emdash 0.41.0 → 0.42.0

package/src/api/handlers/update-check.ts

@@ -0,0 +1,236 @@
+/**
+ * Core update status handler.
+ *
+ * Caches the publish times of stable `emdash` releases from the npm
+ * registry in the options table, and reports the newest release that has
+ * been public for the minimum release age when it is newer than the
+ * running `VERSION`. A stale or missing cache schedules a deferred refresh.
+ */
+
+import type { Kysely } from "kysely";
+
+import { after } from "../../after.js";
+import { OptionsRepository } from "../../database/repositories/options.js";
+import type { Database } from "../../database/types.js";
+import { parseDurationSeconds } from "../../registry/config.js";
+import { VERSION } from "../../version.js";
+import { ErrorCode } from "../errors.js";
+import type { ApiResult } from "../types.js";
+
+/** Options-table key for the cached registry result. */
+export const CORE_UPDATE_OPTION = "emdash:core_update_check";
+
+/** Check the registry at most once per day, whether or not the check succeeds. */
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+
+/** npm packument for `emdash`: the `latest` dist-tag and each version's publish time. */
+const REGISTRY_URL = "https://registry.npmjs.org/emdash";
+
+/** Default time a release must be public before admins are told about it. */
+export const DEFAULT_MINIMUM_RELEASE_AGE = "24h";
+
+const REGISTRY_TIMEOUT_MS = 10_000;
+
+/** Cached registry state, stored in the options table. */
+interface CoreUpdateCache {
+	/** Publish time (ISO) of each non-deprecated stable release up to the `latest` dist-tag. */
+	releases: Record<string, string>;
+	/** ISO timestamp of the last registry check. */
+	checkedAt: string;
+}
+
+export interface CoreUpdateStatus {
+	/** The running EmDash version (`"dev"` in uncompiled dev/test runs). */
+	current: string;
+	/**
+	 * Newest stable release that has been public for the minimum release
+	 * age, or null when no check has completed yet.
+	 */
+	latest: string | null;
+	updateAvailable: boolean;
+	/** ISO timestamp of the last registry check, if any. */
+	checkedAt: string | null;
+}
+
+const SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)(-.+)?$/;
+const STABLE_RE = /^\d+\.\d+\.\d+$/;
+
+/**
+ * True when `latest` is a strictly newer release than `current`.
+ *
+ * Handles plain `major.minor.patch` versions. Anything unparsable —
+ * including the `"dev"` fallback version — compares as "not newer", so
+ * dev/test runs never show the banner. On an equal base version, a stable
+ * release is newer than a prerelease of it, so a site running
+ * `0.24.0-beta.1` is notified when `0.24.0` ships. Prerelease identifiers
+ * are not compared to each other.
+ */
+export function isNewerVersion(latest: string, current: string): boolean {
+	const l = SEMVER_RE.exec(latest);
+	const c = SEMVER_RE.exec(current);
+	if (!l || !c) return false;
+	for (let i = 1; i <= 3; i++) {
+		const a = Number(l[i]);
+		const b = Number(c[i]);
+		if (a !== b) return a > b;
+	}
+	return !l[4] && !!c[4];
+}
+
+function field(value: unknown, key: string): unknown {
+	return typeof value === "object" && value !== null && Object.hasOwn(value, key)
+		? (Reflect.get(value, key) as unknown)
+		: undefined;
+}
+
+/**
+ * Fetch the stable releases and their publish times from the npm registry
+ * and cache them. Exported for tests; production callers go through
+ * `handleCoreUpdateStatus`, which defers this via `after()`.
+ */
+export async function refreshCoreUpdateCache(
+	db: Kysely<Database>,
+	fetchImpl: typeof fetch = fetch,
+): Promise<void> {
+	const response = await fetchImpl(REGISTRY_URL, {
+		headers: { accept: "application/json" },
+		signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS),
+	});
+	if (!response.ok) {
+		throw new Error(`registry responded ${response.status}`);
+	}
+	const body: unknown = await response.json();
+	const latest = field(field(body, "dist-tags"), "latest");
+	if (typeof latest !== "string" || !STABLE_RE.test(latest)) {
+		throw new Error("registry response missing a valid version");
+	}
+	const time = field(body, "time");
+	const versions = field(body, "versions");
+	const releases: Record<string, string> = {};
+	if (typeof time === "object" && time !== null) {
+		for (const [version, publishedAt] of Object.entries(time)) {
+			if (!STABLE_RE.test(version) || isNewerVersion(version, latest)) continue;
+			const manifest = field(versions, version);
