emdash 1.1.0 → 1.3.0

package/src/astro/routes/sitemap.xml.ts

@@ -1,16 +1,17 @@
 /**
  * Sitemap index endpoint
  *
- * GET /sitemap.xml - Sitemap index listing one sitemap per collection.
+ * GET /sitemap.xml - Sitemap index listing the child sitemaps.
  *
- * Each collection with published, indexable content gets its own
- * child sitemap at /sitemap-{collection}.xml. The index includes
- * a <lastmod> per child derived from the most recently updated entry.
+ * Each collection with published, indexable content gets a child sitemap
+ * at /sitemap-{collection}.xml, continued at /sitemap-{collection}-{n}.xml
+ * once it exceeds one page. The index includes a <lastmod> per child
+ * derived from the most recently updated entry on that page.
  */
 
 import type { APIRoute } from "astro";
 
-import { handleSitemapData } from "#api/handlers/seo.js";
+import { handleSitemapIndexData } from "#api/handlers/seo.js";
 import { getPublicOrigin } from "#api/public-url.js";
 import { getSiteSettingsWithDb } from "#settings/index.js";
 
@@ -40,7 +41,7 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			"",
 		);
 
-		const result = await handleSitemapData(emdash.db);
+		const result = await handleSitemapIndexData(emdash.db);
 
 		if (!result.success || !result.data) {
 			return new Response("<!-- Failed to generate sitemap -->", {
@@ -49,18 +50,19 @@ export const GET: APIRoute = async ({ locals, url }) => {
 			});
 		}
 
-		const { collections } = result.data;
+		const { sitemaps } = result.data;
 
 		const lines: string[] = [
 			'<?xml version="1.0" encoding="UTF-8"?>',
 			'<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
 		];
 
-		for (const col of collections) {
-			const loc = `${siteUrl}/sitemap-${encodeURIComponent(col.collection)}.xml`;
+		for (const sitemap of sitemaps) {
+			const suffix = sitemap.page === 1 ? "" : `-${sitemap.page}`;
+			const loc = `${siteUrl}/sitemap-${encodeURIComponent(sitemap.collection)}${suffix}.xml`;
 			lines.push("  <sitemap>");
 			lines.push(`    <loc>${escapeXml(loc)}</loc>`);
-			lines.push(`    <lastmod>${escapeXml(col.lastmod)}</lastmod>`);
+			lines.push(`    <lastmod>${escapeXml(sitemap.lastmod)}</lastmod>`);
 			lines.push("  </sitemap>");
 		}
 

package/src/astro/types.ts

@@ -9,6 +9,7 @@ import type { Element } from "@emdash-cms/blocks";
 import type { Kysely } from "kysely";
 
 import type { ContentFieldFilters } from "../content-list-query.js";
+import type { ContentSeoInput } from "../database/repositories/types.js";
 import type {
 	PluginEditorExtensionDispatch,
 	ResolvedPluginEditorExtension,
@@ -83,6 +84,8 @@ export interface ManifestCollection {
 			id?: string;
 			/** Validation config for the field (e.g. `allowedMimeTypes` for file/image fields, subFields for repeater). */
 			validation?: Record<string, unknown>;
+			/** Value a new entry starts with in the admin editor. */
+			defaultValue?: unknown;
 		}
 	>;
 }
@@ -107,6 +110,7 @@ export interface ManifestPlugin {
 		path: string;
 		label?: string;
 		icon?: string;
+		group?: string;
 	}>;
 	dashboardWidgets?: Array<{
 		id: string;
@@ -163,6 +167,12 @@ export interface EmDashManifest {
 	 * authentication is handled externally.
 	 */
 	authMode: ManifestAuthMode;
+	/**
+	 * Whether the external auth provider replaces user names on every
+	 * authenticated request (`syncName` is not `false`). The admin shows the
+	 * name as managed by the identity provider instead of editable.
+	 */
+	providerManagedName?: boolean;
 	/**
 	 * Whether self-signup is enabled (at least one allowed domain is active).
 	 * Used by the login page to conditionally show the "Sign up" link.
@@ -288,6 +298,7 @@ export interface EmDashHandlers {
 		collection: string,
 		params: {
 			cursor?: string;
+			page?: number;
 			limit?: number;
 			status?: string;
 			orderBy?: string;
@@ -333,6 +344,7 @@ export interface EmDashHandlers {
 			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
 			locale?: string;
 			translationOf?: string;
+			seo?: ContentSeoInput;
 			taxonomies?: Record<string, string[]>;
 			references?: Record<string, string[]>;
 			createdAt?: string | null;
@@ -375,7 +387,7 @@ export interface EmDashHandlers {
 	// Trash handlers
 	handleContentListTrashed: (
 		collection: string,
-		params?: { cursor?: string; limit?: number; locale?: string },
+		params?: { cursor?: string; page?: number; limit?: number; locale?: string },
 	) => Promise<HandlerResponse>;
 
