emdash 0.27.0 → 0.28.1

package/src/astro/routes/api/plugins/[pluginId]/[...path].ts

@@ -39,11 +39,16 @@ const handleRequest: APIRoute = async ({ params, request, locals }) => {
 
 	// Public routes skip auth, CSRF, and scope checks entirely
 	if (!routeMeta.public) {
-		// Private routes require authentication and permission checks
-		const permission = ["GET", "HEAD", "OPTIONS"].includes(method)
-			? "plugins:read"
-			: "plugins:manage";
-		const denied = requirePerm(user, permission);
+		// Plugin routes are dispatched by name only — the HTTP method never
+		// selects a different handler, so a route reached via GET or HEAD runs
+		// exactly the same code (and side effects) as one reached via POST.
+		// Method-based tiering is therefore unsafe: gating GET/HEAD/OPTIONS on
+		// `plugins:read` with no CSRF let an editor (or a cross-origin page,
+		// since HEAD is CORS-safe) invoke a mutating admin route by choosing the
+		// method (#1853). Astro also dispatches HEAD to the GET export, so no
+		// explicit HEAD handler is needed to reach a "GET" route. Gate every
+		// private invocation on `plugins:manage` + CSRF regardless of method.
+		const denied = requirePerm(user, "plugins:manage");
 		if (denied) return denied;
 
 		// Token scope enforcement — plugin routes require "admin" scope.
@@ -51,16 +56,13 @@ const handleRequest: APIRoute = async ({ params, request, locals }) => {
 		const scopeError = requireScope(locals, "admin");
 		if (scopeError) return scopeError;
 
-		// CSRF protection for state-changing requests on private routes.
-		// Plugin routes use soft auth in the middleware (user resolved but not required),
-		// so the middleware's CSRF check doesn't run. We enforce it here for private routes.
-		// Token-authed requests (which set tokenScopes) are exempt — tokens aren't
-		// ambient credentials like cookies.
-		if (
-			!["GET", "HEAD", "OPTIONS"].includes(method) &&
-			!locals.tokenScopes &&
-			request.headers.get("X-EmDash-Request") !== "1"
-		) {
+		// CSRF protection on private routes. Plugin routes use soft auth in the
+		// middleware (user resolved but not required), so the middleware's CSRF
+		// check doesn't run — enforce it here. Applied to every method because
+		// any method can trigger a state change (see above). Token-authed
+		// requests (which set tokenScopes) are exempt — tokens aren't ambient
+		// credentials like cookies.
+		if (!locals.tokenScopes && request.headers.get("X-EmDash-Request") !== "1") {
 			return apiError("CSRF_REJECTED", "Missing required header", 403);
 		}
 	}

package/src/components/EmDashImage.astro

@@ -18,7 +18,7 @@
  */
 import type { MediaValue } from "../fields/types.js";
 import type { HTMLAttributes } from "astro/types";
-import { getImage } from "astro:assets";
+import { Image as AstroImage, getImage } from "astro:assets";
 import type { ImageEmbed } from "../media/types.js";
 import { getMediaProvider } from "../media/provider-loader.js";
 import { buildRenderMediaUrl } from "../media/url.js";
@@ -43,9 +43,20 @@ interface Props extends Omit<
 	height?: number;
 	/** Priority loading (disables lazy loading) */
 	priority?: boolean;
+	/** Render the LQIP placeholder as an inline background. Disable for strict CSP. */
+	placeholder?: boolean;
 }
 
-const { image, alt, width, height, priority, ...attrs } = Astro.props;
+const {
+	image,
+	alt,
+	width,
+	height,
+	priority,
+	placeholder = true,
+	class: className,
+	...attrs
+} = Astro.props;
 
