emdash 0.28.1 → 0.30.0

package/src/api/handlers/relations.ts

@@ -0,0 +1,474 @@
+import type { Kysely } from "kysely";
+
+import { ContentRepository } from "../../database/repositories/content.js";
+import {
+	RelationRepository,
+	type ContentReference,
+	type CreateRelationInput,
+	type Relation,
+} from "../../database/repositories/relation.js";
+import { InvalidCursorError } from "../../database/repositories/types.js";
+import type { ContentItem } from "../../database/repositories/types.js";
+import type { Database } from "../../database/types.js";
+import { SchemaRegistry } from "../../schema/registry.js";
+import type { ApiResult } from "../types.js";
+
+/** Map an edge-read failure: a bad pagination cursor is a 400 client error,
+ * everything else is the generic 500-shaped reference-read error. */
+function referencesGetError(error: unknown): ApiResult<never> {
+	if (error instanceof InvalidCursorError) {
+		return { success: false, error: { code: "INVALID_CURSOR", message: error.message } };
+	}
+	return {
+		success: false,
+		error: { code: "REFERENCES_GET_ERROR", message: "Failed to get references" },
+	};
+}
+
+/** True for SQLite UNIQUE / Postgres unique_violation messages (matches the
+ * fingerprint used in the content handlers). Narrow enough not to catch NOT
+ * NULL / CHECK violations whose messages also say "constraint". */
+function isUniqueViolation(error: unknown): boolean {
+	const message = error instanceof Error ? error.message.toLowerCase() : "";
+	return message.includes("unique constraint failed") || message.includes("duplicate key");
+}
+
+export async function handleRelationCreate(
+	db: Kysely<Database>,
+	input: CreateRelationInput,
+): Promise<ApiResult<{ relation: Relation }>> {
+	try {
+		const repo = new RelationRepository(db);
+
+		// Invariant: a relation must point at collections that exist. There is no
+		// SQL FK (group-linking precludes it), so a ghost collection would yield a
+		// structurally-valid-but-permanently-useless relation. Skip when
+		// `translationOf` is set — structural fields are then inherited from an
+		// already-validated source, and the input collections are ignored.
+		if (!input.translationOf) {
+			if (!input.parentCollection || !input.childCollection) {
+				return {
+					success: false,
+					error: {
+						code: "VALIDATION_ERROR",
+						message:
+							"parentCollection and childCollection are required unless translationOf is set",
+					},
+				};
+			}
+			const registry = new SchemaRegistry(db);
+			for (const collection of [input.parentCollection, input.childCollection]) {
+				if (!(await registry.getCollection(collection))) {
+					return {
+						success: false,
+						error: {
+							code: "COLLECTION_NOT_FOUND",
+							message: `Collection '${collection}' not found`,
+						},
+					};
+				}
+			}
+		}
+
+		const relation = await repo.create(input);
+		return { success: true, data: { relation } };
+	} catch (error) {
+		// A bad `translationOf` makes the repo throw loudly rather than mint an
+		// unlinked relation — surface it as 404, not a generic 500.
+		if (
+			error instanceof Error &&
+			error.message.includes("Source relation for translation not found")
+		) {
+			return {
+				success: false,
+				error: { code: "NOT_FOUND", message: "Source relation for translation not found" },
+			};
+		}
+		// UNIQUE(name, locale) collision, or a second translation for an
+		// already-present (translation_group, locale) — both are client conflicts.
+		if (isUniqueViolation(error)) {
+			return {
+				success: false,
+				error: {
+					code: "CONFLICT",
+					message: "A relation with this name or locale already exists",
+				},
+			};
+		}
+		return {
+			success: false,
+			error: { code: "RELATION_CREATE_ERROR", message: "Failed to create relation" },
+		};
+	}
+}
+
+export async function handleRelationGet(
+	db: Kysely<Database>,
+	id: string,
+): Promise<ApiResult<{ relation: Relation }>> {
+	try {
+		const repo = new RelationRepository(db);
+		const relation = await repo.findById(id);
+		if (!relation) {
+			return { success: false, error: { code: "NOT_FOUND", message: "Relation not found" } };
+		}
+		return { success: true, data: { relation } };
+	} catch {
+		return {
+			success: false,
+			error: { code: "RELATION_GET_ERROR", message: "Failed to get relation" },
+		};
+	}
+}
+
+export async function handleRelationList(
+	db: Kysely<Database>,
+	opts: { locale?: string },
+): Promise<ApiResult<{ relations: Relation[] }>> {
+	try {
+		const repo = new RelationRepository(db);
+		const relations = await repo.list(opts.locale);
+		return { success: true, data: { relations } };
+	} catch {
+		return {
+			success: false,
+			error: { code: "RELATION_LIST_ERROR", message: "Failed to list relations" },
+		};
+	}
+}
+
+export async function handleRelationUpdate(
+	db: Kysely<Database>,
+	id: string,
+	input: { parentLabel?: string; childLabel?: string },
+): Promise<ApiResult<{ relation: Relation }>> {
+	try {
+		const repo = new RelationRepository(db);
+		const relation = await repo.update(id, input);
+		if (!relation) {
+			return { success: false, error: { code: "NOT_FOUND", message: "Relation not found" } };
