inicontent 1.0.0

package/app/middleware/dashboard.ts

@@ -0,0 +1,33 @@
+export default defineNuxtRouteMiddleware(async (to, from) => {
+	const user = useState<User>("user");
+	const database = useState<Database>("database");
+	const redirectTo = useScopedCookie<string | null>("redirectTo", database.value?.slug);
+	const isSafeRedirect = (value?: string) =>
+		!!value &&
+		value.startsWith("/") &&
+		!value.startsWith("//") &&
+		!value.includes("/auth");
+	const queryRedirectTo =
+		typeof to.query.redirectTo === "string" ? to.query.redirectTo : undefined;
+	if (user.value) {
+		if (["auth", "auth-reset", "database-auth", "database-auth-reset"].includes(to.name?.toString() ?? "")) {
+			const target = isSafeRedirect(queryRedirectTo)
+				? queryRedirectTo
+				: isSafeRedirect(redirectTo.value ?? undefined)
+					? redirectTo.value
+					: undefined;
+			return navigateTo(
+				target
+					? target
+					: to.params.database
+						? `/${database.value.slug}/admin`
+						: "/admin",
+			);
+		}
+	} else if (!["auth", "auth-reset", "database-auth", "database-auth-reset"].includes(to.name?.toString() ?? "")) {
+		redirectTo.value = from.fullPath;
+		return navigateTo(
+			to.params.database ? `/${database.value.slug}/auth` : "/auth",
+		);
+	}
+});

package/app/middleware/database.ts

@@ -0,0 +1,83 @@
+import {
+	loadDatabaseConfigLocally,
+	saveDatabaseConfigLocally,
+} from "~/composables/useLocalDatabaseConfig";
+import { isJunkResponse, isNetworkError } from "~/composables/useOfflineFetch";
+
+export default defineNuxtRouteMiddleware(async (to) => {
+	const database = useState<Database>("database");
+	const config = useRuntimeConfig();
+	const currentDatabaseSlug = String(
+		config.public.database === "inicontent"
+			? to.params.database || config.public.database
+			: config.public.database || to.params.database,
+	);
+
+	const sessionID = useScopedCookie<string>("sid", currentDatabaseSlug);
+	const query: Record<string, string> = {};
+
+	if (sessionID.value) query[`${currentDatabaseSlug}_sid`] = sessionID.value;
+
+	if (!database.value) {
+		try {
+			database.value = (
+				await $fetch<apiResponse<Database>>(
+					`${config.public.apiBase}inicontent/databases/${currentDatabaseSlug}`,
+					{
+						credentials: "include",
+						query,
+					},
+				)
+			).result;
+			// Persist a local copy of the database config so the app can still
+			// boot offline from local storage even when the service worker's
+			// config cache is missing or evicted.
+			saveDatabaseConfigLocally(currentDatabaseSlug, database.value);
+		} catch (error) {
+			// Offline (or a hung network). Prefer the locally-persisted copy of
+			// the database config — with it the app boots normally with the real
+			// metadata. In production the service worker also serves this request
+			// from its config cache, so this local copy is a second, independent
+			// fallback that survives cache eviction.
+			//
+			// Never THROW from here: an error thrown during the *initial*
+			// navigation rejects nuxt's `app:created` hook, which skips
+			// `vueApp.mount()` entirely in entry.js — the app never renders
+			// and the user just sees a blank page (NUXT_E1005). Instead,
+			// register the error via `showError()` so `payload.error` is set
+			// *before* mount (NuxtRoot then swaps in error.vue), and return
+			// `true` so the navigation itself completes and mounting proceeds.
+			const localConfig = loadDatabaseConfigLocally(currentDatabaseSlug);
+			if (localConfig) {
+				database.value = localConfig;
+			} else {
+				showError(
+					isNetworkError(error) || isJunkResponse(error)
+						? createError({
+								statusCode: 503,
+								statusMessage: "offline",
+							})
+						: (error as Error),
+				);
+				return true;
+			}
+		}
+	}
+
+	if (!database.value) {
+		showError(createError({ statusCode: 404, statusMessage: "database" }));
+		return true;
+	}
+
+	formatDatabase();
+	syncCookiesFromDatabase(database.value.slug);
+
+	useState<ThemeConfig>("ThemeConfig", () => ({
+		primaryColor: "#FF9800",
+		primaryColorHover: "#F7A42A",
+		primaryColorPressed: "#E19421",
+		primaryColorSuppl: "#CB7900",
+	}));
+
+	setThemeConfig();
+});

package/app/middleware/global.ts

@@ -0,0 +1 @@
+export default defineNuxtRouteMiddleware(() => {})