 	handleContentRestore: (collection: string, id: string) => Promise<HandlerResponse>;
@@ -469,6 +481,8 @@ export interface EmDashHandlers {
 		size?: number;
 		width?: number;
 		height?: number;
+		alt?: string;
+		caption?: string;
 		storageKey: string;
 		contentHash?: string;
 		blurhash?: string;
@@ -551,7 +565,14 @@ export interface EmDashHandlers {
 		request: Request,
 	) => Promise<HandlerResponse>;
 
-	// Plugin route metadata (for auth/caching decisions before dispatch)
+	// Public-only plugin route metadata for SSR page components.
+	// Public routes return their meta. Private and unknown routes return null.
+	// Present on both anonymous and signed-in locals so the result does not
+	// change when a visitor logs in.
+	getPublicPluginRouteMeta: (pluginId: string, path: string) => RouteMeta | null;
+
+	// Plugin route metadata (for auth/caching decisions before dispatch).
+	// Signed-in locals only. Private routes return `{ public: false }`.
 	getPluginRouteMeta: (pluginId: string, path: string) => RouteMeta | null;
 	getEnabledPluginMcpTools: () => Promise<
 		Array<{

package/src/auth/rate-limit.ts

@@ -1,18 +1,20 @@
 /**
- * Database-backed rate limiter for unauthenticated endpoints.
+ * Database-backed rate limiter.
  *
  * Uses a `_emdash_rate_limits` table with composite primary key (key, window).
  * Each call to `checkRateLimit` atomically upserts a counter and returns
  * whether the request is within the allowed limit.
  *
- * Key format: `{ip}:{endpoint}` — limits are per-IP, per-endpoint. Callers
- * may pass a salted IP hash instead of the raw address.
+ * Key format: `{subject}:{endpoint}` — limits are per-subject, per-endpoint.
+ * The subject is the client IP (or a salted IP hash) on unauthenticated
+ * endpoints, and the user ID on endpoints that require a session.
  * Window format: ISO timestamp truncated to the window size.
  */
 
 import type { Kysely } from "kysely";
 import { sql } from "kysely";
 
+import { after } from "../after.js";
 import { apiError } from "../api/error.js";
 import type { Database } from "../database/types.js";
 
@@ -32,11 +34,11 @@ export interface RateLimitResult {
 }
 
 /**
- * Check (and increment) the rate limit for a given IP + endpoint.
+ * Check (and increment) the rate limit for a given subject + endpoint.
  *
- * If `ip` is null (no trusted IP available), rate limiting is skipped
- * and the request is allowed. There's no meaningful key to rate limit
- * on when the IP is unknown.
+ * If `subject` is null (for example, no trusted IP available), rate limiting
+ * is skipped and the request is allowed. There's no meaningful key to rate
+ * limit on when the subject is unknown.
  *
  * Returns whether the request is allowed. The counter is always
  * incremented — even when the limit is exceeded — so that repeated
@@ -47,20 +49,19 @@ export interface RateLimitResult {
  */
 export async function checkRateLimit(
 	db: Kysely<Database>,
-	ip: string | null,
+	subject: string | null,
 	endpoint: string,
 	maxRequests: number,
 	windowSeconds: number,
 ): Promise<RateLimitResult> {
-	// No trusted IP — skip rate limiting entirely
-	if (!ip) {
+	if (!subject) {
 		return { allowed: true, count: 0, limit: maxRequests };
 	}
 
 	const windowStart = new Date(
 		Math.floor(Date.now() / (windowSeconds * 1000)) * windowSeconds * 1000,
 	).toISOString();
-	const key = `${ip}:${endpoint}`;
+	const key = `${subject}:${endpoint}`;
 
 	// Atomic upsert: insert or increment, return current count
 	const result = await sql<{ count: number }>`
@@ -75,8 +76,12 @@ export async function checkRateLimit(
 
