emdash 0.14.0 → 0.16.0

package/src/astro/routes/api/admin/bylines/[id]/translations.ts

@@ -0,0 +1,99 @@
+/**
+ * Byline translation endpoints
+ *
+ * GET  /_emdash/api/admin/bylines/:id/translations  — list every translation
+ *                                                     of a byline (siblings
+ *                                                     in the same
+ *                                                     translation_group)
+ * POST /_emdash/api/admin/bylines/:id/translations  — create a new locale
+ *                                                     variant joining the
+ *                                                     source's
+ *                                                     translation_group
+ *                                                     (body: { locale, ... })
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleBylineCreate, handleBylineTranslations } from "#api/handlers/bylines.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { bylineTranslationCreateBody } from "#api/schemas.js";
+import { invalidateBylineCache } from "#bylines/index.js";
+import { BylineRepository } from "#db/repositories/byline.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const id = params.id!;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "bylines:read");
+	if (denied) return denied;
+
+	try {
+		const result = await handleBylineTranslations(emdash.db, id);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to fetch byline translations", "BYLINE_TRANSLATIONS_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const id = params.id!;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "bylines:manage");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, bylineTranslationCreateBody);
+		if (isParseError(body)) return body;
+
+		// Look up the source byline so we can:
+		//  (a) emit a clean 404 when it doesn't exist (route layer);
+		//  (b) fall back to its slug + display_name + avatar/website when
+		//      the body omits them. Editors creating a translation often
+		//      want to keep the slug stable and only enter the localized
+		//      bio/displayName — defaulting saves clicks.
+		const repo = new BylineRepository(emdash.db);
+		const source = await repo.findById(id);
+		if (!source) {
+			return new Response(
+				JSON.stringify({ error: { code: "NOT_FOUND", message: "Byline not found" } }),
+				{ status: 404, headers: { "Content-Type": "application/json" } },
+			);
+		}
+
+		const result = await handleBylineCreate(emdash.db, {
+			slug: body.slug ?? source.slug,
+			displayName: body.displayName ?? source.displayName,
+			bio: body.bio ?? null,
+			avatarMediaId: body.avatarMediaId ?? source.avatarMediaId,
+			websiteUrl: body.websiteUrl ?? source.websiteUrl,
+			// Translations don't inherit the source's user_id or guest flag —
+			// the partial unique on (user_id, locale) means a single user can
+			// own one byline per locale, but the editor must opt into linking
+			// the new row by editing it after creation.
+			userId: null,
+			isGuest: source.isGuest,
+			locale: body.locale,
+			translationOf: id,
+		});
+
+		if (result.success) invalidateBylineCache();
+		return unwrapResult(result, 201);
+	} catch (error) {
+		return handleError(
+			error,
+			"Failed to create byline translation",
+			"BYLINE_TRANSLATION_CREATE_ERROR",
+		);
+	}
+};

package/src/astro/routes/api/admin/bylines/index.ts

@@ -1,13 +1,15 @@
-import { Role } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
-import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { apiError, apiSuccess, handleError, unwrapResult } from "#api/error.js";
+import { handleBylineCreate } from "#api/handlers/bylines.js";
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { bylineCreateBody, bylinesListQuery } from "#api/schemas.js";
 import { invalidateBylineCache } from "#bylines/index.js";
 import { BylineRepository } from "#db/repositories/byline.js";
 
+import { getI18nConfig } from "../../../../../i18n/config.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ url, locals }) => {
@@ -17,19 +19,28 @@ export const GET: APIRoute = async ({ url, locals }) => {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
 
-	// Read access uses content:read so all authenticated roles can view byline data
-	const denied = requirePerm(user, "content:read");
+	const denied = requirePerm(user, "bylines:read");
 	if (denied) return denied;
 
 	const query = parseQuery(url, bylinesListQuery);
 	if (isParseError(query)) return query;
 
+	const i18n = getI18nConfig();
+	if (query.locale && i18n && !i18n.locales.includes(query.locale)) {
+		return apiError(
+			"VALIDATION_ERROR",
+			`Locale "${query.locale}" is not configured for this site`,
+			400,
+		);
+	}
+
 	try {
 		const repo = new BylineRepository(emdash.db);
 		const result = await repo.findMany({
 			search: query.search,
 			isGuest: query.isGuest,
 			userId: query.userId,
+			locale: query.locale,
 			cursor: query.cursor,
 			limit: query.limit,
 		});
@@ -47,16 +58,14 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
 
-	if (!user || user.role < Role.EDITOR) {
-		return apiError("FORBIDDEN", "Editor privileges required", 403);
-	}
+	const denied = requirePerm(user, "bylines:manage");
+	if (denied) return denied;
 
 	const body = await parseBody(request, bylineCreateBody);
 	if (isParseError(body)) return body;
 
 	try {
-		const repo = new BylineRepository(emdash.db);
-		const byline = await repo.create({
+		const result = await handleBylineCreate(emdash.db, {
 			slug: body.slug,
 			displayName: body.displayName,
 			bio: body.bio ?? null,
@@ -64,10 +73,12 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			websiteUrl: body.websiteUrl ?? null,
 			userId: body.userId ?? null,
 			isGuest: body.isGuest,
+			locale: body.locale,
+			translationOf: body.translationOf,
 		});
 
