emdash 1.1.0 → 1.3.0

package/src/astro/routes/api/content/[collection]/[id]/permanent.ts

@@ -8,6 +8,7 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -26,7 +27,7 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, id] });
+	await invalidateRouteCache(cache, [collection, id]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/publish.ts

@@ -18,6 +18,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentPublishBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -98,7 +99,7 @@ export async function publishContent(
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 }

package/src/astro/routes/api/content/[collection]/[id]/restore.ts

@@ -8,6 +8,7 @@ import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -50,7 +51,7 @@ export const POST: APIRoute = async ({ params, locals, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/schedule.ts

@@ -12,6 +12,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentScheduleBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -84,7 +85,7 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId ?? id] });
+	await invalidateRouteCache(cache, [collection, resolvedId ?? id]);
 
 	return unwrapResult(result);
 };
@@ -128,7 +129,7 @@ export const DELETE: APIRoute = async ({ params, locals, url, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId ?? id] });
+	await invalidateRouteCache(cache, [collection, resolvedId ?? id]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/terms/[taxonomy].ts

@@ -7,11 +7,12 @@
 
 import type { APIRoute } from "astro";
 
-import { requirePerm, requireOwnerPerm } from "#api/authorize.js";
+import { requireAnyPerm, requireEntryEditPerm, requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError, requireDb } from "#api/error.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentTermsBody } from "#api/schemas.js";
 import { taxonomyTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 import { ContentRepository } from "#db/repositories/content.js";
 import {
 	TaxonomyRepository,
@@ -111,7 +112,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
-	const denied = requirePerm(user, "content:edit_own");
+	const denied = requireAnyPerm(user, ["content:edit_own", "content:edit_own_drafts"]);
 	if (denied) return denied;
 
 	if (!emdash.handleContentGet) {
@@ -141,7 +142,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 				(existingData.item as Record<string, unknown>)
 			: existingData;
 	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
-	const editDenied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	const editDenied = requireEntryEditPerm(user, { authorId, status: existingItem?.status });
 	if (editDenied) return editDenied;
 
 	// Resolve the canonical content ID from the handler result.
@@ -190,7 +191,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 					: [];
 			const tags = [collection, ...new Set([canonicalId, ...siblingIds]), taxonomyTag(taxonomy)];
 			for (const tagBatch of chunks(tags, MAX_CACHE_PURGE_TAGS)) {
-				await cache.invalidate({ tags: tagBatch });
+				await invalidateRouteCache(cache, tagBatch);
 			}
 		}
 

package/src/astro/routes/api/content/[collection]/[id]/unpublish.ts

@@ -11,6 +11,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentRevisionConditionBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -70,7 +71,7 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id].ts

@@ -9,11 +9,17 @@
 import { hasPermission } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
-import { requirePerm, requireOwnerPerm } from "#api/authorize.js";
+import {
+	entryEditAccess,
+	requireEntryEditPerm,
+	requireOwnerPerm,
+	requirePerm,
+} from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentUpdateBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -100,8 +106,14 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 				(existingData.item as Record<string, unknown>)
 			: existingData;
 	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
-	const editDenied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	const entry = { authorId, status: existingItem?.status };
+	const editDenied = requireEntryEditPerm(user, entry);
 	if (editDenied) return editDenied;
+	// A draft-only grant covers the entry only while it is a draft. Conditioning
+	// the save on the checked revision makes it fail if the entry is published
+	// between this check and the write.
+	const checkedRev = typeof existingData?._rev === "string" ? existingData._rev : undefined;
+	const rev = entryEditAccess(user, entry) === "draft" ? (body._rev ?? checkedRev) : body._rev;
 
 	// Only EDITOR+ can write publishedAt directly — incl. clearing to null.
 	if (body.publishedAt !== undefined && !hasPermission(user, "content:publish_any")) {
@@ -137,14 +149,14 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 	const result = await emdash.handleContentUpdate(collection, resolvedId, {
 		...writeBody,
 		locale,
-		_rev: body._rev,
+		_rev: rev,
 		actor,
 	});
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled && result.liveContentChanged !== false) {
-		await cache.invalidate({ tags: [collection, resolvedId] });
+	if (result.liveContentChanged !== false) {
+		await invalidateRouteCache(cache, [collection, resolvedId]);
 	}
 
 	return unwrapResult(result);
@@ -203,7 +215,7 @@ export const DELETE: APIRoute = async ({ params, locals, url, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/index.ts

