emdash 1.1.0 → 1.3.0

package/src/api/site-url.ts

@@ -1,10 +1,10 @@
 /**
  * Resolve the canonical site base URL for use in outbound links (emails, etc.).
  *
- * Precedence mirrors `getPublicOrigin`: the operator-configured origin
- * (`config.siteUrl`, then the `EMDASH_SITE_URL`/`SITE_URL` env vars) wins,
- * then the stored `emdash:site_url` option (written once during setup on the
- * real domain), and only before setup completes does the request URL fill in.
+ * Precedence: the operator-configured origin (`config.siteUrl`, then the
+ * `EMDASH_SITE_URL`/`SITE_URL` env vars), then the **Site URL** an admin set
+ * in Settings > General (`site:url`, origin only), then the `emdash:site_url` option
+ * written once during setup, and only before setup completes the request URL.
  * A configured or stored value always beats the request, so Host header
  * spoofing cannot redirect users to attacker-controlled domains.
  */
@@ -15,6 +15,49 @@ import { OptionsRepository } from "../database/repositories/options.js";
 import type { Database } from "../database/types.js";
 import { getConfiguredOrigin, type SiteUrlConfig } from "./public-url.js";
 
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+/** Sign-in tokens travel in these links, so plain HTTP is only accepted for loopback hosts. */
+function siteUrlSettingOrigin(value: unknown): string | undefined {
+	if (typeof value !== "string" || !URL.canParse(value)) return undefined;
+	const url = new URL(value);
+	if (url.protocol === "https:") return url.origin;
+	if (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname)) return url.origin;
+	return undefined;
+}
+
+/**
+ * The site's public origin for outbound links, in the precedence order
+ * described above. `siteUrlSetting` and `setupUrl` are the stored
+ * `site:url` and `emdash:site_url` option values.
+ */
+export function resolveSiteOrigin(
+	config: SiteUrlConfig | undefined,
+	siteUrlSetting: unknown,
+	setupUrl: unknown,
+): string | undefined {
+	return (
+		getConfiguredOrigin(config) ??
+		siteUrlSettingOrigin(siteUrlSetting) ??
+		(typeof setupUrl === "string" && setupUrl ? setupUrl : undefined)
+	);
+}
+
+/**
+ * The origin chosen for the site: the configured origin, then the **Site URL**.
+ * Unlike `getSiteBaseUrl`, it never falls back to the origin recorded during
+ * setup, which may be an address the site has since moved away from.
+ */
+export async function getChosenSiteOrigin(
+	db: Kysely<Database>,
+	config?: SiteUrlConfig,
+): Promise<string | undefined> {
+	return (
+		getConfiguredOrigin(config) ??
+		siteUrlSettingOrigin(await new OptionsRepository(db).get("site:url"))
+	);
+}
+
 export async function getSiteBaseUrl(
 	db: Kysely<Database>,
 	request: Request,
@@ -25,7 +68,12 @@ export async function getSiteBaseUrl(
 		return `${configured}/_emdash`;
 	}
 	const options = new OptionsRepository(db);
-	const storedUrl = await options.get<string>("emdash:site_url");
+	const stored = await options.getMany(["site:url", "emdash:site_url"]);
+	const storedUrl = resolveSiteOrigin(
+		config,
+		stored.get("site:url"),
+		stored.get("emdash:site_url"),
+	);
 	if (storedUrl) {
 		return `${storedUrl}/_emdash`;
 	}

package/src/api/types.ts

@@ -74,6 +74,10 @@ export interface ManifestFieldDescriptor extends FieldDescriptor {
 	unsupportedType?: { type: string; path: string };
 	blockTypes?: BlockType[];
 	blockTypeFingerprint?: string;
+	/** Value a new entry starts with in the admin editor. */
+	defaultValue?: unknown;
+	/** Set on `integer` fields, which share the `number` kind. */
+	integer?: boolean;
 }
 
 export interface FieldDescriptor {

package/src/astro/image-endpoint.ts

@@ -15,9 +15,12 @@ import { GET as genericGET } from "astro/assets/endpoint/generic";
 import { getConfiguredImageService, imageConfig } from "astro:assets";
 
 import {
+	getTransformFingerprint,
 	matchInternalMediaKey,
 	MUTABLE_MEDIA_CACHE_CONTROL,
 	originalMediaHeaders,
+	validatorHeaders,
+	isNotModified,
 } from "../media/image-endpoint.js";
 
 export const prerender = false;
@@ -38,8 +41,33 @@ function isNotFound(error: unknown): boolean {
 	);
 }
 
