emdash 0.28.1 → 0.30.0

package/dist/astro/middleware/request-context.mjs

@@ -1,11 +1,131 @@
 import "../../after-B1IIdH3Y.mjs";
 import { getRequestContext, runWithContext } from "../../request-context.mjs";
-import "../../base64-CmWvODNW.mjs";
-import "../../options-DTTML-Tx.mjs";
-import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-BGT0TUUo.mjs";
-import { i as resolveSecretsCached } from "../../secrets-kp760LlD.mjs";
+import "../../base64-B-PsqheR.mjs";
+import "../../options-BlmBHTvX.mjs";
+import { n as parseContentId, r as verifyPreviewToken } from "../../tokens-DVltpO2D.mjs";
+import { i as resolveSecretsCached } from "../../secrets-CSwQIl4q.mjs";
 import { defineMiddleware } from "astro:middleware";
+import virtualConfig from "virtual:emdash/config";
 
+//#region src/visual-editing/toolbar-bootstrap.ts
+/**
+* EmDash Toolbar Bootstrap (toolbar: "client")
+*
+* A tiny script injected into every public HTML response when the client
+* toolbar mode is enabled. It is identical for every visitor, so the HTML
+* stays fully cacheable by shared caches (Workers Cache, Cache Everything,
+* Fastly, Varnish, …).
+*
+* Behavior: if this browser has logged into the admin (non-secret
+* localStorage flag set by the admin SPA), render a small "Edit" pill.
+* Clicking it verifies the session server-side and reloads the page with the
+* `_edit` query param — that URL is always rendered fresh with the full
+* server-side toolbar. Logged-out browsers pay one localStorage read and
+* nothing else. See Discussion #1742.
+*/
+/**
+* Non-secret localStorage flag set by the admin SPA when an editor session
+* exists in this browser. It only means "a session may exist" — the click
+* handler verifies the real session before entering edit mode. The literal
+* is duplicated in `@emdash-cms/admin` (Shell/Header), which cannot import
+* from core.
+*/
+const EDITOR_FLAG_KEY = "emdash-editor";
+/**
+* localStorage flag set when the user dismisses the toolbar in this browser.
+* Cleared the next time an editor opens the admin. Also duplicated in
+* `@emdash-cms/admin`.
+*/
+const TOOLBAR_DISMISSED_KEY = "emdash-toolbar-dismissed";
+/**
+* Query param that requests a fresh (never cached) editor render. Presence is
+* verified server-side: non-editors are redirected to the canonical URL.
+*/
+const EDIT_PARAM = "_edit";
+function renderToolbarBootstrap() {
+	return `
+<!-- EmDash Toolbar Bootstrap -->
+<script>
+(function() {
+  var flag, dismissed;
+  try {
+    flag = localStorage.getItem("${EDITOR_FLAG_KEY}");
+    dismissed = localStorage.getItem("${TOOLBAR_DISMISSED_KEY}");
+  } catch (e) {
+    return;
+  }
+  if (!flag || dismissed) return;
+  // The server toolbar is present on _edit / edit-mode / preview renders.
+  if (document.getElementById("emdash-toolbar")) return;
+
+  var root = document.createElement("div");
+  root.id = "emdash-toolbar-bootstrap";
