headroom-cms 0.1.8 → 0.1.10

package/src/collaboration.ts

@@ -0,0 +1,187 @@
+/**
+ * Collaboration Infrastructure
+ *
+ * API Gateway WebSocket API + DynamoDB Collab table + Node.js Lambda handler.
+ * Deployed at all times but dormant for solo editing — no Lambda invocations
+ * and no Collab table writes happen until collaboration is opted into.
+ *
+ * Supports dev mode (Node.js source with live reload) and package mode
+ * (pre-bundled handler).
+ *
+ * Split into two helpers:
+ *   - `createCollabTable` — provisions just the DynamoDB Collab table.
+ *     Must be called BEFORE `createApi`, because the Go API links the
+ *     Collab table for ticket reads/writes.
+ *   - `createCollabHandler` — provisions the WebSocket API + Lambda and
+ *     wires `API_URL` into the Lambda environment so `snapshotToDraft`
+ *     can `fetch` back into the Go API on `$disconnect`. Must be called
+ *     AFTER `createApi`, because it needs `api.api.url`.
+ *
+ * The two halves are merged into a single `CollaborationResources` value
+ * by `index.ts` so downstream consumers (admin-site, etc.) see one shape.
+ */
+
+import path from "path";
+import type { StorageResources } from "./storage.js";
+import type { AuthResources } from "./auth.js";
+import type { ApiResources } from "./api.js";
+
+export interface CollabTableArgs {
+  // No external dependencies — the table is a leaf resource.
+}
+
+export function createCollabTable(name: string, _args: CollabTableArgs = {}) {
+  // DynamoDB table for collaboration sessions + YJS state
+  const collabTable = new sst.aws.Dynamo(`${name}Collab`, {
+    fields: {
+      pk: "string",
+      sk: "string",
+    },
+    primaryIndex: { hashKey: "pk", rangeKey: "sk" },
+    // PascalCase to match the convention used throughout the collab TS
+    // package (RoomManager, YjsPersistence) and the Go ticket writer
+    // (repository/collab.go). DynamoDB attribute names are case-sensitive;
+    // the TTL attribute name must match what writers actually emit.
+    ttl: "ExpiresAt",
+  });
+
+  return { collabTable };
+}
+
+export type CollabTableResources = ReturnType<typeof createCollabTable>;
+
+export interface CollabHandlerArgs {
+  storage: StorageResources;
+  auth: AuthResources;
+  api: ApiResources;
+  collabTable: CollabTableResources["collabTable"];
+  pkgRoot: string;
+  dev?: {
+    /** SST handler string, e.g. "packages/collab/src/index.handler" */
+    handler: string;
+  };
+}
+
+export function createCollabHandler(name: string, args: CollabHandlerArgs) {
+  const { storage, auth, api, collabTable } = args;
+
+  // WebSocket API via raw Pulumi (SST v4 doesn't have a WebSocket component)
+  const wsApi = new aws.apigatewayv2.Api(`${name}WsApi`, {
+    protocolType: "WEBSOCKET",
+    routeSelectionExpression: "$request.body.action",
+  });
+
+  const handlerConfig = args.dev
+    ? {
+        handler: args.dev.handler,
+        runtime: "nodejs22.x" as const,
+      }
+    : {
+        bundle: path.join(args.pkgRoot, "packages/collab"),
+        handler: "index.handler",
+        runtime: "nodejs22.x" as const,
+      };
+
+  const wsHandler = new sst.aws.Function(`${name}CollabHandler`, {
+    ...handlerConfig,
+    // jsdom is pulled in transitively via @blocknote/server-util (used in
+    // src/yjs/converter.ts to convert YJS state to BlockNote blocks during
+    // the disconnect snapshot). esbuild does not auto-bundle jsdom's
+    // xhr-sync-worker.js because it's spawned dynamically at runtime
+    // (`new Worker(__dirname + "/xhr-sync-worker.js")`), so the worker file
+    // is missing on disk in the deployed Lambda and cold-starts fail with
+    // "Cannot find module './xhr-sync-worker.js'". Adding jsdom to
+    // `nodejs.install` excludes it from the esbuild bundle and instead
+    // installs it (with its full directory tree, including the worker file)
+    // into the function's node_modules/ at deploy time.
+    nodejs: {
+      install: ["jsdom"],
+    },
+    timeout: "30 seconds",
+    memory: "512 MB",
+    environment: {
+      COLLAB_TABLE: collabTable.name,
+      DRAFT_CONTENT_TABLE: storage.draftContent.name,
+      BLOCKS_TABLE: storage.blocks.name,
+      SITES_TABLE: storage.sites.name,
+      USER_POOL_ID: auth.userPool.id,
+      USER_POOL_CLIENT_ID: auth.userPoolClient.id,
+      WS_API_ENDPOINT: $interpolate`https://${wsApi.id}.execute-api.${aws.getRegionOutput().name}.amazonaws.com/${$app.stage}`,
+      // Required by `snapshotToDraft` (packages/collab/src/draft/snapshot.ts)
+      // which fetches `${apiUrl}/v1/admin/sites/{host}/content/{id}/draft`
+      // on `$disconnect` to persist the YJS room state back to DraftContent.
+      // Without this, the URL becomes `undefined/v1/admin/...` and the fetch
+      // throws "Failed to parse URL", crashing the disconnect Lambda.
+      API_URL: api.api.url,
+      // Shared with the Go API. Sent as `X-Headroom-Internal` on the
+      // disconnect snapshot PUT so the Go JWT middleware accepts the
+      // internal service-to-service call. See packages/api/internal/middleware/jwt.go.
+      INTERNAL_SECRET: storage.internalSecret.value,
+      // Phase 7.1 "Large documents": S3 bucket for YJS state that exceeds
+      // DynamoDB's 400KB per-item cap. See `YjsPersistence.saveState`.
+      COLLAB_STATE_BUCKET: storage.collabStateBucket.name,
+    },
+    link: [
+      collabTable,
+      storage.draftContent,
+      storage.blocks,
+      storage.sites,
+      storage.internalSecret,
+      // S3 link grants the Lambda IAM permissions for s3:GetObject /
+      // s3:PutObject on the bucket via SST's resource binding.
+      storage.collabStateBucket,
+    ],
+    permissions: [
+      {
+        actions: ["execute-api:ManageConnections"],
+        resources: [$interpolate`arn:aws:execute-api:*:*:${wsApi.id}/*`],
+      },
+    ],
+  });
+
+  // Wire up $connect, $default, $disconnect routes
+  const integration = new aws.apigatewayv2.Integration(
+    `${name}WsIntegration`,
+    {
+      apiId: wsApi.id,
+      integrationType: "AWS_PROXY",
+      integrationUri: wsHandler.nodes.function.invokeArn,
+    },
+  );
+
+  for (const routeKey of ["$connect", "$default", "$disconnect"]) {
+    new aws.apigatewayv2.Route(`${name}WsRoute${routeKey}`, {
+      apiId: wsApi.id,
+      routeKey,
+      target: $interpolate`integrations/${integration.id}`,
+    });
+  }
+
+  new aws.apigatewayv2.Stage(`${name}WsStage`, {
+    apiId: wsApi.id,
+    name: $app.stage,
+    autoDeploy: true,
+  });
+
+  // Grant API Gateway permission to invoke Lambda
+  new aws.lambda.Permission(`${name}WsPermission`, {
+    action: "lambda:InvokeFunction",
+    function: wsHandler.nodes.function.name,
+    principal: "apigateway.amazonaws.com",
+    sourceArn: $interpolate`${wsApi.executionArn}/*/*`,
+  });
+
+  const wsUrl =
+    $interpolate`wss://${wsApi.id}.execute-api.${aws.getRegionOutput().name}.amazonaws.com/${$app.stage}`;
+
+  return { wsApi, wsHandler, wsUrl };
+}
+
+export type CollabHandlerResources = ReturnType<typeof createCollabHandler>;
+
+/**
+ * Combined collaboration resource shape — the union of the table half
+ * (created early) and the handler half (created late). Downstream consumers
+ * (admin-site, public outputs) see a single object.
+ */
+export type CollaborationResources = CollabTableResources & CollabHandlerResources;

