emdash 0.40.1 → 0.42.0

package/src/api/handlers/device-flow.ts

@@ -12,7 +12,7 @@
 import { clampScopes } from "@emdash-cms/auth";
 import type { RoleLevel } from "@emdash-cms/auth";
 import { generateCodeVerifier } from "arctic";
-import type { Kysely } from "kysely";
+import type { Kysely, Selectable } from "kysely";
 
 import {
 	generatePrefixedToken,
@@ -21,7 +21,7 @@ import {
 	TOKEN_PREFIXES,
 } from "../../auth/api-tokens.js";
 import { withTransaction } from "../../database/transaction.js";
-import type { Database } from "../../database/types.js";
+import type { Database, DeviceCodeTable } from "../../database/types.js";
 import type { ApiResult } from "../types.js";
 import { lookupOAuthClient } from "./oauth-clients.js";
 import { lookupUserRoleAndStatus } from "./oauth-user-lookup.js";
@@ -112,7 +112,33 @@ function normalizeScopes(requested?: string[]): string[] {
 	if (!requested || requested.length === 0) {
 		return [...DEFAULT_SCOPES];
 	}
-	return requested.filter(isValidScope);
+	return [...new Set(requested.filter(isValidScope))];
+}
+
+/**
+ * Scopes an approval by a user with `role` would grant:
+ * requested_scopes ∩ scopesForRole(role). Approval and the approval-page
+ * lookup must agree, so both go through here.
+ */
+function grantableScopes(requested: string[], role: RoleLevel): string[] {
+	return clampScopes(requested, role);
+}
+
+/** Find a pending device code by user code, ignoring hyphens and case. Does not check expiry. */
+async function findPendingDeviceCode(
+	db: Kysely<Database>,
+	userCode: string,
+): Promise<Selectable<DeviceCodeTable> | undefined> {
+	const chars = userCode.replace(HYPHEN_PATTERN, "").toUpperCase();
+	if (chars.length !== 8) return undefined;
+
+	// Stored codes always have the generateUserCode() shape.
+	return db
+		.selectFrom("_emdash_device_codes")
+		.selectAll()
+		.where("user_code", "=", `${chars.slice(0, 4)}-${chars.slice(4)}`)
+		.where("status", "=", "pending")
+		.executeTakeFirst();
 }
 
 // ---------------------------------------------------------------------------
@@ -393,6 +419,49 @@ export async function handleDeviceTokenExchange(
 	}
 }
 
+/**
+ * GET /oauth/device/authorize
+ *
+ * Returns the scopes a pending device code requested, and the subset an
+ * approval by this user would grant, so the approval page can show them
+ * before the user approves. Reveals nothing else about the device code.
+ */
+export async function handleDeviceCodeLookup(
+	db: Kysely<Database>,
+	userRole: RoleLevel,
+	input: { user_code: string },
+): Promise<ApiResult<{ requestedScopes: string[]; grantedScopes: string[] }>> {
+	try {
+		const match = await findPendingDeviceCode(db, input.user_code);
+
+		if (!match) {
+			return {
+				success: false,
+				error: { code: "INVALID_CODE", message: "Invalid or expired code" },
+			};
+		}
+
+		if (new Date(match.expires_at) < new Date()) {
+			return {
+				success: false,
+				error: { code: "EXPIRED_CODE", message: "This code has expired" },
+			};
+		}
+
+		const requestedScopes = JSON.parse(match.scopes) as string[];
+
+		return {
+			success: true,
+			data: { requestedScopes, grantedScopes: grantableScopes(requestedScopes, userRole) },
+		};
+	} catch {
+		return {
+			success: false,
+			error: { code: "DEVICE_CODE_LOOKUP_ERROR", message: "Failed to look up device code" },
+		};
+	}
+}
+
 /**
  * POST /oauth/device/authorize
  *
@@ -413,20 +482,7 @@ export async function handleDeviceAuthorize(
 	},
 ): Promise<ApiResult<{ authorized: boolean }>> {
 	try {
-		// Normalize user code (strip hyphens, uppercase)
-		const normalizedCode = input.user_code.replace(HYPHEN_PATTERN, "").toUpperCase();
-
-		// Look up the device code by user_code
-		const row = await db
-			.selectFrom("_emdash_device_codes")
-			.selectAll()
-			.where("status", "=", "pending")
-			.execute();
-
-		// Find the matching code (strip hyphens for comparison)
-		const match = row.find(
-			(r) => r.user_code.replace(HYPHEN_PATTERN, "").toUpperCase() === normalizedCode,
-		);
+		const match = await findPendingDeviceCode(db, input.user_code);
 
 		if (!match) {
 			return {
@@ -460,10 +516,7 @@ export async function handleDeviceAuthorize(
 			return { success: true, data: { authorized: false } };
 		}
 
