katecms 0.0.0-stage → 1.0.0-beta.1

package/dist/runtime/server/api/_katecms/oembed.get.js

@@ -0,0 +1,53 @@
+import { createError, defineEventHandler, getQuery } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { can, fetchOembed, getRole } from "@katecms/core";
+import { connectOembed, resolveOembedHost } from "../../utils/oembed-fetch.js";
+import { requireUser } from "../../utils/session.js";
+function queryString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function canWrite(right) {
+  if (right === true) {
+    return true;
+  }
+  return Array.isArray(right) && (right.includes("create") || right.includes("update"));
+}
+function canFetchOembed(user, roles) {
+  if (can(user, "media", "read", { roles })) {
+    return true;
+  }
+  if (can(user, "collections", "create", { roles }) || can(user, "collections", "update", { roles })) {
+    return true;
+  }
+  const collections = getRole(roles, user.role)?.rights.collections;
+  if (!collections || typeof collections !== "object" || Array.isArray(collections)) {
+    return false;
+  }
+  return Object.values(collections).some((right) => canWrite(right));
+}
+export default defineEventHandler(async (event) => {
+  const user = await requireUser(event);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  if (!canFetchOembed(user, roles)) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Insufficient permissions."
+    });
+  }
+  const query = getQuery(event);
+  const result = await fetchOembed({
+    url: queryString(query.url) ?? "",
+    maxwidth: queryString(query.maxwidth),
+    maxheight: queryString(query.maxheight),
+    resolve: resolveOembedHost,
+    connect: connectOembed
+  });
+  if (!result.ok) {
+    throw createError({
+      statusCode: result.status,
+      statusMessage: result.error
+    });
+  }
+  return result.data;
+});

package/dist/runtime/server/api/_katecms/options/[page].get.d.ts

@@ -0,0 +1,7 @@
+import type { OptionPageResponse } from '../../../../utils/options.js';
+/**
+ * Load one options page. Values are public site settings.
+ * `canRead` / `canUpdate` reflect the current session (both false when logged out).
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<OptionPageResponse>>;
+export default _default;

package/dist/runtime/server/api/_katecms/options/[page].get.js

@@ -0,0 +1,28 @@
+import { defineEventHandler, getRouterParam } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { findOption } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { getCurrentUser } from "../../../utils/session.js";
+import {
+  optionFlags,
+  optionPageFields,
+  readOptionPageSlug,
+  requireOptionPage,
+  resolveOptionValues,
+  toOptionMeta
+} from "../../../utils/options.js";
+export default defineEventHandler(async (event) => {
+  const slug = readOptionPageSlug(getRouterParam(event, "page"));
+  const def = requireOptionPage(slug);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  const actor = await getCurrentUser(event);
+  const flags = optionFlags(actor, roles, slug);
+  const row = await findOption(getDb(), slug);
+  const fields = optionPageFields(def.fields);
+  return {
+    page: toOptionMeta(slug, def),
+    values: resolveOptionValues(fields, row?.value),
+    canRead: flags.canRead,
+    canUpdate: flags.canUpdate
+  };
+});

package/dist/runtime/server/api/_katecms/options/[page].patch.d.ts

@@ -0,0 +1,4 @@
+import type { OptionPageResponse } from '../../../../utils/options.js';
+/** Save one options page (fields JSON on `options.key` = page slug). */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<OptionPageResponse>>;
+export default _default;

package/dist/runtime/server/api/_katecms/options/[page].patch.js

@@ -0,0 +1,36 @@
+import { defineEventHandler, getRouterParam, readBody } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { setOption } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { requireUser } from "../../../utils/session.js";
+import { requirePermission } from "../../../utils/permissions.js";
+import {
+  optionFlags,
+  optionPageFields,
+  readFields,
+  readOptionPageSlug,
+  requireOptionFields,
+  requireOptionPage,
+  resolveOptionValues,
+  toOptionMeta
+} from "../../../utils/options.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  const slug = readOptionPageSlug(getRouterParam(event, "page"));
+  const def = requireOptionPage(slug);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  requirePermission(actor, "options", "update", roles, slug);
+  const body = await readBody(event);
+  const schema = optionPageFields(def.fields);
+  const fields = readFields(body?.fields);
+  requireOptionFields(schema, fields);
+  const db = getDb();
+  const row = await setOption(db, slug, fields);
+  const flags = optionFlags(actor, roles, slug);
+  return {
+    page: toOptionMeta(slug, def),
+    values: resolveOptionValues(schema, row?.value),
+    canRead: flags.canRead,
+    canUpdate: flags.canUpdate
+  };
+});

