emdash 0.9.0 → 0.11.0

package/src/api/handlers/content.ts

@@ -27,6 +27,7 @@ import { invalidateRedirectCache } from "../../redirects/cache.js";
 import { isMissingTableError } from "../../utils/db-errors.js";
 import { encodeRev, validateRev } from "../rev.js";
 import type { ApiResult, ContentListResponse, ContentResponse } from "../types.js";
+import { validateMediaFields } from "./validate-media-fields.js";
 
 /**
  * Narrow a caught error to one carrying a structured `apiError` discriminant.
@@ -444,6 +445,9 @@ export async function handleContentCreate(
 			};
 		}
 
+		const mimeCheck = await validateMediaFields(db, collection, body.data);
+		if (!mimeCheck.success) return mimeCheck;
+
 		// Wrap content + SEO writes in a transaction for atomicity
 		const item = await withTransaction(db, async (trx) => {
 			const repo = new ContentRepository(trx);
@@ -476,6 +480,17 @@ export async function handleContentCreate(
 			}
 			await hydrateBylines(trx, collection, created);
 
+			// When this row is a translation of an existing item, inherit the
+			// source's taxonomy assignments. The pivot stores translation_groups
+			// so the copied rows apply to every locale of the translation group
+			// (existing per-locale assignments still resolve correctly in
+			// `getEntryTerms` because the join picks the locale-specific row).
+			if (body.translationOf) {
+				const { TaxonomyRepository } = await import("../../database/repositories/taxonomy.js");
+				const taxRepo = new TaxonomyRepository(trx);
+				await taxRepo.copyEntryTerms(collection, body.translationOf, created.id);
+			}
+
 			// Side-write SEO data if provided
 			if (body.seo && hasSeo) {
 				const seoRepo = new SeoRepository(trx);
@@ -580,6 +595,11 @@ export async function handleContentUpdate(
 			};
 		}
 
+		if (body.data) {
+			const mimeCheck = await validateMediaFields(db, collection, body.data);
+			if (!mimeCheck.success) return mimeCheck;
+		}
+
 		const repo = new ContentRepository(db);
 
 		// Resolve slug → ID if needed

package/src/api/handlers/dashboard.ts

@@ -140,21 +140,22 @@ async function fetchRecentItems(
 
 	const collectionsWithTitle = new Set(titleFields.map((r) => r.collection_slug));
 
-	// Build a UNION ALL query across all content tables.
-	// Each branch is wrapped in SELECT * FROM (...) so the inner
-	// ORDER BY + LIMIT is valid SQLite (bare ORDER BY inside UNION
-	// branches is a syntax error in SQLite).
-	const subQueries = collections.map((col) => {
-		validateIdentifier(col.slug);
-		const table = `ec_${col.slug}`;
-		const hasTitle = collectionsWithTitle.has(col.slug);
-
-		// Use title column if it exists, otherwise fall back to slug → id.
-		// All output uses snake_case to avoid SQLite quoting issues on D1.
-		const titleExpr = hasTitle ? sql`COALESCE(title, slug, id)` : sql`COALESCE(slug, id)`;
-
-		return sql<RecentItemRow>`
-			SELECT * FROM (
+	// Issue one query per collection in parallel, then merge in JS.
+	// A single UNION ALL across N collections trips D1's
+	// SQLITE_LIMIT_COMPOUND_SELECT cap when N is large enough (#895);
+	// per-collection queries side-step that. Each query fetches at most
+	// 10 rows, so the merge handles at most N * 10 rows before slicing.
+	const perCollection = await Promise.all(
+		collections.map(async (col) => {
+			validateIdentifier(col.slug);
+			const table = `ec_${col.slug}`;
+			const hasTitle = collectionsWithTitle.has(col.slug);
+
+			// Use title column if it exists, otherwise fall back to slug, id.
+			// All output uses snake_case to avoid SQLite quoting issues on D1.
+			const titleExpr = hasTitle ? sql`COALESCE(title, slug, id)` : sql`COALESCE(slug, id)`;
+
+			const result = await sql<RecentItemRow>`
 				SELECT
 					id,
 					${sql.lit(col.slug)} AS collection,
@@ -168,27 +169,19 @@ async function fetchRecentItems(
 				WHERE deleted_at IS NULL
 				ORDER BY updated_at DESC
 				LIMIT 10
-			)
-		`;
-	});
-
-	// Combine with UNION ALL
-	// eslint-disable-next-line typescript-eslint(no-unnecessary-type-assertion) -- noUncheckedIndexedAccess
-	let combined = subQueries[0]!;
-	for (let i = 1; i < subQueries.length; i++) {
-		// eslint-disable-next-line typescript-eslint(no-unnecessary-type-assertion) -- noUncheckedIndexedAccess
-		combined = sql<RecentItemRow>`${combined} UNION ALL ${subQueries[i]!}`;
-	}
-
-	// Final sort + limit across all branches
-	const result = await sql<RecentItemRow>`
-		SELECT * FROM (${combined})
-		ORDER BY updated_at DESC
-		LIMIT 10
-	`.execute(db);
-
-	// Map snake_case DB rows → camelCase API shape
-	return result.rows.map((row) => ({
+			`.execute(db);
+			return result.rows;
+		}),
+	);
+
+	// Merge across collections, sort by updated_at desc, take top 10.
+	const merged = perCollection
+		.flat()
+		.toSorted((a, b) => (a.updated_at < b.updated_at ? 1 : a.updated_at > b.updated_at ? -1 : 0))
+		.slice(0, 10);
+
+	// Map snake_case DB rows to camelCase API shape
+	return merged.map((row) => ({
 		id: row.id,
 		collection: row.collection,
 		collectionLabel: row.collection_label,

package/src/api/handlers/media-allowlist.ts

@@ -0,0 +1,40 @@
+import type { Kysely } from "kysely";
+
+import type { Database } from "../../database/types.js";
+import { parseAllowedMimeTypes } from "../../media/mime.js";
+
+/**
+ * MIME types allowed for upload by default (when no field-specific list
+ * overrides this). Entries ending with "/" are prefix-matched (e.g.
+ * "image/" matches "image/jpeg", "image/png", etc.).
+ */
+export const GLOBAL_UPLOAD_ALLOWLIST: readonly string[] = [
+	"image/",
+	"video/",
+	"audio/",
+	"application/pdf",
+];
+
+/**
+ * Resolve the MIME allowlist for a specific field.
+ *
+ * Returns the field's `allowedMimeTypes` list when the field exists, is of
+ * type "file" or "image", and has a non-empty list configured. Returns null
+ * in all other cases — callers should fall back to GLOBAL_UPLOAD_ALLOWLIST.
+ *
+ * Authentication is the caller's responsibility (the upload routes already
+ * gate on `media:upload`).
+ */
+export async function resolveFieldAllowlist(
+	db: Kysely<Database>,
+	fieldId: string,
+): Promise<string[] | null> {
+	const row = await db
+		.selectFrom("_emdash_fields")
+		.select(["type", "validation"])
+		.where("id", "=", fieldId)
+		.where("type", "in", ["file", "image"])
+		.executeTakeFirst();
+
+	return row ? parseAllowedMimeTypes(row.validation) : null;
+}

package/src/api/handlers/media.ts

@@ -26,7 +26,7 @@ export async function handleMediaList(
 	params: {
 		cursor?: string;
 		limit?: number;
-		mimeType?: string;
+		mimeType?: string | readonly string[];
 	},
 ): Promise<ApiResult<MediaListResponse>> {
 	try {