package/src/index.ts

@@ -14,6 +14,7 @@ import { createImage } from "./image.js";
 import { createApi } from "./api.js";
 import { createCdn } from "./cdn.js";
 import { createScheduler } from "./scheduler.js";
+import { createCollabTable, createCollabHandler } from "./collaboration.js";
 import { createAdminSite } from "./admin-site.js";
 
 /**
@@ -50,6 +51,7 @@ export type { ImageResources } from "./image.js";
 export type { ApiResources } from "./api.js";
 export type { CdnResources } from "./cdn.js";
 export type { SchedulerResources } from "./scheduler.js";
+export type { CollaborationResources } from "./collaboration.js";
 export type { AdminSiteResources } from "./admin-site.js";
 
 export interface HeadroomCMSArgs {
@@ -120,7 +122,18 @@ export interface HeadroomCMSArgs {
     adminPath: string;
     /** Go source path for scheduler Lambda, e.g. "packages/scheduler" */
     schedulerHandler?: string;
+    /** SST handler for collab Lambda, e.g. "packages/collab/src/index.handler" */
+    collabHandler?: string;
   };
+
+  /**
+   * Build-time toggle for the collaboration feature in the admin UI.
+   * Defaults to `true`. Set `false` to keep the WebSocket / Collab table
+   * deployed but hide the "Collaborate" / "Request collaboration" buttons
+   * and refuse to open WebSockets — a kill-switch without teardown. Used
+   * to ship the feature to a stage before turning it on for editors.
+   */
+  collabEnabled?: boolean;
 }
 
 export class HeadroomCMS {
@@ -129,6 +142,7 @@ export class HeadroomCMS {
   public readonly adminUrl: $util.Output<string>;
   public readonly userPoolId: $util.Output<string>;
   public readonly userPoolClientId: $util.Output<string>;
+  public readonly collabWsUrl: $util.Output<string>;
 
   public readonly outputs: Record<string, $util.Output<string>>;
 
