emdash 0.17.2 → 0.19.0

package/src/database/migrations/043_content_references.ts

@@ -0,0 +1,121 @@
+import type { Kysely } from "kysely";
+
+import { getI18nConfig } from "../../i18n/config.js";
+import { currentTimestamp } from "../dialect-helpers.js";
+
+/**
+ * Content references.
+ *
+ * `_emdash_relations` defines relationship types (row-per-locale, mirroring
+ * `_emdash_taxonomy_defs`): which collection is the parent, which is the child
+ * (the side that may multiply), and localized labels for each role.
+ *
+ * `_emdash_content_references` holds directed `parent → child` edges between
+ * content entries. Both endpoints and the relation are referenced by
+ * `translation_group`, so edges are locale-agnostic. As with
+ * `content_taxonomies`, group-linking precludes SQL foreign keys; referential
+ * cleanup is an application-layer concern.
+ *
+ * Idempotency: every `CREATE TABLE` and `CREATE INDEX` uses `.ifNotExists()`,
+ * so a partial prior run (a crash mid-migration, or a retry after the runner's
+ * race-recovery path) re-applies cleanly — including any indexes that landed in
+ * the failed pass after their table.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	const defaultLocale = getI18nConfig()?.defaultLocale ?? "en";
+
+	await db.schema
+		.createTable("_emdash_relations")
+		.ifNotExists()
+		.addColumn("id", "text", (c) => c.primaryKey())
+		.addColumn("name", "text", (c) => c.notNull())
+		.addColumn("parent_collection", "text", (c) => c.notNull())
+		.addColumn("child_collection", "text", (c) => c.notNull())
+		.addColumn("parent_label", "text", (c) => c.notNull())
+		.addColumn("child_label", "text", (c) => c.notNull())
+		.addColumn("locale", "text", (c) => c.notNull().defaultTo(defaultLocale))
+		.addColumn("translation_group", "text", (c) => c.notNull())
+		.addColumn("created_at", "text", (c) => c.defaultTo(currentTimestamp(db)))
+		.addColumn("updated_at", "text", (c) => c.defaultTo(currentTimestamp(db)))
+		.addUniqueConstraint("_emdash_relations_name_locale_unique", ["name", "locale"])
+		.execute();
+
+	await db.schema
+		.createIndex("idx__emdash_relations_locale")
+		.ifNotExists()
+		.on("_emdash_relations")
+		.column("locale")
+		.execute();
+	await db.schema
+		.createIndex("idx__emdash_relations_translation_group")
+		.ifNotExists()
+		.on("_emdash_relations")
+		.column("translation_group")
+		.execute();
+	await db.schema
+		.createIndex("idx__emdash_relations_parent_collection")
+		.ifNotExists()
+		.on("_emdash_relations")
+		.column("parent_collection")
+		.execute();
+	await db.schema
+		.createIndex("idx__emdash_relations_child_collection")
+		.ifNotExists()
+		.on("_emdash_relations")
+		.column("child_collection")
+		.execute();
+
+	// One row per (translation_group, locale): the row-per-locale model wants a
+	// relation to have at most one variant per locale. Migration 040 enforces
+	// the same invariant for `_emdash_bylines` with a *partial* unique
+	// (`WHERE translation_group IS NOT NULL`) only because it back-fills an
+	// existing table; this table is new and `translation_group` is `NOT NULL`,
+	// so a plain unique index suffices.
+	await db.schema
+		.createIndex("idx__emdash_relations_group_locale_unique")
+		.ifNotExists()
+		.unique()
+		.on("_emdash_relations")
+		.columns(["translation_group", "locale"])
+		.execute();
+
+	await db.schema
+		.createTable("_emdash_content_references")
+		.ifNotExists()
+		.addColumn("id", "text", (c) => c.primaryKey())
+		.addColumn("relation_group", "text", (c) => c.notNull())
+		.addColumn("parent_group", "text", (c) => c.notNull())
+		.addColumn("child_group", "text", (c) => c.notNull())
+		.addColumn("sort_order", "integer", (c) => c.notNull().defaultTo(0))
+		.addColumn("created_at", "text", (c) => c.defaultTo(currentTimestamp(db)))
+		.addUniqueConstraint("content_references_unique", [
+			"relation_group",
+			"parent_group",
+			"child_group",
+		])
+		.execute();
+
+	await db.schema
+		.createIndex("idx__emdash_content_references_parent")
+		.ifNotExists()
+		.on("_emdash_content_references")
+		.columns(["parent_group", "relation_group", "sort_order"])
+		.execute();
+	await db.schema
+		.createIndex("idx__emdash_content_references_child")
+		.ifNotExists()
+		.on("_emdash_content_references")
+		.columns(["child_group", "relation_group"])
+		.execute();
+	await db.schema
+		.createIndex("idx__emdash_content_references_relation")
+		.ifNotExists()
+		.on("_emdash_content_references")
+		.column("relation_group")
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("_emdash_content_references").ifExists().execute();
+	await db.schema.dropTable("_emdash_relations").ifExists().execute();
+}