+		}
+		return { success: true, data: { relation } };
+	} catch {
+		return {
+			success: false,
+			error: { code: "RELATION_UPDATE_ERROR", message: "Failed to update relation" },
+		};
+	}
+}
+
+export async function handleRelationDelete(
+	db: Kysely<Database>,
+	id: string,
+): Promise<ApiResult<{ deleted: true }>> {
+	try {
+		const repo = new RelationRepository(db);
+		const deleted = await repo.delete(id);
+		if (!deleted) {
+			return { success: false, error: { code: "NOT_FOUND", message: "Relation not found" } };
+		}
+		return { success: true, data: { deleted: true } };
+	} catch {
+		return {
+			success: false,
+			error: { code: "RELATION_DELETE_ERROR", message: "Failed to delete relation" },
+		};
+	}
+}
+
+export async function handleRelationTranslations(
+	db: Kysely<Database>,
+	id: string,
+): Promise<
+	ApiResult<{
+		translationGroup: string;
+		translations: {
+			id: string;
+			name: string;
+			locale: string;
+			parentLabel: string;
+			childLabel: string;
+		}[];
+	}>
+> {
+	try {
+		const repo = new RelationRepository(db);
+		const relation = await repo.findById(id);
+		if (!relation) {
+			return { success: false, error: { code: "NOT_FOUND", message: "Relation not found" } };
+		}
+		const siblings = await repo.findTranslations(relation.translationGroup);
+		return {
+			success: true,
+			data: {
+				translationGroup: relation.translationGroup,
+				translations: siblings.map((r) => ({
+					id: r.id,
+					name: r.name,
+					locale: r.locale,
+					parentLabel: r.parentLabel,
+					childLabel: r.childLabel,
+				})),
+			},
+		};
+	} catch {
+		return {
+			success: false,
+			error: { code: "RELATION_TRANSLATIONS_ERROR", message: "Failed to get translations" },
+		};
+	}
+}
+
+export type EntryRef = {
+	id: string;
+	slug: string | null;
+	collection: string;
+	/** The actual locale of the resolved variant — see `pickVariant`. */
+	locale: string | null;
+	sortOrder?: number;
+};
+
+/** Resolve a relation from an id OR its translation_group. */
+async function resolveRelation(
+	repo: RelationRepository,
+	idOrGroup: string,
+): Promise<Relation | null> {
+	const byId = await repo.findById(idOrGroup);
+	if (byId) return byId;
+	const group = await repo.findTranslations(idOrGroup);
+	return group[0] ?? null;
+}
+
+/**
+ * Pick the locale variant matching `locale`, falling back to the first entry
+ * (lowest locale code). The fallback is intentional — an edge is keyed by
+ * `translation_group`, so a referenced entry that exists only in another locale
+ * is still a real reference — but the returned ref carries the variant's actual
+ * `locale` so callers never mistake a fallback for the requested locale.
+ */
+function pickVariant(items: ContentItem[], locale: string | null): ContentItem | undefined {
+	return items.find((i) => i.locale === locale) ?? items[0];
+}
+
+/**
+ * Resolve edge groups to loadable entries in `collection` at `locale`.
+ * Dangling groups (no surviving entry) are skipped — cleanup is a later slice.
+ *
+ * All groups are loaded in one batched query (chunked at `SQL_BATCH_SIZE`)
+ * rather than a `findTranslations` per edge, so a parent with N children costs
+ * a constant number of queries, not N+1. Edge order (the caller's `sort_order`)
+ * is preserved by iterating `edges`.
+ *
+ * `includeDrafts` is false for callers without `content:read_drafts`: the load
+ * is restricted to published entries so a draft/scheduled entry referenced by an
+ * edge is skipped exactly like a dangling one, never leaking its id/slug/locale.
+ */
+async function resolveEntries(
+	content: ContentRepository,
+	collection: string,
+	edges: ContentReference[],
+	pick: (e: ContentReference) => string,
+	locale: string | null,
+	includeDrafts: boolean,
+): Promise<EntryRef[]> {
+	const groups = edges.map(pick);
+	const all = await content.findTranslationsForGroups(collection, groups, {
+		publishedOnly: !includeDrafts,
+	});
+
+	// Group the flat variant list by translation_group so each edge can pick its
+	// own locale variant.
+	const variantsByGroup = new Map<string, ContentItem[]>();
+	for (const item of all) {
+		if (item.translationGroup == null) continue;
+		const list = variantsByGroup.get(item.translationGroup);
+		if (list) list.push(item);
+		else variantsByGroup.set(item.translationGroup, [item]);
+	}
+
+	const refs: EntryRef[] = [];
+	for (const edge of edges) {
+		const variants = variantsByGroup.get(pick(edge));
+		if (!variants) continue;
+		const entry = pickVariant(variants, locale);
+		if (!entry) continue;
+		refs.push({
+			id: entry.id,
+			slug: entry.slug,
+			collection,
+			locale: entry.locale,
+			sortOrder: edge.sortOrder,
+		});
+	}
+	return refs;
+}
+
+/** Pagination inputs for the edge read endpoints. */
+export type PageOptions = { limit?: number; cursor?: string };
+
+export async function handleReferenceChildrenGet(
+	db: Kysely<Database>,
+	collection: string,
+	entryId: string,
+	relation: string,
+	page: PageOptions = {},
+	includeDrafts = false,
+): Promise<ApiResult<{ children: EntryRef[]; nextCursor?: string }>> {
+	try {
+		const repo = new RelationRepository(db);