+  root.style.cssText = "position:fixed;bottom:16px;left:50%;transform:translateX(-50%);z-index:999999;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;font-size:13px;line-height:1;-webkit-font-smoothing:antialiased;";
+
+  var inner = document.createElement("div");
+  inner.style.cssText = "display:flex;align-items:center;gap:10px;padding:8px 16px;background:#1a1a1a;color:#e0e0e0;border-radius:999px;box-shadow:0 4px 24px rgba(0,0,0,0.3),0 0 0 1px rgba(255,255,255,0.08);white-space:nowrap;user-select:none;";
+
+  var logo = document.createElement("span");
+  logo.textContent = "EmDash";
+  logo.style.cssText = "font-weight:600;font-size:12px;letter-spacing:0.02em;color:#fff;opacity:0.7;";
+
+  var divider = document.createElement("span");
+  divider.style.cssText = "width:1px;height:16px;background:rgba(255,255,255,0.15);";
+
+  var editBtn = document.createElement("button");
+  editBtn.textContent = "Edit";
+  editBtn.style.cssText = "padding:4px 12px;background:#3b82f6;color:#fff;border:none;border-radius:999px;font-size:12px;font-weight:600;cursor:pointer;font-family:inherit;";
+
+  var closeBtn = document.createElement("button");
+  closeBtn.textContent = "\\u00d7";
+  closeBtn.title = "Hide toolbar";
+  closeBtn.setAttribute("aria-label", "Hide toolbar");
+  closeBtn.style.cssText = "background:none;border:none;color:#666;cursor:pointer;font-size:16px;padding:0 2px;line-height:1;font-family:inherit;";
+
+  editBtn.addEventListener("click", function() {
+    editBtn.disabled = true;
+    fetch("/_emdash/api/auth/me", {
+      credentials: "same-origin",
+      headers: { "X-EmDash-Request": "1" }
+    })
+    .then(function(r) { return r.ok ? r.json() : null; })
+    .then(function(body) {
+      var user = body && body.data;
+      if (user && user.role >= 30) {
+        var u = new URL(location.href);
+        u.searchParams.set("${EDIT_PARAM}", "1");
+        location.href = u.toString();
+      } else if (user) {
+        // Logged in but not an editor — the flag is stale for this browser.
+        try { localStorage.removeItem("${EDITOR_FLAG_KEY}"); } catch (e) {}
+        root.remove();
+      } else {
+        // No session — go to the admin login page.
+        location.href = "/_emdash/admin/login";
+      }
+    })
+    .catch(function() {
+      editBtn.disabled = false;
+    });
+  });
+
+  closeBtn.addEventListener("click", function() {
+    try { localStorage.setItem("${TOOLBAR_DISMISSED_KEY}", "1"); } catch (e) {}
+    root.remove();
+  });
+
+  inner.appendChild(logo);
+  inner.appendChild(divider);
+  inner.appendChild(editBtn);
+  inner.appendChild(closeBtn);
+  root.appendChild(inner);
+  document.body.appendChild(root);
+})();
+<\/script>
+`;
+}
+
+//#endregion
 //#region src/visual-editing/toolbar.ts
 function renderToolbar(config) {
 	const { editMode, isPreview } = config;
@@ -34,6 +154,8 @@ function renderToolbar(config) {
     </a>
 
