emdash 0.38.0 → 0.39.0

package/src/astro/routes/api/admin/plugins/updates.ts

@@ -18,6 +18,8 @@ import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess } from "#api/error.js";
 import { handleMarketplaceUpdateCheck, handleRegistryUpdateCheck } from "#api/index.js";
 
+import { getRegistryConfigInput } from "../../../../../registry/config.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ locals }) => {
@@ -39,7 +41,10 @@ export const GET: APIRoute = async ({ locals }) => {
 			console.warn("[plugins/updates] marketplace check threw:", err);
 			return null;
 		}),
-		handleRegistryUpdateCheck(emdash.db, emdash.config.experimental?.registry).catch((err) => {
+		handleRegistryUpdateCheck(
+			emdash.db,
+			getRegistryConfigInput(emdash.config.registry, emdash.config.experimental?.registry),
+		).catch((err) => {
 			console.warn("[plugins/updates] registry check threw:", err);
 			return null;
 		}),

package/src/astro/routes/api/admin/scheduled-policy-rejections/[collection]/[id].ts

@@ -0,0 +1,34 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { OptionsRepository } from "#db/repositories/options.js";
+import { scheduledPolicyRejectionKey } from "#plugins/content-policy.js";
+
+export const prerender = false;
+
+export const DELETE: APIRoute = async ({ params, locals, url }) => {
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "content:publish_any");
+	if (denied) return denied;
+	if (!emdash?.db) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+
+	try {
+		const revision = url.searchParams.get("rev");
+		if (!revision) return apiError("INVALID_INPUT", "Rejection revision is required", 400);
+		const result = await new OptionsRepository(emdash.db).compareAndDelete(
+			scheduledPolicyRejectionKey(params.collection!, params.id!),
+			revision,
+		);
+		if (!result.applied) {
+			return apiError("CONFLICT", "Scheduled publication rejection has changed", 409);
+		}
+		return apiSuccess({ dismissed: true });
+	} catch (error) {
+		return handleError(
+			error,
+			"Failed to dismiss scheduled publication rejection",
+			"POLICY_REJECTION_DISMISS_ERROR",
+		);
+	}
+};

package/src/astro/routes/api/comments/[collection]/[contentId]/index.ts

@@ -7,19 +7,9 @@
 
 import type { APIRoute } from "astro";
 
-import { apiError, apiSuccess, handleError, requireDb, unwrapResult } from "#api/error.js";
-import { handleCommentList, checkRateLimit, hashIp } from "#api/handlers/comments.js";
-import { isParseError, parseBody } from "#api/parse.js";
-import { createCommentBody } from "#api/schemas.js";
-import { getSiteBaseUrl } from "#api/site-url.js";
-import { sendCommentNotification } from "#comments/notifications.js";
-import { createComment, type CommentHookRunner } from "#comments/service.js";
-import { getTurnstileSecretKey, verifyTurnstileToken } from "#comments/turnstile.js";
-import { resolveSecretsCached } from "#config/secrets.js";
-import { CommentRepository } from "#db/repositories/comment.js";
-import { validateIdentifier } from "#db/validate.js";
-import { extractRequestMeta } from "#plugins/request-meta.js";
-import type { CollectionCommentSettings, ModerationDecision } from "#plugins/types.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleCommentList } from "#api/handlers/comments.js";
+import { submitPublicComment } from "#comments/public-submission.js";
 
 export const prerender = false;
 