@@ -167,12 +181,17 @@ export class HeadroomCMS {
         : undefined,
     });
 
-    // 5. API Lambda (Go handler with access to all resources)
+    // 5a. Collaboration table (must exist before the API Lambda, which
+    // links it for ticket reads/writes).
+    const collabTable = createCollabTable(name);
+
+    // 6. API Lambda (Go handler with access to all resources)
     const api = createApi(name, {
       storage,
       auth,
       webhooks,
       image,
+      collab: collabTable,
       senderEmail: args.senderEmail,
       pkgRoot,
       dev: args.dev
@@ -180,7 +199,24 @@ export class HeadroomCMS {
         : undefined,
     });
 
-    // 6. Scheduler (EventBridge cron + Go Lambda + lock table)
+    // 5b. Collaboration WebSocket handler (must be created AFTER the API
+    // because its Lambda environment includes API_URL = api.api.url, which
+    // `snapshotToDraft` uses to PUT the disconnect snapshot back to the
+    // Go draft endpoint).
+    const collabHandler = createCollabHandler(name, {
+      storage,
+      auth,
+      api,
+      collabTable: collabTable.collabTable,
+      pkgRoot,
+      dev: args.dev?.collabHandler
+        ? { handler: args.dev.collabHandler }
+        : undefined,
+    });
+
+    const collab = { ...collabTable, ...collabHandler };
+
+    // 7. Scheduler (EventBridge cron + Go Lambda + lock table)
     const schedulerResources = createScheduler(name, {
       storage,
       api,
@@ -190,7 +226,7 @@ export class HeadroomCMS {
         : undefined,
     });
 
-    // 7. CDN (CloudFront distribution + edge functions)
+    // 8. CDN (CloudFront distribution + edge functions)
     const cdn = createCdn(name, {
       api,
       image,
@@ -201,16 +237,18 @@ export class HeadroomCMS {
       domain: args.domain,
     });
 
-    // 8. Admin UI (static site)
+    // 9. Admin UI (static site)
     const admin = createAdminSite(name, {
       api,
       cdn,
       auth,
+      collab,
       pkgRoot,
       dev: args.dev
         ? { adminPath: args.dev.adminPath }
         : undefined,
       domain: args.adminDomain,
+      collabEnabled: args.collabEnabled,
     });
 
     // Expose outputs
@@ -219,6 +257,7 @@ export class HeadroomCMS {
     this.adminUrl = admin.url;
     this.userPoolId = auth.userPool.id;
     this.userPoolClientId = auth.userPoolClient.id;
+    this.collabWsUrl = collab.wsUrl;
 
     this.outputs = {
       api: api.api.url,
@@ -226,6 +265,7 @@ export class HeadroomCMS {
       admin: admin.url,
       userPoolId: auth.userPool.id,
       userPoolClientId: auth.userPoolClient.id,
+      collabWs: collab.wsUrl,
     };
   }
 }

package/src/sst-env.d.ts

@@ -40,6 +40,13 @@ declare namespace sst {
       url: PulumiOutput<string>;
       name: PulumiOutput<string>;
       arn: PulumiOutput<string>;
+      nodes: {
+        function: {
+          name: PulumiOutput<string>;
+          invokeArn: PulumiOutput<string>;
+          arn: PulumiOutput<string>;
+        };
+      };
     }
 
     class CognitoUserPool {
@@ -111,6 +118,27 @@ declare namespace aws {
     }
   }
 
+  namespace apigatewayv2 {
+    class Api {
+      constructor(name: string, args?: any, opts?: any);
+      id: PulumiOutput<string>;
+      executionArn: PulumiOutput<string>;
+    }
+
+    class Integration {
+      constructor(name: string, args?: any, opts?: any);
+      id: PulumiOutput<string>;
+    }
+
+    class Route {
+      constructor(name: string, args?: any, opts?: any);
+    }
+
+    class Stage {
+      constructor(name: string, args?: any, opts?: any);
+    }
+  }
+
   namespace ses {
     class EmailIdentity {
       constructor(name: string, args?: any, opts?: any);

package/src/storage.ts

@@ -131,11 +131,44 @@ export function createStorage(name: string) {
     },
   });
 