package/app/middleware/sid-ingest.global.ts

@@ -0,0 +1,29 @@
+// Global middleware that restores sessions passed across deployments as URL
+// query params. When the tenant app redirects to the platform app (pages,
+// blocks, templates, billing), cookies cannot travel cross-origin, so the
+// redirect URL carries `?{db}_sid=...&inicontent_sid=...` (see
+// usePlatformRedirect). This middleware writes them back into the scoped
+// cookies so the target boots already signed in. It runs before the route
+// level `database` / `user` middlewares and is a no-op when the params are
+// absent, so it is safe on every deployment of this app.
+export default defineNuxtRouteMiddleware((to) => {
+	const config = useRuntimeConfig();
+	const databaseSlug = String(
+		config.public.database === "inicontent"
+			? to.params.database || config.public.database
+			: config.public.database || to.params.database,
+	);
+
+	const ingest = (key: string) => {
+		const value = to.query[key];
+		if (typeof value !== "string" || !value.trim()) return;
+		const cookie = useCookie<string | null>(key, { sameSite: true });
+		// Never overwrite an existing (fresher) local session.
+		if (!cookie.value) cookie.value = value;
+	};
+
+	ingest(`${databaseSlug}_sid`);
+	// On the platform database the database sid key IS the platform key, so
+	// only the platform key is ingested there.
+	if (databaseSlug !== "inicontent") ingest("inicontent_sid");
+});

package/app/middleware/table.ts

@@ -0,0 +1,54 @@
+export default defineNuxtRouteMiddleware(async (to) => {
+	const database = useState<Database>("database")
+	const table = useState<Table>("table")
+	let currentTableInPath: string | undefined = decodeURIComponent(
+		(to.params.table as string) ||
+			to.path.split("/admin/tables/")[1]?.split("/")[0] ||
+			"",
+	)
+
+	if (currentTableInPath === "undefined") currentTableInPath = undefined
+
+	if (!currentTableInPath && to.path.replace(/\/$/, "").includes("/auth"))
+		currentTableInPath = "users"
+
+	// The backups page is a database-level admin surface. New databases ship
+	// with a "backups" table in their meta, but legacy databases created before
+	// the feature only get a lazy table — so never 404 on its dedicated pages.
+	if (currentTableInPath === "backups") {
+		table.value =
+			database.value.tables?.find(({ slug }) => slug === "backups") ??
+			({ slug: "backups", label: "backups" } as Table)
+		return
+	}
+
+	if (
+		!database.value.tables ||
+		!currentTableInPath ||
+		!database.value.tables?.find(({ slug }) => slug === currentTableInPath)
+	) {
+		// The 404 error page renders inside the table layout. Drop any stale
+		// table state (e.g. the previously visited table) so the sidebar
+		// doesn't keep a now-mismatched table highlighted.
+		clearNuxtState("table")
+		// The redirect intent is dead (the table no longer exists) — drop it
+		// so a later login doesn't bounce back into this same 404 loop.
+		useScopedCookie<string | null>("redirectTo", database.value?.slug).value =
+			undefined
+		// Do NOT `throw` here: an error thrown from a route middleware during
+		// *client-side* navigation is swallowed by the router (nothing renders
+		// the error page), so navigating here from /auth after a redirectTo
+		// would abort silently and leave the user stuck on the auth page.
+		// Register the error with `showError()` (NuxtRoot swaps in error.vue)
+		// and `return true` so the navigation itself completes.
+		showError(createError({
+			statusCode: 404,
+			statusMessage: "table",
+		}))
+		return true
+	}
+
+	table.value = database.value.tables.find(
+		({ slug }) => slug === currentTableInPath,
+	) as Table
+})

package/app/middleware/user.ts

@@ -0,0 +1,26 @@
+export default defineNuxtRouteMiddleware(async () => {
+	const user = useState<User>("user");
+	const database = useState<Database>("database");
+	const config = useRuntimeConfig();
+
+	const sessionID = useScopedCookie<string|undefined>("sid", database.value?.slug);
+
+	if (!user.value) {
+		const platformSessionID = useScopedCookie<string|undefined>("sid", "inicontent");
+
+		if (!sessionID.value && !platformSessionID.value) return;
+
+		user.value = (
+			await $fetch<apiResponse<User>>(
+				`${config.public.apiBase}${database.value.slug}/auth/current`,
+				{
+					credentials: "include",
+					query: sessionID.value ? { [`${database.value.slug}_sid`]: sessionID.value } : { "inicontent_sid": platformSessionID.value },
+				},
+			)
+		).result;
+		if (!sessionID.value && user.value?.sessionID)
+			sessionID.value = user.value.sessionID;
+		if (!user.value) sessionID.value = undefined;
+	}
+});

