emdash 0.0.0-b → 0.0.2

package/src/astro/routes/api/widget-areas/[name]/widgets.ts

@@ -0,0 +1,80 @@
+/**
+ * Widgets CRUD endpoints
+ *
+ * POST /_emdash/api/widget-areas/:name/widgets - Add widget
+ */
+
+import type { APIRoute } from "astro";
+import { ulid } from "ulidx";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { createWidgetBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+	const { name } = params;
+
+	const denied = requirePerm(user, "widgets:manage");
+	if (denied) return denied;
+
+	if (!name) {
+		return apiError("VALIDATION_ERROR", "name is required", 400);
+	}
+
+	try {
+		// Get the area
+		const area = await db
+			.selectFrom("_emdash_widget_areas")
+			.select("id")
+			.where("name", "=", name)
+			.executeTakeFirst();
+
+		if (!area) {
+			return apiError("NOT_FOUND", `Widget area "${name}" not found`, 404);
+		}
+
+		const body = await parseBody(request, createWidgetBody);
+		if (isParseError(body)) return body;
+
+		// Get max sort_order
+		const maxOrder = await db
+			.selectFrom("_emdash_widgets")
+			.select(({ fn }) => fn.max("sort_order").as("maxOrder"))
+			.where("area_id", "=", area.id)
+			.executeTakeFirst();
+
+		const sortOrder = (maxOrder?.maxOrder ?? -1) + 1;
+
+		// Prepare values
+		const id = ulid();
+		await db
+			.insertInto("_emdash_widgets")
+			.values({
+				id,
+				area_id: area.id,
+				sort_order: sortOrder,
+				type: body.type,
+				title: body.title ?? null,
+				content: body.content ? JSON.stringify(body.content) : null,
+				menu_name: body.menuName ?? null,
+				component_id: body.componentId ?? null,
+				component_props: body.componentProps ? JSON.stringify(body.componentProps) : null,
+			})
+			.execute();
+
+		const widget = await db
+			.selectFrom("_emdash_widgets")
+			.selectAll()
+			.where("id", "=", id)
+			.executeTakeFirstOrThrow();
+
+		return apiSuccess(widget, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create widget", "WIDGET_CREATE_ERROR");
+	}
+};

package/src/astro/routes/api/widget-areas/[name].ts

@@ -0,0 +1,87 @@
+/**
+ * Widget area by name endpoints
+ *
+ * GET    /_emdash/api/widget-areas/:name - Get area with widgets
+ * DELETE /_emdash/api/widget-areas/:name - Delete area
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+	const { name } = params;
+
+	const denied = requirePerm(user, "widgets:read");
+	if (denied) return denied;
+
+	if (!name) {
+		return apiError("VALIDATION_ERROR", "name is required", 400);
+	}
+
+	try {
+		// Get the area
+		const area = await db
+			.selectFrom("_emdash_widget_areas")
+			.selectAll()
+			.where("name", "=", name)
+			.executeTakeFirst();
+
+		if (!area) {
+			return apiError("NOT_FOUND", `Widget area "${name}" not found`, 404);
+		}
+
+		// Get widgets for this area
+		const widgets = await db
+			.selectFrom("_emdash_widgets")
+			.selectAll()
+			.where("area_id", "=", area.id)
+			.orderBy("sort_order", "asc")
+			.execute();
+
+		return apiSuccess({
+			...area,
+			widgets,
+		});
+	} catch (error) {
+		return handleError(error, "Failed to fetch widget area", "WIDGET_AREA_GET_ERROR");
+	}
+};
+
+export const DELETE: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+	const { name } = params;
+
+	const denied = requirePerm(user, "widgets:manage");
+	if (denied) return denied;
+
+	if (!name) {
+		return apiError("VALIDATION_ERROR", "name is required", 400);
+	}
+
+	try {
+		// Check if area exists
+		const area = await db
+			.selectFrom("_emdash_widget_areas")
+			.select("id")
+			.where("name", "=", name)
+			.executeTakeFirst();
+
+		if (!area) {
+			return apiError("NOT_FOUND", `Widget area "${name}" not found`, 404);
+		}
+
+		// Delete area (widgets cascade)
+		await db.deleteFrom("_emdash_widget_areas").where("id", "=", area.id).execute();
+
+		return apiSuccess({ deleted: true });
+	} catch (error) {
+		return handleError(error, "Failed to delete widget area", "WIDGET_AREA_DELETE_ERROR");
+	}
+};

