emdash 0.10.0 → 0.11.0

package/dist/{search-DkN-BqsS.mjs → search-DuWhx4NG.mjs}

@@ -1,25 +1,25 @@
 import { n as validateJsonFieldName, r as validatePluginIdentifier, t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
 import { s as jsonExtractExpr } from "./dialect-helpers-BKCvISIQ.mjs";
 import { r as isI18nEnabled } from "./config-CVssduLe.mjs";
-import { a as slugify, r as RevisionRepository, t as ContentRepository } from "./content-C7G4QXkK.mjs";
+import { a as slugify, r as RevisionRepository, t as ContentRepository } from "./content-CERxPUN0.mjs";
 import { r as encodeBase64, t as decodeBase64 } from "./base64-MBPo9ozB.mjs";
 import { i as encodeCursor, n as InvalidCursorError, r as decodeCursor, t as EmDashValidationError } from "./types-BIgulNsW.mjs";
-import { t as MediaRepository } from "./media-D8FbNsl0.mjs";
+import { t as MediaRepository } from "./media-1fFhub9c.mjs";
 import { t as OptionsRepository } from "./options-nPxWnrya.mjs";
 import { t as withTransaction } from "./transaction-D44LBXvU.mjs";
 import { t as RedirectRepository } from "./redirect-C5H7VGIX.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-Da2-b-oA.mjs";
-import { t as BylineRepository } from "./byline-C3vnhIpU.mjs";
-import { r as invalidateRedirectCache } from "./cache-fTzxgMFJ.mjs";
+import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-BK1oZS-l.mjs";
+import { t as BylineRepository } from "./byline-gFn1r0vA.mjs";
+import { r as invalidateRedirectCache } from "./cache-BAJbeoZ8.mjs";
 import { t as isMissingTableError } from "./db-errors-B7P2pSCn.mjs";
-import { r as hashString } from "./zod-generator-BNJDQBSZ.mjs";
-import { i as FTSManager, n as SchemaRegistry } from "./registry-Beb7wxFc.mjs";
-import { r as getDb } from "./loader-Bx2_9-5e.mjs";
-import { n as requestCached } from "./request-cache-C-tIpYIw.mjs";
-import { a as ssrfSafeFetch, i as resolveAndValidateExternalUrl, o as stripCredentialHeaders, r as SsrfError, s as validateExternalUrl } from "./apply-UsrFuO7l.mjs";
-import { d as resolveLocale, f as resolveLocaleChain } from "./taxonomies-CTtewrSQ.mjs";
+import { n as requestCached } from "./request-cache-D4I69LeL.mjs";
+import { r as hashString } from "./zod-generator-CHnJUP2l.mjs";
+import { i as FTSManager, n as SchemaRegistry } from "./registry-Do34mz_P.mjs";
+import { r as getDb } from "./loader-ou_PXAjg.mjs";
+import { a as ssrfSafeFetch, i as resolveAndValidateExternalUrl, o as stripCredentialHeaders, r as SsrfError, s as validateExternalUrl } from "./apply-Ded_1vng.mjs";
+import { d as resolveLocale, f as resolveLocaleChain } from "./taxonomies-Bw76xAxo.mjs";
 import { i as pluginManifestSchema } from "./manifest-schema-CXAbd1vH.mjs";
-import { i as normalizeCapabilities } from "./types-CoO6mpV3.mjs";
+import { i as normalizeCapabilities } from "./types-DiI8NOG_.mjs";
 import { t as generatePreviewToken } from "./tokens-CyRDPVW2.mjs";
 import { sql } from "kysely";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -739,9 +739,6 @@ var PluginStorageRepository = class {
 
 //#endregion
 //#region src/fields/image.ts
-/**
-* Image field schema
-*/
 const imageSchema = z.object({
 	id: z.string(),
 	src: z.string(),
@@ -749,17 +746,39 @@ const imageSchema = z.object({
 	width: z.number().optional(),
 	height: z.number().optional()
 });
-/**
-* Image field
-* References media items from the media library
-*/
-function image(options) {
+function image(options = {}) {
+	const validation = options.allowedTypes && options.allowedTypes.length > 0 ? { allowedMimeTypes: [...options.allowedTypes] } : void 0;