-function streamOriginal(body: ReadableStream<Uint8Array>, contentType: string): Response {
-	return new Response(body, { status: 200, headers: originalMediaHeaders(contentType) });
+function streamOriginal(
+	body: ReadableStream<Uint8Array>,
+	contentType: string,
+	size: number,
+	lastModified?: Date,
+): Response {
+	return new Response(body, {
+		status: 200,
+		headers: originalMediaHeaders(contentType, size, lastModified),
+	});
+}
+
+function notModifiedResponse(
+	contentType: string,
+	size: number,
+	lastModified?: Date,
+	suffix?: string,
+): Response {
+	return new Response(null, {
+		status: 304,
+		headers: {
+			"Content-Type": contentType,
+			"Cache-Control": MUTABLE_MEDIA_CACHE_CONTROL,
+			"X-Content-Type-Options": "nosniff",
+			...validatorHeaders(size, lastModified, suffix),
+		},
+	});
 }
 
 export const GET: APIRoute = async (ctx) => {
@@ -59,11 +87,24 @@ export const GET: APIRoute = async (ctx) => {
 
 		// Only raster images are transformable; serve anything else unchanged.
 		if (!source.contentType.startsWith("image/")) {
-			return streamOriginal(source.body, source.contentType);
+			if (isNotModified(ctx.request, source.size, source.lastModified)) {
+				return notModifiedResponse(source.contentType, source.size, source.lastModified);
+			}
+			return streamOriginal(source.body, source.contentType, source.size, source.lastModified);
 		}
 
 		const transform = await service.parseURL(url, imageConfig);
-		if (!transform) return streamOriginal(source.body, source.contentType);
+		if (!transform) {
+			if (isNotModified(ctx.request, source.size, source.lastModified)) {
+				return notModifiedResponse(source.contentType, source.size, source.lastModified);
+			}
+			return streamOriginal(source.body, source.contentType, source.size, source.lastModified);
+		}
+
+		const fingerprint = getTransformFingerprint(url.searchParams);
+		if (isNotModified(ctx.request, source.size, source.lastModified, fingerprint)) {
+			return notModifiedResponse(source.contentType, source.size, source.lastModified, fingerprint);
+		}
 
 		const inputBuffer = new Uint8Array(await new Response(source.body).arrayBuffer());
 		const { data, format } = await service.transform(inputBuffer, transform, imageConfig);
@@ -74,6 +115,7 @@ export const GET: APIRoute = async (ctx) => {
 				"Content-Type": FORMAT_MIME[format] ?? source.contentType,
 				"Cache-Control": MUTABLE_MEDIA_CACHE_CONTROL,
 				"X-Content-Type-Options": "nosniff",
+				...validatorHeaders(source.size, source.lastModified, fingerprint),
 			},
 		});
 	} catch (error) {