+		const content = new ContentRepository(db);
+
+		const rel = await resolveRelation(repo, relation);
+		if (!rel)
+			return { success: false, error: { code: "NOT_FOUND", message: "Relation not found" } };
+		if (collection !== rel.parentCollection) {
+			return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: "Entry is not the parent side of this relation",
+				},
+			};
+		}
+
+		const entry = await content.findByIdOrSlug(collection, entryId);
+		// A caller without draft access must not anchor on a non-published entry —
+		// return NOT_FOUND (not 403) so they can't probe draft ids by status code,
+		// mirroring the single-item content read.
+		if (!entry?.translationGroup || (!includeDrafts && entry.status !== "published")) {
+			return { success: false, error: { code: "NOT_FOUND", message: "Content entry not found" } };
+		}
+
+		const edges = await repo.getChildrenPage(rel.translationGroup, entry.translationGroup, page);
+		const children = await resolveEntries(
+			content,
+			rel.childCollection,
+			edges.items,
+			(e) => e.childGroup,
+			entry.locale,
+			includeDrafts,
+		);
+		return { success: true, data: { children, nextCursor: edges.nextCursor } };
+	} catch (error) {
+		return referencesGetError(error);
+	}
+}
+
+export async function handleReferenceChildrenSet(
+	db: Kysely<Database>,
+	collection: string,
+	entryId: string,
+	relation: string,
+	childIds: string[],
+): Promise<ApiResult<{ children: EntryRef[]; nextCursor?: string }>> {
+	try {
+		const repo = new RelationRepository(db);
+		const content = new ContentRepository(db);
+
+		const rel = await resolveRelation(repo, relation);
+		if (!rel)
+			return { success: false, error: { code: "NOT_FOUND", message: "Relation not found" } };
+		if (collection !== rel.parentCollection) {
+			return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: "Entry is not the parent side of this relation",
+				},
+			};
+		}
+
+		const entry = await content.findByIdOrSlug(collection, entryId);
+		if (!entry?.translationGroup) {
+			return { success: false, error: { code: "NOT_FOUND", message: "Content entry not found" } };
+		}
+
+		// Resolve every child within the relation's child_collection in one batch
+		// (constant queries, not an N+1 of point lookups for a set up to 1000). A
+		// child id that does not resolve there fails collection-agreement
+		// (invariant 3); order is preserved by iterating the caller's `childIds`.
+		const resolvedChildren = await content.findManyByIdOrSlug(rel.childCollection, childIds);
+		const childGroups: string[] = [];
+		for (const childId of childIds) {
+			const child = resolvedChildren.get(childId);
+			if (!child?.translationGroup) {
+				return {
+					success: false,
+					error: {
+						code: "NOT_FOUND",
+						message: `Child entry '${childId}' not found in ${rel.childCollection}`,
+					},
+				};
+			}
+			childGroups.push(child.translationGroup);
+		}
+
+		await repo.setChildren(rel.translationGroup, entry.translationGroup, childGroups);
+
+		// Return the first page of the new set, mirroring the GET shape. The actor
+		// holds an edit permission (gated by the route), so draft children are
+		// included in the echo.
+		const edges = await repo.getChildrenPage(rel.translationGroup, entry.translationGroup);
+		const children = await resolveEntries(
+			content,
+			rel.childCollection,
+			edges.items,
+			(e) => e.childGroup,
+			entry.locale,
+			true,
+		);
+		return { success: true, data: { children, nextCursor: edges.nextCursor } };
+	} catch {
+		return {
+			success: false,
+			error: { code: "REFERENCES_SET_ERROR", message: "Failed to set references" },
+		};
+	}
+}
+
+export async function handleReferenceParentsGet(
+	db: Kysely<Database>,
+	collection: string,
+	entryId: string,
+	relation: string,
+	page: PageOptions = {},
+	includeDrafts = false,
+): Promise<ApiResult<{ parents: EntryRef[]; nextCursor?: string }>> {
+	try {
+		const repo = new RelationRepository(db);
+		const content = new ContentRepository(db);
+
+		const rel = await resolveRelation(repo, relation);
+		if (!rel)
+			return { success: false, error: { code: "NOT_FOUND", message: "Relation not found" } };
+		if (collection !== rel.childCollection) {
+			return {
+				success: false,
+				error: {
+					code: "VALIDATION_ERROR",
+					message: "Entry is not the child side of this relation",
+				},
+			};
+		}
+
+		const entry = await content.findByIdOrSlug(collection, entryId);
+		// Same draft-anchor guard as the children read: a non-draft-reader anchoring
+		// on an unpublished entry gets NOT_FOUND, not its backlinks.
+		if (!entry?.translationGroup || (!includeDrafts && entry.status !== "published")) {
+			return { success: false, error: { code: "NOT_FOUND", message: "Content entry not found" } };
+		}
+
+		const edges = await repo.getParentsPage(rel.translationGroup, entry.translationGroup, page);
+		const parents = await resolveEntries(
+			content,
+			rel.parentCollection,
+			edges.items,
+			(e) => e.parentGroup,
+			entry.locale,
+			includeDrafts,
+		);
+		return { success: true, data: { parents, nextCursor: edges.nextCursor } };
+	} catch (error) {
+		return referencesGetError(error);
+	}
+}