 	return {
 		type: "image",
 		columnType: "TEXT",
-		schema: options?.required === false ? imageSchema.optional() : imageSchema,
+		schema: options.required === false ? imageSchema.optional() : imageSchema,
 		options,
-		ui: { widget: "image" }
+		ui: { widget: "image" },
+		validation
+	};
+}
+
+//#endregion
+//#region src/fields/file.ts
+function file(options = {}) {
+	const fileObjSchema = z.object({
+		id: z.string(),
+		url: z.string(),
+		filename: z.string(),
+		mimeType: z.string(),
+		size: z.number()
+	});
+	return {
+		type: "file",
+		columnType: "TEXT",
+		schema: options.required ? fileObjSchema : fileObjSchema.optional(),
+		options,
+		ui: {
+			widget: "file",
+			helpText: options.helpText,
+			maxSize: options.maxSize
+		},
+		validation: options.allowedTypes && options.allowedTypes.length > 0 ? { allowedMimeTypes: [...options.allowedTypes] } : void 0
 	};
 }
 
@@ -978,6 +997,115 @@ function validateRev(rev, item) {
 	return { valid: true };
 }
 
+//#endregion
+//#region src/media/mime.ts
+function normalizeMime(mime) {
+	return mime.split(";")[0].trim().toLowerCase();
+}
+function matchesMimeAllowlist(mime, allowList) {
+	const normalized = normalizeMime(mime);
+	for (const entry of allowList) {
+		if (!entry || !entry.includes("/")) continue;
+		const normalizedEntry = normalizeMime(entry);
+		if (normalizedEntry.endsWith("/")) {
+			if (normalized.startsWith(normalizedEntry)) return true;
+		} else if (normalized === normalizedEntry) return true;
+	}
+	return false;
+}
+/**
+* Extract the `allowedMimeTypes` list from a `_emdash_fields.validation` row
+* (raw JSON string). Returns null when the value is missing, malformed, or the
+* list is empty — callers treat that as "no field-specific constraint".
+*/
+function parseAllowedMimeTypes(rawValidation) {
+	if (!rawValidation) return null;
+	try {
+		const parsed = JSON.parse(rawValidation);
+		if (typeof parsed !== "object" || parsed === null) return null;
+		const list = parsed.allowedMimeTypes;
+		if (!Array.isArray(list) || list.length === 0) return null;
+		return list.filter((entry) => typeof entry === "string");
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+//#region src/api/handlers/validate-media-fields.ts
+function asMediaRef(value) {
+	if (value === null || value === void 0) return null;
+	if (typeof value !== "object" || Array.isArray(value)) return null;
+	return value;
+}
+function fail(message) {
+	return {
+		success: false,
+		error: {
+			code: "INVALID_MIME_FOR_FIELD",
+			message
+		}
+	};
+}
+async function loadMediaFieldsForCollection(db, collectionSlug) {
+	const rows = await db.selectFrom("_emdash_fields").innerJoin("_emdash_collections", "_emdash_collections.id", "_emdash_fields.collection_id").select([
+		"_emdash_fields.slug",
+		"_emdash_fields.type",
+		"_emdash_fields.validation"
+	]).where("_emdash_collections.slug", "=", collectionSlug).where("_emdash_fields.type", "in", ["file", "image"]).execute();
+	const out = [];
+	for (const row of rows) {
+		const list = parseAllowedMimeTypes(row.validation);
+		if (!list) continue;
+		out.push({
+			slug: row.slug,
+			type: row.type,
+			allowedMimeTypes: list
+		});
+	}
+	return out;
+}
+async function validateMediaFields(db, collectionSlug, data) {
+	const fields = await requestCached(`mediaFields:${collectionSlug}`, () => loadMediaFieldsForCollection(db, collectionSlug));
+	if (fields.length === 0) return {
+		success: true,
+		data: true
+	};