-		// Clamp requested scopes to those the user's role permits.
-		// effective_scopes = requested_scopes ∩ scopesForRole(user.role)
-		const requestedScopes = JSON.parse(match.scopes) as string[];
-		const effectiveScopes = clampScopes(requestedScopes, userRole);
+		const effectiveScopes = grantableScopes(JSON.parse(match.scopes) as string[], userRole);
 
 		if (effectiveScopes.length === 0) {
 			return {

package/src/api/handlers/index.ts

@@ -39,6 +39,9 @@ export {
 	type RecentItem,
 } from "./dashboard.js";
 
+// Core update check
+export { handleCoreUpdateStatus, type CoreUpdateStatus } from "./update-check.js";
+
 // Manifest generation
 export { generateManifest } from "./manifest.js";
 

package/src/api/handlers/manifest.ts

@@ -7,8 +7,14 @@ import type { Kysely } from "kysely";
 import type { Database } from "../../database/types.js";
 import { expandCollectionBlockFields } from "../../schema/block-values.js";
 import { SchemaRegistry } from "../../schema/registry.js";
-import { MAX_COLLECTION_LIST_COLUMNS } from "../../schema/types.js";
-import type { Field, FieldType } from "../../schema/types.js";
+import { isStoragelessField, MAX_COLLECTION_LIST_COLUMNS } from "../../schema/types.js";
+import type {
+	CollectionWithFields,
+	Field,
+	FieldType,
+	FieldValidation,
+} from "../../schema/types.js";
+import { isMissingTableError } from "../../utils/db-errors.js";
 import { hashString } from "../../utils/hash.js";
 import type {
 	FieldDescriptor,
@@ -136,12 +142,13 @@ export async function buildManifestCollections(
 		const dbCollections = await Promise.all(
 			storedCollections.map((collection) => expandCollectionBlockFields(db, collection)),
 		);
+		const cardinality = await relationCardinality(db, dbCollections);
 		for (const collection of dbCollections) {
 			if (manifestCollections[collection.slug]) continue;
 
 			const fields: Record<string, ManifestFieldDescriptor> = {};
 			for (const field of collection.fields) {
-				fields[field.slug] = dbFieldDescriptor(field);
+				fields[field.slug] = dbFieldDescriptor(field, cardinality);
 			}
 
 			const configuredListColumns = collection.admin?.listColumns ?? [];
@@ -175,7 +182,9 @@ export async function buildManifestCollections(
 				titleField: collection.titleField,
 				dateField: collection.dateField,
 				...(collection.hidden ? { hidden: true } : {}),
+				...(collection.icon ? { icon: collection.icon } : {}),
 				...(collection.group ? { group: collection.group } : {}),
+				...(collection.admin?.quickCreate === false ? { quickCreate: false } : {}),
 				listColumns: listColumns.length > 0 ? listColumns : undefined,
 				fields,
 			};
@@ -273,7 +282,69 @@ function extractFieldType(name: string, schema: unknown): FieldDescriptor {
 	}
 }
 