package/src/database/migrations/runner.ts

@@ -44,6 +44,7 @@ import * as m039 from "./039_fix_fts5_triggers.js";
 import * as m040 from "./040_byline_i18n.js";
 import * as m041 from "./041_content_locale_list_index.js";
 import * as m042 from "./042_byline_fields.js";
+import * as m043 from "./043_content_references.js";
 
 const MIGRATIONS: Readonly<Record<string, Migration>> = Object.freeze({
 	"001_initial": m001,
@@ -87,6 +88,7 @@ const MIGRATIONS: Readonly<Record<string, Migration>> = Object.freeze({
 	"040_byline_i18n": m040,
 	"041_content_locale_list_index": m041,
 	"042_byline_fields": m042,
+	"043_content_references": m043,
 });
 
 /** Total number of registered migrations. Exported for use in tests. */
@@ -178,8 +180,13 @@ const MIGRATION_RACE_PATTERN = new RegExp(
 	"i",
 );
 
-/** How long to wait for a concurrent migrator to finish before giving up. */
-const MIGRATION_RACE_WAIT_MS = 10_000;
+/**
+ * How long to wait for a concurrent migrator to finish before giving up.
+ * Exported because the db init lock's reclaim deadline must comfortably
+ * exceed it (see DB_INIT_DEADLINE_MS in emdash-runtime.ts) — a healthy
+ * init can legitimately block this long inside waitForConcurrentMigrator.
+ */
+export const MIGRATION_RACE_WAIT_MS = 10_000;
 /** Polling interval while waiting for a concurrent migrator. */
 const MIGRATION_RACE_POLL_MS = 100;
 

package/src/database/repositories/content.ts

@@ -11,8 +11,14 @@ import type {
 	FindManyOptions,
 	FindManyResult,
 	ContentItem,
+	ContentDateField,
+} from "./types.js";
+import {
+	EmDashValidationError,
+	ScheduledNotDueError,
+	encodeCursor,
+	decodeCursor,
 } from "./types.js";
-import { EmDashValidationError, encodeCursor, decodeCursor } from "./types.js";
 
 // Regex pattern for ULID validation
 const ULID_PATTERN = /^[0-9A-Z]{26}$/;
@@ -20,6 +26,18 @@ const ULID_PATTERN = /^[0-9A-Z]{26}$/;
 // LIKE wildcards that must be escaped so user search input is matched literally.
 const LIKE_WILDCARD_RE = /[\\%_]/g;
 
+/**
+ * Whitelist mapping a public date-filter field to its physical column. Keeping
+ * this separate from `mapOrderField` makes the filterable set explicit and
+ * prevents filtering on arbitrary columns.
+ */
+const DATE_FILTER_COLUMNS: Record<ContentDateField, "created_at" | "updated_at" | "published_at"> =
+	{
+		createdAt: "created_at",
+		updatedAt: "updated_at",
+		publishedAt: "published_at",
+	};
+
 /**
  * System columns that exist in every ec_* table
  */
@@ -493,6 +511,7 @@ export class ContentRepository {
 		}
 
 		query = this.applySearchFilter(query, options.where);
+		query = this.applyDateFilter(query, options.where);
 
 		// Handle cursor pagination — decodeCursor throws InvalidCursorError
 		// on malformed input; let it propagate so handlers surface a
@@ -785,19 +804,35 @@ export class ContentRepository {
 		);
 	}
 