+	const localIds = /* @__PURE__ */ new Set();
+	for (const field of fields) {
+		const ref = asMediaRef(data[field.slug]);
+		if (!ref) continue;
+		if ((typeof ref.provider === "string" ? ref.provider : "local") === "local" && typeof ref.id === "string") localIds.add(ref.id);
+	}
+	const idList = [...localIds];
+	const mimeById = /* @__PURE__ */ new Map();
+	if (idList.length > 0) for (const batch of chunks(idList, SQL_BATCH_SIZE)) {
+		const rows = await db.selectFrom("media").select(["id", "mime_type"]).where("id", "in", batch).execute();
+		for (const r of rows) mimeById.set(r.id, r.mime_type);
+	}
+	for (const field of fields) {
+		const value = data[field.slug];
+		if (value === null || value === void 0) continue;
+		const ref = asMediaRef(value);
+		if (!ref) continue;
+		const provider = typeof ref.provider === "string" ? ref.provider : "local";
+		let mime;
+		if (provider === "local") {
+			if (typeof ref.id !== "string") return fail(`Field '${field.slug}' references media with an invalid id`);
+			mime = mimeById.get(ref.id);
+			if (!mime) return fail(`Field '${field.slug}' references media with unknown MIME type`);
+		} else {
+			if (typeof ref.mimeType !== "string") return fail(`Field '${field.slug}' requires a mimeType declaration for non-local media`);
+			mime = ref.mimeType;
+		}
+		if (!matchesMimeAllowlist(mime, field.allowedMimeTypes)) return fail(`Field '${field.slug}' does not accept ${mime}`);
+	}
+	return {
+		success: true,
+		data: true
+	};
+}
+
 //#endregion
 //#region src/api/handlers/content.ts
 /**
@@ -1255,6 +1383,8 @@ async function handleContentCreate(db, collection, body) {
 				message: `Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`
 			}
 		};
+		const mimeCheck = await validateMediaFields(db, collection, body.data);
+		if (!mimeCheck.success) return mimeCheck;
 		const item = await withTransaction(db, async (trx) => {
 			const repo = new ContentRepository(trx);
 			const bylineRepo = new BylineRepository(trx);
@@ -1280,7 +1410,7 @@ async function handleContentCreate(db, collection, body) {
 			}
 			await hydrateBylines(trx, collection, created);
 			if (body.translationOf) {
-				const { TaxonomyRepository } = await import("./taxonomy-DSxx2K2L.mjs").then((n) => n.n);
+				const { TaxonomyRepository } = await import("./taxonomy-D6NvlKo8.mjs").then((n) => n.n);
 				await new TaxonomyRepository(trx).copyEntryTerms(collection, body.translationOf, created.id);
 			}
 			if (body.seo && hasSeo) created.seo = await new SeoRepository(trx).upsert(collection, created.id, body.seo);
@@ -1353,6 +1483,10 @@ async function handleContentUpdate(db, collection, id, body) {
 				message: `Collection "${collection}" does not have SEO enabled. Remove the seo field or enable SEO on this collection.`
 			}
 		};
+		if (body.data) {
+			const mimeCheck = await validateMediaFields(db, collection, body.data);
+			if (!mimeCheck.success) return mimeCheck;
+		}
 		const resolvedId = await resolveId(new ContentRepository(db), collection, id) ?? id;
 		const item = await withTransaction(db, async (trx) => {
 			const trxRepo = new ContentRepository(trx);
@@ -2869,7 +3003,14 @@ const contentTranslationsResponseSchema = z$1.object({
 
 //#endregion
 //#region src/api/schemas/media.ts
-const mediaListQuery = cursorPaginationQuery.extend({ mimeType: z$1.string().optional() }).meta({ id: "MediaListQuery" });
+/**
+* Accepts a comma-separated string (from URL query params) or an array of
+* strings (from JSON body or programmatic use) and normalises to string[].