package/src/astro/routes/api/widget-areas/index.ts

@@ -0,0 +1,99 @@
+/**
+ * Widget areas list and create endpoints
+ *
+ * GET  /_emdash/api/widget-areas - List all widget areas
+ * POST /_emdash/api/widget-areas - Create widget area
+ */
+
+import type { APIRoute } from "astro";
+import { ulid } from "ulidx";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { createWidgetAreaBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+
+	const denied = requirePerm(user, "widgets:read");
+	if (denied) return denied;
+
+	try {
+		const areas = await db
+			.selectFrom("_emdash_widget_areas")
+			.selectAll()
+			.orderBy("name", "asc")
+			.execute();
+
+		// Get widgets for each area (needed for drag-and-drop reordering in admin UI)
+		const areasWithWidgets = await Promise.all(
+			areas.map(async (area) => {
+				const widgets = await db
+					.selectFrom("_emdash_widgets")
+					.selectAll()
+					.where("area_id", "=", area.id)
+					.orderBy("sort_order", "asc")
+					.execute();
+
+				return {
+					...area,
+					widgets,
+					widgetCount: widgets.length,
+				};
+			}),
+		);
+
+		return apiSuccess({ items: areasWithWidgets });
+	} catch (error) {
+		return handleError(error, "Failed to fetch widget areas", "WIDGET_AREA_LIST_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const db = emdash.db;
+
+	const denied = requirePerm(user, "widgets:manage");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, createWidgetAreaBody);
+		if (isParseError(body)) return body;
+
+		// Check if area name already exists
+		const existing = await db
+			.selectFrom("_emdash_widget_areas")
+			.select("id")
+			.where("name", "=", body.name)
+			.executeTakeFirst();
+
+		if (existing) {
+			return apiError("CONFLICT", `Widget area with name "${body.name}" already exists`, 409);
+		}
+
+		const id = ulid();
+		await db
+			.insertInto("_emdash_widget_areas")
+			.values({
+				id,
+				name: body.name,
+				label: body.label,
+				description: body.description ?? null,
+			})
+			.execute();
+
+		const area = await db
+			.selectFrom("_emdash_widget_areas")
+			.selectAll()
+			.where("id", "=", id)
+			.executeTakeFirstOrThrow();
+
+		return apiSuccess(area, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create widget area", "WIDGET_AREA_CREATE_ERROR");
+	}
+};

package/src/astro/routes/api/widget-components.ts

@@ -0,0 +1,22 @@
+/**
+ * Widget components registry endpoint
+ *
+ * GET /_emdash/api/widget-components - List available widget components
+ */
+
+import type { APIRoute } from "astro";
+
+import { apiSuccess, handleError } from "#api/error.js";
+import { getWidgetComponents } from "#widgets/components.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async () => {
+	try {
+		const components = getWidgetComponents();
+
+		return apiSuccess({ items: components });
+	} catch (error) {
+		return handleError(error, "Failed to fetch widget components", "WIDGET_COMPONENTS_ERROR");
+	}
+};

package/src/astro/routes/robots.txt.ts

@@ -0,0 +1,77 @@
+/**
+ * Robots.txt endpoint
+ *
+ * GET /robots.txt - Serves robots.txt with sitemap reference
+ *
+ * If a custom robots.txt is configured in SEO settings, that is returned.
+ * Otherwise generates a default that allows all crawlers and references
+ * the sitemap.
+ */
+
+import type { APIRoute } from "astro";
+
+import { getSiteSettingsWithDb } from "#settings/index.js";
+
+export const prerender = false;
+
+const TRAILING_SLASH_RE = /\/$/;
+
+export const GET: APIRoute = async ({ locals, url }) => {
+	const { emdash } = locals;
+
+	if (!emdash?.db) {
+		// Return a permissive default if CMS isn't initialized
+		return new Response("User-agent: *\nAllow: /\n", {
+			status: 200,
+			headers: { "Content-Type": "text/plain; charset=utf-8" },
+		});
+	}
+
+	try {
+		const settings = await getSiteSettingsWithDb(emdash.db);
+		const siteUrl = (settings.url || url.origin).replace(TRAILING_SLASH_RE, "");
+		const sitemapUrl = `${siteUrl}/sitemap.xml`;
+
+		// Use custom robots.txt if configured
+		if (settings.seo?.robotsTxt) {
+			// Append sitemap directive if not already present
+			let content = settings.seo.robotsTxt;
+			if (!content.toLowerCase().includes("sitemap:")) {
+				content = `${content.trimEnd()}\n\nSitemap: ${sitemapUrl}\n`;
+			}
+
+			return new Response(content, {
+				status: 200,
+				headers: {
+					"Content-Type": "text/plain; charset=utf-8",
+					"Cache-Control": "public, max-age=86400",
+				},
+			});
+		}
+
+		// Generate default robots.txt
+		const defaultRobots = [
+			"User-agent: *",
+			"Allow: /",
+			"",
+			"# Disallow admin and API routes",
+			"Disallow: /_emdash/",
+			"",
+			`Sitemap: ${sitemapUrl}`,
+			"",
+		].join("\n");
+
+		return new Response(defaultRobots, {
+			status: 200,
+			headers: {
+				"Content-Type": "text/plain; charset=utf-8",
+				"Cache-Control": "public, max-age=86400",
+			},
+		});
+	} catch {
+		return new Response("User-agent: *\nAllow: /\n", {
+			status: 200,
+			headers: { "Content-Type": "text/plain; charset=utf-8" },
+		});
+	}
+};