+	/**
+	 * Apply the optional inclusive date-range filter. The field is mapped
+	 * through `DATE_FILTER_COLUMNS` (a closed whitelist), and bounds compare
+	 * lexicographically against the stored ISO 8601 timestamps. A `publishedAt`
+	 * range naturally excludes never-published rows (their column is NULL).
+	 */
+	private applyDateFilter<QB extends { where: (cb: (eb: any) => unknown) => QB }>(
+		query: QB,
+		where?: { dateFilter?: { field: string; from?: string; to?: string } },
+	): QB {
+		const filter = where?.dateFilter;
+		if (!filter) return query;
+		const column = DATE_FILTER_COLUMNS[filter.field as ContentDateField];
+		if (!column) {
+			throw new EmDashValidationError(`Invalid date filter field: ${filter.field}`);
+		}
+		const { from, to } = filter;
+		if (!from && !to) return query;
+
+		let next = query;
+		if (from) next = next.where((eb) => eb(column as any, ">=", from));
+		if (to) next = next.where((eb) => eb(column as any, "<=", to));
+		return next;
+	}
+
 	/**
 	 * Count content items
 	 */
-	async count(
-		type: string,
-		where?: {
-			status?: string;
-			authorId?: string;
-			locale?: string;
-			q?: string;
-			searchColumns?: string[];
-		},
-	): Promise<number> {
+	async count(type: string, where?: FindManyOptions["where"]): Promise<number> {
 		const tableName = getTableName(type);
 
 		let query = this.db
@@ -818,11 +853,34 @@ export class ContentRepository {
 		}
 
 		query = this.applySearchFilter(query, where);
+		query = this.applyDateFilter(query, where);
 
 		const result = await query.executeTakeFirst();
 		return Number(result?.count || 0);
 	}
 
+	/**
+	 * Distinct, non-null `author_id` values across the collection's live
+	 * (non-trashed) content. Used to populate the admin author filter with
+	 * only the users who have actually authored entries, rather than the
+	 * full user directory (which requires admin privileges to read).
+	 */
+	async findDistinctAuthorIds(type: string): Promise<string[]> {
+		const tableName = getTableName(type);
+
+		const rows = await this.db
+			.selectFrom(tableName as keyof Database)
+			.select("author_id")
+			.distinct()
+			.where("deleted_at" as never, "is", null)
+			.where("author_id" as never, "is not", null)
+			.execute();
+
+		return rows
+			.map((row) => (row as { author_id: string | null }).author_id)
+			.filter((id): id is string => id !== null);
+	}
+
 	// get overall statistics (total, published, draft) for a content type in a single query
 	async getStats(type: string): Promise<{ total: number; published: number; draft: number }> {
 		const tableName = getTableName(type);
@@ -933,17 +991,30 @@ export class ContentRepository {
 	 * Returns all content where scheduled_at <= now, regardless of status.
 	 * This covers both draft-scheduled posts (status='scheduled') and
 	 * published posts with scheduled draft changes (status='published').
+	 *
+	 * `limit` (optional) caps how many due rows are returned, oldest-due first.
+	 * The scheduled-publishing sweep passes a limit so a large backlog can't
+	 * fan out unbounded publish/webhook work in a single tick (and blow a Worker
+	 * invocation's CPU/subrequest budget); the remainder drains on later ticks.
 	 */
-	async findReadyToPublish(type: string): Promise<ContentItem[]> {
+	async findReadyToPublish(type: string, limit?: number): Promise<ContentItem[]> {
 		const tableName = getTableName(type);
 		const now = new Date().toISOString();
 
+		// Embed an empty fragment when unbounded so callers that want every due
+		// row (manual flows, tests) keep the original behaviour.
+		const limitClause =
+			typeof limit === "number" && Number.isInteger(limit) && limit > 0
+				? sql`LIMIT ${limit}`
+				: sql``;
+
 		const result = await sql<Record<string, unknown>>`
 			SELECT * FROM ${sql.ref(tableName)}
 			WHERE scheduled_at IS NOT NULL
 			AND scheduled_at <= ${now}
 			AND deleted_at IS NULL
 			ORDER BY scheduled_at ASC
+			${limitClause}
 		`.execute(this.db);
 
 		return result.rows.map((row) => this.mapRow(type, row));
@@ -978,8 +1049,21 @@ export class ContentRepository {
 	 * original date) and falls back to the current time on first publish. Pass
 	 * an explicit value to backdate a publish (e.g. when migrating content from
 	 * another CMS).
+	 *
+	 * `requireDue` (optional) gates the publish on the row still being due:
+	 * `scheduled_at` non-null and in the past. Used by the scheduled-publishing
+	 * sweep to avoid publishing content an editor unscheduled or rescheduled
+	 * between selection and publish. It claims the row with a single conditional
+	 * UPDATE (clearing `scheduled_at`) before any other write, so it is atomic
+	 * even on D1 (no multi-statement transactions) and serialises against
+	 * `unschedule()` and concurrent sweeps — no TOCTOU and no double publish.
 	 */
-	async publish(type: string, id: string, publishedAt?: string): Promise<ContentItem> {
+	async publish(
+		type: string,
+		id: string,
+		publishedAt?: string,
+		requireDue = false,
+	): Promise<ContentItem> {
 		const tableName = getTableName(type);
 		const now = new Date().toISOString();
 