@@ -38,7 +38,7 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 	return unwrapResult(result);
 };
 
-export const POST: APIRoute = async ({ params, request, locals, cache }) => {
+export const POST: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	if (!emdash?.handleContentCreate || !emdash?.handleContentGet) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
@@ -90,9 +90,5 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 		actor,
 	});
 
-	if (!result.success) return unwrapResult(result);
-
-	if (cache?.enabled) await cache.invalidate({ tags: [collection] });
-
 	return unwrapResult(result, 201);
 };

package/src/astro/routes/api/dashboard.ts

@@ -4,6 +4,7 @@
  * GET /_emdash/api/dashboard - Collection counts, media/user counts, recent items
  */
 
+import { hasPermission } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
@@ -23,7 +24,9 @@ export const GET: APIRoute = async ({ locals }) => {
 	}
 
 	try {
-		const result = await handleDashboardStats(emdash.db);
+		const result = await handleDashboardStats(emdash.db, {
+			includeDrafts: hasPermission(user, "content:read_drafts"),
+		});
 
 		return unwrapResult(result);
 	} catch (error) {

package/src/astro/routes/api/dev/scheduled-tasks.ts

@@ -0,0 +1,20 @@
+import type { APIRoute } from "astro";
+
+import { apiError } from "#api/error.js";
+
+import { runScheduledTasks } from "../../../middleware.js";
+
+export const prerender = false;
+
+/**
+ * Cloudflare development bridge for EmDash-owned scheduled maintenance.
+ * The integration injects this route only during Cloudflare `astro dev`.
+ */
+export const POST: APIRoute = async () => {
+	if (!import.meta.env.DEV) {
+		return apiError("FORBIDDEN", "Dev maintenance is only available in development mode", 403);
+	}
+
+	await runScheduledTasks();
+	return new Response(null, { status: 204 });
+};

package/src/astro/routes/api/import/wordpress/analyze.ts

@@ -13,6 +13,7 @@ import mime from "mime/lite";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isInternalPostType } from "#import/utils.js";
 import { RESERVED_COLLECTION_SLUGS } from "#schema/types.js";
 import type { EmDashHandlers } from "#types";
 
@@ -423,22 +424,6 @@ function isTypeCompatible(requiredType: string, existingType: string): boolean {
 	return compatible?.includes(existingType) ?? false;
 }
 
-function isInternalPostType(type: string): boolean {
-	return [
-		"revision",
-		"nav_menu_item",
-		"custom_css",
-		"customize_changeset",
-		"oembed_cache",
-		"wp_global_styles",
-		"wp_navigation",
-		"wp_template",
-		"wp_template_part",
-		"attachment", // Handled separately as media
-		"wp_block", // Handled separately as sections (reusable blocks)
-	].includes(type);
-}
-
 function isInternalMetaKey(key: string): boolean {
 	if (key.startsWith("_edit_")) return true;
 	if (key.startsWith("_wp_")) return true;

package/src/astro/routes/api/import/wordpress/execute.ts

@@ -20,7 +20,7 @@ import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { wxrChunkCursor, wxrChunkState, wxrImportConfig } from "#api/schemas.js";
 import { BylineRepository } from "#db/repositories/byline.js";
-import { resolveImportByline } from "#import/utils.js";
+import { relativizeContentLinks, resolveImportByline } from "#import/utils.js";
 import {
 	attachPostTaxonomies,
 	isWxrTaxonomyConflictError,
@@ -83,6 +83,7 @@ export interface ImportConfig {
 export interface ImportResult {
 	success: boolean;
 	imported: number;
+	/** Entries not imported because the slug already exists in the collection and locale. */
 	skipped: number;
 	errors: Array<{ title: string; error: string }>;
 	byCollection: Record<string, number>;
@@ -334,6 +335,8 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			config.locale,
 			authorDisplayNames,
 			taxonomyPlan,
+			new Map(),
+			wxr.site.link,
 		);
 
