong>.</p>
+  <p>If you received this, your email provider is working correctly.</p>
+  <p style="color: #666; font-size: 14px; margin-top: 30px;">
+    Sent via the EmDash email pipeline.
+  </p>
+</body>
+</html>`,
+			},
+			"admin",
+		);
+
+		return apiSuccess({
+			success: true,
+			message: `Test email sent to ${body.to}`,
+		});
+	} catch (error) {
+		return handleError(error, "Failed to send test email", "EMAIL_TEST_ERROR");
+	}
+};

package/src/astro/routes/api/settings.ts

@@ -0,0 +1,67 @@
+/**
+ * Site Settings API endpoint
+ *
+ * GET  /_emdash/api/settings - Get all site settings
+ * POST /_emdash/api/settings - Update site settings
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleSettingsGet, handleSettingsUpdate } from "#api/handlers/settings.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { settingsUpdateBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+/**
+ * GET /_emdash/api/settings
+ *
+ * Returns all site settings as a JSON object.
+ * Unset values are undefined. Media references include resolved URLs.
+ */
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:read");
+	if (denied) return denied;
+
+	try {
+		const result = await handleSettingsGet(emdash.db, emdash.storage);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to get settings", "SETTINGS_READ_ERROR");
+	}
+};
+
+/**
+ * POST /_emdash/api/settings
+ *
+ * Updates site settings. Accepts a partial settings object.
+ * Merges with existing settings and returns the updated settings.
+ */
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "settings:manage");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, settingsUpdateBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleSettingsUpdate(emdash.db, emdash.storage, body);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to update settings", "SETTINGS_UPDATE_ERROR");
+	}
+};

package/src/astro/routes/api/setup/admin-verify.ts

@@ -0,0 +1,100 @@
+/**
+ * POST /_emdash/api/setup/admin/verify
+ *
+ * Complete admin creation by verifying the passkey registration
+ */
+
+import type { APIRoute } from "astro";
+
+export const prerender = false;
+
+import { Role } from "@emdash-cms/auth";
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { verifyRegistrationResponse, registerPasskey } from "@emdash-cms/auth/passkey";
+
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { setupAdminVerifyBody } from "#api/schemas.js";
+import { createChallengeStore } from "#auth/challenge-store.js";
+import { getPasskeyConfig } from "#auth/passkey-config.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	try {
+		// Check if setup is already complete
+		const options = new OptionsRepository(emdash.db);
+		const setupComplete = await options.get("emdash:setup_complete");
+
+		if (setupComplete === true || setupComplete === "true") {
+			return apiError("SETUP_COMPLETE", "Setup already complete", 400);
+		}
+
+		// Check if any users exist
+		const adapter = createKyselyAdapter(emdash.db);
+		const userCount = await adapter.countUsers();
+
+		if (userCount > 0) {
+			return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
+		}
+
+		// Get setup state
+		const setupState = await options.get("emdash:setup_state");
+
+		if (!setupState || setupState.step !== "admin") {
+			return apiError("INVALID_STATE", "Invalid setup state. Please restart setup.", 400);
+		}
+
+		// Parse request body
+		const body = await parseBody(request, setupAdminVerifyBody);
+		if (isParseError(body)) return body;
+
+		// Get passkey config
+		const url = new URL(request.url);
+		const siteName = (await options.get<string>("emdash:site_title")) ?? undefined;
+		const passkeyConfig = getPasskeyConfig(url, siteName);
+
+		// Verify the registration response
+		const challengeStore = createChallengeStore(emdash.db);
+
+		const verified = await verifyRegistrationResponse(
+			passkeyConfig,
+			body.credential,
+			challengeStore,
+		);
+
+		// Create the admin user
+		const user = await adapter.createUser({
+			email: setupState.email,
+			name: setupState.name,
+			role: Role.ADMIN,
+			emailVerified: false, // No email verification for first user
+		});
+
+		// Register the passkey
+		await registerPasskey(adapter, user.id, verified, "Setup passkey");
+
+		// Mark setup as complete
+		await options.set("emdash:setup_complete", true);
+
+		// Clean up setup state
+		await options.delete("emdash:setup_state");
+
+		return apiSuccess({
+			success: true,
+			user: {
+				id: user.id,
+				email: user.email,
+				name: user.name,
+				role: user.role,
+			},
+		});
+	} catch (error) {
+		return handleError(error, "Failed to verify admin setup", "SETUP_VERIFY_ERROR");
+	}
+};

package/src/astro/routes/api/setup/admin.ts

@@ -0,0 +1,94 @@
+/**
+ * POST /_emdash/api/setup/admin
+ *
+ * Step 3 of setup: Start admin creation by returning passkey registration options
+ */
+
+import type { APIRoute } from "astro";
+
+export const prerender = false;
+
+import { createKyselyAdapter } from "@emdash-cms/auth/adapters/kysely";
+import { generateRegistrationOptions } from "@emdash-cms/auth/passkey";
+
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { setupAdminBody } from "#api/schemas.js";
+import { createChallengeStore } from "#auth/challenge-store.js";
+import { getPasskeyConfig } from "#auth/passkey-config.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash } = locals;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	try {
+		// Check if setup is already complete
+		const options = new OptionsRepository(emdash.db);
+		const setupComplete = await options.get("emdash:setup_complete");
+
+		if (setupComplete === true || setupComplete === "true") {
+			return apiError("SETUP_COMPLETE", "Setup already complete", 400);
+		}
+
+		// Check if any users exist
+		const adapter = createKyselyAdapter(emdash.db);
+		const userCount = await adapter.countUsers();
+
+		if (userCount > 0) {
+			return apiError("ADMIN_EXISTS", "Admin user already exists", 400);
+		}
+
+		// Parse request body
+		const body = await parseBody(request, setupAdminBody);
+		if (isParseError(body)) return body;
+
+		// Store admin info in setup state for later
+		await options.set("emdash:setup_state", {
+			step: "admin",
+			email: body.email.toLowerCase(),
+			name: body.name || null,
+		});
+
+		// Get passkey config
+		const url = new URL(request.url);
+		const siteName = (await options.get<string>("emdash:site_title")) ?? undefined;
+		const passkeyConfig = getPasskeyConfig(url, siteName);
+
+		// Generate registration options
+		const challengeStore = createChallengeStore(emdash.db);
+
+		// Create a temporary user object for registration options
+		// (not persisted until passkey is verified)
+		const tempUser = {
+			id: `setup-${Date.now()}`, // Temporary ID
+			email: body.email.toLowerCase(),
+			name: body.name || null,
+		};
+
+		const registrationOptions = await generateRegistrationOptions(
+			passkeyConfig,
+			tempUser,
+			[], // No existing credentials
+			challengeStore,
+		);
+
+		// Store the temp user ID with the setup state
+		await options.set("emdash:setup_state", {
+			step: "admin",
+			email: body.email.toLowerCase(),
+			name: body.name || null,
+			tempUserId: tempUser.id,
+		});
+
+		return apiSuccess({
+			success: true,
+			options: registrationOptions,
+		});
+	} catch (error) {
+		return handleError(error, "Failed to create admin", "SETUP_ADMIN_ERROR");
+	}
+};