package/src/astro/integration/admin-locales.ts

@@ -0,0 +1,168 @@
+/**
+ * Build-time support for the `admin.locales` allowlist: validates it against
+ * the catalogs the installed admin package ships, and keeps excluded catalogs
+ * out of the bundle by resolving their imports to the source-locale catalog.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { posix, resolve } from "node:path";
+
+import type { Plugin } from "vite";
+
+const SOURCE_LOCALE = "en";
+const MANIFEST_FILE = "locales-manifest.json";
+const QUERY_RE = /[?#].*$/;
+
+/** Locale code mapped to its catalog chunk, relative to the admin dist directory. */
+export type AdminLocaleManifest = Record<string, string>;
+
+function isStringRecord(value: unknown): value is Record<string, string> {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		!Array.isArray(value) &&
+		Object.values(value).every((entry) => typeof entry === "string")
+	);
+}
+
+/**
+ * Read the locale manifest emitted by the `@emdash-cms/admin` build. Throws if
+ * it is missing, malformed, lacks the source locale, or names a chunk that is
+ * not in the dist directory.
+ */
+export function readAdminLocaleManifest(adminDistPath: string): AdminLocaleManifest {
+	const manifestPath = resolve(adminDistPath, MANIFEST_FILE);
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+	} catch (error) {
+		throw new Error(
+			`\`admin.locales\` needs the admin locale manifest at ${manifestPath}, but it could not be read. ` +
+				"Reinstall or rebuild @emdash-cms/admin.",
+			{ cause: error },
+		);
+	}
+
+	const locales =
+		typeof parsed === "object" && parsed !== null && "locales" in parsed
+			? parsed.locales
+			: undefined;
+	if (!isStringRecord(locales) || !Object.hasOwn(locales, SOURCE_LOCALE)) {
+		throw new Error(
+			`The admin locale manifest at ${manifestPath} is invalid: expected a "locales" object ` +
+				`mapping locale codes to chunk files, including "${SOURCE_LOCALE}". ` +
+				"Reinstall or rebuild @emdash-cms/admin.",
+		);
+	}
+
+	for (const [code, chunk] of Object.entries(locales)) {
+		if (!existsSync(resolve(adminDistPath, chunk))) {
+			throw new Error(
+				`The admin locale manifest at ${manifestPath} lists "${chunk}" for "${code}", ` +
+					"but that file does not exist. Reinstall or rebuild @emdash-cms/admin.",
+			);
+		}
+	}
+
+	return locales;
+}
+
+function canonicalizeLocale(code: string): string | undefined {
+	try {
+		return new Intl.Locale(code.trim()).baseName;
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Resolve a user-supplied `admin.locales` list to the admin's own locale
+ * codes. Matching ignores case and surrounding whitespace, the source locale
+ * is always included first, and duplicates are dropped. Throws, naming every
+ * unrecognized entry and listing the available codes, if any entry does not
+ * match an available locale.
+ */
+export function resolveAdminLocales(requested: unknown, available: Iterable<string>): string[] {
+	if (!Array.isArray(requested)) {
+		throw new Error("`admin.locales` must be an array of locale codes.");
+	}
+	const entries: unknown[] = requested;
+
+	const byCanonical = new Map<string, string>();
+	for (const code of available) {
+		byCanonical.set(canonicalizeLocale(code) ?? code, code);
+	}
+
+	const resolved = new Set([SOURCE_LOCALE]);
+	const unknownEntries: string[] = [];
+	for (const entry of entries) {
+		const canonical = typeof entry === "string" ? canonicalizeLocale(entry) : undefined;
+		const code = canonical === undefined ? undefined : byCanonical.get(canonical);
+		if (code === undefined) {
+			unknownEntries.push(String(JSON.stringify(entry)));
+		} else {
+			resolved.add(code);
+		}
+	}
+
+	if (unknownEntries.length > 0) {
+		const availableCodes = [...byCanonical.values()].toSorted().join(", ");
+		throw new Error(
+			`Unknown admin locale${unknownEntries.length === 1 ? "" : "s"} in \`admin.locales\`: ` +
+				`${unknownEntries.join(", ")}. Available locales: ${availableCodes}.`,
+		);
+	}
+
+	return [...resolved];
+}
+
+function toVitePath(path: string): string {
+	return path.replaceAll("\\", "/");
+}
+
+interface AdminLocaleResolverOptions {
+	adminDistPath: string;
+	/** Set in dev when the admin package is aliased to its source. */
+	adminSourcePath?: string;
+	locales: readonly string[];
+	manifest: AdminLocaleManifest;
+}
+
+/**
+ * Vite plugin that resolves imports of excluded admin catalogs to the source
+ * locale's catalog, so the excluded catalogs are never bundled. Covers both
+ * the built admin package (hashed chunks listed in the manifest) and, in dev,
+ * the admin source (`./<code>/messages.mjs`).
+ */
+export function createAdminLocaleResolverPlugin(options: AdminLocaleResolverOptions): Plugin {
+	const { manifest } = options;
+	const sourceLocaleChunk = manifest[SOURCE_LOCALE];
+	if (sourceLocaleChunk === undefined) {
+		throw new Error(`The admin locale manifest has no "${SOURCE_LOCALE}" catalog.`);
+	}
+
+	const allowed = new Set(options.locales);
+	const distDir = toVitePath(options.adminDistPath);
+	const sourceDir = options.adminSourcePath ? toVitePath(options.adminSourcePath) : undefined;
+	const redirects = new Map<string, string>();
+	for (const [code, chunk] of Object.entries(manifest)) {
+		if (code === SOURCE_LOCALE || allowed.has(code)) continue;
+		redirects.set(posix.join(distDir, chunk), posix.join(distDir, sourceLocaleChunk));
+		if (sourceDir) {
+			redirects.set(
+				posix.join(sourceDir, "locales", code, "messages.mjs"),
+				posix.join(distDir, "locales", SOURCE_LOCALE, "messages.mjs"),
+			);
+		}
+	}
+
+	return {
+		name: "emdash-admin-locales",
+		enforce: "pre",
+		resolveId(source, importer) {
+			if (!importer || !source.startsWith(".")) return;
+			const importerDir = posix.dirname(toVitePath(importer).replace(QUERY_RE, ""));
+			return redirects.get(posix.join(importerDir, source.replace(QUERY_RE, "")));
+		},
+	};
+}

