emdash 0.17.2 → 0.19.0

package/src/api/handlers/content.ts

@@ -14,13 +14,17 @@ import { RevisionRepository } from "../../database/repositories/revision.js";
 import { SeoRepository } from "../../database/repositories/seo.js";
 import {
 	EmDashValidationError,
+	ScheduledNotDueError,
 	InvalidCursorError,
 	type BylineSummary,
 	type ContentBylineCredit,
+	type ContentDateField,
 	type ContentItem,
 	type ContentSeo,
 	type ContentSeoInput,
+	type FindManyOptions,
 } from "../../database/repositories/types.js";
+import { UserRepository } from "../../database/repositories/user.js";
 import { withTransaction } from "../../database/transaction.js";
 import type { Database } from "../../database/types.js";
 import { validateIdentifier } from "../../database/validate.js";
@@ -323,6 +327,24 @@ async function resolveSearchColumns(db: Kysely<Database>, collection: string): P
 	return columns;
 }
 
+/** Matches a date-only `YYYY-MM-DD` bound (no time component). */
+const DATE_ONLY_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+/**
+ * Normalize a date-range bound to an ISO datetime for lexicographic comparison
+ * against stored ISO 8601 timestamps. A bare `YYYY-MM-DD` is widened to the
+ * appropriate UTC day boundary so the range stays inclusive: a `start` bound
+ * becomes the start of the day and an `end` bound the end of the day.
+ * Otherwise a date-only upper bound would exclude every same-day row (since
+ * `2024-06-01T12:00:00Z` sorts after `2024-06-01`). Full datetimes pass
+ * through unchanged.
+ */
+function normalizeDateBound(value: string | undefined, edge: "start" | "end"): string | undefined {
+	if (!value) return undefined;
+	if (!DATE_ONLY_RE.test(value)) return value;
+	return edge === "start" ? `${value}T00:00:00.000Z` : `${value}T23:59:59.999Z`;
+}
+
 /**
  * Create content list handler
  */
@@ -337,18 +359,28 @@ export async function handleContentList(
 		order?: "asc" | "desc";
 		locale?: string;
 		q?: string;
+		authorId?: string;
+		dateField?: ContentDateField;
+		dateFrom?: string;
+		dateTo?: string;
 	},
 ): Promise<ApiResult<ContentListResponse>> {
 	try {
 		const repo = new ContentRepository(db);
-		const where: {
-			status?: string;
-			locale?: string;
-			q?: string;
-			searchColumns?: string[];
-		} = {};
+		const where: FindManyOptions["where"] = {};
 		if (params.status) where.status = params.status;
 		if (params.locale) where.locale = params.locale;
+		if (params.authorId) where.authorId = params.authorId;
+
+		// A date range requires a target column; ignore stray from/to without
+		// a field so a half-specified filter doesn't silently drop all rows.
+		if (params.dateField && (params.dateFrom || params.dateTo)) {
+			where.dateFilter = {
+				field: params.dateField,
+				from: normalizeDateBound(params.dateFrom, "start"),
+				to: normalizeDateBound(params.dateTo, "end"),
+			};
+		}
 
 		const q = params.q?.trim();
 		if (q) {
@@ -412,6 +444,62 @@ export async function handleContentList(
 	}
 }
 