+			if (manifest === undefined || field(manifest, "deprecated") !== undefined) continue;
+			if (typeof publishedAt !== "string" || Number.isNaN(Date.parse(publishedAt))) continue;
+			releases[version] = publishedAt;
+		}
+	}
+	if (!releases[latest]) {
+		throw new Error("registry response missing a publish time for the latest version");
+	}
+	const cache: CoreUpdateCache = { releases, checkedAt: new Date().toISOString() };
+	await new OptionsRepository(db).set(CORE_UPDATE_OPTION, cache);
+}
+
+function parseCache(value: unknown): CoreUpdateCache | null {
+	const releases = field(value, "releases");
+	const checkedAt = field(value, "checkedAt");
+	if (typeof releases !== "object" || releases === null || typeof checkedAt !== "string") {
+		return null;
+	}
+	// An unparsable checkedAt would make the staleness math NaN (never
+	// stale), freezing a corrupt cache forever — treat it as no cache so
+	// the next request schedules a refresh that overwrites it.
+	if (Number.isNaN(Date.parse(checkedAt))) return null;
+	const valid: Record<string, string> = {};
+	for (const [version, publishedAt] of Object.entries(releases)) {
+		if (
+			STABLE_RE.test(version) &&
+			typeof publishedAt === "string" &&
+			!Number.isNaN(Date.parse(publishedAt))
+		) {
+			valid[version] = publishedAt;
+		}
+	}
+	return { releases: valid, checkedAt };
+}
+
+/** The newest release published at least `minimumAgeMs` before `now`. */
+function newestReleased(
+	releases: Record<string, string>,
+	now: Date,
+	minimumAgeMs: number,
+): string | null {
+	let newest: string | null = null;
+	for (const [version, publishedAt] of Object.entries(releases)) {
+		if (now.getTime() - Date.parse(publishedAt) < minimumAgeMs) continue;
+		if (!newest || isNewerVersion(version, newest)) newest = version;
+	}
+	return newest;
+}
+
+/**
+ * Seconds a release must be public before it is reported, from the
+ * `updateCheck` option. Throws on an invalid duration.
+ */
+export function minimumReleaseAgeSeconds(
+	option: boolean | { minimumReleaseAge?: string | number } | null | undefined,
+): number {
+	const age = typeof option === "object" ? option?.minimumReleaseAge : undefined;
+	return parseDurationSeconds(age ?? DEFAULT_MINIMUM_RELEASE_AGE);
+}
+
+/**
+ * Report the cached update status and, when the cache is stale (or
+ * missing), kick a deferred registry refresh. Never blocks on the
+ * network: the first request after install/expiry reports the previous
+ * state and the next request sees the refreshed one.
+ */
+export async function handleCoreUpdateStatus(
+	db: Kysely<Database>,
+	options?: { now?: Date; enabled?: boolean; minimumReleaseAgeSeconds?: number; current?: string },
+): Promise<ApiResult<CoreUpdateStatus>> {
+	const current = options?.current ?? VERSION;
+	if (options?.enabled === false) {
+		return {
+			success: true,
+			data: { current, latest: null, updateAvailable: false, checkedAt: null },
+		};
+	}
+
+	try {
+		const repo = new OptionsRepository(db);
+		const cache = parseCache(await repo.get(CORE_UPDATE_OPTION));
+
+		const now = options?.now ?? new Date();
+		const minimumAgeMs =
+			(options?.minimumReleaseAgeSeconds ?? minimumReleaseAgeSeconds(undefined)) * 1000;
+		const stale = !cache || now.getTime() - Date.parse(cache.checkedAt) >= CHECK_INTERVAL_MS;
+		// A "dev" version can never compare as outdated, so skip the
+		// registry round-trip entirely in uncompiled dev/test runs.
+		if (stale && current !== "dev") {
+			after(async () => {
+				try {
+					await refreshCoreUpdateCache(db);
+				} catch (error) {
+					console.warn("[update-check] registry refresh failed:", error);
+					const latestCache = parseCache(await repo.get(CORE_UPDATE_OPTION));
+					if (latestCache?.checkedAt !== cache?.checkedAt) return;
+					const retryLater: CoreUpdateCache = {
+						releases: cache?.releases ?? {},
+						checkedAt: new Date().toISOString(),
+					};
+					await repo.set(CORE_UPDATE_OPTION, retryLater);
+				}
+			});
+		}
+
+		const latest = cache ? newestReleased(cache.releases, now, minimumAgeMs) : null;
+		return {
+			success: true,
+			data: {
+				current,
+				latest,
+				updateAvailable: latest ? isNewerVersion(latest, current) : false,
+				checkedAt: cache?.checkedAt ?? null,
+			},
+		};
+	} catch (error) {
+		console.error("[update-check] status read failed:", error);
+		return {
+			success: false,
+			error: { code: ErrorCode.UPDATE_CHECK_ERROR, message: "Failed to read update status" },
+		};
+	}
+}