 // Normalize string URLs to object form
 function normalizeImage(
@@ -98,25 +109,28 @@ const aspectRatio =
 let src = "";
 let srcset: string | undefined;
 let sizes: string | undefined;
+let astroImageSrc = "";
 
 if (img) {
 	const providerId = img.provider ?? "local";
 
 	if (providerId === "local" || img.src) {
-		// Local provider or direct src URL. Route through Astro's image service
-		// (`astro:assets`) to generate a responsive srcset; on Cloudflare this is
-		// the Images binding, on Node it is sharp. Falls back to a plain <img>
-		// when the service is unavailable or the source can't be optimized.
 		src = img.src || buildLocalImageUrl(img);
-		const optimized = await buildResponsiveImage(getImage, {
-			src: toAbsoluteMediaUrl(src, getPublicOrigin(Astro.url, Astro.locals.emdash?.config)),
-			width: finalWidth,
-			height: finalHeight,
-		});
-		if (optimized) {
-			src = optimized.src;
-			srcset = optimized.srcset;
-			sizes = optimized.sizes;
+		const publicOrigin = getPublicOrigin(Astro.url, Astro.locals.emdash?.config);
+		const absoluteSrc = toAbsoluteMediaUrl(src, publicOrigin);
+		if (finalWidth && finalHeight && absoluteSrc.startsWith(`${publicOrigin}/`)) {
+			astroImageSrc = absoluteSrc;
+		} else {
+			const optimized = await buildResponsiveImage(getImage, {
+				src: absoluteSrc,
+				width: finalWidth,
+				height: finalHeight,
+			});
+			if (optimized) {
+				src = optimized.src;
+				srcset = optimized.srcset;
+				sizes = optimized.sizes;
+			}
 		}
 	} else {
 		// External provider
@@ -166,17 +180,13 @@ const dominantColor =
 	img?.dominantColor ?? (img?.meta?.dominantColor as string | undefined);
 
 let placeholderStyle = "";
-if (blurhash) {
+if (placeholder && blurhash) {
 	const { blurhashToImageCssString } = await import("@unpic/placeholder");
 	placeholderStyle = blurhashToImageCssString(blurhash);
-} else if (dominantColor) {
+} else if (placeholder && dominantColor) {
 	placeholderStyle = `background-color: ${dominantColor};`;
 }
 
-const baseStyle = aspectRatio
-	? `aspect-ratio: ${aspectRatio}; max-width: 100%; height: auto;`
-	: "max-width: 100%; height: auto;";
-
 const imgProps: Record<string, unknown> = {
 	src,
 	srcset,
@@ -187,9 +197,35 @@ const imgProps: Record<string, unknown> = {
 	loading: priority ? "eager" : "lazy",
 	fetchpriority: priority ? "high" : undefined,
 	decoding: "async",
-	style: placeholderStyle ? `${baseStyle} ${placeholderStyle}` : baseStyle,
+	style: placeholderStyle || undefined,
+	class: ["emdash-image-media", className].filter(Boolean).join(" "),
 	...attrs,
 };
 ---
 
-{img && src ? <img {...imgProps} /> : null}
+{
+	img && astroImageSrc ? (
+		<AstroImage
+			src={astroImageSrc}
+			alt={finalAlt}
+			width={finalWidth}
+			height={finalHeight}
+			priority={priority}
+			layout="constrained"
+			loading={priority ? "eager" : "lazy"}
+			decoding="async"
+			class={className}
+			style={placeholderStyle || undefined}
+			{...attrs}
+		/>
+	) : img && src ? (
+		<img {...imgProps} />
+	) : null
+}
+
+<style>
+	.emdash-image-media {
+		max-width: 100%;
+		height: auto;
+	}
+</style>

package/src/components/Image.astro

@@ -5,15 +5,11 @@
  * Renders image blocks from WordPress imports and EmDash media.
  * Uses the provider's getSrc function for responsive srcset generation.
  */
-import { getImage } from "astro:assets";
+import { Image as AstroImage } from "astro:assets";
 import type { ImageEmbed } from "../media/types.js";
 import { getMediaProvider } from "../media/provider-loader.js";
 import { buildRenderMediaUrl } from "../media/url.js";
-import {
-	buildResponsiveImage,
-	toAbsoluteMediaUrl,
-	RESPONSIVE_BREAKPOINTS,
-} from "../media/responsive.js";
+import { toAbsoluteMediaUrl, RESPONSIVE_BREAKPOINTS } from "../media/responsive.js";
 import { getPublicOrigin } from "../api/public-url.js";
 
 export interface Props {
@@ -46,6 +42,8 @@ export interface Props {
 		/** Alignment for this image instance (e.g. from a WordPress import) */
 		alignment?: "left" | "center" | "right" | "wide" | "full";
 	};
+	/** Render the LQIP placeholder as an inline background. Disable for strict CSP. */
+	placeholder?: boolean;
 }
 