package/src/api/handlers/snapshot.ts

@@ -218,10 +218,19 @@ interface ColumnInfo {
 }
 
 export interface GenerateSnapshotOptions {
-	/** Include draft and trashed content (default: false) */
+	/** Include draft and scheduled content (default: false) */
 	includeDrafts?: boolean;
+	/** Include trashed content (deleted_at set). Used by backups (default: false) */
+	includeTrashed?: boolean;
 	/** Origin URL for absolutizing local media URLs (e.g. "https://mysite.com") */
 	origin?: string;
+	/**
+	 * Allowlist of options-table key prefixes to include (default:
+	 * `SAFE_OPTIONS_PREFIXES`). Callers widening this must never include a
+	 * prefix that matches secrets (`emdash:preview_secret`, `plugin:`,
+	 * `emdash:passkey_pending:`) — the output may be user-downloadable.
+	 */
+	optionPrefixes?: string[];
 }
 
 /**
@@ -235,6 +244,8 @@ export async function generateSnapshot(
 	options?: GenerateSnapshotOptions,
 ): Promise<Snapshot> {
 	const includeDrafts = options?.includeDrafts ?? false;
+	const includeTrashed = options?.includeTrashed ?? false;
+	const optionPrefixes = options?.optionPrefixes ?? SAFE_OPTIONS_PREFIXES;
 