package/dist/runtime/server/api/_katecms/query.get.d.ts

@@ -0,0 +1,24 @@
+import type { QueryCollectionResponse } from '../../../utils/collections.js';
+/**
+ * Public list query.
+ *
+ * Query:
+ * - `collection` (required) — comma-separated collection slugs, or `any`
+ *   for every public collection
+ * - `preview` — `1`/`true`/`yes` to include drafts when the requester may
+ *   `collections:read` every queried collection
+ * - `status` — `published`, `draft`, or comma-separated; `draft` is ignored
+ *   unless preview is granted. Trash is never returned.
+ * - `page`, `perPage`
+ * - `search`, `title`, `includeIds`, `excludeIds`
+ * - `parentId` (`0` = top-level), `parentIds`, `excludeParentIds`
+ * - `authorIn`, `authorNotIn`, `slug`, `slugs`
+ * - `dictionaryQuery` — JSON object (`relation` + `queries`)
+ * - `fieldsQuery` — JSON object (`relation` + `queries`) against `fields`.
+ *   `REGEXP` and `NOT REGEXP` are rejected.
+ * - `orderBy` (`date`, `modified`, `name`, `includeIds`, or a column), `order`
+ *
+ * Collections with `public: false` are skipped. Unknown types are skipped.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<QueryCollectionResponse>>;
+export default _default;