-function dbFieldDescriptor(field: Field): ManifestFieldDescriptor {
+/** How many entries each end of a relation may hold. `null` is unlimited. */
+interface RelationCardinality {
+	maxChildrenPerParent: number | null;
+	maxParentsPerChild: number | null;
+}
+
+/**
+ * The limits of every relation a bound reference field names, by relation slug.
+ *
+ * Empty when nothing is bound, so a site with no reference fields never issues
+ * the query, and empty before migration 086 has created the table.
+ */
+async function relationCardinality(
+	db: Kysely<Database>,
+	collections: CollectionWithFields[],
+): Promise<Map<string, RelationCardinality>> {
+	if (!collections.some((collection) => collection.fields.some(isStoragelessField))) {
+		return new Map();
+	}
+	try {
+		const rows = await db
+			.selectFrom("_emdash_relations")
+			.select(["slug", "max_children_per_parent", "max_parents_per_child"])
+			.execute();
+		return new Map(
+			rows.map((row) => [
+				row.slug,
+				{
+					maxChildrenPerParent: row.max_children_per_parent,
+					maxParentsPerChild: row.max_parents_per_child,
+				},
+			]),
+		);
+	} catch (error) {
+		if (isMissingTableError(error)) return new Map();
+		throw error;
+	}
+}
+
+/**
+ * Whether the editor may select more than one entry for a bound reference
+ * field: the question the relation answers, from the end the field views.
+ *
+ * `validation.multiple` on the field row is a create-time input — it is what
+ * set the relation's limit — and the relation is what the write path enforces.
+ * Reading the field back would let the two disagree, which is what happens when
+ * a later edit rewrites the row's validation without it.
+ */
+function boundReferenceIsMultiple(
+	validation: FieldValidation,
+	cardinality: RelationCardinality,
+): boolean {
+	const max =
+		validation.relationSide === "child"
+			? cardinality.maxParentsPerChild
+			: cardinality.maxChildrenPerParent;
+	return max !== 1;
+}
+
+function dbFieldDescriptor(
+	field: Field,
+	cardinality: Map<string, RelationCardinality>,
+): ManifestFieldDescriptor {
 	const entry: ManifestFieldDescriptor = {
 		kind: field.unsupportedType ? "unsupported" : FIELD_TYPE_TO_KIND[field.type],
 		label: field.label,
@@ -298,7 +369,12 @@ function dbFieldDescriptor(field: Field): ManifestFieldDescriptor {
 	}
 
 	if (field.validation) {
-		entry.validation = { ...field.validation };
+		const validation: Record<string, unknown> = { ...field.validation };
+		if (isStoragelessField(field) && field.validation.relation) {
+			const limits = cardinality.get(field.validation.relation);
+			if (limits) validation.multiple = boundReferenceIsMultiple(field.validation, limits);
+		}
+		entry.validation = validation;
 	}
 
 	return entry;

package/src/api/handlers/media-upload.ts

@@ -31,6 +31,8 @@ export interface MediaUploadInput {
 	contentType: string;
 	/** Alt text stored on the media record. */
 	alt?: string;
+	/** Caption stored on the media record. */
+	caption?: string;
 	authorId?: string;
 	/** Upload size limit in bytes (defaults to DEFAULT_MAX_UPLOAD_SIZE). */
 	maxUploadSize?: number;
@@ -161,6 +163,7 @@ export async function handleMediaUpload(
 				width: enriched.width,
 				height: enriched.height,
 				alt: input.alt,
+				caption: input.caption,
 				storageKey,
 				contentHash,
 				blurhash: enriched.blurhash,

package/src/api/handlers/media.ts

@@ -40,7 +40,7 @@ export async function handleMediaList(
 ): Promise<ApiResult<MediaListResponse>> {
 	try {
 		if (params.page !== undefined) {
-			const limit = Math.min(params.limit || 50, 100);
+			const limit = Math.max(1, Math.min(params.limit || 50, 100));
 			const offset = (params.page - 1) * limit;
 			if (
 				params.cursor !== undefined ||
@@ -68,7 +68,7 @@ export async function handleMediaList(
 		const repo = new MediaRepository(db);
 		const result = await repo.findMany({
 			cursor: params.cursor,
-			limit: Math.min(params.limit || 50, 100),
+			limit: Math.max(1, Math.min(params.limit || 50, 100)),
 			mimeType: params.mimeType,
 			q: params.q,
 			folderId: params.folderId,