 	// Piggyback cleanup: 1% chance per request to clean expired entries
 	if (Math.random() < 0.01) {
-		cleanupExpiredRateLimits(db).catch(() => {
-			// Swallow errors — cleanup is best-effort
+		after(async () => {
+			try {
+				await cleanupExpiredRateLimits(db);
+			} catch (error) {
+				console.error("[rate-limit] failed to delete expired entries:", error);
+			}
 		});
 	}
 

package/src/auth/types.ts

@@ -19,7 +19,7 @@ export interface AuthResult {
 	email: string;
 	/** User's display name */
 	name: string;
-	/** Resolved role level (e.g., 50 for Admin, 30 for Editor) */
+	/** Resolved role level (e.g., 50 for Admin, 40 for Editor, 30 for Author) */
 	role: number;
 	/** Provider-specific subject ID */
 	subject?: string;
@@ -186,7 +186,7 @@ export interface ExternalAuthConfig {
 
 	/**
 	 * Role level for users not matching any group in roleMapping
-	 * @default 30 (Editor)
+	 * @default 30 (Author, who can publish their own content)
 	 */
 	defaultRole?: number;
 
@@ -197,6 +197,13 @@ export interface ExternalAuthConfig {
 	 */
 	syncRoles?: boolean;
 
+	/**
+	 * Update user's name from the IdP on every authenticated request
+	 * When false, name is only set on first provisioning, so names edited in the admin are kept
+	 * @default true
+	 */
+	syncName?: boolean;
+
 	/**
 	 * Map IdP group names to EmDash role levels
 	 * First match wins if user is in multiple groups
@@ -205,8 +212,8 @@ export interface ExternalAuthConfig {
 	 * ```ts
 	 * roleMapping: {
 	 *   "Admins": 50,        // Admin
-	 *   "Developers": 40,    // Developer
-	 *   "Content Team": 30,  // Editor
+	 *   "Editors": 40,       // Editor
+	 *   "Content Team": 30,  // Author
 	 * }
 	 * ```
 	 */

package/src/aws-sdk.d.ts

@@ -25,6 +25,7 @@ declare module "@aws-sdk/client-s3" {
 		Body?: SdkStreamMixin;
 		ContentType?: string;
 		ContentLength?: number;
+		ContentRange?: string;
 		ETag?: string;
 		LastModified?: Date;
 	}
@@ -69,7 +70,7 @@ declare module "@aws-sdk/client-s3" {
 	}
 
 	export class GetObjectCommand {
-		constructor(input: { Bucket: string; Key: string });
+		constructor(input: { Bucket: string; Key: string; Range?: string });
 	}
 
 	export class DeleteObjectCommand {

package/src/cache/redirect-paths.ts

@@ -0,0 +1,56 @@
+/**
+ * Cache invalidation specs for redirect source paths.
+ *
+ * The Cloudflare adapter tags cached pages by request pathname
+ * (`astro-path:<pathname>`). When a redirect is written, purging the source
+ * path (and its trailing-slash variant) clears any stale cached page at that
+ * location so the redirect middleware runs on the next request.
+ */
+
+export interface CachePathSpec {
+	path: string;
+}
+
+interface CacheLike {
+	enabled?: boolean;
+	invalidate(spec: CachePathSpec): Promise<unknown>;
+}
+
+function toggledTrailingSlash(path: string): string | null {
+	if (path.length <= 1) return null;
+	return path.endsWith("/") ? path.slice(0, -1) : `${path}/`;
+}
+
+/**
+ * Build cache-invalidation specs for one or more redirect source paths.
+ * Returns each path with and without a trailing slash, deduplicated.
+ */
+export function redirectSourceCachePaths(...sources: string[]): CachePathSpec[] {
+	const paths = new Set<string>();
+	for (const source of sources) {
+		if (!source) continue;
+		paths.add(source);
+		const alt = toggledTrailingSlash(source);
+		if (alt) paths.add(alt);
+	}
+	return Array.from(paths, (path) => ({ path }));
+}
+
+/**
+ * Invalidate the edge cache for one or more redirect source paths.
+ * Failures are logged but not thrown: the redirect mutation has already
+ * been committed and should still return a successful response.
+ */
+export async function invalidateRedirectSourcePaths(
+	cache: CacheLike | undefined,
+	...sources: string[]
+): Promise<void> {
+	if (!cache?.enabled) return;
+	for (const spec of redirectSourceCachePaths(...sources)) {
+		try {
+			await cache.invalidate(spec);
+		} catch (error) {
+			console.error(`[redirects] Failed to invalidate cache for ${spec.path}:`, error);
+		}
+	}
+}