+  // Phase 7.1 "Large documents": YJS room state that exceeds DynamoDB's 400KB
+  // per-item cap is uploaded here instead of being inlined on the Collab
+  // item. Dedicated bucket (vs reusing `contentBucket`) for two reasons:
+  //   1. `contentBucket` is `access: "cloudfront"` for media delivery; YJS
+  //      state must NOT be CDN-fronted (it's per-collaboration-session
+  //      transient state, never publicly addressable).
+  //   2. Lifecycle expiration is much shorter — these objects are recovery
+  //      fallback for an active collaboration session; the matching Collab
+  //      table item carries a 24h DynamoDB TTL, so the S3 lifecycle rule
+  //      cleans up overflow objects on a similar timeline.
+  const collabStateBucket = new sst.aws.Bucket(`${name}CollabStateBucket`, {
+    transform: {
+      bucket: (args: any) => {
+        args.lifecycleRules = [
+          {
+            id: "expire-collab-state",
+            enabled: true,
+            expiration: { days: 7 },
+            // Keep the matching Collab DynamoDB TTL (24h) as the primary
+            // cleanup mechanism; this is a long-stop safety net so orphaned
+            // S3 objects don't accumulate forever.
+          },
+        ];
+      },
+    },
+  });
+
   const kvs = new aws.cloudfront.KeyValueStore(`${name}KVS`, {
     name: $interpolate`${$app.name}-${$app.stage}-kvs`,
     comment: "Headroom CMS edge data: API keys and site versions",
   });
 
+  // Shared secret for internal service-to-service auth between the collab
+  // Lambda and the Go API (`X-Headroom-Internal` header). Both Lambdas read
+  // this from their `INTERNAL_SECRET` environment variable. Set the value via
+  // `sst secret set HeadroomInternalSecret <value>` (or the namespaced equivalent).
+  const internalSecret = new sst.Secret(`${name}InternalSecret`);
+
   return {
     sites,
     content,
@@ -148,7 +181,9 @@ export function createStorage(name: string) {
     relationships,
     siteUsers,
     contentBucket,
+    collabStateBucket,
     kvs,
+    internalSecret,
   };
 }
 