@@ -82,250 +72,5 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
-
-	try {
-		// Parse and validate input
-		const body = await parseBody(request, createCommentBody);
-		if (isParseError(body)) return body;
-
-		// Check collection exists and has comments enabled
-		const collectionRow = await emdash.db
-			.selectFrom("_emdash_collections")
-			.select([
-				"comments_enabled",
-				"comments_moderation",
-				"comments_closed_after_days",
-				"comments_auto_approve_users",
-			])
-			.where("slug", "=", collection)
-			.executeTakeFirst();
-
-		if (!collectionRow) {
-			return apiError("NOT_FOUND", `Collection '${collection}' not found`, 404);
-		}
-
-		if (!collectionRow.comments_enabled) {
-			return apiError("COMMENTS_DISABLED", "Comments are not enabled for this collection", 403);
-		}
-
-		// Verify the content item exists, is published, and not soft-deleted
-		validateIdentifier(collection, "collection");
-		const contentRow = await emdash.db
-			.selectFrom(`ec_${collection}` as never)
-			.select(["id" as never, "slug" as never, "author_id" as never, "published_at" as never])
-			.where("id" as never, "=", contentId as never)
-			.where("status" as never, "=", "published" as never)
-			.where("deleted_at" as never, "is", null as never)
-			.executeTakeFirst();
-
-		if (!contentRow) {
-			return apiError("NOT_FOUND", "Content not found", 404);
-		}
-
-		// Check if comments are closed (published_at + closed_after_days)
-		if (collectionRow.comments_closed_after_days > 0) {
-			const publishedAt = (contentRow as { published_at: string | null }).published_at;
-			if (publishedAt) {
-				const closedDate = new Date(publishedAt);
-				closedDate.setDate(closedDate.getDate() + collectionRow.comments_closed_after_days);
-				if (new Date() > closedDate) {
-					return apiError("COMMENTS_CLOSED", "Comments are closed for this content", 403);
-				}
-			}
-		}
-
-		// Anti-spam: Honeypot — hidden field filled only by bots
-		if (body.website_url) {
-			// Silently accept — don't reveal the honeypot to bots
-			return apiSuccess({ status: "pending", message: "Comment submitted for review" });
-		}
-
-		// Anti-spam: Rate limiting
-		const meta = extractRequestMeta(request, emdash.config);
-		const { ipSalt } = await resolveSecretsCached(emdash.db);
-		let ipHash: string;
-		if (meta.ip) {
-			ipHash = await hashIp(meta.ip, ipSalt);
-		} else {
-			// No trusted IP — fail closed by bucketing all unidentifiable
-			// requests together. A larger limit reflects the shared bucket.
-			//
-			// Self-hosted operators behind a reverse proxy should set
-			// `trustedProxyHeaders` in the EmDash config (or the
-			// EMDASH_TRUSTED_PROXY_HEADERS env var) so this path isn't hit
-			// for legitimate traffic. UA-hashing was previously used here
-			// but was trivially rotatable — the shared bucket is stricter
-			// and forces operators toward a real fix.
-			ipHash = "unknown";
-		}
-		const unknownBucketLimit = ipHash === "unknown" ? 20 : undefined;
-		const rateLimited = await checkRateLimit(emdash.db, ipHash, unknownBucketLimit);
-		if (rateLimited) {
-			return apiError("RATE_LIMITED", "Too many comments. Please try again later.", 429);
-		}
-
-		// Anti-spam: Turnstile — enforced only when the operator configured a
-		// secret key. Runs after the free checks (honeypot, rate limit) so
-		// obvious spam never triggers a siteverify subrequest. Fails closed:
-		// missing token, failed verification, and siteverify errors all reject.
-		const turnstileSecretKey = getTurnstileSecretKey();
-		if (turnstileSecretKey) {
-			const verified = await verifyTurnstileToken(body.turnstileToken, turnstileSecretKey, meta.ip);
-			if (!verified) {
-				return apiError("TURNSTILE_FAILED", "CAPTCHA verification failed", 403);
-			}
-		}
-
-		// Build collection settings
-		const collectionSettings: CollectionCommentSettings = {
-			commentsEnabled: collectionRow.comments_enabled === 1,
-			commentsModeration:
-				collectionRow.comments_moderation as CollectionCommentSettings["commentsModeration"],
-			commentsClosedAfterDays: collectionRow.comments_closed_after_days,
-			commentsAutoApproveUsers: collectionRow.comments_auto_approve_users === 1,
-		};
-
-		// Determine author fields — authenticated user overrides form input
-		let authorName = body.authorName;