package/src/astro/routes/sitemap.xml.ts

@@ -0,0 +1,97 @@
+/**
+ * Sitemap XML endpoint
+ *
+ * GET /sitemap.xml - Auto-generated sitemap from published content
+ *
+ * Includes all published, non-noindex content across all collections.
+ * The site URL is read from site settings or the request URL origin.
+ *
+ * Default URL pattern: /{collection}/{slug-or-id}. Users can override
+ * by creating their own /sitemap.xml route in their Astro project.
+ */
+
+import type { APIRoute } from "astro";
+
+import { handleSitemapData } from "#api/handlers/seo.js";
+import { getSiteSettingsWithDb } from "#settings/index.js";
+
+export const prerender = false;
+
+const TRAILING_SLASH_RE = /\/$/;
+const AMP_RE = /&/g;
+const LT_RE = /</g;
+const GT_RE = />/g;
+const QUOT_RE = /"/g;
+const APOS_RE = /'/g;
+
+export const GET: APIRoute = async ({ locals, url }) => {
+	const { emdash } = locals;
+
+	if (!emdash?.db) {
+		return new Response("<!-- EmDash not configured -->", {
+			status: 500,
+			headers: { "Content-Type": "application/xml" },
+		});
+	}
+
+	try {
+		// Determine site URL from settings or request origin
+		const settings = await getSiteSettingsWithDb(emdash.db);
+		const siteUrl = (settings.url || url.origin).replace(TRAILING_SLASH_RE, "");
+
+		const result = await handleSitemapData(emdash.db);
+
+		if (!result.success || !result.data) {
+			return new Response("<!-- Failed to generate sitemap -->", {
+				status: 500,
+				headers: { "Content-Type": "application/xml" },
+			});
+		}
+
+		const entries = result.data.entries;
+
+		// Build XML
+		const lines: string[] = [
+			'<?xml version="1.0" encoding="UTF-8"?>',
+			'<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
+		];
+
+		for (const entry of entries) {
+			// Default URL pattern: /{collection}/{identifier}
+			// Encode path segments to handle slugs with spaces/unicode/reserved chars
+			const loc = `${siteUrl}/${encodeURIComponent(entry.collection)}/${encodeURIComponent(entry.identifier)}`;
+
+			lines.push("  <url>");
+			lines.push(`    <loc>${escapeXml(loc)}</loc>`);
+			lines.push(`    <lastmod>${escapeXml(entry.updatedAt)}</lastmod>`);
+			lines.push("    <changefreq>weekly</changefreq>");
+			lines.push("    <priority>0.7</priority>");
+			lines.push("  </url>");
+		}
+
+		lines.push("</urlset>");
+
+		return new Response(lines.join("\n"), {
+			status: 200,
+			headers: {
+				"Content-Type": "application/xml; charset=utf-8",
+				"Cache-Control": "public, max-age=3600",
+			},
+		});
+	} catch {
+		return new Response("<!-- Internal error generating sitemap -->", {
+			status: 500,
+			headers: { "Content-Type": "application/xml" },
+		});
+	}
+};
+
+/** Escape special XML characters in a string */
+function escapeXml(str: string): string {
+	return str
+		.replace(AMP_RE, "&amp;")
+		.replace(LT_RE, "&lt;")
+		.replace(GT_RE, "&gt;")
+		.replace(QUOT_RE, "&quot;")
+		.replace(APOS_RE, "&apos;");
+}