package/admin/assets/AllContentPage-CFqEMAl9.js

@@ -1 +0,0 @@
-import{j as s}from"./tanstack-Bs3zYPPV.js";import{u as U,f as D,r as w}from"./react-vendor-C2CvUxFh.js";import{u as M,a as R,b as L,c as z}from"./useContent-e8beBIuq.js";import{m as k}from"./media-url-DIg_vSyf.js";import{w as E,x as H,v as r,S as F,j as h,y as V,B as _}from"./index-Cir9tY_P.js";import{u as q}from"./usePageTitle-BNSba9_L.js";import{C as G,c as J}from"./card-hXVtlM0q.js";import{C as m}from"./checkbox-WGrS3sUr.js";import{T as K,a as O,b as S,c as i,d as Q,e as d}from"./table-DLoIbCQ5.js";import{f as y}from"./format-C88SDH8g.js";import{B as W}from"./BulkActionBar-TRiXXLQd.js";import"./radix-C1kb_NqW.js";function ie(){const{host:c}=U(),p=D(),{collections:A}=E(),f=H();q({title:"Recent"});const[$,P]=w.useState(),[n,a]=w.useState(new Set),{data:o,isLoading:I}=M(c,$),j=R(c),g=L(c),b=z(c),N=new Map(A.map(e=>[e.name,e.label])),x=o?.items.map(e=>e.contentId)??[],v=x.length>0&&x.every(e=>n.has(e));function C(e){a(t=>{const l=new Set(t);return l.has(e)?l.delete(e):l.add(e),l})}function B(){a(v?new Set:new Set(x))}const T=j.isPending||g.isPending||b.isPending;return s.jsxs("div",{children:[!f&&s.jsxs("div",{className:"mb-6",children:[s.jsx("h1",{className:"text-2xl font-semibold",children:"All Content"}),s.jsx("p",{className:"text-muted-foreground text-sm",children:"Recently updated content across all collections."})]}),n.size>0&&s.jsx(W,{selectedCount:n.size,onPublish:async()=>{const e=[...n],l=(await j.mutateAsync(e)).filter(u=>u.status==="rejected").length;l?r.error(`${l} of ${e.length} failed to publish`):r.success(`${e.length} item(s) published`),a(new Set)},onUnpublish:async()=>{const e=[...n],l=(await g.mutateAsync(e)).filter(u=>u.status==="rejected").length;l?r.error(`${l} of ${e.length} failed to unpublish`):r.success(`${e.length} item(s) unpublished`),a(new Set)},onDelete:async()=>{const e=[...n],l=(await b.mutateAsync(e)).filter(u=>u.status==="rejected").length;l?r.error(`${l} of ${e.length} failed to delete`):r.success(`${e.length} item(s) deleted`),a(new Set)},onClear:()=>a(new Set),isPending:T}),I?s.jsx("div",{className:"space-y-2",children:Array.from({length:5}).map((e,t)=>s.jsx(F,{className:"h-12 w-full"},t))}):o?.items.length?s.jsxs(s.Fragment,{children:[f?s.jsx("div",{className:"grid gap-3","data-testid":"all-content-card-view",children:o.items.map(e=>{const t=e.cover;return s.jsx(G,{className:V("cursor-pointer gap-0 overflow-hidden py-0 transition-shadow hover:shadow-md",n.has(e.contentId)&&"ring-2 ring-primary"),onClick:()=>p(`/sites/${c}/content/${e.collection}/${e.contentId}?from=recent`),children:s.jsx(J,{className:"p-3",children:s.jsxs("div",{className:"flex items-start gap-3 min-w-0",children:[t?.url&&s.jsx("img",{src:k(t.url),alt:t.alt??"",className:"h-12 w-12 rounded object-cover flex-shrink-0"}),s.jsxs("div",{className:"min-w-0 flex-1",children:[s.jsxs("div",{className:"flex items-center gap-2 min-w-0",children:[s.jsx("span",{className:"font-medium truncate",children:e.title||"Untitled"}),s.jsx(h,{variant:e.publishedAt?"default":"secondary",className:"shrink-0",children:e.publishedAt?"Published":"Draft"})]}),e.slug&&s.jsxs("p",{className:"text-xs text-muted-foreground truncate mt-0.5",children:["/",e.slug]}),s.jsxs("div",{className:"flex items-center gap-2 mt-1",children:[s.jsx(h,{variant:"outline",className:"text-[10px] px-1.5 py-0",children:N.get(e.collection)??e.collection}),s.jsx("span",{className:"text-xs text-muted-foreground",children:e.publishedAt?y(e.publishedAt):"—"})]})]}),s.jsx(m,{checked:n.has(e.contentId),onCheckedChange:()=>C(e.contentId),onClick:l=>l.stopPropagation(),className:"mt-1"})]})})},e.contentId)})}):s.jsxs(K,{children:[s.jsx(O,{children:s.jsxs(S,{children:[s.jsx(i,{className:"w-10",children:s.jsx(m,{checked:v,onCheckedChange:B,"aria-label":"Select all"})}),s.jsx(i,{children:"Title"}),s.jsx(i,{children:"Slug"}),s.jsx(i,{children:"Collection"}),s.jsx(i,{children:"Status"}),s.jsx(i,{children:"Updated"})]})}),s.jsx(Q,{children:o.items.map(e=>s.jsxs(S,{className:"cursor-pointer",onClick:()=>p(`/sites/${c}/content/${e.collection}/${e.contentId}?from=recent`),children:[s.jsx(d,{onClick:t=>t.stopPropagation(),children:s.jsx(m,{checked:n.has(e.contentId),onCheckedChange:()=>C(e.contentId),"aria-label":`Select ${e.title||"Untitled"}`})}),s.jsx(d,{className:"font-medium",children:s.jsxs("div",{className:"flex items-center gap-3",children:[(()=>{const t=e.cover;return t?.url?s.jsx("img",{src:k(t.url),alt:t.alt??"",className:"h-8 w-8 rounded object-cover flex-shrink-0"}):null})(),s.jsx("span",{children:e.title||"Untitled"})]})}),s.jsx(d,{className:"text-muted-foreground text-sm",children:e.slug||"—"}),s.jsx(d,{children:s.jsx(h,{variant:"outline",children:N.get(e.collection)??e.collection})}),s.jsx(d,{children:s.jsx(h,{variant:e.publishedAt?"default":"secondary",children:e.publishedAt?"Published":"Draft"})}),s.jsx(d,{className:"text-muted-foreground",children:e.publishedAt?y(e.publishedAt):"—"})]},e.contentId))})]}),o.hasMore&&s.jsx("div",{className:"mt-4 flex justify-center",children:s.jsx(_,{variant:"outline",onClick:()=>P(o.cursor??void 0),children:"Load More"})})]}):s.jsx("p",{className:"text-muted-foreground",children:"No content yet."})]})}export{ie as AllContentPage};