-		let authorEmail = body.authorEmail;
-		let authorUserId: string | null = null;
-
-		if (user) {
-			authorName = user.name || authorName;
-			authorEmail = user.email;
-			authorUserId = user.id;
-		}
-
-		// Validate parent exists and belongs to the same content.
-		// Enforce 1-level nesting: if the parent is itself a reply, attach to its root.
-		let resolvedParentId = body.parentId ?? null;
-		if (body.parentId) {
-			const repo = new CommentRepository(emdash.db);
-			const parent = await repo.findById(body.parentId);
-			if (!parent) {
-				return apiError("VALIDATION_ERROR", "Parent comment not found", 400);
-			}
-			if (parent.collection !== collection || parent.contentId !== contentId) {
-				return apiError("VALIDATION_ERROR", "Parent comment belongs to different content", 400);
-			}
-			// Flatten: if parent is a reply, use its parent (the root) instead
-			resolvedParentId = parent.parentId ?? parent.id;
-		}
-
-		// Wire the comment service to the real hook pipeline
-		const hookRunner: CommentHookRunner = {
-			async runBeforeCreate(event) {
-				return emdash.hooks.runCommentBeforeCreate(event);
-			},
-			async runModerate(event) {
-				const result = await emdash.hooks.invokeExclusiveHook("comment:moderate", event);
-				if (!result) return { status: "pending" as const, reason: "No moderator configured" };
-				if (result.error) {
-					console.error(`[comments] Moderation error (${result.pluginId}):`, result.error.message);
-					return { status: "pending" as const, reason: "Moderation error" };
-				}
-				return result.result as ModerationDecision;
-			},
-			fireAfterCreate(event) {
-				emdash.hooks
-					.runCommentAfterCreate(event)
-					.catch((err) =>
-						console.error(
-							"[comments] afterCreate error:",
-							err instanceof Error ? err.message : err,
-						),
-					);
-			},
-			fireAfterModerate(event) {
-				emdash.hooks
-					.runCommentAfterModerate(event)
-					.catch((err) =>
-						console.error(
-							"[comments] afterModerate error:",
-							err instanceof Error ? err.message : err,
-						),
-					);
-			},
-		};
-
-		// Build content info for afterCreate hooks (e.g. email notifications)
-		const typedContent = contentRow as {
-			id: string;
-			slug: string;
-			author_id: string | null;
-		};
-		let contentAuthor: { id: string; name: string | null; email: string } | undefined;
-		if (typedContent.author_id) {
-			const authorRow = await emdash.db
-				.selectFrom("users")
-				.select(["id", "name", "email", "email_verified"])
-				.where("id", "=", typedContent.author_id)
-				.executeTakeFirst();
-			if (authorRow && authorRow.email_verified) {
-				contentAuthor = {
-					id: authorRow.id,
-					name: authorRow.name,
-					email: authorRow.email,
-				};
-			}
-		}
-
-		const result = await createComment(
-			emdash.db,
-			{
-				collection,
-				contentId,
-				parentId: resolvedParentId,
-				authorName,
-				authorEmail,
-				authorUserId,
-				body: body.body,
-				ipHash,
-				userAgent: meta.userAgent,
-			},
-			collectionSettings,
-			hookRunner,
-			{
-				id: typedContent.id,
-				collection,
-				slug: typedContent.slug,
-				author: contentAuthor,
-			},
-		);
-
-		if (!result) {
-			return apiError("COMMENT_REJECTED", "Comment was rejected", 403);
-		}
-
-		// Send notification to content author (awaited so it completes before
-		// the response is sent — required for Cloudflare Workers where the
-		// isolate terminates after the response).
-		if (result.comment.status === "approved" && emdash.email && contentAuthor) {
-			try {
-				const adminBaseUrl = await getSiteBaseUrl(emdash.db, request, emdash.config);
-				await sendCommentNotification({
-					email: emdash.email,
-					comment: result.comment,
-					contentAuthor,
-					adminBaseUrl,
-				});
-			} catch (err) {
-				console.error("[comments] notification error:", err instanceof Error ? err.message : err);
-			}
-		}
-
-		return apiSuccess(
-			{
-				id: result.comment.id,
-				status: result.comment.status,
-				message:
-					result.comment.status === "approved"
-						? "Comment published"
-						: "Comment submitted for review",
-			},
-			201,
-		);
-	} catch (error) {
-		return handleError(error, "Failed to submit comment", "COMMENT_CREATE_ERROR");
-	}
+	return submitPublicComment(emdash, collection, contentId, request, user);
 };