package/src/api/redirect.ts

@@ -1,14 +1,22 @@
+// eslint-disable-next-line no-control-regex -- rejecting control characters is the whole point of this regex
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+
 /**
  * Validate that a redirect URL is a safe local path.
  *
  * Rejects:
  * - Protocol-relative URLs (`//evil.com`)
  * - Backslash bypass (`/\evil.com` — browsers normalize `\` to `/` in Location headers)
+ * - Control characters (`/\t/evil.com` — browsers strip tab/CR/LF, leaving `//evil.com`)
  * - Absolute URLs (`https://evil.com`)
  * - Empty / nullish values
  */
 export function isSafeRedirect(url: string | null | undefined): url is string {
 	return (
-		typeof url === "string" && url.startsWith("/") && !url.startsWith("//") && !url.includes("\\")
+		typeof url === "string" &&
+		url.startsWith("/") &&
+		!url.startsWith("//") &&
+		!url.includes("\\") &&
+		!CONTROL_CHARACTERS.test(url)
 	);
 }

package/src/api/schemas/content.ts

@@ -273,6 +273,10 @@ export const contentRevisionConditionBody = z
 	})
 	.meta({ id: "ContentRevisionConditionBody" });
 
+export const revisionRestoreBody = z.object({
+	overrideLock: overrideLockFlag,
+});
+
 export const contentPublishBody = contentRevisionConditionBody
 	.extend({
 		// .optional() rather than .nullish(): publishing has no semantic

package/src/api/schemas/import.ts

@@ -40,24 +40,60 @@ export const wpPluginExecuteBody = z.object({
 	commentRoots: z.record(z.string(), z.string().min(1)).optional(),
 });
 
-export const wpPrepareBody = z.object({
-	postTypes: z.array(
+export const wxrImportConfig = z.object({
+	postTypeMappings: z.record(
+		z.string(),
 		z.object({
-			name: z.string().min(1),
 			collection: z.string().min(1),
-			fields: z
-				.array(
-					z.object({
-						slug: z.string().min(1),
-						label: z.string().min(1),
-						type: z.string().min(1),
-						required: z.boolean(),
-						searchable: z.boolean().optional(),
-					}),
-				)
-				.optional(),
+			enabled: z.boolean(),
 		}),
 	),
+	skipExisting: z.boolean().default(false),
+	importSections: z.boolean().optional(),
+	authorMappings: z.record(z.string(), z.string().min(1).nullable()).optional(),
+	locale: z.string().min(1).optional(),
+});
+
+export const wxrChunkCursor = z.object({
+	offset: z.number().int().min(0).max(10_000_000),
+	source: z.string().regex(/^[a-f0-9]{64}$/),
+	taxonomiesReady: z.literal(true),
+});
+
+export const wxrChunkState = z.object({
+	translationGroups: z
+		.record(z.string().max(1024), z.string().min(1).max(256))
+		.refine((groups) => Object.keys(groups).length <= 100_000, "Too many translation groups"),
+});
+
+const wpPrepareField = z.object({
+	slug: z.string().min(1),
+	label: z.string().min(1),
+	type: z.string().min(1),
+	required: z.boolean(),
+	searchable: z.boolean().optional(),
+});
+
+export const wpPrepareBody = z.object({
+	postTypes: z.array(
+		z
+			.object({
+				name: z.string().min(1),
+				collection: z.string().min(1).optional(),
+				suggestedCollection: z.string().min(1).optional(),
+				fields: z.array(wpPrepareField).optional(),
+				requiredFields: z.array(wpPrepareField).optional(),
+			})
+			.refine((pt) => pt.collection || pt.suggestedCollection, {
+				message: "collection or suggestedCollection is required",
+				path: ["collection"],
+			})
+			.transform((pt) => ({
+				name: pt.name,
+				collection: pt.collection ?? pt.suggestedCollection!,
+				fields: pt.fields ?? pt.requiredFields ?? [],
+			})),
+	),
 });
 
 export const wpMediaImportBody = z.object({

package/src/api/schemas/schema.ts

@@ -1,6 +1,10 @@
 import { z } from "zod";
 
-import { MAX_COLLECTION_GROUP_LENGTH, MAX_COLLECTION_LIST_COLUMNS } from "../../schema/types.js";
+import {
+	MAX_COLLECTION_GROUP_LENGTH,
+	MAX_COLLECTION_ICON_LENGTH,
+	MAX_COLLECTION_LIST_COLUMNS,
+} from "../../schema/types.js";
 import { compileUrlPattern } from "../../schema/url-pattern.js";
 import { slugPattern } from "./common.js";
 