     <button class="emdash-tb-publish" id="emdash-tb-publish" style="display:none">Publish</button>
+
+    <button class="emdash-tb-dismiss" id="emdash-tb-dismiss" title="Hide toolbar" aria-label="Hide toolbar">&times;</button>
   </div>
 </div>
 
@@ -228,6 +350,23 @@ function renderToolbar(config) {
     cursor: not-allowed;
   }
 
+  /* Dismiss button */
+  .emdash-tb-dismiss {
+    background: none;
+    border: none;
+    color: #666;
+    cursor: pointer;
+    font-size: 16px;
+    line-height: 1;
+    padding: 0 2px;
+    font-family: inherit;
+    transition: color 0.15s;
+  }
+
+  .emdash-tb-dismiss:hover {
+    color: #fff;
+  }
+
   /* Edit mode: editable hover styles — uses :has() to check toolbar state */
   body:has(#emdash-toolbar[data-edit-mode="true"]) [data-emdash-ref] {
     transition: box-shadow 0.15s, background-color 0.15s;
@@ -513,8 +652,35 @@ function renderToolbar(config) {
   var publishBtn = document.getElementById("emdash-tb-publish");
   if (!toolbar || !toggle || !statusEl || !publishBtn || !saveStatusEl) return;
 
+  // Dismissed in this browser (localStorage flag, cleared on the next admin
+  // visit). Remove the toolbar entirely instead of rendering it.
+  try {
+    if (localStorage.getItem("emdash-toolbar-dismissed")) {
+      toolbar.remove();
+      return;
+    }
+  } catch (e) {
+    // localStorage unavailable — render normally
+  }
+
   var isEditMode = toolbar.getAttribute("data-edit-mode") === "true";
 
+  var dismissBtn = document.getElementById("emdash-tb-dismiss");
+  if (dismissBtn) {
+    dismissBtn.addEventListener("click", function() {
+      try { localStorage.setItem("emdash-toolbar-dismissed", "1"); } catch (e) {}
+      // Dismissing while edit mode is on would strand the user in edit mode
+      // with no UI to leave it — clear the cookie too.
+      if (isEditMode) {
+        document.cookie = "emdash-edit-mode=;path=/;expires=Thu, 01 Jan 1970 00:00:00 GMT";
+        toolbar.remove();
+        location.replace(location.href);
+        return;
+      }
+      toolbar.remove();
+    });
+  }
+
   // CSRF-protected fetch — adds X-EmDash-Request header to all API calls
   function ecFetch(url, init) {
     init = init || {};
@@ -679,7 +845,7 @@ function renderToolbar(config) {
     manifestPromise = ecFetch("/_emdash/api/manifest", { credentials: "same-origin" })
       .then(function(r) { return r.json(); })
       .then(function(m) {
-        // The manifest endpoint wraps the payload in a { data } envelope (ApiResponse shape).
+        // The manifest endpoint wraps the payload in a { success, data } envelope (ApiResponse shape).
         // Unwrap it so getFieldKind can read manifest.collections directly.
         manifestCache = m && m.data ? m.data : m;
         return manifestCache;
@@ -1302,32 +1468,78 @@ function renderToolbar(config) {
 