@@ -988,71 +1072,145 @@ export class ContentRepository {
 			throw new EmDashValidationError("Content item not found");
 		}
 
-		const revisionRepo = new RevisionRepository(this.db);
-		let revisionToPublish = existing.draftRevisionId || existing.liveRevisionId;
-
-		if (!revisionToPublish) {
-			// No revision exists - create one from current data
-			const revision = await revisionRepo.create({
-				collection: type,
-				entryId: id,
-				data: existing.data,
-			});
-			revisionToPublish = revision.id;
+		// Scheduled sweep: atomically claim the row before any other write. A
+		// single conditional UPDATE is atomic per-statement on every dialect
+		// (it doesn't depend on a wrapping transaction, which D1 lacks). If the
+		// schedule was cleared or pushed to the future (unschedule/reschedule)
+		// or another sweep already claimed it, this affects 0 rows and we bail
+		// before promoting any revision — so the row can't be double-published.
+		let claimedScheduledAt: string | null = null;
+		let claimedUpdatedAt: string | null = null;
+		if (requireDue) {
+			const claim = await sql`
+				UPDATE ${sql.ref(tableName)}
+				SET scheduled_at = NULL,
+					updated_at = ${now}
+				WHERE id = ${id}
+				AND scheduled_at IS NOT NULL
+				AND scheduled_at <= ${now}
+				AND deleted_at IS NULL
+			`.execute(this.db);
+			if ((claim.numAffectedRows ?? 0n) === 0n) {
+				throw new ScheduledNotDueError();
+			}
+			// Remember what we cleared so we can put it back if the publish work
+			// below fails on a driver without transactions (see catch). Both
+			// values come from the pre-claim snapshot: if a concurrent
+			// reschedule-to-a-different-past-time landed between findById and the
+			// claim, the restore writes the snapshot value rather than the one the
+			// claim actually cleared. That window is tiny and the restore is
+			// best-effort retry bookkeeping, so the imprecision is acceptable.
+			claimedScheduledAt = existing.scheduledAt;
+			claimedUpdatedAt = existing.updatedAt;
 		}
 
-		// Sync the revision's data into the content table columns
-		// so the content table always holds the published version
-		const revision = await revisionRepo.findById(revisionToPublish);
-		if (revision) {
-			await this.syncDataColumns(type, id, revision.data);
+		// Track whether the final publish write committed. On D1 the claim above
+		// is already durable (withTransaction is a no-op there), so if a later
+		// step throws we must restore the schedule — otherwise the row is left
+		// `scheduled` with `scheduled_at = NULL` and no sweep ever retries it.
+		let publishCommitted = false;
+		try {
+			const revisionRepo = new RevisionRepository(this.db);
+			let revisionToPublish = existing.draftRevisionId || existing.liveRevisionId;
 
-			// Sync slug from revision if stored there
-			if (typeof revision.data._slug === "string") {
+			if (!revisionToPublish) {
+				// No revision exists - create one from current data
+				const revision = await revisionRepo.create({
+					collection: type,
+					entryId: id,
+					data: existing.data,
+				});
+				revisionToPublish = revision.id;
+			}
+
+			// Sync the revision's data into the content table columns
+			// so the content table always holds the published version
+			const revision = await revisionRepo.findById(revisionToPublish);
+			if (revision) {
+				await this.syncDataColumns(type, id, revision.data);
+
+				// Sync slug from revision if stored there
+				if (typeof revision.data._slug === "string") {
+					await sql`
+						UPDATE ${sql.ref(tableName)}
+						SET slug = ${revision.data._slug}
+						WHERE id = ${id}
+					`.execute(this.db);
+				}
+			}
+
+			if (publishedAt !== undefined) {
+				// Caller supplied an explicit timestamp, so we overwrite published_at
+				// directly (used to backdate a publish, e.g. for content migrations).
+				await sql`
+					UPDATE ${sql.ref(tableName)}
+					SET live_revision_id = ${revisionToPublish},
+						draft_revision_id = NULL,
+						status = 'published',
+						scheduled_at = NULL,
+						published_at = ${publishedAt},
+						updated_at = ${now}
+					WHERE id = ${id}
+					AND deleted_at IS NULL
+				`.execute(this.db);
+			} else {
+				// No timestamp supplied — preserve existing published_at on
+				// idempotent re-publish, fall back to `now` on first publish.
 				await sql`
 					UPDATE ${sql.ref(tableName)}
-					SET slug = ${revision.data._slug}
+					SET live_revision_id = ${revisionToPublish},
+						draft_revision_id = NULL,
+						status = 'published',
+						scheduled_at = NULL,
+						published_at = COALESCE(published_at, ${now}),
+						updated_at = ${now}
 					WHERE id = ${id}
+					AND deleted_at IS NULL
 				`.execute(this.db);
 			}
-		}
+			publishCommitted = true;
 