 	// Discover all ec_* content tables
 	const tableResult = await sql<{ name: string }>`
@@ -280,7 +291,14 @@ export async function generateSnapshot(
 			let rows: Record<string, unknown>[];
 
 			if (tableName.startsWith("ec_")) {
-				if (includeDrafts) {
+				if (includeTrashed) {
+					// Everything, including trash — full-fidelity backup export
+					rows = (
+						await sql<Record<string, unknown>>`
+						SELECT * FROM ${sql.raw(`"${tableName}"`)}
+					`.execute(db)
+					).rows;
+				} else if (includeDrafts) {
 					// Include all non-deleted content (published, draft, scheduled)
 					rows = (
 						await sql<Record<string, unknown>>`
@@ -307,7 +325,7 @@ export async function generateSnapshot(
 				`.execute(db)
 				).rows.filter((row) => {
 					const name = typeof row.name === "string" ? row.name : "";
-					return SAFE_OPTIONS_PREFIXES.some((prefix) => name.startsWith(prefix));
+					return optionPrefixes.some((prefix) => name.startsWith(prefix));
 				});
 			} else {
 				rows = (

package/src/api/handlers/taxonomies.ts

@@ -13,6 +13,7 @@ import { ulid } from "ulidx";
 import { TaxonomyRepository } from "../../database/repositories/taxonomy.js";
 import type { Database, TaxonomyDefTable } from "../../database/types.js";
 import { invalidateTaxonomyDefsCache, invalidateTermCache } from "../../taxonomies/index.js";
+import { fetchVisibleTermCounts } from "../../taxonomies/term-counts.js";
 import type { ApiResult } from "../types.js";
 
 const NAME_PATTERN = /^[a-z][a-z0-9_]*$/;
@@ -141,6 +142,13 @@ async function requireTaxonomyDef(
 	return { success: true, def };
 }
 
+/** Declared collections of a taxonomy def row (deduped, parsed from JSON). */
+function defCollections(def: Selectable<TaxonomyDefTable>): string[] {
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- column stores a JSON string[] written by handleTaxonomyCreate
+	const parsed = def.collections ? (JSON.parse(def.collections) as string[]) : [];
+	return [...new Set(parsed)];
+}
+
 function rowToDef(row: Selectable<TaxonomyDefTable>): TaxonomyDef {
 	return {
 		id: row.id,
@@ -384,11 +392,16 @@ export async function handleTermList(
 		const repo = new TaxonomyRepository(db);
 		const terms = await repo.findByName(taxonomyName, { locale: options.locale });
 
-		// Batch count entries per term in a single query (replaces N+1 pattern).
+		// Counts match what visitors see on the public site: published (or
+		// scheduled-and-due) entries that aren't soft-deleted, scoped to the
+		// taxonomy's declared collections — one query for the whole list.
 		// content_taxonomies.taxonomy_id stores the translation_group, so we
 		// look up by group and map back to each term's id.
-		const groups = terms.map((t) => t.translationGroup ?? t.id);
-		const countsByGroup = await repo.countEntriesForTerms(groups);
+		const countsByGroup = await fetchVisibleTermCounts(
+			db,
+			taxonomyName,
+			defCollections(lookup.def),
+		);
 
 		const termData: TermWithCount[] = terms.map((term) => ({
 			id: term.id,
@@ -634,7 +647,16 @@ export async function handleTermGet(
 			};
 		}
 
-		const count = await repo.countEntriesWithTerm(term.id);
+		// Count matches public visibility (published or scheduled-and-due, not
+		// soft-deleted) scoped to the def's declared collections. The def lookup
+		// is lenient: a term whose def is missing still resolves, with count 0.
+		const lookup = await requireTaxonomyDef(db, taxonomyName);
+		const counts = await fetchVisibleTermCounts(
+			db,
+			taxonomyName,
+			lookup.success ? defCollections(lookup.def) : [],
+		);
+		const count = counts.get(term.translationGroup ?? term.id) ?? 0;
 		// Children share this term's translation_group as their parent_id; scope
 		// to the term's own locale so the response stays within one locale's tree.
 		const children = await repo.findChildren(term.id, term.locale);

package/src/api/handlers/validate-media-fields.ts

@@ -21,7 +21,7 @@ interface MediaRefValue {
 function asMediaRef(value: unknown): MediaRefValue | null {
 	if (value === null || value === undefined) return null;
 	if (typeof value !== "object" || Array.isArray(value)) return null;
-	return value as MediaRefValue;
+	return value;
 }
 
 function fail(message: string): ApiResult<never> {