package/src/astro/integration/dev-env.ts

@@ -0,0 +1,84 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const DEV_ENV_SECRET_VAR_NAMES = new Set(["EMDASH_ENCRYPTION_KEY"]);
+const NEWLINE_RE = /\r?\n/;
+
+/**
+ * Parse a minimal subset of dotenv syntax, enough for the local secrets
+ * scaffolder and common user edits. Inline comments, blank lines, and
+ * lines without an `=` are ignored; leading/trailing whitespace is trimmed.
+ * Single and double quotes are stripped; no variable expansion is performed.
+ */
+function parseDotenv(content: string): Record<string, string> {
+	const result: Record<string, string> = {};
+	for (const rawLine of content.split(NEWLINE_RE)) {
+		const line = stripInlineComment(rawLine).trim();
+		if (line === "" || line.startsWith("#")) continue;
+
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+
+		const key = line.slice(0, eq).trim();
+		let value = line.slice(eq + 1).trim();
+
+		// Strip matching quote pair. Keep escaped quotes simple: only unescape
+		// the quote char that wrapped the value.
+		if (value.length >= 2) {
+			const first = value[0];
+			const last = value.at(-1)!;
+			if ((first === '"' || first === "'") && first === last) {
+				value = value.slice(1, -1).replaceAll(`\\${first}`, first);
+			}
+		}
+
+		result[key] = value;
+	}
+	return result;
+}
+
+/**
+ * Remove an inline `#` comment only if it is not inside a quoted value. This
+ * keeps values like `FOO="a # b"` intact while stripping trailing comments.
+ */
+function stripInlineComment(line: string): string {
+	let inSingleQuote = false;
+	let inDoubleQuote = false;
+	for (let i = 0; i < line.length; i++) {
+		const char = line[i];
+		if (char === "'" && !inDoubleQuote) {
+			inSingleQuote = !inSingleQuote;
+		} else if (char === '"' && !inSingleQuote) {
+			inDoubleQuote = !inDoubleQuote;
+		} else if (char === "#" && !inSingleQuote && !inDoubleQuote) {
+			return line.slice(0, i);
+		}
+	}
+	return line;
+}
+
+/**
+ * Load the plugin-secret encryption key from the project's `.env` into
+ * `process.env` during `astro dev`. Existing environment variables (e.g.
+ * already exported in the shell, or set by the host platform) are honored and
+ * never overwritten.
+ *
+ * This keeps the deliberate `process.env`-only rule in the secrets module
+ * while letting freshly scaffolded Node sites use the generated encryption key
+ * without a manual `export` step. Other EmDash variables are intentionally not
+ * copied, so `.env` values intended for production do not accidentally replace
+ * generated dev values (for example `SITE_URL`).
+ */
+export function loadDevEnv(root: URL | string): void {
+	const rootPath = typeof root === "string" ? root : fileURLToPath(root);
+	const envPath = join(rootPath, ".env");
+	if (!existsSync(envPath)) return;
+
+	const parsed = parseDotenv(readFileSync(envPath, "utf-8"));
+	for (const [key, value] of Object.entries(parsed)) {
+		if (DEV_ENV_SECRET_VAR_NAMES.has(key) && !process.env[key]) {
+			process.env[key] = value;
+		}
+	}
+}