package/src/cache/route-cache.ts

@@ -0,0 +1,22 @@
+import type { APIContext } from "astro";
+
+type RouteCache = Pick<APIContext["cache"], "enabled" | "invalidate">;
+
+/**
+ * Purge `tags` from Astro's route cache when a cache provider is configured.
+ *
+ * Never throws: callers run it after a committed write, and a rejected purge
+ * must not fail that write. The pages stay cached until a later purge or their
+ * `maxAge`.
+ */
+export async function invalidateRouteCache(
+	cache: RouteCache | undefined,
+	tags: string[],
+): Promise<void> {
+	if (!cache?.enabled) return;
+	try {
+		await cache.invalidate({ tags });
+	} catch (error) {
+		console.error(`[cache] Failed to invalidate route cache tags ${tags.join(", ")}:`, error);
+	}
+}

package/src/cleanup.ts

@@ -42,6 +42,32 @@ export interface CleanupResult {
 const REVISION_KEEP_COUNT = 50;
 const REVISION_PRUNE_BATCH_SIZE = 10;
 
+/** Target cadence for full system cleanup. */
+export const SYSTEM_CLEANUP_INTERVAL_MS = 60 * 60 * 1000;
+
+/**
+ * Tolerance when comparing the last cleanup time to the interval. Allows
+ * a tick that fires slightly before the exact hour to still be treated as
+ * the hourly cleanup when the previous one ran at the start of the hour.
+ */
+const SYSTEM_CLEANUP_INTERVAL_TOLERANCE_MS = 5 * 60 * 1000;
+
+/**
+ * Decide whether the full system cleanup should run for this tick.
+ *
+ * Bookkeeping cleanup is expensive on serverless free tiers with tight CPU
+ * budgets, so it runs once per hour on the top of the hour. The per-minute
+ * path keeps only scheduled publishing, cron tasks, and the heartbeat.
+ */
+export function shouldRunSystemCleanup(currentTime: Date, lastRunAt?: Date | null): boolean {
+	if (currentTime.getUTCMinutes() !== 0) return false;
+	if (!lastRunAt) return true;
+	return (
+		currentTime.getTime() - lastRunAt.getTime() >=
+		SYSTEM_CLEANUP_INTERVAL_MS - SYSTEM_CLEANUP_INTERVAL_TOLERANCE_MS
+	);
+}
+
 /**
  * Run all system cleanup tasks.
  *

package/src/cli/commands/export-seed.ts

@@ -47,6 +47,7 @@ import type {
 	SeedBylineCredit,
 	SeedBlockType,
 } from "../../seed/types.js";
+import { classifySetting } from "../../transfer/format/settings.js";
 import { isMissingTableError } from "../../utils/db-errors.js";
 import { slugify } from "../../utils/slugify.js";
 
@@ -391,6 +392,7 @@ async function exportSettings(db: Kysely<Database>): Promise<SeedFile["settings"
 
 	const settings: Record<string, unknown> = {};
 	for (const [key, value] of allOptions) {
+		if (classifySetting(key) === "targetLocal") continue;
 		const settingKey = key.replace(SETTINGS_PREFIX, "");
 		settings[settingKey] = value;
 	}

package/src/cli/commands/import/wordpress.ts

@@ -16,6 +16,7 @@ import pc from "picocolors";
 import { slugify } from "#utils/slugify.js";
 
 import { validateExternalUrl, ssrfSafeFetch } from "../../../import/ssrf.js";
+import { INTERNAL_POST_TYPES, isInternalPostType } from "../../../import/utils.js";
 import { parseWxr, type WxrData, type WxrPost, type WxrAttachment } from "../../wxr/parser.js";
 
 // Regex patterns for WordPress import
@@ -385,20 +386,7 @@ function generateMigrationConfig(wxr: WxrData, analysis: ContentAnalysis): Migra
 
 	// Map post types to collections
 	for (const [type, count] of analysis.postTypes) {
-		// Skip internal types (see INTERNAL_POST_TYPES in utils.ts)
-		const skip = [
-			"revision",
-			"nav_menu_item",
-			"custom_css",
-			"customize_changeset",
-			"oembed_cache",
-			"wp_global_styles",
-			"wp_navigation",
-			"wp_template",
-			"wp_template_part",
-			"attachment", // Handled separately as media
-			"wp_block", // Handled separately as sections (reusable blocks)
-		].includes(type);
+		const skip = isInternalPostType(type);
 
 		collections[type] = {
 			collection: mapPostTypeToCollection(type),
@@ -425,19 +413,7 @@ function generateMigrationConfig(wxr: WxrData, analysis: ContentAnalysis): Migra
 		},
 		collections,
 		fields,
-		skipPostTypes: [
-			"revision",
-			"nav_menu_item",
-			"custom_css",
-			"customize_changeset",
-			"oembed_cache",
-			"wp_global_styles",
-			"wp_navigation",
-			"wp_template",
-			"wp_template_part",
-			"attachment",
-			"wp_block",
-		],
+		skipPostTypes: [...INTERNAL_POST_TYPES],
 		skipMetaKeys: ["_edit_last", "_edit_lock", "_pingme", "_encloseme"],
 	};
 }