+*/
+const mimeTypeFilter = z$1.union([z$1.string(), z$1.array(z$1.string())]).transform((v) => {
+	return (Array.isArray(v) ? v : v.split(",")).map((s) => s.trim()).filter((s) => s.length > 0);
+}).optional();
+const mediaListQuery = cursorPaginationQuery.extend({ mimeType: mimeTypeFilter }).meta({ id: "MediaListQuery" });
 const mediaUpdateBody = z$1.object({
 	alt: z$1.string().optional(),
 	caption: z$1.string().optional(),
@@ -2885,7 +3026,7 @@ const mediaConfirmBody = z$1.object({
 }).meta({ id: "MediaConfirmBody" });
 const mediaProviderListQuery = cursorPaginationQuery.extend({
 	query: z$1.string().optional(),
-	mimeType: z$1.string().optional()
+	mimeType: mimeTypeFilter
 }).meta({ id: "MediaProviderListQuery" });
 const mediaStatusSchema = z$1.enum([
 	"pending",
@@ -2983,7 +3124,8 @@ const fieldValidation = z$1.object({
 	options: z$1.array(z$1.string()).optional(),
 	subFields: z$1.array(repeaterSubFieldSchema).min(1).optional(),
 	minItems: z$1.number().int().min(0).optional(),
-	maxItems: z$1.number().int().min(1).optional()
+	maxItems: z$1.number().int().min(1).optional(),
+	allowedMimeTypes: z$1.array(z$1.string().regex(/^[a-z0-9][a-z0-9!#$&^_+\-.]*\/[a-z0-9!#$&^_+\-.]*$/i, "Invalid MIME type")).min(1, "allowedMimeTypes must not be empty — omit the field to allow all types").max(64, "allowedMimeTypes may contain at most 64 entries").optional()
 }).optional();
 const fieldWidgetOptions = z$1.record(z$1.string(), z$1.unknown()).optional();
 const createCollectionBody = z$1.object({
@@ -3021,7 +3163,7 @@ const createFieldBody = z$1.object({
 	required: z$1.boolean().optional(),
 	unique: z$1.boolean().optional(),
 	defaultValue: z$1.unknown().optional(),
-	validation: fieldValidation,
+	validation: fieldValidation.nullable(),
 	widget: z$1.string().optional(),
 	options: fieldWidgetOptions,
 	sortOrder: z$1.number().int().min(0).optional(),
@@ -3033,7 +3175,7 @@ const updateFieldBody = z$1.object({
 	required: z$1.boolean().optional(),
 	unique: z$1.boolean().optional(),
 	defaultValue: z$1.unknown().optional(),
-	validation: fieldValidation,
+	validation: fieldValidation.nullable(),
 	widget: z$1.string().optional(),
 	options: fieldWidgetOptions,
 	sortOrder: z$1.number().int().min(0).optional(),
@@ -9751,5 +9893,5 @@ function extractSearchableFields(entry, fields) {
 }
 
 //#endregion
-export { isSafeHref as $, NoopSandboxRunner as A, handleContentTranslations as At, HookPipeline as B, getAllSources as C, handleContentGetIncludingTrashed as Ct, probeUrl as D, handleContentPublish as Dt, getUrlSources as E, handleContentPermanentDelete as Et, PluginRouteError as F, portableText as Ft, sanitizeHeadersForSandbox as G, resolveExclusiveHooks as H, PluginRouteRegistry as I, reference as It, parseWxr as J, getTrustedProxyHeaders as K, DEV_CONSOLE_EMAIL_PLUGIN_ID as L, image as Lt, createNoopSandboxRunner as M, handleContentUnschedule as Mt, PluginManager as N, handleContentUpdate as Nt, registerSource as O, handleContentRestore as Ot, createPluginManager as P, validateRev as Pt, prosemirrorToPortableText as Q, devConsoleEmailDeliver as R, clearSources as S, handleContentGet as St, getSource as T, handleContentListTrashed as Tt, CronExecutor as U, createHookPipeline as V, extractRequestMeta as W, after as X, parseWxrString as Y, portableTextToProsemirror as Z, buildPreviewUrl as _, handleContentCountTrashed as _t, search as a, getCollectionInfo as at, parseWxrDate