package/app/pages/[[database]]/admin/api/auth/index.vue

@@ -0,0 +1,306 @@
+<template>
+	<main class="api-auth-doc-page">
+		<NCard :bordered="false">
+			<template #header>
+				<NFlex align="center" :size="8">
+					<Icon name="tabler:key" size="18" />
+					<NH2 style="margin: 0">{{ t('apiDocs.auth.title') }}</NH2>
+				</NFlex>
+			</template>
+			<NH5>{{ t('apiDocs.auth.description', { param: sessionParamName }) }}</NH5>
+		</NCard>
+
+		<section class="api-auth-doc-page__endpoints">
+			<ApiEndpointCard
+				:endpoint="signinEndpoint"
+				method="PUT"
+				:description="t('apiDocs.auth.signinDescription')"
+				:request-example="signinRequest"
+				:response-example="signinResponse"
+				:params="signinParams"
+			/>
+
+			<ApiEndpointCard
+				:endpoint="signupEndpoint"
+				method="POST"
+				:description="t('apiDocs.auth.signupDescription')"
+				:request-example="signupRequest"
+				:response-example="signupResponse"
+			/>
+
+			<ApiEndpointCard
+				:endpoint="currentEndpoint"
+				method="GET"
+				:description="t('apiDocs.auth.currentDescription', { param: sessionParamName })"
+				:response-example="currentResponse"
+				:params="currentParams"
+			/>
+
+			<ApiEndpointCard
+				:endpoint="signoutEndpoint"
+				method="GET"
+				:description="t('apiDocs.auth.signoutDescription')"
+				:response-example="signoutResponse"
+			/>
+
+			<ApiEndpointCard
+				:endpoint="resetRequestEndpoint"
+				method="POST"
+				:description="t('apiDocs.auth.resetRequestDescription')"
+				:request-example="resetRequestRequest"
+				:response-example="resetRequestResponse"
+			/>
+
+			<ApiEndpointCard
+				:endpoint="resetCompleteEndpoint"
+				method="PUT"
+				:description="t('apiDocs.auth.resetCompleteDescription')"
+				:request-example="resetCompleteRequest"
+				:response-example="resetCompleteResponse"
+			/>
+		</section>
+
+		<section v-if="usersTable?.schema?.length" class="api-auth-doc-page__schema">
+			<NCard :bordered="false">
+				<template #header>
+					<NFlex align="center" :size="8">
+						<Icon name="tabler:users" size="18" />
+						<NH3 style="margin: 0">{{ t('apiDocs.auth.signupSchemaTitle') }}</NH3>
+					</NFlex>
+				</template>
+				<ApiSchemaDocsTable :schema="usersTable.schema" size="large" />
+			</NCard>
+		</section>
+
+		<NAlert type="info" :show-icon="false">
+			{{ t('apiDocs.auth.cookieHint', { param: sessionParamName }) }}
+		</NAlert>
+	</main>
+</template>
+
+<script setup lang="ts">
+import { Icon } from "#components";
+
+definePageMeta({
+	layout: "dashboard",
+	middleware: ["database", "user", "dashboard", "global"],
+});
+
+const route = useRoute();
+const database = useState<Database>("database");
+const config = useRuntimeConfig();
+
+const sessionParamName = computed(() => {
+	const slug =
+		(route.params.database as string | undefined) ||
+		database.value?.slug ||
+		"inicontent";
+	return `${slug}_sid`;
+});
+
+const dbSlug = computed(
+	() =>
+		(route.params.database as string | undefined) ||
+		database.value?.slug ||
+		"inicontent",
+);
+
+const apiBase = computed(() => config.public.apiBase);
+
+const usersTable = computed(() =>
+	database.value?.tables?.find((table) => table.slug === "users"),
+);
+
+const signinEndpoint = computed(() => `/${dbSlug.value}/auth/signin`);
+const signupEndpoint = computed(() => `/${dbSlug.value}/auth/signup`);
+const currentEndpoint = computed(() => `/${dbSlug.value}/auth/current`);
+const signoutEndpoint = computed(() => `/${dbSlug.value}/auth/signout`);
+const resetRequestEndpoint = computed(() => `/${dbSlug.value}/auth/reset`);
+const resetCompleteEndpoint = computed(() => `/${dbSlug.value}/auth/reset`);
+
+const signinRequest = `{
+  "username": "demo",
+  "password": "mypassword123"
+}`;
+
+const signinResponse = `{
+  "result": {
+    "id": "a1b2c3d4",
+    "username": "demo",
+    "email": "demo@example.com",
+    "role": "editor",
+    "createdBy": "...",
+    "sessionID": "e5f6g7h8i9j0"
+  },
+  "message": "Signed in successfully",