package/src/astro/routes/api/content/[collection]/[id]/plugin-extensions/[pluginId]/[kind]/[extensionId].ts

@@ -0,0 +1,29 @@
+import type { APIRoute } from "astro";
+
+import { apiError } from "#api/error.js";
+import { dispatchPluginEditorExtensionApiRequest } from "#plugins/http-route-dispatch.js";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ params, request, locals, cache }) => {
+	const { emdash, user } = locals;
+	if (!emdash) return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+
+	const kind = params.kind;
+	if (kind !== "panel" && kind !== "action") {
+		return apiError("NOT_FOUND", "Plugin editor extension not found", 404);
+	}
+
+	return dispatchPluginEditorExtensionApiRequest({
+		runtime: emdash,
+		pluginId: params.pluginId!,
+		kind,
+		extensionId: params.extensionId!,
+		collection: params.collection!,
+		entryId: params.id!,
+		request,
+		user,
+		tokenScopes: locals.tokenScopes,
+		invalidateContentCache: cache?.enabled ? (tags) => cache.invalidate({ tags }) : undefined,
+	});
+};

package/src/astro/routes/api/content/[collection]/[id]/publish.ts

@@ -11,7 +11,7 @@
  */
 
 import { hasPermission } from "@emdash-cms/auth";
-import type { APIRoute } from "astro";
+import type { APIContext, APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
@@ -21,7 +21,10 @@ import { contentPublishBody } from "#api/schemas.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ params, request, locals, url, cache }) => {
+export async function publishContent(
+	{ params, request, locals, url, cache }: APIContext,
+	originSource: "api" | "visual-editor",
+): Promise<Response> {
 	const { emdash, user } = locals;
 	const collection = params.collection!;
 	const id = params.id!;
@@ -89,6 +92,8 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 	const result = await emdash.handleContentPublish(collection, resolvedId, {
 		publishedAt,
 		_rev: body?._rev,
+		actor: { id: user!.id, role: user!.role },
+		origin: { source: originSource },
 	});
 
 	if (!result.success) return unwrapResult(result);
@@ -96,4 +101,6 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
 
 	return unwrapResult(result);
-};
+}
+
+export const POST: APIRoute = (context) => publishContent(context, "api");

package/src/astro/routes/api/content/[collection]/[id]/schedule.ts

@@ -71,7 +71,16 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 		});
 	}
 
-	const result = await emdash.handleContentSchedule(collection, resolvedId ?? id, body.scheduledAt);
+	const result = await emdash.handleContentSchedule(
+		collection,
+		resolvedId ?? id,
+		body.scheduledAt,
+		{
+			_rev: body._rev,
+			actor: { id: user!.id, role: user!.role },
+			origin: { source: "api" },
+		},
+	);
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/content/[collection]/[id]/unpublish.ts

@@ -62,7 +62,11 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 		});
 	}
 
-	const result = await emdash.handleContentUnpublish(collection, resolvedId, { _rev: body?._rev });
+	const result = await emdash.handleContentUnpublish(collection, resolvedId, {
+		_rev: body?._rev,
+		actor: { id: user!.id, role: user!.role },
+		origin: { source: "api" },
+	});
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/health.ts

@@ -0,0 +1,23 @@
+import type { APIRoute } from "astro";
+
+import { apiSuccess } from "#api/error.js";
+
+import { getRegistryConfigInput } from "../../../registry/config.js";
+import { VERSION } from "../../../version.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = ({ locals }) => {
+	const response = apiSuccess({
+		product: "emdash",
+		version: VERSION,
+		registry: Boolean(
+			getRegistryConfigInput(
+				locals.emdash?.config.registry,
+				locals.emdash?.config.experimental?.registry,
+			),
+		),
+	});
+	response.headers.set("Access-Control-Allow-Origin", "*");
+	return response;
+};

package/src/astro/routes/api/manifest.ts

@@ -41,18 +41,26 @@ export const GET: APIRoute = async ({ locals }) => {
 		// null and the React SPA never received custom logo/siteName/favicon.
 		// See issue #835.
 		let adminBranding = emdash?.config?.admin;
+		let siteTimezone = "UTC";
 