 //#endregion
 //#region src/astro/middleware/request-context.ts
+const toolbarMode = virtualConfig?.toolbar ?? "server";
 /**
-* EmDash Request Context Middleware
-*
-* Sets up AsyncLocalStorage-based request context for query functions.
-* Skips ALS entirely for logged-out users with no CMS signals (fast path).
-*
-* Handles:
-* - Preview tokens: _preview query param with signed HMAC token
-* - Edit mode: emdash-edit-mode cookie (for visual editing)
-* - Toolbar injection: floating pill for authenticated editors
+* Opt the current request out of Astro's route cache (e.g. Workers Cache on
+* Cloudflare). `Cache-Control` headers do NOT cover this: the adapter derives
+* the shared-cache TTL from the route-cache options (on Cloudflare via
+* `Cloudflare-CDN-Cache-Control`), so session-specific responses must
+* explicitly disable it or they get stored in the shared cache and served to
+* anonymous visitors without ever invoking the middleware again. With no cache
+* provider configured this is a no-op (`NoopAstroCache`/`DisabledAstroCache`).
 */
+function optOutOfRouteCache(cache) {
+	cache.set(false);
+}
+/**
+* Inject HTML before `</body>` if the response is an HTML page with a body
+* end tag. Does not touch cache headers — callers decide whether the result
+* is still shareable. `injected` tells the caller whether anything changed.
+*/
+async function injectBeforeBodyEnd(response, htmlToInject) {
+	if (!response.headers.get("content-type")?.includes("text/html")) return {
+		response,
+		injected: false
+	};
+	const html = await response.text();
+	if (!html.includes("</body>")) return {
+		response: new Response(html, response),
+		injected: false
+	};
+	const injected = html.replace("</body>", `${htmlToInject}</body>`);
+	return {
+		response: new Response(injected, {
+			status: response.status,
+			headers: response.headers
+		}),
+		injected: true
+	};
+}
 /**
 * Inject toolbar HTML into a response if it's an HTML page.
 * Returns the original response if not HTML.
 */
-async function injectToolbar(response, toolbarHtml) {
-	if (!response.headers.get("content-type")?.includes("text/html")) return response;
-	const html = await response.text();
-	if (!html.includes("</body>")) return new Response(html, response);
-	const injected = html.replace("</body>", `${toolbarHtml}</body>`);
-	const result = new Response(injected, {
-		status: response.status,
-		headers: response.headers
+async function injectToolbar(response, toolbarHtml, routeCache) {
+	const result = await injectBeforeBodyEnd(response, toolbarHtml);
+	if (result.injected) {
+		result.response.headers.set("Cache-Control", "private, no-store");
+		optOutOfRouteCache(routeCache);
+	}
+	return result.response;
+}
+/**
+* Inject the client-toolbar bootstrap script. Identical for every visitor, so
+* cache headers and route-cache options are left untouched and the response
+* stays fully shareable.
+*/
+async function injectBootstrap(response) {
+	return (await injectBeforeBodyEnd(response, renderToolbarBootstrap())).response;
+}
+/**
+* Redirect an `_edit` URL to its canonical form (same URL without the param).
+* Applied when the requester is not an authenticated editor, so a shared
+* `?_edit` link degrades gracefully for everyone else (Discussion #1742).
+*/
+function redirectToCanonical(url) {
+	const canonical = new URL(url);
+	canonical.searchParams.delete(EDIT_PARAM);
+	return new Response(null, {
+		status: 302,
+		headers: {
+			Location: canonical.pathname + canonical.search + canonical.hash,
+			"Cache-Control": "private, no-store"
+		}
 	});
-	result.headers.set("Cache-Control", "private, no-store");
-	return result;
 }
 const onRequest = defineMiddleware(async (context, next) => {
 	const { cookies, url } = context;
@@ -1342,9 +1554,18 @@ const onRequest = defineMiddleware(async (context, next) => {
 	}, () => next());
 	const hasEditCookie = cookies.get("emdash-edit-mode")?.value === "true";
 	const hasPreviewToken = url.searchParams.has("_preview");
-	if (!hasEditCookie && !hasPreviewToken && !isEditor) return next();
+	const hasEditParam = toolbarMode === "client" && url.searchParams.has(EDIT_PARAM);
+	if (hasEditParam) {
+		optOutOfRouteCache(context.cache);
+		if (!isEditor) return redirectToCanonical(url);
+	}
+	if (!hasEditCookie && !hasPreviewToken && !isEditor) {
+		if (toolbarMode === "client") return injectBootstrap(await next());
+		return next();
+	}
 	const editMode = hasEditCookie && isEditor;
 	const locale = context.currentLocale;
+	const routeCache = context.cache;
 	let preview;
 	if (hasPreviewToken) {
 		const db = context.locals.emdash?.db;
@@ -1370,23 +1591,29 @@ const onRequest = defineMiddleware(async (context, next) => {
 		locale
 	}, async () => {
 		let response = await next();
+		if (hasPreviewToken) optOutOfRouteCache(routeCache);
 		if (preview) {
 			response = new Response(response.body, response);
 			response.headers.set("Cache-Control", "private, no-store");
 		}
-		if (isEditor) {
+		if (isEditor && toolbarMode !== false) {
 			const toolbarHtml = renderToolbar({
 				editMode,
 				isPreview: !!preview
 			});
-			return injectToolbar(response, toolbarHtml);
+			return injectToolbar(response, toolbarHtml, routeCache);
 		}
+		if (toolbarMode === "client" && !isEditor && !preview) return injectBootstrap(response);
 		return response;
 	});
-	if (isEditor) return injectToolbar(await next(), renderToolbar({
-		editMode: false,
-		isPreview: false
-	}));
+	if (isEditor) {
+		if (toolbarMode === false) return next();
+		if (toolbarMode === "client" && !hasEditParam) return injectBootstrap(await next());
+		return injectToolbar(await next(), renderToolbar({
+			editMode: false,
+			isPreview: false
+		}), routeCache);
+	}
 	return next();
 });