 /**
@@ -64,7 +62,7 @@ function generateSrcset(
 		.join(", ");
 }
 
-const { node } = Astro.props;
+const { node, placeholder = true } = Astro.props;
 
 if (!node?.asset) {
 	return null;
@@ -97,6 +95,7 @@ if (displayWidth && displayHeight) {
 let src = "";
 let srcset: string | undefined;
 let sizes: string | undefined;
+let astroImageSrc = "";
 const providerId = asset.provider;
 
 if (providerId && providerId !== "local") {
@@ -143,17 +142,8 @@ if (!src) {
 		url: asset.url,
 		id: asset._ref,
 	});
-	// Generate a responsive srcset via Astro's image service for local/R2 media.
-	// Falls back to the plain URL when optimization isn't possible.
-	const optimized = await buildResponsiveImage(getImage, {
-		src: toAbsoluteMediaUrl(src, getPublicOrigin(Astro.url, Astro.locals.emdash?.config)),
-		width: renderWidth,
-		height: renderHeight,
-	});
-	if (optimized) {
-		src = optimized.src;
-		srcset = optimized.srcset;
-		sizes = optimized.sizes;
+	if (renderWidth && renderHeight) {
+		astroImageSrc = toAbsoluteMediaUrl(src, getPublicOrigin(Astro.url, Astro.locals.emdash?.config));
 	}
 }
 
@@ -167,31 +157,42 @@ const dominantColor = (node.dominantColor ?? (asset.meta?.dominantColor as strin
 	| undefined;
 
 let placeholderStyle = "";
-if (blurhash) {
+if (placeholder && blurhash) {
 	const { blurhashToImageCssString } = await import("@unpic/placeholder");
 	placeholderStyle = blurhashToImageCssString(blurhash);
-} else if (dominantColor) {
+} else if (placeholder && dominantColor) {
 	placeholderStyle = `background-color: ${dominantColor};`;
 }
 
-const baseStyle = aspectRatio
-	? `aspect-ratio: ${aspectRatio}; max-width: 100%; height: auto;`
-	: "max-width: 100%; height: auto;";
-const imgStyle = placeholderStyle ? `${baseStyle} ${placeholderStyle}` : baseStyle;
 ---
 
 <figure class:list={["emdash-image", alignment && `emdash-image--align-${alignment}`]}>
-	<img
-		src={src}
-		srcset={srcset}
-		sizes={sizes}
-		alt={alt}
-		width={renderWidth}
-		height={renderHeight}
-		loading="lazy"
-		decoding="async"
-		style={imgStyle}
-	/>
+	{
+		astroImageSrc ? (
+			<AstroImage
+				src={astroImageSrc}
+				alt={alt}
+				width={renderWidth}
+				height={renderHeight}
+				layout="constrained"
+				loading="lazy"
+				decoding="async"
+				style={placeholderStyle || undefined}
+			/>
+		) : (
+			<img
+				src={src}
+				srcset={srcset}
+				sizes={sizes}
+				alt={alt}
+				width={renderWidth}
+				height={renderHeight}
+				loading="lazy"
+				decoding="async"
+				style={placeholderStyle || undefined}
+			/>
+		)
+	}
 	{caption && <figcaption>{caption}</figcaption>}
 </figure>
 