package/src/api/handlers/registry.ts

@@ -11,9 +11,14 @@ import { ClientResponseError, ClientValidationError } from "@atcute/client";
 import type { Did } from "@atcute/lexicons";
 import { canonicalizeDeclaredAccess } from "@emdash-cms/plugin-types";
 import type { CanonicalDeclaredAccess } from "@emdash-cms/plugin-types";
-import { checkEnvCompatibility, findSkippedEnvConstraints } from "@emdash-cms/registry-client/env";
+import {
+	checkEnvCompatibility,
+	compareVersions,
+	findSkippedEnvConstraints,
+} from "@emdash-cms/registry-client/env";
 import type { HostEnv } from "@emdash-cms/registry-client/env";
 import { isProvenFirstRelease } from "@emdash-cms/registry-client/listing-policy";
+import type { ReleaseHistoryEvidence } from "@emdash-cms/registry-client/listing-policy";
 import { evaluateRegistryReleaseWithdrawal } from "@emdash-cms/registry-client/withdrawal";
 import { NSID } from "@emdash-cms/registry-lexicons";
 import {
@@ -55,7 +60,7 @@ import {
 } from "../../registry/config.js";
 import { makeRegistryPluginId } from "../../registry/plugin-id.js";
 import { hasCurrentRecordLabel } from "../../registry/record-labels.js";
-import type { RegistryConfigInput } from "../../registry/types.js";
+import type { RegistryConfig, RegistryConfigInput } from "../../registry/types.js";
 import { resolveAndValidateExternalUrlTarget } from "../../security/ssrf.js";
 import { EmDashStorageError } from "../../storage/types.js";
 import type { Storage } from "../../storage/types.js";
@@ -258,7 +263,7 @@ function recordVerificationSummary(
 /**
  * Bytes-per-artifact cap on the gzipped tarball we'll download before
  * decompression. RFC 0001 caps a sandboxed plugin bundle at 256 KiB
- * decompressed (see `MAX_BUNDLE_SIZE` in cli/commands/bundle-utils.ts);
+ * decompressed (see `MAX_BUNDLE_SIZE` in @emdash-cms/plugin-cli);
  * gzip on a mix of JSON manifest + JS code typically gives 0.3-0.6
  * ratio, so compressed bundles are well under 200 KiB in practice.
  * 512 KiB leaves margin for unusual file mixes that compress poorly
@@ -392,6 +397,80 @@ interface EnvIncompatibleError {
 	details: { requires: Record<string, string>; host: HostEnv };
 }
 