package/dist/runtime/server/api/_katecms/query.get.js

@@ -0,0 +1,270 @@
+import { defineEventHandler, getQuery } from "h3";
+import { useRuntimeConfig } from "#imports";
+import {
+  buildSlugPathMap,
+  can,
+  collectionListPaging,
+  collectionPerPage,
+  countQueryCollections,
+  DEFAULT_COLLECTION_PER_PAGE,
+  isCollectionQueryOrderBy,
+  parseDictionaryQuery,
+  parseFieldsQuery,
+  queryCollections
+} from "@katecms/core";
+import { getDb } from "../../utils/db.js";
+import { rejectPublicRegexp } from "../../utils/public-fields-query.js";
+import { getCurrentUser } from "../../utils/session.js";
+import {
+  fail,
+  getCollectionDefinition,
+  getCollections,
+  readPage,
+  readPerPage,
+  readSearch,
+  toAdminEntry,
+  toCollectionMeta
+} from "../../utils/collections.js";
+import { loadAssignedEntryDictionaries } from "../../utils/dictionaries.js";
+import {
+  isTruthyQueryParam,
+  parsePublicStatusParam,
+  resolvePublicStatuses
+} from "../../../utils/preview.js";
+const ORDER_ALIASES = {
+  date: "published_at",
+  modified: "updated_at",
+  name: "slug",
+  ID: "id"
+};
+function firstQueryValue(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+function hasQueryParam(query, keys) {
+  return keys.some((key) => query[key] !== void 0);
+}
+function readStringList(value) {
+  const parts = Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : [];
+  return [...new Set(parts.map((item) => String(item).trim()).filter(Boolean))];
+}
+function readIdList(value) {
+  const parts = Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : value == null ? [] : [value];
+  const ids = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const part of parts) {
+    const n = Number(part);
+    if (!Number.isInteger(n) || n < 1 || seen.has(n)) {
+      continue;
+    }
+    seen.add(n);
+    ids.push(n);
+  }
+  return ids;
+}
+function readParentIdList(value) {
+  const parts = Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : value == null ? [] : [value];
+  const ids = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const part of parts) {
+    if (part === null || part === "null") {
+      if (!seen.has(0)) {
+        seen.add(0);
+        ids.push(0);
+      }
+      continue;
+    }
+    if (part === "") {
+      continue;
+    }
+    const n = Number(part);
+    if (!Number.isInteger(n) || n < 0 || seen.has(n)) {
+      continue;
+    }
+    seen.add(n);
+    ids.push(n);
+  }
+  return ids;
+}
+function readOrderBy(value) {
+  const raw = firstQueryValue(value);
+  if (typeof raw !== "string" || !raw.trim()) {
+    return void 0;
+  }
+  const token = raw.trim();
+  if (token === "includeIds") {
+    return "includeIds";
+  }
+  const mapped = ORDER_ALIASES[token] ?? token;
+  return isCollectionQueryOrderBy(mapped) ? mapped : void 0;
+}
+function readOrder(value) {
+  const raw = firstQueryValue(value);
+  if (typeof raw !== "string") {
+    return void 0;
+  }
+  const token = raw.trim().toLowerCase();
+  if (token === "asc" || token === "desc") {
+    return token;
+  }
+  return void 0;
+}
+function readDictionaryQuery(value) {
+  const raw = firstQueryValue(value);
+  if (raw == null || raw === "") {
+    return void 0;
+  }
+  let parsed = raw;
+  if (typeof raw === "string") {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      fail(400, "Invalid dictionaryQuery.");
+    }
+  }
+  if (typeof parsed !== "object" || parsed == null || Array.isArray(parsed)) {
+    fail(400, "Invalid dictionaryQuery.");
+  }
+  return parseDictionaryQuery(parsed);
+}
+function readFieldsQuery(value) {
+  const raw = firstQueryValue(value);
+  if (raw == null || raw === "") {
+    return void 0;
+  }
+  let parsed = raw;
+  if (typeof raw === "string") {
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      fail(400, "Invalid fieldsQuery.");
+    }
+  }
+  if (typeof parsed !== "object" || parsed == null || Array.isArray(parsed)) {
+    fail(400, "Invalid fieldsQuery.");
+  }
+  return rejectPublicRegexp(parseFieldsQuery(parsed));
+}
+function defaultPerPage(defs) {
+  if (defs.length === 1) {
+    return collectionPerPage(defs[0]);
+  }
+  return DEFAULT_COLLECTION_PER_PAGE;
+}
+function publicCollectionSlugs(all) {
+  return Object.keys(all).filter((slug) => all[slug]?.public !== false);
+}
+function resolveQueryCollectionTypes(requested, all) {
+  if (requested.includes("any")) {
+    return publicCollectionSlugs(all);
+  }
+  return requested.filter((slug) => {
+    const def = all[slug];
+    return def != null && def.public !== false;
+  });
+}
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event);
+  const requested = readStringList(query.collection);
+  if (requested.length === 0) {
+    fail(400, "Missing collection.");
+  }
+  const all = getCollections();
+  const types = resolveQueryCollectionTypes(requested, all);
+  const defs = types.map((slug) => getCollectionDefinition(slug)).filter((def) => def != null);
+  if (types.length === 0) {
+    return {
+      entries: [],
+      collections: [],
+      preview: false,
+      page: readPage(query.page),
+      perPage: readPerPage(query.perPage, DEFAULT_COLLECTION_PER_PAGE),
+      total: 0
+    };
+  }
+  const previewRequested = isTruthyQueryParam(query.preview);
+  const actor = previewRequested ? await getCurrentUser(event) : null;
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  const previewAllowed = actor != null && types.every((slug) => can(actor, "collections", "read", { roles, scope: slug }));
+  const { statuses, preview } = resolvePublicStatuses({
+    previewRequested,
+    previewAllowed,
+    requested: parsePublicStatusParam(query.status)
+  });
+  const page = readPage(query.page);
+  const perPage = readPerPage(query.perPage, defaultPerPage(defs));
+  const filters = {
+    types,
+    statuses,
+    search: readSearch(query.search) || void 0,
+    ...collectionListPaging(page, perPage)
+  };
+  if (hasQueryParam(query, ["title"])) {
+    filters.title = readStringList(query.title);
+  }
+  if (hasQueryParam(query, ["includeIds"])) {
+    filters.includeIds = readIdList(query.includeIds);
+  }
+  if (hasQueryParam(query, ["excludeIds"])) {
+    filters.excludeIds = readIdList(query.excludeIds);
+  }
+  if (hasQueryParam(query, ["parentId", "parentIds"])) {
+    filters.parentIds = [
+      ...readParentIdList(query.parentIds),
+      ...readParentIdList(query.parentId)
+    ];
+  }
+  if (hasQueryParam(query, ["excludeParentIds"])) {
+    filters.excludeParentIds = readParentIdList(query.excludeParentIds);
+  }
+  if (hasQueryParam(query, ["authorIn"])) {
+    filters.authorIn = readIdList(query.authorIn);
+  }
+  if (hasQueryParam(query, ["authorNotIn"])) {
+    filters.authorNotIn = readIdList(query.authorNotIn);
+  }
+  if (hasQueryParam(query, ["slug", "slugs"])) {
+    filters.slugs = [
+      ...readStringList(query.slugs),
+      ...readStringList(query.slug)
+    ];
+  }
+  if (hasQueryParam(query, ["dictionaryQuery"])) {
+    filters.dictionaryQuery = readDictionaryQuery(query.dictionaryQuery);
+  }
+  if (hasQueryParam(query, ["fieldsQuery"])) {
+    filters.fieldsQuery = readFieldsQuery(query.fieldsQuery);
+  }
+  filters.orderBy = readOrderBy(query.orderBy) ?? "published_at";
+  const order = readOrder(query.order);
+  if (order) {
+    filters.order = order;
+  }
+  const db = getDb();
+  const [rows, total, pathRows] = await Promise.all([
+    queryCollections(db, filters),
+    countQueryCollections(db, filters),
+    db.selectFrom("collections").select(["id", "slug", "parent_id", "type"]).where("type", "in", types).execute()
+  ]);
+  const pathsByType = /* @__PURE__ */ new Map();
+  for (const type of types) {
+    pathsByType.set(
+      type,
+      buildSlugPathMap(pathRows.filter((row) => row.type === type))
+    );
+  }
+  const entries = await Promise.all(rows.map(async (row) => {
+    const dictionaries = await loadAssignedEntryDictionaries(db, row.id, row.type);
+    return toAdminEntry(row, pathsByType.get(row.type)?.get(row.id) ?? row.slug, { dictionaries });
+  }));
+  return {
+    entries,
+    collections: types.flatMap((slug) => {
+      const def = getCollectionDefinition(slug);
+      return def ? [toCollectionMeta(slug, def)] : [];
+    }),
+    preview,
+    page,
+    perPage,
+    total
+  };
+});