package/src/database/migrations/049_taxonomies_name_locale_index.ts

@@ -0,0 +1,42 @@
+import type { Kysely } from "kysely";
+
+/**
+ * Add composite `idx_taxonomies_name_locale` on `taxonomies(name, locale)` (#1723).
+ *
+ * `TaxonomyRepository.findByName` filters `WHERE name = ? AND locale = ?`, but
+ * the only indexes were the single-column `idx_taxonomies_name(name)` and
+ * `idx_taxonomies_locale(locale)`. On SQLite/D1 with no `sqlite_stat1` the
+ * planner picks `idx_taxonomies_locale` and reads *every* term in the locale,
+ * filtering `name` in memory — once per facet rendered. On a site where one
+ * taxonomy dominates a locale, each small facet still walks the whole locale.
+ *
+ * The composite resolves both equalities, so the planner searches only the one
+ * taxonomy's terms. Its leftmost prefix (`name`) also serves every name-only
+ * lookup, so it supersedes `idx_taxonomies_name`, which we drop. The
+ * single-column `idx_taxonomies_locale` stays for locale-only lookups.
+ *
+ * Strictly additive: no query changes, and the dropped index is fully covered
+ * by the new composite's prefix. Create-before-drop keeps name lookups indexed
+ * at every point. Both statements are idempotent so a partial apply can retry.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createIndex("idx_taxonomies_name_locale")
+		.ifNotExists()
+		.on("taxonomies")
+		.columns(["name", "locale"])
+		.execute();
+
+	await db.schema.dropIndex("idx_taxonomies_name").ifExists().execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createIndex("idx_taxonomies_name")
+		.ifNotExists()
+		.on("taxonomies")
+		.column("name")
+		.execute();
+
+	await db.schema.dropIndex("idx_taxonomies_name_locale").ifExists().execute();
+}