-		if (publishedAt !== undefined) {
-			// Caller supplied an explicit timestamp, so we overwrite published_at
-			// directly (used to backdate a publish, e.g. for content migrations).
-			await sql`
-				UPDATE ${sql.ref(tableName)}
-				SET live_revision_id = ${revisionToPublish},
-					draft_revision_id = NULL,
-					status = 'published',
-					scheduled_at = NULL,
-					published_at = ${publishedAt},
-					updated_at = ${now}
-				WHERE id = ${id}
-				AND deleted_at IS NULL
-			`.execute(this.db);
-		} else {
-			// No timestamp supplied — preserve existing published_at on
-			// idempotent re-publish, fall back to `now` on first publish.
-			await sql`
-				UPDATE ${sql.ref(tableName)}
-				SET live_revision_id = ${revisionToPublish},
-					draft_revision_id = NULL,
-					status = 'published',
-					scheduled_at = NULL,
-					published_at = COALESCE(published_at, ${now}),
-					updated_at = ${now}
-				WHERE id = ${id}
-				AND deleted_at IS NULL
-			`.execute(this.db);
-		}
+			const updated = await this.findById(type, id);
+			if (!updated) {
+				throw new Error("Content not found");
+			}
 
-		const updated = await this.findById(type, id);
-		if (!updated) {
-			throw new Error("Content not found");
+			return updated;
+		} catch (error) {
+			// Best-effort schedule restore for the no-transaction (D1) case so a
+			// failed publish stays retryable. Skipped when the publish actually
+			// committed (the failure was afterwards). On SQLite/Postgres the
+			// enclosing transaction rolls the claim back, so this restore also
+			// rolls back — a harmless no-op. Never mask the original error.
+			if (requireDue && claimedScheduledAt && !publishCommitted) {
+				try {
+					// Only restore if the row still has pending work: either it's not
+					// published, or it's a published row that still has a draft change
+					// queued. This avoids re-adding a stale schedule (and triggering a
+					// redundant republish) when another actor fully published the row
+					// in the failure window — that publish clears draft_revision_id.
+					// Restore updated_at to its pre-claim value too — the claim bumped
+					// it to `now`, and a failed publish made no real change, so leaving
+					// it advanced would be a phantom modification for "changed since"
+					// consumers (sync, ETags, incremental indexers).
+					await sql`
+						UPDATE ${sql.ref(tableName)}
+						SET scheduled_at = ${claimedScheduledAt},
+							updated_at = ${claimedUpdatedAt ?? now}
+						WHERE id = ${id}
+						AND scheduled_at IS NULL
+						AND deleted_at IS NULL
+						AND (status != 'published' OR draft_revision_id IS NOT NULL)
+					`.execute(this.db);
+				} catch (restoreError) {
+					console.error(
+						`[content] Failed to restore schedule for ${type}/${id} after publish failure:`,
+						restoreError,
+					);
+				}
+			}
+			throw error;
 		}
-
-		return updated;
 	}
 
 	/**

package/src/database/repositories/index.ts

@@ -42,3 +42,10 @@ export { BylineRepository } from "./byline.js";
 export type { CreateBylineInput, UpdateBylineInput, ContentBylineInput } from "./byline.js";
 export type * from "./types.js";
 export { EmDashValidationError, InvalidCursorError, encodeCursor, decodeCursor } from "./types.js";
+export { RelationRepository } from "./relation.js";
+export type {
+	Relation,
+	CreateRelationInput,
+	UpdateRelationInput,
+	ContentReference,
+} from "./relation.js";