-		// When no build-time `admin.siteName` is configured, brand the admin with
+		// Read the site timezone alongside the title fallback so datetime controls
+		// and branding share one options query. When no build-time `admin.siteName`
+		// is configured, brand the admin with
 		// the site's own title so multi-site operators can tell backends apart
 		// (WordPress-style: wp-admin always shows the site name). Precedence:
 		// explicit `admin.siteName` → Site Title (Settings → General) → the title
 		// captured by the setup wizard → the bundled "EmDash" default in the SPA.
-		if (!adminBranding?.siteName && emdash?.db) {
+		if (emdash?.db) {
 			try {
 				const options = new OptionsRepository(emdash.db);
-				const titles = await options.getMany<string>(["site:title", "emdash:site_title"]);
+				const titles = await options.getMany<string>([
+					"site:title",
+					"emdash:site_title",
+					"site:timezone",
+				]);
 				const siteTitle = titles.get("site:title") || titles.get("emdash:site_title");
-				if (siteTitle) {
+				siteTimezone = titles.get("site:timezone") || "UTC";
+				if (!adminBranding?.siteName && siteTitle) {
 					adminBranding = { ...adminBranding, siteName: siteTitle };
 				}
 			} catch {
@@ -78,6 +86,7 @@ export const GET: APIRoute = async ({ locals }) => {
 		const manifest: EmDashManifest = emdashManifest
 			? {
 					...emdashManifest,
+					timezone: siteTimezone,
 					authMode: authMode.type === "external" ? authMode.providerType : "passkey",
 					signupEnabled,
 					admin: adminBranding,
@@ -88,6 +97,7 @@ export const GET: APIRoute = async ({ locals }) => {
 					hash: "default",
 					collections: {},
 					plugins: {},
+					timezone: siteTimezone,
 					taxonomies: [],
 					authMode: "passkey",
 					signupEnabled,

package/src/astro/routes/api/mcp.ts

@@ -19,7 +19,7 @@ import { createMcpServer } from "#mcp/server.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ request, locals }) => {
+export const POST: APIRoute = async ({ request, locals, cache }) => {
 	const { emdash, user } = locals;
 
 	if (!emdash) {
@@ -52,6 +52,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 					userId: user.id,
 					userRole: user.role,
 					tokenScopes: locals.tokenScopes,
+					cache,
 				},
 			},
 		});

package/src/astro/routes/api/media/asset/[id]/[filename].ts

@@ -0,0 +1,50 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError } from "#api/error.js";
+import { MediaRepository } from "#db/repositories/media.js";
+
+export const prerender = false;
+
+const SAFE_INLINE_TYPES = new Set([
+	"image/jpeg",
+	"image/png",
+	"image/gif",
+	"image/webp",
+	"image/avif",
+	"image/x-icon",
+	"video/mp4",
+	"video/webm",
+	"audio/mpeg",
+	"audio/wav",
+	"audio/ogg",
+]);
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { id, filename } = params;
+	const { emdash, user } = locals;
+	const denied = requirePerm(user, "media:read");
+	if (denied) return denied;
+	if (!id || !filename) return apiError("NOT_FOUND", "File not found", 404);
+	if (!emdash?.storage) return apiError("NOT_CONFIGURED", "Storage not configured", 500);
+
+	try {
+		const item = await new MediaRepository(emdash.db).findById(id);
+		if (!item || item.status !== "ready" || item.filename !== filename) {
+			return apiError("NOT_FOUND", "File not found", 404);
+		}
+		const result = await emdash.storage.download(item.storageKey);
+		const headers: Record<string, string> = {
+			"Content-Type": result.contentType,
+			"Cache-Control": "private, max-age=0, must-revalidate",
+			"X-Content-Type-Options": "nosniff",
+			"Content-Security-Policy":
+				"sandbox; default-src 'none'; img-src 'self'; style-src 'unsafe-inline'",
+			"Content-Disposition": SAFE_INLINE_TYPES.has(result.contentType) ? "inline" : "attachment",
+		};
+		if (result.size) headers["Content-Length"] = String(result.size);
+		return new Response(result.body, { status: 200, headers });
+	} catch (error) {
+		return handleError(error, "Failed to serve file", "FILE_SERVE_ERROR");
+	}
+};