package/src/database/migrations/050_media_usage_index_status.ts

@@ -0,0 +1,142 @@
+import type { Kysely } from "kysely";
+
+import { columnExists, currentTimestamp } from "../dialect-helpers.js";
+
+const SOURCE_TABLE = "_emdash_media_usage_sources";
+const DUPLICATE_COLUMN_RE = /(?:duplicate column|column .* already exists|already exists.*column)/i;
+
+/**
+ * Media usage index metadata.
+ *
+ * DDL-only by design: adds freshness/completeness metadata and scope status
+ * tracking for later reference-index reconciliation. No content scans, no
+ * runtime imports, and no backfill.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await addSourceMetadataColumns(db);
+
+	await db.schema
+		.createTable("_emdash_media_usage_index_status")
+		.ifNotExists()
+		.addColumn("adapter_id", "text", (c) => c.notNull())
+		.addColumn("scope_type", "text", (c) => c.notNull())
+		.addColumn("scope_key", "text", (c) => c.notNull())
+		.addColumn("status", "text", (c) => c.notNull())
+		.addColumn("schema_version", "integer", (c) => c.notNull().defaultTo(1))
+		.addColumn("started_at", "text")
+		.addColumn("completed_at", "text")
+		.addColumn("cursor", "text")
+		.addColumn("indexed_source_count", "integer", (c) => c.notNull().defaultTo(0))
+		.addColumn("failed_source_count", "integer", (c) => c.notNull().defaultTo(0))
+		.addColumn("last_error_code", "text")
+		.addColumn("updated_at", "text", (c) => c.notNull().defaultTo(currentTimestamp(db)))
+		.addPrimaryKeyConstraint("_emdash_media_usage_index_status_pk", [
+			"adapter_id",
+			"scope_type",
+			"scope_key",
+		])
+		.execute();
+
+	await db.schema
+		.createIndex("idx__emdash_media_usage_sources_completeness")
+		.ifNotExists()
+		.on("_emdash_media_usage_sources")
+		.columns(["source_type", "collection_slug", "source_completeness"])
+		.execute();
+
+	await db.schema
+		.createIndex("idx__emdash_media_usage_sources_fingerprint")
+		.ifNotExists()
+		.on("_emdash_media_usage_sources")
+		.column("source_fingerprint")
+		.execute();
+
+	await db.schema
+		.createIndex("idx__emdash_media_usage_index_status_status")
+		.ifNotExists()
+		.on("_emdash_media_usage_index_status")
+		.columns(["adapter_id", "status"])
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropIndex("idx__emdash_media_usage_index_status_status").ifExists().execute();
+	await db.schema.dropIndex("idx__emdash_media_usage_sources_fingerprint").ifExists().execute();
+	await db.schema.dropIndex("idx__emdash_media_usage_sources_completeness").ifExists().execute();
+	await db.schema.dropTable("_emdash_media_usage_index_status").ifExists().execute();
+
+	await dropSourceMetadataColumns(db);
+}
+
+async function addSourceMetadataColumns(db: Kysely<unknown>): Promise<void> {
+	await addColumnIfMissing(db, "source_updated_at", () =>
+		db.schema.alterTable(SOURCE_TABLE).addColumn("source_updated_at", "text").execute(),
+	);
+	await addColumnIfMissing(db, "source_version", () =>
+		db.schema.alterTable(SOURCE_TABLE).addColumn("source_version", "integer").execute(),
+	);
+	await addColumnIfMissing(db, "source_fingerprint", () =>
+		db.schema.alterTable(SOURCE_TABLE).addColumn("source_fingerprint", "text").execute(),
+	);
+	await addColumnIfMissing(db, "source_completeness", () =>
+		db.schema
+			.alterTable(SOURCE_TABLE)
+			.addColumn("source_completeness", "text", (c) => c.notNull().defaultTo("unknown"))
+			.execute(),
+	);
+	await addColumnIfMissing(db, "last_attempted_at", () =>
+		db.schema.alterTable(SOURCE_TABLE).addColumn("last_attempted_at", "text").execute(),
+	);
+	await addColumnIfMissing(db, "last_error_code", () =>
+		db.schema.alterTable(SOURCE_TABLE).addColumn("last_error_code", "text").execute(),
+	);
+}
+
+async function addColumnIfMissing(
+	db: Kysely<unknown>,
+	columnName: string,
+	addColumn: () => Promise<void>,
+): Promise<void> {
+	if (await columnExists(db, SOURCE_TABLE, columnName)) return;
+
+	try {
+		await addColumn();
+	} catch (error) {
+		if (DUPLICATE_COLUMN_RE.test(deepErrorMessage(error))) {
+			if (await columnExists(db, SOURCE_TABLE, columnName)) return;
+		}
+		throw error;
+	}
+}
+
+function deepErrorMessage(error: unknown): string {
+	if (error instanceof Error) {
+		const own = error.message ?? "";
+		if (error.cause) {
+			const causeMessage = deepErrorMessage(error.cause);
+			return own ? `${own}: ${causeMessage}` : causeMessage;
+		}
+		return own;
+	}
+	if (typeof error === "string") return error;
+	try {
+		return JSON.stringify(error);
+	} catch {
+		return String(error);
+	}
+}
+
+async function dropSourceMetadataColumns(db: Kysely<unknown>): Promise<void> {
+	for (const columnName of [
+		"last_error_code",
+		"last_attempted_at",
+		"source_completeness",
+		"source_fingerprint",
+		"source_version",
+		"source_updated_at",
+	] as const) {
+		if (await columnExists(db, SOURCE_TABLE, columnName)) {
+			await db.schema.alterTable(SOURCE_TABLE).dropColumn(columnName).execute();
+		}
+	}
+}

package/src/database/migrations/runner.ts

@@ -50,6 +50,8 @@ import * as m045 from "./045_taxonomy_parent_group.js";
 import * as m046 from "./046_media_usage_index.js";
 import * as m047 from "./047_restore_taxonomy_parent_index.js";
 import * as m048 from "./048_restore_content_taxonomies_term_index.js";
+import * as m049 from "./049_taxonomies_name_locale_index.js";
+import * as m050 from "./050_media_usage_index_status.js";
 
 const MIGRATIONS: Readonly<Record<string, Migration>> = Object.freeze({
 	"001_initial": m001,
@@ -99,6 +101,8 @@ const MIGRATIONS: Readonly<Record<string, Migration>> = Object.freeze({
 	"046_media_usage_index": m046,
 	"047_restore_taxonomy_parent_index": m047,
 	"048_restore_content_taxonomies_term_index": m048,
+	"049_taxonomies_name_locale_index": m049,
+	"050_media_usage_index_status": m050,
 });
 
 /** Total number of registered migrations. Exported for use in tests. */