-		invalidateBylineCache();
-		return apiSuccess(byline, 201);
+		if (result.success) invalidateBylineCache();
+		return unwrapResult(result, 201);
 	} catch (error) {
 		return handleError(error, "Failed to create byline", "BYLINE_CREATE_ERROR");
 	}

package/src/astro/routes/api/admin/plugins/[id]/update.ts

@@ -48,6 +48,7 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			version: body.version,
 			confirmCapabilityChanges: body.confirmCapabilityChanges,
 			confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+			sandboxBypassed: emdash.isSandboxBypassed(),
 		},
 	);
 

package/src/astro/routes/api/admin/plugins/marketplace/[id]/install.ts

@@ -49,7 +49,12 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 			emdash.getSandboxRunner(),
 			emdash.config.marketplace,
 			id,
-			{ version: body.version, configuredPluginIds, siteOrigin },
+			{
+				version: body.version,
+				configuredPluginIds,
+				siteOrigin,
+				sandboxBypassed: emdash.isSandboxBypassed(),
+			},
 		);
 
 		if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/admin/plugins/registry/[id]/uninstall.ts

@@ -0,0 +1,51 @@
+/**
+ * Registry plugin uninstall endpoint (experimental)
+ *
+ * POST /_emdash/api/admin/plugins/registry/:id/uninstall — Uninstall a
+ * registry-source plugin. Mirrors the marketplace uninstall route; the
+ * handler refuses non-registry sources, so this won't trash a marketplace
+ * or config plugin that shares the id namespace.
+ */
+
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, unwrapResult } from "#api/error.js";
+import { handleRegistryUninstall } from "#api/index.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
+
+export const prerender = false;
+
+const uninstallBodySchema = z.object({
+	deleteData: z.boolean().optional(),
+});
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	if (!emdash?.db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const denied = requirePerm(user, "plugins:manage");
+	if (denied) return denied;
+
+	if (!id) {
+		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
+	}
+
+	const body = await parseOptionalBody(request, uninstallBodySchema, {});
+	if (isParseError(body)) return body;
+
+	const result = await handleRegistryUninstall(emdash.db, emdash.storage, id, {
+		deleteData: body.deleteData ?? false,
+	});
+
+	if (!result.success) return unwrapResult(result);
+
+	await emdash.syncRegistryPlugins();
+
+	return unwrapResult(result);
+};

package/src/astro/routes/api/admin/plugins/registry/[id]/update.ts

@@ -0,0 +1,83 @@
+/**
+ * Registry plugin update endpoint (experimental)
+ *
+ * POST /_emdash/api/admin/plugins/registry/:id/update — Update a
+ * registry-source plugin to a newer release. Mirrors the marketplace
+ * update route's escalation gates: `CAPABILITY_ESCALATION` if the new
+ * version declares new capabilities and `confirmCapabilityChanges` is
+ * absent, and `ROUTE_VISIBILITY_ESCALATION` if it newly exposes public
+ * routes and `confirmRouteVisibilityChanges` is absent.
+ */
+
+import { hostEnvFromVersions } from "@emdash-cms/registry-client/env";
+import type { APIRoute } from "astro";
+import { z } from "zod";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, unwrapResult } from "#api/error.js";
+import { handleRegistryUpdate } from "#api/index.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
+
+import { VERSION } from "../../../../../../../version.js";
+
+export const prerender = false;
+
+const updateBodySchema = z.object({
+	/** Optional explicit target version. Defaults to the aggregator's latest. */
+	version: z.string().min(1).max(64).optional(),
+	/**
+	 * Set by the admin's capability re-consent dialog when the new version
+	 * declares capabilities the installed version did not. Without this,
+	 * the handler returns `CAPABILITY_ESCALATION` carrying the diff.
+	 */
+	confirmCapabilityChanges: z.boolean().optional(),
+	/**
+	 * Set by the admin's route-visibility re-consent dialog when the new
+	 * version newly exposes a public (unauthenticated) route.
+	 */
+	confirmRouteVisibilityChanges: z.boolean().optional(),
+});
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	try {
+		const { emdash, user } = locals;
+		const { id } = params;
+
+		if (!emdash?.db) {
+			return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+		}
+
+		const denied = requirePerm(user, "plugins:manage");
+		if (denied) return denied;
+
+		if (!id) {
+			return apiError("INVALID_REQUEST", "Plugin ID required", 400);
+		}
+
+		const body = await parseOptionalBody(request, updateBodySchema, {});
+		if (isParseError(body)) return body;
+
+		const result = await handleRegistryUpdate(
+			emdash.db,
+			emdash.storage,
+			emdash.getSandboxRunner(),
+			emdash.config.experimental?.registry,
+			id,
+			{
+				version: body.version,
+				confirmCapabilityChanges: body.confirmCapabilityChanges,
+				confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
+				hostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),
+			},
+		);
+
+		if (!result.success) return unwrapResult(result);
+
+		await emdash.syncRegistryPlugins();
+
+		return unwrapResult(result);
+	} catch (error) {
+		console.error("[registry-update] Unhandled error:", error);
+		return handleError(error, "Failed to update plugin from registry", "UPDATE_FAILED");
+	}
+};