+/**
+ * Returns an error when the release is younger than `policy.minimumReleaseAge`,
+ * unless its publisher or package is in `minimumReleaseAgeExclude` or it is a
+ * proven first release.
+ *
+ * `releaseView.indexedAt` is aggregator operational data, not part of the
+ * signed release. The release schema has no publication timestamp, so minimum
+ * age remains a local discovery holdback rather than a cryptographic property.
+ * A missing or malformed timestamp fails closed.
+ */
+function checkMinimumReleaseAge(
+	registryConfig: RegistryConfig,
+	publisherDid: string,
+	slug: string,
+	packageView: ReleaseHistoryEvidence,
+	releaseView: { indexedAt: string },
+): ApiResult<never> | null {
+	const minimumReleaseAge = registryConfig.policy?.minimumReleaseAge;
+	let minimumReleaseAgeSeconds = 0;
+	if (minimumReleaseAge !== undefined) {
+		// Normally rejected by `normalizeRegistryConfig`, but a config-mutation
+		// path could re-enter with a bad value; surface it as a structured error
+		// rather than a generic 500.
+		try {
+			minimumReleaseAgeSeconds = parseDurationSeconds(minimumReleaseAge);
+		} catch (err) {
+			return {
+				success: false,
+				error: {
+					code: "REGISTRY_POLICY_INVALID",
+					message:
+						err instanceof Error
+							? err.message
+							: "Invalid minimumReleaseAge value in registry config",
+				},
+			};
+		}
+	}
+	if (minimumReleaseAgeSeconds > 0) {
+		const exclude = registryConfig.policy?.minimumReleaseAgeExclude?.map((e) =>
+			e.trim().toLowerCase(),
+		);
+		const exempt =
+			releaseExemptFromMinimumAge(exclude, publisherDid, slug) || isProvenFirstRelease(packageView);
+		if (!exempt) {
+			const indexedAt = Date.parse(releaseView.indexedAt);
+			if (!Number.isFinite(indexedAt)) {
+				return {
+					success: false,
+					error: {
+						code: "RELEASE_TIMESTAMP_INVALID",
+						message:
+							"Release record is missing a valid indexed-at timestamp; cannot evaluate minimum release age policy.",
+					},
+				};
+			}
+			const ageSeconds = (Date.now() - indexedAt) / 1000;
+			if (ageSeconds < minimumReleaseAgeSeconds) {
+				const remaining = Math.ceil(minimumReleaseAgeSeconds - ageSeconds);
+				return {
+					success: false,
+					error: {
+						code: "RELEASE_TOO_NEW",
+						message:
+							`This release does not meet the configured minimum release age of ` +
+							`${minimumReleaseAgeSeconds}s. It will be installable in ~${remaining}s.`,
+					},
+				};
+			}
+		}
+	}
+	return null;
+}
+
 /**
  * Gate a release's `requires` constraints against the running host
  * environment. `requires` is the lexicon-`unknown` value off the signed
@@ -698,73 +777,15 @@ export async function handleRegistryInstall(
 		// Step 3a: enforce the configured minimum release age. The browser
 		// applies the same check up front for UX, but the gate lives here
 		// -- a stale browser tab, a deep link, or a non-admin-UI caller
-		// must still hit the holdback. The `minimumReleaseAgeExclude`
-		// allowlist short-circuits the check for trusted publisher DIDs.
-		//
-		// `releaseView.indexedAt` is aggregator operational data, not part
-		// of the signed release. The release schema has no publication
-		// timestamp, so minimum age remains a local discovery holdback
-		// rather than a cryptographic property. A missing or malformed
-		// timestamp fails closed.
-		// `registryConfig` is the user-supplied integration option, not
-		// the normalized manifest shape, so the duration parse runs once
-		// per install. Catch a malformed value here -- normally caught at
-		// `normalizeRegistryConfig` time, but a future config-mutation
-		// path could re-enter with a bad value -- and surface it as a
-		// structured error rather than letting it bubble out as a generic
-		// 500.
-		const minimumReleaseAge = registryConfig.policy?.minimumReleaseAge;
-		let minimumReleaseAgeSeconds = 0;
-		if (minimumReleaseAge !== undefined) {
-			try {
-				minimumReleaseAgeSeconds = parseDurationSeconds(minimumReleaseAge);
-			} catch (err) {
-				return {
-					success: false,
-					error: {
-						code: "REGISTRY_POLICY_INVALID",
-						message:
-							err instanceof Error
-								? err.message
-								: "Invalid minimumReleaseAge value in registry config",
-					},
-				};
-			}
-		}
-		if (minimumReleaseAgeSeconds > 0) {
-			const exclude = registryConfig.policy?.minimumReleaseAgeExclude?.map((e) =>
-				e.trim().toLowerCase(),
-			);
-			const exempt =
-				releaseExemptFromMinimumAge(exclude, publisherDid, slug) ||
-				isProvenFirstRelease(packageView);
-			if (!exempt) {
-				const indexedAt = Date.parse(releaseView.indexedAt);
-				if (!Number.isFinite(indexedAt)) {
-					return {
-						success: false,
-						error: {
-							code: "RELEASE_TIMESTAMP_INVALID",
-							message:
-								"Release record is missing a valid indexed-at timestamp; cannot evaluate minimum release age policy.",
-						},
-					};
-				}
-				const ageSeconds = (Date.now() - indexedAt) / 1000;
-				if (ageSeconds < minimumReleaseAgeSeconds) {
-					const remaining = Math.ceil(minimumReleaseAgeSeconds - ageSeconds);
-					return {
-						success: false,
-						error: {
-							code: "RELEASE_TOO_NEW",
-							message:
-								`This release does not meet the configured minimum release age of ` +
-								`${minimumReleaseAgeSeconds}s. It will be installable in ~${remaining}s.`,
-						},
-					};
-				}
-			}
-		}
+		// must still hit the holdback.
+		const releaseAgeError = checkMinimumReleaseAge(
+			registryConfig,
+			publisherDid,
+			slug,
+			packageView,
+			releaseView,
+		);
+		if (releaseAgeError) return releaseAgeError;
 
 		// Derive the normalized opaque plugin id we'll use as the
 		// runtime-wide identifier from here on. The publisher_did + slug
@@ -1401,6 +1422,38 @@ export async function handleRegistryUpdate(
 				},
 			};
 		}
+		// Only an explicitly requested version is order-checked: on the latest
+		// path the aggregator selects the version, and a publisher yanking the
+		// newest release is how a rollback reaches installed sites.
+		if (opts?.version !== undefined) {
+			const order = compareVersions(newVersion, oldVersion);
+			if (order === null) {
+				return {
+					success: false,
+					error: {
+						code: "INVALID_VERSION",
+						message: "Installed or requested version is not valid semver",
+					},
+				};
+			}
+			if (order < 0) {
+				return {
+					success: false,
+					error: {
+						code: "DOWNGRADE_NOT_ALLOWED",
+						message: "An update cannot target a version older than the installed one",
+					},
+				};
+			}
+		}
+		const releaseAgeError = checkMinimumReleaseAge(
+			registryConfig,
+			publisherDid,
+			slug,
+			packageView,
+			releaseView,
+		);
+		if (releaseAgeError) return releaseAgeError;
 		const authoritative = await (opts?.readAuthoritativeRecords ?? readAuthoritativePackageRelease)(
 			publisherDid,
 			slug,