+/** A content author option for the admin author filter. */
+export interface ContentAuthor {
+	id: string;
+	name: string | null;
+	email: string;
+	avatarUrl: string | null;
+}
+
+/**
+ * List the distinct authors of a collection's live content.
+ *
+ * Backs the admin content-list author filter. Unlike `/admin/users` (ADMIN
+ * only), this is gated on `content:read`, so any editor can filter by author.
+ * Returns only users who have authored at least one non-trashed entry, sorted
+ * by display name then email for a stable dropdown order.
+ */
+export async function handleContentAuthors(
+	db: Kysely<Database>,
+	collection: string,
+): Promise<ApiResult<{ items: ContentAuthor[] }>> {
+	try {
+		const repo = new ContentRepository(db);
+		const authorIds = await repo.findDistinctAuthorIds(collection);
+		if (authorIds.length === 0) {
+			return { success: true, data: { items: [] } };
+		}
+
+		const userRepo = new UserRepository(db);
+		const users = await userRepo.findByIds(authorIds);
+
+		const items: ContentAuthor[] = users
+			.map((u) => ({ id: u.id, name: u.name, email: u.email, avatarUrl: u.avatarUrl }))
+			.toSorted((a, b) => (a.name ?? a.email).localeCompare(b.name ?? b.email));
+
+		return { success: true, data: { items } };
+	} catch (error) {
+		if (isMissingTableError(error)) {
+			return {
+				success: false,
+				error: {
+					code: "COLLECTION_NOT_FOUND",
+					message: `Collection '${collection}' not found`,
+				},
+			};
+		}
+		console.error("Content authors error:", error);
+		return {
+			success: false,
+			error: {
+				code: "CONTENT_AUTHORS_ERROR",
+				message: "Failed to list content authors",
+			},
+		};
+	}
+}
+
 /**
  * Get single content item
  */
@@ -1268,13 +1356,13 @@ export async function handleContentPublish(
 	db: Kysely<Database>,
 	collection: string,
 	id: string,
-	options: { publishedAt?: string } = {},
+	options: { publishedAt?: string; requireScheduledDue?: boolean } = {},
 ): Promise<ApiResult<ContentResponse>> {
 	try {
 		const item = await withTransaction(db, async (trx) => {
 			const repo = new ContentRepository(trx);
 			const resolvedId = (await resolveId(repo, collection, id)) ?? id;
-			return repo.publish(collection, resolvedId, options.publishedAt);
+			return repo.publish(collection, resolvedId, options.publishedAt, options.requireScheduledDue);
 		});
 
 		const hasSeo = await collectionHasSeo(db, collection);
@@ -1285,6 +1373,17 @@ export async function handleContentPublish(
 			data: { item },
 		};
 	} catch (error) {
+		// The scheduled sweep gates publish on the row still being due; a row
+		// unscheduled in the meantime is a silent skip, not a failure.
+		if (error instanceof ScheduledNotDueError) {
+			return {
+				success: false,
+				error: {
+					code: "NOT_DUE",
+					message: error.message,
+				},
+			};
+		}
 		if (error instanceof EmDashValidationError) {
 			return {
 				success: false,

package/src/api/handlers/index.ts

@@ -7,6 +7,8 @@
 // Content handlers
 export {
 	handleContentList,
+	handleContentAuthors,
+	type ContentAuthor,
 	handleContentGet,
 	handleContentGetIncludingTrashed,
 	handleContentCreate,

package/src/api/openapi/document.ts

@@ -24,6 +24,7 @@ import {
 import { apiErrorSchema, deleteResponseSchema, successEnvelope } from "../schemas/common.js";
 import {
 	contentCompareResponseSchema,
+	contentAuthorsResponseSchema,
 	contentCreateBody,
 	contentItemSchema,
 	contentListQuery,
@@ -597,6 +598,30 @@ const contentPaths = {
 		},
 	},
 
+	"/_emdash/api/content/{collection}/authors": {
+		get: {
+			operationId: "listContentAuthors",
+			summary: "List distinct authors of a collection's content",
+			tags: ["Content"],
+			requestParams: {
+				path: z.object({
+					collection: z.string().meta({ description: "Collection slug" }),
+				}),
+			},
+			responses: {
+				"200": {
+					description: "Content authors",
+					content: {
+						[JSON_CONTENT]: {
+							schema: successEnvelope(contentAuthorsResponseSchema),
+						},
+					},
+				},
+				...authErrors,
+				...standardErrors(500),
+			},
+		},
+	},
 	"/_emdash/api/content/{collection}/trash": {
 		get: {
 			operationId: "listTrashedContent",

package/src/api/schemas/content.ts

@@ -18,6 +18,14 @@ export const contentSeoInput = z
 	})
 	.meta({ id: "ContentSeoInput" });
 