package/src/astro/storage/adapters.ts

@@ -0,0 +1,74 @@
+/**
+ * Storage Adapter Functions
+ *
+ * These run at config time (astro.config.mjs) and return serializable descriptors.
+ * The actual storage is created at runtime by loading the entrypoint.
+ *
+ * @example
+ * ```ts
+ * // astro.config.mjs
+ * import emdash, { s3, local } from "emdash/astro";
+ *
+ * export default defineConfig({
+ *   integrations: [
+ *     emdash({
+ *       storage: s3({
+ *         endpoint: "https://xxx.r2.cloudflarestorage.com",
+ *         bucket: "media",
+ *         accessKeyId: process.env.R2_ACCESS_KEY_ID!,
+ *         secretAccessKey: process.env.R2_SECRET_ACCESS_KEY!,
+ *       }),
+ *       // or: storage: local({ directory: "./uploads", baseUrl: "/_emdash/api/media/file" }),
+ *     }),
+ *   ],
+ * });
+ * ```
+ *
+ * For Cloudflare R2 bindings, use `r2()` from `@emdash-cms/cloudflare`.
+ */
+
+import type { StorageDescriptor, S3StorageConfig, LocalStorageConfig } from "./types.js";
+
+/**
+ * S3-compatible storage adapter
+ *
+ * Works with AWS S3, Cloudflare R2 (via S3 API), Minio, etc.
+ *
+ * @example
+ * ```ts
+ * storage: s3({
+ *   endpoint: "https://xxx.r2.cloudflarestorage.com",
+ *   bucket: "media",
+ *   accessKeyId: process.env.R2_ACCESS_KEY_ID!,
+ *   secretAccessKey: process.env.R2_SECRET_ACCESS_KEY!,
+ *   publicUrl: "https://cdn.example.com", // optional CDN
+ * })
+ * ```
+ */
+export function s3(config: S3StorageConfig): StorageDescriptor {
+	return {
+		entrypoint: "emdash/storage/s3",
+		config,
+	};
+}
+
+/**
+ * Local filesystem storage adapter
+ *
+ * For development and testing. Stores files in a local directory.
+ * Does NOT support signed upload URLs.
+ *
+ * @example
+ * ```ts
+ * storage: local({
+ *   directory: "./uploads",
+ *   baseUrl: "/_emdash/api/media/file",
+ * })
+ * ```
+ */
+export function local(config: LocalStorageConfig): StorageDescriptor {
+	return {
+		entrypoint: "emdash/storage/local",
+		config,
+	};
+}

package/src/astro/storage/index.ts

@@ -0,0 +1,19 @@
+/**
+ * Storage Adapters
+ *
+ * Re-exports config-time adapter functions and types.
+ * Runtime entrypoints are in the emdash core package.
+ *
+ * For Cloudflare R2 bindings, use `r2()` from `@emdash-cms/cloudflare`.
+ */
+
+// Config-time adapter functions
+export { s3, local } from "./adapters.js";
+
+// Types
+export type {
+	StorageDescriptor,
+	CreateStorageFn,
+	S3StorageConfig,
+	LocalStorageConfig,
+} from "./types.js";

package/src/astro/storage/types.ts

@@ -0,0 +1,60 @@
+/**
+ * Storage Adapter Types
+ *
+ * Adapters use a serializable descriptor pattern:
+ * - Config-time function returns { entrypoint, config }
+ * - Runtime loads entrypoint and calls createStorage(config)
+ *
+ * Each adapter is responsible for accessing its own bindings.
+ * For Cloudflare (R2), use `@emdash-cms/cloudflare` package.
+ */
+
+import type { Storage } from "../../index.js";
+
+/**
+ * Serializable storage configuration descriptor
+ */
+export interface StorageDescriptor {
+	/** Module path exporting createStorage function */
+	entrypoint: string;
+	/** Serializable config passed to createStorage at runtime */
+	config: unknown;
+}
+
+/**
+ * The function signature that storage entrypoints must export
+ *
+ * Each adapter accesses its own bindings directly:
+ * - S3: uses credentials from config
+ * - Local: uses filesystem path from config
+ * - R2: use @emdash-cms/cloudflare package
+ */
+export type CreateStorageFn = (config: Record<string, unknown>) => Storage;
+
+/**
+ * S3-compatible storage configuration
+ */
+export interface S3StorageConfig {
+	/** S3 endpoint URL */
+	endpoint: string;
+	/** Bucket name */
+	bucket: string;
+	/** Access key ID */
+	accessKeyId: string;
+	/** Secret access key */
+	secretAccessKey: string;
+	/** Optional region (defaults to "auto") */
+	region?: string;
+	/** Optional public URL prefix for CDN */
+	publicUrl?: string;
+}
+
+/**
+ * Local filesystem storage configuration
+ */
+export interface LocalStorageConfig {
+	/** Directory path for storing files */
+	directory: string;
+	/** Base URL for serving files */
+	baseUrl: string;
+}