 		// Import reusable blocks as sections (if enabled)
@@ -418,6 +421,7 @@ async function runContentChunk(
 		authorDisplayNames,
 		taxonomyPlan,
 		translationGroupMap,
+		wxr.site.link,
 	);
 
 	const nextOffset = offset + posts.length;
@@ -465,6 +469,7 @@ export async function importContent(
 	authorDisplayNames: Map<string, string> | undefined,
 	taxonomyPlan: TaxonomyImportPlan,
 	translationGroupMap = new Map<string, string>(),
+	siteUrl = "",
 ): Promise<ImportResult> {
 	const result: ImportResult = {
 		success: true,
@@ -489,9 +494,8 @@ export async function importContent(
 		const postType = post.postType || "post";
 		const mapping = config.postTypeMappings[postType];
 
-		// Skip if not mapped or disabled
+		// Not part of the import: internal post types, or ones left disabled.
 		if (!mapping || !mapping.enabled) {
-			result.skipped++;
 			continue;
 		}
 
@@ -511,6 +515,7 @@ export async function importContent(
 		try {
 			// Convert content to Portable Text
 			const content = post.content ? gutenbergToPortableText(post.content) : [];
+			if (siteUrl) relativizeContentLinks(content, siteUrl);
 
 			// Generate slug from post name or title
 			const slug = post.postName || slugify(post.title || `post-${post.id || Date.now()}`);
@@ -678,6 +683,25 @@ export async function importContent(
 						});
 					}
 				}
+
+				if (
+					createdItem &&
+					post.status === "future" &&
+					createdAt &&
+					Date.parse(createdAt) > Date.now()
+				) {
+					const scheduled = await emdash.handleContentSchedule(
+						collection,
+						createdItem.id,
+						createdAt,
+					);
+					if (!scheduled.success) {
+						result.errors.push({
+							title: post.title || "Untitled",
+							error: `Imported as draft but failed to schedule: ${scheduled.error?.message ?? "Unknown error"}`,
+						});
+					}
+				}
 			} else {
 				result.errors.push({
 					title: post.title || "Untitled",

package/src/astro/routes/api/import/wordpress/rewrite-url-helpers.ts

@@ -106,6 +106,10 @@ export interface PortableTextBlock {
 	// For nested content like galleries
 	images?: PortableTextBlock[];
 	columns?: Array<{ content?: PortableTextBlock[] }>;
+	content?: PortableTextBlock[];
+	markDefs?: Array<Record<string, unknown>>;
+	rows?: Array<{ cells?: Array<{ markDefs?: Array<Record<string, unknown>> }> }>;
+	buttons?: Array<Record<string, unknown>>;
 	[key: string]: unknown;
 }
 
@@ -120,54 +124,88 @@ export function rewritePortableTextUrls(
 	let changed = false;
 	let urlsRewritten = 0;
 