package/admin/assets/AuditPage-BE0XIUl2.js

@@ -1 +0,0 @@
-import{u as F,j as e}from"./tanstack-Bs3zYPPV.js";import{L,r as i,u as E}from"./react-vendor-C2CvUxFh.js";import{e as O,F as K,G as V,J as W,K as q,B as R,au as H,S as y,x as J,aK as z,aJ as v,aL as G,aM as Q,aN as X,aO as Y,aP as Z,aQ as ee,aR as te,aS as se,al as S,aT as ae,T as x,$ as m,aE as le,P as A,aU as U,ai as re,aV as de,aW as ne,aX as oe,a4 as ce,aY as ie,aZ as ue}from"./index-Cir9tY_P.js";import{u as me}from"./useAdminResolver-D-LlmquD.js";import{s as _,T as he}from"./serializeToText-DR_WnxiI.js";import{h as T}from"./useContent-e8beBIuq.js";import{f as P,a as xe}from"./format-C88SDH8g.js";import{S as be,a as pe,b as fe,c as ge,d as je}from"./select-_uJYxzeZ.js";import{T as ke,a as Ie,b as D,c as p,d as ye,e as f}from"./table-DLoIbCQ5.js";import{u as Ce}from"./usePageTitle-BNSba9_L.js";import"./radix-C1kb_NqW.js";function we(t,a){const l=O(),d=new URLSearchParams;a?.action&&d.set("action",a.action),a?.before&&d.set("before",String(a.before));const o=d.toString();return F({queryKey:["sites",t,"audit",a?.action??"",a?.before??""],queryFn:()=>l.apiFetch(`/v1/admin/sites/${t}/audit${o?`?${o}`:""}`),enabled:!!t})}const Ne={"content.create":"Content Created","content.update":"Content Updated","content.publish":"Content Published","content.unpublish":"Content Unpublished","content.delete":"Content Deleted","content.schedule":"Content Scheduled","content.unschedule":"Content Unscheduled","content.update_publish_date":"Publish Date Changed","content.discard":"Draft Discarded","media.create":"Media Uploaded","media.update":"Media Updated","media.delete":"Media Deleted","media.bulk":"Bulk Media Operation","media.folder.create":"Folder Created","media.folder.update":"Folder Renamed","media.folder.delete":"Folder Deleted","collection.create":"Collection Created","collection.update":"Collection Updated","collection.delete":"Collection Deleted","blocktype.create":"Block Type Created","blocktype.update":"Block Type Updated","blocktype.delete":"Block Type Deleted","webhook.create":"Webhook Created","webhook.update":"Webhook Updated","webhook.delete":"Webhook Deleted","webhook.rotate_secret":"Webhook Secret Rotated","webhook.retry_delivery":"Delivery Retried","apikey.create":"API Key Created","apikey.revoke":"API Key Revoked","site.archived":"Site Archived","site.unarchived":"Site Unarchived","site.purged":"Site Purged","site_user.create":"User Created","site_user.update":"User Updated","site_user.delete":"User Deleted","site_user.change_email":"User Email Changed","site_user.self_register":"User Self-Registered","site_user.self_update":"User Updated Profile"};function ve(t){return!!t?.blockId&&!!t?.prevBlockId&&!!t?.resourceId}function Se({host:t,details:a}){const l=a.resourceId,d=a.collection??"",{data:o}=H(t,d),{data:s,isLoading:b}=T(t,l,a.blockId??null),{data:n,isLoading:u}=T(t,l,a.prevBlockId??null),c=i.useMemo(()=>o?.fields??[],[o?.fields]),g=i.useMemo(()=>{if(!s)return[];const h={title:s.title,slug:s.slug,snippet:s.snippet,tags:s.tags};return _(c,s.body??{},h)},[s,c]),j=i.useMemo(()=>{if(!n)return[];const h={title:n.title,slug:n.slug,snippet:n.snippet,tags:n.tags};return _(c,n.body??{},h)},[n,c]);return b||u?e.jsxs("div",{className:"space-y-2","data-testid":"diff-loading",children:[e.jsx(y,{className:"h-6 w-24"}),e.jsx(y,{className:"h-40 w-full"})]}):!s||!n?e.jsx("p",{className:"text-muted-foreground text-sm","data-testid":"diff-unavailable",children:"Version data unavailable."}):e.jsxs("div",{"data-testid":"diff-view",children:[e.jsx("h3",{className:"mb-2 text-sm font-medium",children:"Changes"}),e.jsx(he,{left:j,right:g,leftLabel:"Before",rightLabel:"After"})]})}function Ae({open:t,onOpenChange:a,event:l,host:d,resolveAdmin:o}){if(!l)return null;const s=l.details,b=Ne[l.action]??l.action,n=ve(s),u=s?.resourceType==="content"&&s?.resourceId&&s?.collection?