@@ -30,10 +34,12 @@ const collectionAdminInputConfig = z.object({
 			`At most ${MAX_COLLECTION_LIST_COLUMNS} list columns are allowed`,
 		)
 		.optional(),
+	quickCreate: z.boolean().optional(),
 });
 
 const collectionAdminResponseConfig = z.object({
 	listColumns: collectionListColumns.optional(),
+	quickCreate: z.boolean().optional(),
 });
 
 const fieldTypeValues = z.enum([
@@ -79,10 +85,10 @@ const repeaterSubFieldSchema = z.object({
 const urlPatternValue = z.string().superRefine((pattern, ctx) => {
 	try {
 		compileUrlPattern(pattern);
-	} catch {
+	} catch (error) {
 		ctx.addIssue({
 			code: "custom",
-			message: "Invalid URL pattern",
+			message: error instanceof Error ? error.message : "Invalid URL pattern",
 		});
 	}
 });
@@ -167,7 +173,7 @@ export const createCollectionBody = z
 		label: z.string().min(1),
 		labelSingular: z.string().optional(),
 		description: z.string().optional(),
-		icon: z.string().optional(),
+		icon: z.string().trim().max(MAX_COLLECTION_ICON_LENGTH).optional(),
 		admin: collectionAdminInputConfig.optional(),
 		supports: z.array(collectionSupportValues).optional(),
 		source: z.string().regex(collectionSourcePattern).optional(),
@@ -186,10 +192,10 @@ export const updateCollectionBody = z
 		label: z.string().min(1).optional(),
 		labelSingular: z.string().optional(),
 		description: z.string().optional(),
-		icon: z.string().optional(),
+		icon: z.string().trim().max(MAX_COLLECTION_ICON_LENGTH).optional(),
 		admin: collectionAdminInputConfig.optional(),
 		supports: z.array(collectionSupportValues).optional(),
-		urlPattern: urlPatternValue.nullish(),
+		urlPattern: z.string().nullish(),
 		routable: z.boolean().optional(),
 		hasSeo: z.boolean().optional(),
 		hidden: z.boolean().optional(),

package/src/api/setup-complete.ts

@@ -6,11 +6,59 @@
  * and marks setup as complete.
  */
 
-import type { Kysely } from "kysely";
+import { Role } from "@emdash-cms/auth";
+import { sql, type Kysely } from "kysely";
+import { ulid } from "ulidx";
 
+import { isPostgres } from "../database/dialect-helpers.js";
 import { OptionsRepository } from "../database/repositories/options.js";
 import type { Database } from "../database/types.js";
 
+export const FIRST_ADMIN_LOCK_KEY = 1_168_624_764;
+
+export interface FirstAdmin {
+	id: string;
+	email: string;
+	name: string | null;
+	role: typeof Role.ADMIN;
+}
+
+/**
+ * Create the first admin only while the users table is empty.
+ *
+ * Returns null when a user already exists, including one created by a
+ * concurrent call after the caller's own zero-users check. On Postgres the
+ * insert runs under an advisory lock, because `NOT EXISTS` alone doesn't see
+ * another transaction's uncommitted row under READ COMMITTED.
+ */
+export async function createFirstAdmin(
+	db: Kysely<Database>,
+	input: { email: string; name: string | null },
+): Promise<FirstAdmin | null> {
+	const admin: FirstAdmin = {
+		id: ulid(),
+		email: input.email.toLowerCase(),
+		name: input.name,
+		role: Role.ADMIN,
+	};
+	const now = new Date().toISOString();
+	const insert = async (executor: Kysely<Database>) =>
+		sql<{ id: string }>`
+			INSERT INTO users (id, email, name, role, email_verified, created_at, updated_at)
+			SELECT ${admin.id}, ${admin.email}, ${admin.name}, CAST(${admin.role} AS integer), 0, ${now}, ${now}
+			WHERE NOT EXISTS (SELECT 1 FROM users)
+			RETURNING id
+		`.execute(executor);
+
+	const result = isPostgres(db)
+		? await db.transaction().execute(async (trx) => {
+				await sql`SELECT pg_advisory_xact_lock(${FIRST_ADMIN_LOCK_KEY})`.execute(trx);
+				return insert(trx);
+			})
+		: await insert(db);
+	return result.rows.length > 0 ? admin : null;
+}
+
 /**
  * Finalize setup after the first admin user is created.
  *