-	for (const block of blocks) {
-		// Handle image blocks
-		if (block._type === "image" && block.asset?.url) {
-			const newUrl = findMatchingUrl(block.asset.url, exactMap, baseMap);
-			if (newUrl) {
-				block.asset.url = newUrl;
-				block.asset._ref = newUrl; // Also update the reference
-				changed = true;
-				urlsRewritten++;
-			}
-		}
-
-		// Handle image link URLs (for linked images). The link is a bare string on
-		// freshly imported content and `{ href, blank? }` once edited in the editor.
-		if (block._type === "image" && block.link) {
-			const linkHref = typeof block.link === "string" ? block.link : block.link.href;
-			const newUrl = linkHref ? findMatchingUrl(linkHref, exactMap, baseMap) : null;
-			if (newUrl) {
-				if (typeof block.link === "string") {
-					block.link = newUrl;
-				} else {
-					block.link.href = newUrl;
-				}
-				changed = true;
-				urlsRewritten++;
-			}
+	const rewriteField = (target: Record<string, unknown>, key: string): boolean => {
+		const value = target[key];
+		const newUrl = typeof value === "string" ? findMatchingUrl(value, exactMap, baseMap) : null;
+		if (!newUrl) return false;
+		target[key] = newUrl;
+		changed = true;
+		urlsRewritten++;
+		return true;
+	};
+	const rewriteHtml = (target: Record<string, unknown>, count = true) => {
+		if (typeof target.html !== "string") return;
+		const result = rewriteStringUrls(target.html, exactMap, baseMap);
+		if (result.changed) {
+			target.html = result.newValue;
+			changed = true;
+			if (count) urlsRewritten += result.urlsRewritten;
 		}
-
-		// Handle gallery blocks with nested images
-		if (block._type === "gallery" && Array.isArray(block.images)) {
-			const result = rewritePortableTextUrls(block.images, exactMap, baseMap);
-			if (result.changed) {
-				changed = true;
-				urlsRewritten += result.urlsRewritten;
-			}
+	};
+	const rewriteMarkDefs = (markDefs: Array<Record<string, unknown>> | undefined) => {
+		for (const def of markDefs ?? []) rewriteField(def, "href");
+	};
+	const rewriteNested = (content: PortableTextBlock[] | undefined) => {
+		if (!Array.isArray(content)) return;
+		const result = rewritePortableTextUrls(content, exactMap, baseMap);
+		if (result.changed) {
+			changed = true;
+			urlsRewritten += result.urlsRewritten;
 		}
+	};
 
-		// Handle columns blocks with nested content
-		if (block._type === "columns" && Array.isArray(block.columns)) {
-			for (const column of block.columns) {
-				if (Array.isArray(column.content)) {
-					const result = rewritePortableTextUrls(column.content, exactMap, baseMap);
-					if (result.changed) {
+	for (const block of blocks) {
+		switch (block._type) {
+			case "image":
+				if (block.asset?.url) {
+					const newUrl = findMatchingUrl(block.asset.url, exactMap, baseMap);
+					if (newUrl) {
+						block.asset.url = newUrl;
+						block.asset._ref = newUrl; // Also update the reference
 						changed = true;
-						urlsRewritten += result.urlsRewritten;
+						urlsRewritten++;
 					}
 				}
-			}
+				// The link is a bare string on freshly imported content and
+				// `{ href, blank? }` once edited in the editor.
+				if (typeof block.link === "string") {
+					rewriteField(block, "link");
+				} else if (block.link) {
+					rewriteField(block.link, "href");
+				}
+				break;
+			case "gallery":
+				rewriteNested(block.images);
+				break;
+			case "columns":
+				for (const column of block.columns ?? []) rewriteNested(column.content);
+				break;
+			case "cover":
+				rewriteField(block, "backgroundImage");
+				rewriteNested(block.content);
+				break;
+			case "block":
+				rewriteMarkDefs(block.markDefs);
+				break;
+			case "table":
+				for (const row of block.rows ?? []) {
+					for (const cell of row.cells ?? []) rewriteMarkDefs(cell.markDefs);
+				}
+				break;
+			case "file":
+			case "button":
+				rewriteField(block, "url");
+				break;
+			case "embed":
+				// The html carries the same media URL; count it only when the url didn't match
+				rewriteHtml(block, !rewriteField(block, "url"));
+				break;
+			case "htmlBlock":
+				rewriteHtml(block);
+				break;
+			case "buttons":
+				for (const button of block.buttons ?? []) rewriteField(button, "url");
+				break;
 		}
 	}
 

package/src/astro/routes/api/import/wordpress-plugin/analyze.ts

@@ -14,7 +14,7 @@ import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { wpPluginAnalyzeBody } from "#api/schemas.js";
-import { getSource } from "#import/index.js";
+import { getSource, SiteChallengeError } from "#import/index.js";
 import { resolveAndValidateExternalUrl, SsrfError } from "#import/ssrf.js";
 import type { ImportAnalysis } from "#import/types.js";
 import type { EmDashHandlers } from "#types";
@@ -69,6 +69,9 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			analysis,
 		});
 	} catch (error) {
+		if (error instanceof SiteChallengeError) {
+			return apiError("WP_SITE_CHALLENGE", error.message, 502);
+		}
 		return handleError(error, "Failed to analyze WordPress site", "WP_PLUGIN_ANALYZE_ERROR");
 	}
 };