`/sites/${d}/content/${s.collection}/${s.resourceId}`:null;return e.jsx(K,{open:t,onOpenChange:a,children:e.jsxs(V,{className:"w-full overflow-y-auto px-6 sm:max-w-lg","data-testid":"audit-drawer",children:[e.jsx(W,{children:e.jsx(q,{children:b})}),e.jsxs("div",{className:"mt-4 space-y-4",children:[e.jsxs("dl",{className:"grid grid-cols-[auto_1fr] gap-x-4 gap-y-2 text-sm",children:[s?.title&&e.jsxs(e.Fragment,{children:[e.jsx("dt",{className:"text-muted-foreground",children:"Resource"}),e.jsx("dd",{className:"font-medium","data-testid":"drawer-resource",children:s.title})]}),s?.collection&&e.jsxs(e.Fragment,{children:[e.jsx("dt",{className:"text-muted-foreground",children:"Collection"}),e.jsx("dd",{children:s.collection})]}),e.jsx("dt",{className:"text-muted-foreground",children:"Admin"}),e.jsx("dd",{children:o(l.adminId)}),e.jsx("dt",{className:"text-muted-foreground",children:"Time"}),e.jsx("dd",{children:P(l.createdAt)}),e.jsx("dt",{className:"text-muted-foreground",children:"Status"}),e.jsx("dd",{children:e.jsx("span",{className:l.status==="success"?"text-green-600":l.status==="failed"?"text-red-600":"text-yellow-600",children:l.status})}),s?.ipAddress&&e.jsxs(e.Fragment,{children:[e.jsx("dt",{className:"text-muted-foreground",children:"IP Address"}),e.jsx("dd",{className:"font-mono text-xs",children:s.ipAddress})]}),s?.extra&&e.jsxs(e.Fragment,{children:[e.jsx("dt",{className:"text-muted-foreground",children:"Details"}),e.jsx("dd",{className:"text-muted-foreground",children:s.extra})]})]}),s&&e.jsxs("details",{className:"text-sm","data-testid":"drawer-json",children:[e.jsx("summary",{className:"text-muted-foreground cursor-pointer select-none",children:"Raw details"}),e.jsx("pre",{className:"bg-muted mt-2 overflow-x-auto rounded p-3 text-xs",children:JSON.stringify(s,null,2)})]}),l.errorMsg&&e.jsx("div",{className:"rounded border border-red-200 bg-red-50 p-3 text-sm text-red-800 dark:border-red-900 dark:bg-red-950 dark:text-red-300","data-testid":"drawer-error",children:l.errorMsg}),u&&e.jsx(R,{variant:"outline",size:"sm",asChild:!0,children:e.jsx(L,{to:u,children:"View content"})}),n&&s&&e.jsx("div",{className:"border-t pt-4",children:e.jsx(Se,{host:d,details:s})}),!n&&s?.resourceType==="content"&&e.jsx("p",{className:"text-muted-foreground text-sm","data-testid":"no-changes",children:"No change comparison available for this event."})]})]})})}const Ue={"content.create":{label:"Created content",Icon:A},"content.update":{label:"Updated content",Icon:m},"content.publish":{label:"Published content",Icon:ue},"content.unpublish":{label:"Unpublished content",Icon:ie},"content.delete":{label:"Deleted content",Icon:x},"content.schedule":{label:"Scheduled content",Icon:ce},"content.unschedule":{label:"Unscheduled content",Icon:oe},"content.update_publish_date":{label:"Changed publish date",Icon:ne},"content.discard":{label:"Discarded draft",Icon:de},"media.create":{label:"Uploaded media",Icon:re},"media.update":{label:"Updated media",Icon:m},"media.delete":{label:"Deleted media",Icon:x},"media.bulk":{label:"Bulk media operation",Icon:S},"media.folder.create":{label:"Created folder",Icon:U},"media.folder.update":{label:"Renamed folder",Icon:m},"media.folder.delete":{label:"Deleted folder",Icon:x},"collection.create":{label:"Created collection",Icon:U},"collection.update":{label:"Updated collection",Icon:m},"collection.delete":{label:"Deleted collection",Icon:x},"blocktype.create":{label:"Created block type",Icon:A},"blocktype.update":{label:"Updated block type",Icon:m},"blocktype.delete":{label:"Deleted block type",Icon:x},"webhook.create":{label:"Created webhook",Icon:le},"webhook.update":{label:"Updated webhook",Icon:m},"webhook.delete":{label:"Deleted webhook",Icon:x},"webhook.rotate_secret":{label:"Rotated webhook secret",Icon:ae},"webhook.retry_delivery":{label:"Retried delivery",Icon:S},"apikey.create":{label:"Created API key",Icon:se},"apikey.revoke":{label:"Revoked API key",Icon:te},"site.archived":{label:"Archived site",Icon:ee},"site.unarchived":{label:"Unarchived site",Icon:Z},"site.purged":{label:"Purged site",Icon:Y},"site_user.create":{label:"Created user",Icon:v},"site_user.update":{label:"Updated user",Icon:X},"site_user.delete":{label:"Deleted user",Icon:Q},"site_user.change_email":{label:"Changed user email",Icon:G},"site_user.self_register":{label:"User registered",Icon:v},"site_user.self_update":{label:"User updated profile",Icon:z}},_e=[{label:"All",value:"all"},{label:"Content",value:"content."