package/src/cli/commands/login.ts

@@ -23,6 +23,7 @@ import {
 	resolveCustomHeaders,
 	runCloudflaredLogin,
 } from "../../client/cf-access.js";
+import { connectionArgs, resolveBaseUrl } from "../client-factory.js";
 import {
 	getCredentials,
 	removeCredentials,
@@ -409,42 +410,27 @@ export const whoamiCommand = defineCommand({
 		name: "whoami",
 		description: "Show current user and auth method",
 	},
-	args: {
-		url: {
-			type: "string",
-			alias: "u",
-			description: "EmDash instance URL",
-			default: "http://localhost:4321",
-		},
-		token: {
-			type: "string",
-			alias: "t",
-			description: "Auth token",
-		},
-		json: {
-			type: "boolean",
-			description: "Output as JSON",
-		},
-	},
+	args: { ...connectionArgs },
 	async run({ args }) {
 		configureOutputMode(args);
-		const baseUrl = args.url || "http://localhost:4321";
+		const baseUrl = resolveBaseUrl(args);
 
 		// Resolve token: --token flag > EMDASH_TOKEN env > stored credentials
 		let token = args.token || process.env["EMDASH_TOKEN"];
 		let authMethod = token ? "token" : "none";
-		let storedHeaders: Record<string, string> = {};
+		const cred = token ? null : getCredentials(baseUrl);
+		const headerFetch = createHeaderAwareFetch({
+			...cred?.customHeaders,
+			...resolveCustomHeaders(),
+		});
 
 		if (!token) {
-			const cred = getCredentials(baseUrl);
 			if (cred) {
 				token = cred.accessToken;
 				authMethod = "stored";
-				storedHeaders = cred.customHeaders ?? {};
 
 				// Check if expired
 				if (new Date(cred.expiresAt) < new Date()) {
-					const headerFetch = createHeaderAwareFetch(storedHeaders);
 					// Try to refresh
 					try {
 						const refreshRes = await headerFetch(
@@ -490,40 +476,46 @@ export const whoamiCommand = defineCommand({
 			const isLocal = baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1");
 			if (isLocal) {
 				authMethod = "dev-bypass";
-				consola.info(`Auth method: ${pc.cyan("dev-bypass")}`);
-				consola.info("No stored credentials. Client will use dev bypass for localhost.");
-				return;
+			} else {
+				consola.error("Not logged in. Run: emdash login");
+				process.exit(2);
 			}
-
-			consola.error("Not logged in. Run: emdash login");
-			process.exit(2);
 		}
 
-		const headerFetch = createHeaderAwareFetch(storedHeaders);
-
 		try {
-			const meRes = await headerFetch(new URL("/_emdash/api/auth/me", baseUrl), {
-				headers: { Authorization: `Bearer ${token}` },
-			});
+			const meRes = token
+				? await headerFetch(new URL("/_emdash/api/auth/me", baseUrl), {
+						headers: { Authorization: `Bearer ${token}` },
+					})
+				: await headerFetch(new URL("/_emdash/api/auth/dev-bypass", baseUrl), {
+						redirect: "manual",
+					});
 
 			if (!meRes.ok) {
-				if (meRes.status === 401) {
+				if (token && meRes.status === 401) {
 					consola.error("Token is invalid or expired. Run: emdash login");
 					process.exit(1);
 				}
+				if (!token && meRes.status === 403) {
+					consola.error("The dev bypass only works under `astro dev`. Run: emdash login");
+					process.exit(1);
+				}
+				if (!token && meRes.status === 404) {
+					consola.error("The dev bypass is not available on this site. Run: emdash login");
+					process.exit(1);
+				}
 				consola.error(`Failed to fetch user info: ${meRes.status}`);
 				process.exit(1);
 			}
 
-			const raw = (await meRes.json()) as {
-				data: {
-					id: string;
-					email: string;
-					name: string | null;
-					role: number;
-				};
-			};
-			const me = raw.data;
+			interface Me {
+				id: string;
+				email: string;
+				name: string | null;
+				role: number;
+			}
+			const raw = (await meRes.json()) as { data: Me | { user: Me } };
+			const me = "user" in raw.data ? raw.data.user : raw.data;
 
 			const roleNames: Record<number, string> = {
 				10: "subscriber",