+/** ISO 8601 date or datetime bound for the content-list date range filter. */
+const contentDateBound = z
+	.union([
+		z.iso.datetime({ offset: true, message: "must be an ISO 8601 datetime" }),
+		z.iso.date({ message: "must be an ISO 8601 date" }),
+	])
+	.optional();
+
 export const contentListQuery = cursorPaginationQuery
 	.extend({
 		status: z.string().optional(),
@@ -26,6 +34,14 @@ export const contentListQuery = cursorPaginationQuery
 		locale: localeCode.optional(),
 		/** Case-insensitive substring search across the collection's title/name/slug. */
 		q: z.string().trim().min(1).max(200).optional(),
+		/** Filter to entries authored by this user (the `author_id` column). */
+		authorId: z.string().min(1).max(64).optional(),
+		/** Which timestamp column the `dateFrom`/`dateTo` range applies to. */
+		dateField: z.enum(["createdAt", "updatedAt", "publishedAt"]).optional(),
+		/** Inclusive lower bound for the date range. Requires `dateField`. */
+		dateFrom: contentDateBound,
+		/** Inclusive upper bound for the date range. Requires `dateField`. */
+		dateTo: contentDateBound,
 	})
 	.meta({ id: "ContentListQuery" });
 
@@ -168,6 +184,23 @@ export const contentListResponseSchema = z
 	})
 	.meta({ id: "ContentListResponse" });
 
+/** A distinct content author for the admin author filter */
+export const contentAuthorSchema = z
+	.object({
+		id: z.string(),
+		name: z.string().nullable(),
+		email: z.string(),
+		avatarUrl: z.string().nullable(),
+	})
+	.meta({ id: "ContentAuthor" });
+
+/** Response for the content authors endpoint */
+export const contentAuthorsResponseSchema = z
+	.object({
+		items: z.array(contentAuthorSchema),
+	})
+	.meta({ id: "ContentAuthorsResponse" });
+
 /** Trashed content item */
 export const trashedContentItemSchema = z
 	.object({

package/src/astro/integration/index.ts

@@ -15,6 +15,7 @@ import { createRequire } from "node:module";
 import type { AstroIntegration, AstroIntegrationLogger } from "astro";
 
 import { validateAllowedOrigins, validateOriginShape } from "../../auth/allowed-origins.js";
+import { INTERNAL_MEDIA_PREFIX } from "../../media/normalize.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
 import { local } from "../storage/adapters.js";
 import { notoSans } from "./font-provider.js";
@@ -59,6 +60,92 @@ const DEFAULT_STORAGE = local({
 	baseUrl: "/_emdash/api/media/file",
 });
 