},{label:"Media",value:"media."},{label:"Collections",value:"collection."},{label:"Block Types",value:"blocktype."},{label:"Webhooks",value:"webhook."},{label:"API Keys",value:"apikey."},{label:"Sites",value:"site."},{label:"Site Users",value:"site_user."}];function Te(t){return Ue[t]??{label:t,Icon:m}}function De(t,a){const l=a.resourceType??a.details?.resourceType,d=a.resourceId??a.details?.resourceId;if(!l||!d)return null;switch(l){case"content":{const o=a.details?.collection;return o?`/sites/${t}/content/${o}/${d}`:`/sites/${t}/content`}case"media":return`/sites/${t}/media`;case"collection":return`/sites/${t}/settings/collections`;case"webhook":return`/sites/${t}/settings/webhooks`;case"site_user":return`/sites/${t}/settings/site-users/${d}`;default:return null}}function Le({status:t}){const a=t==="success"?"bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400":t==="failed"?"bg-red-100 text-red-800 dark:bg-red-900/30 dark:text-red-400":"bg-yellow-100 text-yellow-800 dark:bg-yellow-900/30 dark:text-yellow-400";return e.jsx("span",{className:`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${a}`,children:t})}function qe(){const{host:t}=E(),[a,l]=i.useState(),[d,o]=i.useState("all"),[s,b]=i.useState(null),[n,u]=i.useState(!1),{data:c,isLoading:g}=we(t,{before:a}),j=c?.items.map(r=>r.adminId)??[],{resolve:h}=me(j),$=J(),B=i.useCallback(r=>{b(r),u(!0)},[]);Ce({title:"Audit Log"});const C=d!=="all"?c?.items.filter(r=>r.action.startsWith(d)):c?.items;return e.jsxs("div",{children:[e.jsxs("div",{className:"mb-6 flex items-center justify-between gap-4",children:[!$&&e.jsx("h1",{className:"text-2xl font-semibold",children:"Audit Log"}),e.jsxs(be,{value:d,onValueChange:o,children:[e.jsx(pe,{className:"w-[180px]","data-testid":"action-filter",children:e.jsx(fe,{placeholder:"Filter by type"})}),e.jsx(ge,{children:_e.map(r=>e.jsx(je,{value:r.value,children:r.label},r.value))})]})]}),g?e.jsx("div",{className:"space-y-2",children:Array.from({length:5}).map((r,k)=>e.jsx(y,{className:"h-12 w-full"},k))}):C?.length?e.jsxs(e.Fragment,{children:[e.jsxs(ke,{children:[e.jsx(Ie,{children:e.jsxs(D,{children:[e.jsx(p,{children:"Action"}),e.jsx(p,{children:"Resource"}),e.jsx(p,{children:"Admin"}),e.jsx(p,{children:"Status"}),e.jsx(p,{children:"Time"})]})}),e.jsx(ye,{children:C.map(r=>{const{label:k,Icon:M}=Te(r.action),I=r.details?.title,w=r.details?.collection,N=t?De(t,r):null;return e.jsxs(D,{"data-testid":"audit-row",className:"cursor-pointer",onClick:()=>B(r),children:[e.jsx(f,{children:e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx(M,{className:"text-muted-foreground h-4 w-4 shrink-0"}),e.jsx("span",{className:"font-medium",children:k})]})}),e.jsx(f,{children:I?e.jsxs("div",{className:"flex items-center gap-2",children:[N?e.jsx(L,{to:N,className:"text-primary hover:underline",children:I}):e.jsx("span",{children:I}),w&&e.jsx("span",{className:"bg-muted text-muted-foreground rounded px-1.5 py-0.5 text-xs",children:w})]}):e.jsx("span",{className:"text-muted-foreground",children:"-"})}),e.jsx(f,{className:"text-sm",children:h(r.adminId)}),e.jsx(f,{children:e.jsx(Le,{status:r.status})}),e.jsx(f,{className:"text-muted-foreground",title:P(r.createdAt),children:xe(r.createdAt)})]},r.eventId)})})]}),c?.hasMore&&c.items.length>0&&e.jsx("div",{className:"mt-4 flex justify-center",children:e.jsx(R,{variant:"outline",onClick:()=>l(c.items[c.items.length-1].createdAt),children:"Load More"})})]}):e.jsx("p",{className:"text-muted-foreground",children:"No audit events."}),e.jsx(Ae,{open:n,onOpenChange:u,event:s,host:t,resolveAdmin:h})]})}export{qe as AuditPage};