as b, handleContentDiscardDraft as bt, getWidgetArea as c, handleMediaGet as ct, getMenu as d, handleRevisionGet as dt, sanitizeHref as et, getMenus as f, handleRevisionList as ft, isPreviewRequest as g, handleContentCountScheduled as gt, getPreviewToken as h, handleContentCompare as ht, getSuggestions as i, PluginStateRepository as it, SandboxNotAvailableError as j, handleContentUnpublish as jt, importReusableBlocksAsSections as k, handleContentSchedule as kt, getWidgetAreas as l, handleMediaList as lt, getComments as m, generateManifest as mt, extractSearchableFields as n, getSection as nt, searchCollection as o, handleMediaCreate as ot, getCommentCount as p, handleRevisionRestore as pt, definePlugin as q, getSearchStats as r, getSections as rt, searchWithDb as s, handleMediaDelete as st, extractPlainText as t, loadBundleFromR2 as tt, getWidgetComponents as u, handleMediaUpdate as ut, getPreviewUrl as v, handleContentCreate as vt, getFileSources as w, handleContentList as wt, wxrSource as x, handleContentDuplicate as xt, wordpressRestSource as y, handleContentDelete as yt, EmailPipeline as z };
-//# sourceMappingURL=search-DkN-BqsS.mjs.map
+export { isSafeHref as $, NoopSandboxRunner as A, handleContentTranslations as At, HookPipeline as B, getAllSources as C, handleContentGetIncludingTrashed as Ct, probeUrl as D, handleContentPublish as Dt, getUrlSources as E, handleContentPermanentDelete as Et, PluginRouteError as F, portableText as Ft, sanitizeHeadersForSandbox as G, resolveExclusiveHooks as H, PluginRouteRegistry as I, reference as It, parseWxr as J, getTrustedProxyHeaders as K, DEV_CONSOLE_EMAIL_PLUGIN_ID as L, file as Lt, createNoopSandboxRunner as M, handleContentUnschedule as Mt, PluginManager as N, handleContentUpdate as Nt, registerSource as O, handleContentRestore as Ot, createPluginManager as P, validateRev as Pt, prosemirrorToPortableText as Q, devConsoleEmailDeliver as R, image as Rt, clearSources as S, handleContentGet as St, getSource as T, handleContentListTrashed as Tt, CronExecutor as U, createHookPipeline as V, extractRequestMeta as W, after as X, parseWxrString as Y, portableTextToProsemirror as Z, buildPreviewUrl as _, handleContentCountTrashed as _t, search as a, getCollectionInfo as at, parseWxrDate as b, handleContentDiscardDraft as bt, getWidgetArea as c, handleMediaGet as ct, getMenu as d, handleRevisionGet as dt, sanitizeHref as et, getMenus as f, handleRevisionList as ft, isPreviewRequest as g, handleContentCountScheduled as gt, getPreviewToken as h, handleContentCompare as ht, getSuggestions as i, PluginStateRepository as it, SandboxNotAvailableError as j, handleContentUnpublish as jt, importReusableBlocksAsSections as k, handleContentSchedule as kt, getWidgetAreas as l, handleMediaList as lt, getComments as m, generateManifest as mt, extractSearchableFields as n, getSection as nt, searchCollection as o, handleMediaCreate as ot, getCommentCount as p, handleRevisionRestore as pt, definePlugin as q, getSearchStats as r, getSections as rt, searchWithDb as s, handleMediaDelete as st, extractPlainText as t, loadBundleFromR2 as tt, getWidgetComponents as u, handleMediaUpdate as ut, getPreviewUrl as v, handleContentCreate as vt, getFileSources as w, handleContentList as wt, wxrSource as x, handleContentDuplicate as xt, wordpressRestSource as y, handleContentDelete as yt, EmailPipeline as z };
+//# sourceMappingURL=search-DuWhx4NG.mjs.map