+interface ImageRemotePattern {
+	protocol?: "http" | "https";
+	hostname?: string;
+	pathname?: string;
+}
+
+/**
+ * Build `image.remotePatterns` entries so Astro will optimize EmDash media.
+ *
+ * Astro's image services only transform **absolute** URLs whose host is
+ * authorized; everything else is passed through unoptimized. We authorize the
+ * media sources automatically:
+ *
+ *  1. The storage adapter's public URL host (R2 custom domain, S3/CDN), so
+ *     media served directly from a public bucket is optimized.
+ *  2. The site's own origin, scoped to the media proxy route
+ *     (`/_emdash/api/media/file/**`), so same-origin proxied media (local
+ *     storage, or R2 without a public URL) is optimized too. The pathname
+ *     scope keeps Astro's image endpoint from acting as an open proxy for the
+ *     whole origin. Only registered when `siteUrl` is known at build time;
+ *     `getPublicOrigin` resolves the matching origin at render time.
+ *  3. In `astro dev` the dev-server origin (`localhost:<port>`) isn't known at
+ *     build time, so we register a host-agnostic pattern scoped to the media
+ *     route. This is dev-only — it never ships in a production build — so the
+ *     missing host check can't be abused on a deployed site.
+ *
+ * Returns an empty array when no source is statically known (e.g. a production
+ * build using local storage with no `siteUrl`), in which case media renders as
+ * a plain `<img>`.
+ *
+ * @internal Exported for unit testing.
+ */
+export function buildImageRemotePatterns(
+	storage: { config?: unknown } | undefined,
+	siteUrl: string | undefined,
+	command: "dev" | "build" | "preview" | "sync",
+): ImageRemotePattern[] {
+	const patterns: ImageRemotePattern[] = [];
+
+	const config = storage?.config;
+	const publicUrl =
+		config && typeof config === "object"
+			? (config as { publicUrl?: unknown }).publicUrl
+			: undefined;
+	if (typeof publicUrl === "string" && publicUrl) {
+		try {
+			const url = new URL(publicUrl);
+			// Only authorize http(s) hosts — a `file:`/`ftp:` URL is not a media
+			// origin Astro can fetch.
+			if (url.protocol === "http:" || url.protocol === "https:") {
+				const pattern: ImageRemotePattern = {
+					protocol: url.protocol === "http:" ? "http" : "https",
+					hostname: url.hostname,
+				};
+				// When the public URL has a path prefix (CDN sub-path), scope the
+				// pattern to it so we don't authorize the entire host. Media keys
+				// are appended as `${publicUrl}/${key}`, so the prefix is exact.
+				const prefix = url.pathname.endsWith("/") ? url.pathname.slice(0, -1) : url.pathname;
+				if (prefix && prefix !== "/") {
+					pattern.pathname = `${prefix}/**`;
+				}
+				patterns.push(pattern);
+			}
+		} catch {
+			// ignore an unparseable public URL
+		}
+	}
+
+	if (siteUrl) {
+		try {
+			patterns.push({
+				hostname: new URL(siteUrl).hostname,
+				pathname: `${INTERNAL_MEDIA_PREFIX}**`,
+			});
+		} catch {
+			// ignore an unparseable site URL
+		}
+	}
+
+	if (command === "dev") {
+		patterns.push({ pathname: `${INTERNAL_MEDIA_PREFIX}**` });
+	}
+
+	return patterns;
+}
+
 // Terminal formatting
 const dim = (s: string) => `\x1b[2m${s}\x1b[22m`;
 const bold = (s: string) => `\x1b[1m${s}\x1b[22m`;
@@ -298,8 +385,19 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 								},
 							];
 
+				// Authorize media sources for Astro image optimization so the
+				// Image components can generate a responsive srcset for R2/S3 and
+				// same-origin proxied media. `updateConfig` merges arrays, so any
+				// user-configured remotePatterns are preserved.
+				const imageRemotePatterns = buildImageRemotePatterns(
+					resolvedConfig.storage,
+					resolvedConfig.siteUrl,
+					command,
+				);
+
 				updateConfig({
 					security: securityConfig,
+					...(imageRemotePatterns.length ? { image: { remotePatterns: imageRemotePatterns } } : {}),
 					// fonts is a valid AstroConfig key but may not be in the
 					// type definition for the minimum supported Astro version
 					...({ fonts: emdashFonts } as Record<string, unknown>),

package/src/astro/integration/routes.ts

@@ -88,6 +88,12 @@ export function injectCoreRoutes(injectRoute: InjectRoute): void {
 		entrypoint: resolveRoute("api/content/[collection]/[id]/preview-url.ts"),
 	});
 
+	// Content authors (for the admin author filter)
+	injectRoute({
+		pattern: "/_emdash/api/content/[collection]/authors",
+		entrypoint: resolveRoute("api/content/[collection]/authors.ts"),
+	});
+
 	// Trash/restore routes
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]/trash",

package/src/astro/integration/virtual-modules.ts

@@ -63,6 +63,9 @@ export const RESOLVED_VIRTUAL_SEED_ID = "\0" + VIRTUAL_SEED_ID;
 export const VIRTUAL_WAIT_UNTIL_ID = "virtual:emdash/wait-until";
 export const RESOLVED_VIRTUAL_WAIT_UNTIL_ID = "\0" + VIRTUAL_WAIT_UNTIL_ID;
 