package/src/astro/integration/dev-scheduler-bridge.ts

@@ -0,0 +1,91 @@
+import type { Server } from "node:http";
+import { request as requestHttps } from "node:https";
+
+import type { AstroIntegrationLogger } from "astro";
+
+const DEFAULT_INTERVAL_MS = 60_000;
+
+interface DevServer {
+	httpServer: Pick<Server, "once"> | null;
+	resolvedUrls: { local: string[]; network: string[] } | null;
+}
+
+interface SchedulerOptions {
+	intervalMs?: number;
+	fetch?: typeof fetch;
+}
+
+function postMaintenance(url: URL): Promise<{ ok: boolean; status: number }> {
+	if (url.protocol !== "https:") return fetch(url, { method: "POST" });
+	// Dev servers commonly run on self-signed or host-mismatch certificates
+	// that Node would reject by default. This request stays inside the local
+	// dev server and the route is dev-only, so accept the certificate to keep
+	// maintenance running without requiring a matching SAN/CN or trusted CA.
+	return new Promise((resolve, reject) => {
+		const request = requestHttps(
+			url,
+			{ method: "POST", rejectUnauthorized: false, agent: false },
+			(response) => {
+				const status = response.statusCode ?? 500;
+				response.once("error", reject);
+				response.once("end", () => resolve({ ok: status >= 200 && status < 300, status }));
+				response.resume();
+			},
+		);
+		request.once("error", reject);
+		request.end();
+	});
+}
+
+export function startDevSchedulerBridge(
+	server: DevServer,
+	logger: Pick<AstroIntegrationLogger, "warn">,
+	options: SchedulerOptions = {},
+): void {
+	const httpServer = server.httpServer;
+	if (!httpServer) return;
+
+	const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+	let stopped = false;
+	let timer: ReturnType<typeof setTimeout> | undefined;
+
+	const schedule = () => {
+		if (stopped) return;
+		timer = setTimeout(() => void run(), intervalMs);
+		if (typeof timer === "object" && "unref" in timer) timer.unref();
+	};
+
+	const run = async () => {
+		try {
+			const origin = server.resolvedUrls?.local[0] ?? server.resolvedUrls?.network[0];
+			if (!origin) {
+				logger.warn("Dev scheduler bridge could not resolve the dev server origin.");
+				return;
+			}
+
+			const base = origin.endsWith("/") ? origin : `${origin}/`;
+			const url = new URL("_emdash/api/dev/scheduled-tasks", base);
+			const response = options.fetch
+				? await options.fetch(url, { method: "POST" })
+				: await postMaintenance(url);
+			if (!response.ok) {
+				logger.warn(
+					`Dev scheduler bridge request failed with status ${response.status}. ` +
+						"Verify that EmDash's dev maintenance route is available.",
+				);
+			}
+		} catch (error) {
+			logger.warn(
+				`Dev scheduler bridge request failed: ${error instanceof Error ? error.message : String(error)}`,
+			);
+		} finally {
+			schedule();
+		}
+	};
+
+	httpServer.once("listening", schedule);
+	httpServer.once("close", () => {
+		stopped = true;
+		if (timer !== undefined) clearTimeout(timer);
+	});
+}