+  "options": {},
+  "code": 200
+}`;
+
+const signinParams = computed(() => [
+	{
+		name: "locale",
+		type: "string",
+		required: false,
+		description: t("apiDocs.localeParam"),
+	},
+]);
+
+const signupRequest = `{
+  "username": "newuser",
+  "password": "securepass123",
+  "email": "newuser@example.com",
+  "role": "editor"
+}`;
+
+const signupResponse = `{
+  "result": {
+    "id": "b2c3d4e5",
+    "username": "newuser",
+    "email": "newuser@example.com",
+    "role": "editor",
+    "createdBy": "..."
+  },
+  "message": "User created successfully",
+  "options": {},
+  "code": 200
+}`;
+
+const currentResponse = `{
+  "result": {
+    "id": "a1b2c3d4",
+    "username": "demo",
+    "email": "demo@example.com",
+    "role": "editor",
+    "createdBy": "..."
+  },
+  "message": "Session is valid",
+  "options": {},
+  "code": 200
+}`;
+
+const currentParams = computed(() => [
+	{
+		name: sessionParamName.value,
+		type: "string",
+		required: true,
+		description: "Session ID",
+	},
+	{
+		name: "isSignedIn",
+		type: "boolean",
+		required: false,
+		description: t("apiDocs.isSignedInParam"),
+	},
+]);
+
+const signoutResponse = `{
+  "result": true,
+  "message": "Signed out successfully",
+  "options": {},
+  "code": 200
+}`;
+
+const resetRequestRequest = `{
+  "email": "demo@example.com"
+}`;
+
+const resetRequestResponse = `{
+  "result": true,
+  "message": "Password reset email sent",
+  "options": {},
+  "code": 200
+}`;
+
+const resetCompleteRequest = `{
+  "token": "abc123def456",
+  "password": "newpassword123"
+}`;
+
+const resetCompleteResponse = `{
+  "result": true,
+  "message": "Password has been reset successfully",
+  "options": {},
+  "code": 200
+}`;
+
+const jsonLd = computed(() => ({
+	"@context": "https://schema.org",
+	"@type": "WebAPI",
+	name: `${dbSlug.value} Authentication API`,
+	description: "Authentication endpoints for user sessions",
+	baseUrl: `${apiBase.value}${dbSlug.value}/auth`,
+	endpoints: [
+		{
+			"@type": "EntryPoint",
+			name: "Sign in",
+			httpMethod: "PUT",
+			urlTemplate: `${apiBase.value}${dbSlug.value}/auth/signin`,
+		},
+		{
+			"@type": "EntryPoint",
+			name: "Sign up",
+			httpMethod: "POST",
+			urlTemplate: `${apiBase.value}${dbSlug.value}/auth/signup`,
+		},
+		{
+			"@type": "EntryPoint",
+			name: "Current user",
+			httpMethod: "GET",
+			urlTemplate: `${apiBase.value}${dbSlug.value}/auth/current`,
+		},
+		{
+			"@type": "EntryPoint",
+			name: "Sign out",
+			httpMethod: "GET",
+			urlTemplate: `${apiBase.value}${dbSlug.value}/auth/signout`,
+		},
+		{
+			"@type": "EntryPoint",
+			name: "Request password reset",
+			httpMethod: "POST",
+			urlTemplate: `${apiBase.value}${dbSlug.value}/auth/reset`,
+		},
+		{
+			"@type": "EntryPoint",
+			name: "Complete password reset",
+			httpMethod: "PUT",
+			urlTemplate: `${apiBase.value}${dbSlug.value}/auth/reset`,
+		},
+	],
+}));
+
+useHead(() => ({
+	title: `${t("auth")} | ${t("apiDocumentation")}`,
+	meta: [
+		{
+			name: "description",
+			content: `API authentication endpoints for ${dbSlug.value}. Sign in, sign up, manage sessions, and reset passwords.`,
+		},
+	],
+	script: [
+		{
+			type: "application/ld+json",
+			innerHTML: JSON.stringify(jsonLd.value),
+		},
+	],
+}));
+</script>
+
+<style scoped>
+.api-auth-doc-page {
+	display: flex;
+	flex-direction: column;
+	gap: 24px;
+}
+
+.api-auth-doc-page__endpoints {
+	display: flex;
+	flex-direction: column;
+	gap: 16px;
+}
+
+.api-auth-doc-page__schema {
+	margin-top: 8px;
+}
+</style>

package/app/pages/[[database]]/admin/api/index.vue

@@ -0,0 +1,18 @@
+<template>
+	<NFlex justify="center" align="center" style="min-height: 50vh">
+		<NSpin size="large" />
+	</NFlex>
+</template>
+
+<script setup lang="ts">
+definePageMeta({
+	layout: "dashboard",
+	middleware: ["database", "user", "dashboard", "global"],
+});
+
+const route = useRoute();
+
+await navigateTo(
+	`${route.params.database ? `/${route.params.database}` : ""}/admin/api/tables`,
+);
+</script>