+export const VIRTUAL_SCHEDULER_ID = "virtual:emdash/scheduler";
+export const RESOLVED_VIRTUAL_SCHEDULER_ID = "\0" + VIRTUAL_SCHEDULER_ID;
+
 /**
  * Generates the config virtual module.
  */
@@ -413,6 +416,42 @@ export function generateWaitUntilModule(adapterName: string | undefined): string
 	return `export const waitUntil = undefined;`;
 }
 
+/**
+ * Generates the scheduler virtual module.
+ *
+ * Decides — at build time, from the Astro adapter — whether the runtime gets a
+ * long-lived timer heartbeat. A *production* Cloudflare build has no persistent
+ * timers, so the Worker's `scheduled()` handler (a Cron Trigger) drives
+ * `runScheduledTasks()` instead and this exports `null`. Every other case — any
+ * other adapter (Node, Bun), and crucially local `astro dev` even under the
+ * Cloudflare adapter (no Cron Trigger fires in dev) — gets a `NodeCronScheduler`
+ * factory so plugin cron, scheduled publishing, and cleanup still run.
+ *
+ * Keeping the adapter check here — rather than in core's runtime — means the
+ * runtime has no Cloudflare-specific code path; it just calls `createScheduler`
+ * if one was injected. Mirrors the wait-until module's approach.
+ */
+export function generateSchedulerModule(
+	adapterName: string | undefined,
+	command: "build" | "serve" | undefined,
+): string {
+	// Only suppress the timer for an actual Cloudflare *build* — that artifact
+	// runs in workerd where a Cron Trigger drives scheduled work. In `serve`
+	// (local dev) nothing fires the Cron Trigger, so fall through to the timer.
+	if (adapterName === "@astrojs/cloudflare" && command !== "serve") {
+		return `// Serverless build: an external Cron Trigger drives scheduled work.
+export const createScheduler = null;
+`;
+	}
+	return `// Long-lived runtime (or local dev): drive scheduled work from an in-process timer.
+import { NodeCronScheduler } from "emdash";
+
+export function createScheduler(executor) {
+	return new NodeCronScheduler(executor);
+}
+`;
+}
+
 /**
  * Generates the seed virtual module.
  * Reads the user's seed file at build time (in Node context) and embeds it,

package/src/astro/integration/vite-config.ts

@@ -42,8 +42,11 @@ import {
 	RESOLVED_VIRTUAL_SEED_ID,
 	VIRTUAL_WAIT_UNTIL_ID,
 	RESOLVED_VIRTUAL_WAIT_UNTIL_ID,
+	VIRTUAL_SCHEDULER_ID,
+	RESOLVED_VIRTUAL_SCHEDULER_ID,
 	generateSeedModule,
 	generateWaitUntilModule,
+	generateSchedulerModule,
 	generateConfigModule,
 	generateDialectModule,
 	generateStorageModule,
@@ -203,6 +206,9 @@ export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
 			if (id === VIRTUAL_WAIT_UNTIL_ID) {
 				return RESOLVED_VIRTUAL_WAIT_UNTIL_ID;
 			}
+			if (id === VIRTUAL_SCHEDULER_ID) {
+				return RESOLVED_VIRTUAL_SCHEDULER_ID;
+			}
 		},
 		load(id: string) {
 			if (id === RESOLVED_VIRTUAL_CONFIG_ID) {
@@ -271,6 +277,12 @@ export function createVirtualModulesPlugin(options: VitePluginOptions): Plugin {
 			if (id === RESOLVED_VIRTUAL_WAIT_UNTIL_ID) {
 				return generateWaitUntilModule(astroConfig.adapter?.name);
 			}
+			// Generate scheduler module — a NodeCronScheduler factory on
+			// long-lived runtimes, or null under the Cloudflare adapter where
+			// a Cron Trigger drives scheduled work instead.
+			if (id === RESOLVED_VIRTUAL_SCHEDULER_ID) {
+				return generateSchedulerModule(astroConfig.adapter?.name, viteCommand);
+			}
 		},
 	};
 }