package/src/api/types.ts

@@ -57,8 +57,12 @@ export interface ManifestCollectionDescriptor {
 	titleField?: string;
 	dateField?: string;
 	hidden?: boolean;
+	/** Phosphor icon name for the admin sidebar entry */
+	icon?: string;
 	/** Admin sidebar folder shared with other collections of the same group */
 	group?: string;
+	/** `false` omits the dashboard's "new entry" quick action */
+	quickCreate?: boolean;
 	listColumns?: string[];
 	fields: Record<string, ManifestFieldDescriptor>;
 }

package/src/astro/dev-typegen.ts

@@ -1,34 +1,27 @@
 /**
- * Dev-only hook for regenerating `emdash-env.d.ts` when the schema changes.
+ * Dev-only signal for regenerating `emdash-env.d.ts` when the schema changes.
  *
- * The Astro integration registers an environment-specific refresh function
- * (filesystem + local HTTP in Node dev, no-op everywhere else). Schema
- * mutation code just triggers the hook, so runtime modules stay free of
- * Node-only I/O.
+ * Schema mutations send an event over the Vite module runner's hot channel;
+ * the Astro integration listens for it in Node and does the filesystem work.
+ * The hot channel crosses realms (workerd under the Cloudflare adapter), and
+ * runtime modules stay free of Node-only I/O. When HMR is disabled there is
+ * no hot channel, so the integration also registers a same-realm global.
  */
 
-const REFRESH_FN_KEY = "__emdashDevTypegenRefresh";
+export const DEV_TYPEGEN_REFRESH_EVENT = "emdash:typegen-refresh";
 
-export interface DevTypegenRefreshFn {
-	(db: unknown): void | Promise<void>;
-}
+export const DEV_TYPEGEN_REFRESH_GLOBAL = "__emdashDevTypegenRefresh";
 
-export function setDevTypegenRefresh(fn: DevTypegenRefreshFn): void {
-	if (typeof globalThis !== "undefined") {
-		Reflect.set(globalThis, REFRESH_FN_KEY, fn);
-	}
-}
-
-export function refreshDevTypes(db: unknown): void {
+export function refreshDevTypes(): void {
 	if (typeof import.meta.env === "undefined" || !import.meta.env.DEV) return;
 
-	const fn = Reflect.get(globalThis, REFRESH_FN_KEY);
-	if (typeof fn !== "function") return;
-
 	try {
-		Promise.resolve(fn(db)).catch((error: unknown) => {
-			console.error("[emdash] dev typegen refresh failed:", error);
-		});
+		if (import.meta.hot) {
+			import.meta.hot.send(DEV_TYPEGEN_REFRESH_EVENT);
+			return;
+		}
+		const fn = Reflect.get(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL);
+		if (typeof fn === "function") fn();
 	} catch (error) {
 		console.error("[emdash] dev typegen refresh failed:", error);
 	}

package/src/astro/integration/dev-typegen.ts

@@ -1,12 +1,41 @@
 import type { AstroIntegrationLogger } from "astro";
 
+import { DEV_TYPEGEN_REFRESH_EVENT, DEV_TYPEGEN_REFRESH_GLOBAL } from "../dev-typegen.js";
+
+interface DevServerEnvironments {
+	environments: Record<
+		string,
+		{
+			config: { consumer: string };
+			hot: { on(event: string, listener: () => void): void };
+		}
+	>;
+}
+
+/**
+ * Call `refresh` whenever server-side code in any Vite environment reports a
+ * schema change. Schema mutations can run in a separate realm from the
+ * integration (workerd under the Cloudflare adapter), so the signal travels
+ * over each environment's hot channel. The global covers same-realm SSR when
+ * HMR is disabled and modules have no hot channel.
+ */
+export function listenForDevTypegenRefresh(
+	server: DevServerEnvironments,
+	refresh: () => void,
+): void {
+	for (const environment of Object.values(server.environments)) {
+		if (environment.config.consumer !== "server") continue;
+		environment.hot.on(DEV_TYPEGEN_REFRESH_EVENT, () => refresh());
+	}
+	Reflect.set(globalThis, DEV_TYPEGEN_REFRESH_GLOBAL, refresh);
+}
+
 /**
  * Create a debounced refresh function that fetches the generated types from
  * the dev server and writes them to `emdash-env.d.ts` in the project root.
  *
- * This runs in the Astro integration (Node) and is registered for schema
- * mutations to call back into. It never runs in production builds or in
- * workerd SSR isolates, because only the integration registers it.
+ * This runs in the Astro integration (Node), never in production builds or
+ * in workerd SSR isolates.
  */
 export function createDebouncedTypegenRefresh(
 	port: number,