package/src/astro/middleware/stream-end-metrics.ts

@@ -0,0 +1,96 @@
+/**
+ * Stream-end metrics
+ *
+ * Server-Timing db.* counters are snapshotted when middleware's next()
+ * returns — but at that point only the response *headers* are final.
+ * Astro streams the body afterwards, and components rendered during
+ * streaming issue further DB queries that the headers can never report.
+ *
+ * This module wraps the response body in an identity TransformStream and
+ * snapshots the request metrics in flush(), i.e. when the body actually
+ * finishes streaming. The metrics object lives on the request context
+ * (AsyncLocalStorage) and is mutated in-place by the Kysely log hook, so
+ * a reference captured before wrapping observes every post-header query.
+ * The snapshot is emitted as prefixed NDJSON on stdout (same transport as
+ * [emdash-query-log] — console.log works in both Node and workerd).
+ *
+ * Gated on isInstrumentationEnabled() (EMDASH_QUERY_LOG=1): zero overhead
+ * in normal production traffic.
+ */
+
+import { isInstrumentationEnabled } from "../../database/instrumentation.js";
+import { getRequestContext } from "../../request-context.js";
+
+export const STREAM_END_PREFIX = "[emdash-stream-end]";
+
+/**
+ * Astro attaches AstroCookies to outgoing responses via a well-known global
+ * symbol. Constructing a new Response drops non-header metadata, so the
+ * symbol must be forwarded explicitly or `cookies.set()` calls are silently
+ * dropped. Same pattern as finalizeResponse in ../middleware.ts.
+ */
+const ASTRO_COOKIES_SYMBOL = Symbol.for("astro.cookies");
+
+/** Shape of the NDJSON snapshot emitted when the body finishes streaming. */
+export interface StreamEndSnapshot {
+	route?: string;
+	method?: string;
+	phase?: string;
+	/** Total elapsed ms from middleware entry to end of body streaming. */
+	totalMs: number;
+	dbCount: number;
+	dbTotalMs: number;
+	dbFirstOffset: number | null;
+	dbLastOffset: number | null;
+	cacheHits: number;
+	cacheMisses: number;
+}
+
+/**
+ * Wrap a response body so the FINAL request metrics are emitted when the
+ * body finishes streaming. Returns the response unchanged when
+ * instrumentation is disabled, the body is null, or no request metrics
+ * are attached (e.g. outside the middleware's ALS context).
+ */
+export function wrapBodyForStreamMetrics(response: Response): Response {
+	if (!isInstrumentationEnabled()) return response;
+	if (!response.body) return response;
+
+	// Capture the context's metrics object BEFORE wrapping: flush() runs
+	// after the middleware's ALS frame may have exited, but the object
+	// reference stays live and is mutated in-place by the Kysely log hook.
+	const ctx = getRequestContext();
+	const metrics = ctx?.metrics;
+	if (!metrics) return response;
+	const recorder = ctx?.queryRecorder;
+
+	const transform = new TransformStream<Uint8Array, Uint8Array>({
+		flush() {
+			const snapshot: StreamEndSnapshot = {
+				route: recorder?.route,
+				method: recorder?.method,
+				phase: recorder?.phase,
+				totalMs: performance.now() - metrics.start,
+				dbCount: metrics.dbCount,
+				dbTotalMs: metrics.dbTotalMs,
+				dbFirstOffset: metrics.dbFirstOffset,
+				dbLastOffset: metrics.dbLastOffset,
+				cacheHits: metrics.cacheHits,
+				cacheMisses: metrics.cacheMisses,
+			};
+			console.log(`${STREAM_END_PREFIX} ${JSON.stringify(snapshot)}`);
+		},
+	});
+
+	const wrapped = new Response(response.body.pipeThrough(transform), response);
+	const astroCookies = Reflect.get(response, ASTRO_COOKIES_SYMBOL);
+	if (astroCookies !== undefined) {
+		Reflect.set(wrapped, ASTRO_COOKIES_SYMBOL, astroCookies);
+	}
+	// The identity transform preserves byte counts today, but a stale
+	// Content-Length on a re-constructed streaming Response risks
+	// truncation if anything upstream changes; the header is recomputed
+	// (or chunked encoding used) by the server layer anyway.
+	wrapped.headers.delete("Content-Length");
+	return wrapped;
+}