package/dist/runtime/server/api/_katecms/relation/entries.get.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Collection entries for `post_object`, `page_link`, and `relationship`.
+ * Query: `postType` (comma-separated slugs), `q`, `elements` (image field keys), `archives=1`.
+ * Lists published and draft entries (not trash).
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    entries: (import("@katecms/core").RelationEntryValue & {
+        termIds?: number[];
+        featuredImage?: import("@katecms/core").MediaItem | null;
+    })[];
+    archives: {
+        url: string;
+        title: string;
+        type: string;
+    }[];
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/relation/entries.get.js

@@ -0,0 +1,74 @@
+import { defineEventHandler, getQuery } from "h3";
+import { useRuntimeConfig } from "#imports";
+import {
+  can,
+  listCollections
+} from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { requireUser } from "../../../utils/session.js";
+import { getCollections, fail } from "../../../utils/collections.js";
+import {
+  RELATION_PICKER_LIMIT,
+  collectionArchiveOption,
+  pathMapForRows,
+  pickFeaturedImage,
+  readStringList,
+  toPickerEntry
+} from "../../../utils/relation.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  const collections = getCollections();
+  const query = getQuery(event);
+  const requested = readStringList(query.postType);
+  const wanted = requested.length > 0 ? requested.filter((slug) => slug in collections) : Object.keys(collections);
+  if (requested.length > 0 && wanted.length === 0) {
+    fail(404, "Collection not found.");
+  }
+  const readable = wanted.filter((slug) => can(actor, "collections", "read", { roles, scope: slug }));
+  const search = typeof query.q === "string" ? query.q.trim() : "";
+  const imageFields = readStringList(query.elements);
+  const db = getDb();
+  const entries = [];
+  for (const slug of readable) {
+    const def = collections[slug];
+    if (!def) {
+      continue;
+    }
+    const rows = await listCollections(db, slug, {
+      status: "active",
+      search: search || void 0,
+      limit: RELATION_PICKER_LIMIT
+    });
+    const dictionarySlugs = readStringList(query.dictionary);
+    let filtered = rows;
+    const ids = rows.map((row) => row.id);
+    const termIdsByEntry = /* @__PURE__ */ new Map();
+    if (ids.length > 0) {
+      const links = await db.selectFrom("collection_dictionaries").select(["collection_id", "dictionary_id"]).where("collection_id", "in", ids).execute();
+      for (const link of links) {
+        const current = termIdsByEntry.get(link.collection_id) ?? [];
+        current.push(link.dictionary_id);
+        termIdsByEntry.set(link.collection_id, current);
+      }
+      if (dictionarySlugs.length > 0) {
+        const typed = await db.selectFrom("collection_dictionaries").innerJoin("dictionaries", "dictionaries.id", "collection_dictionaries.dictionary_id").select("collection_dictionaries.collection_id as collection_id").where("collection_dictionaries.collection_id", "in", ids).where("dictionaries.type", "in", dictionarySlugs).execute();
+        const allowed = new Set(typed.map((link) => link.collection_id));
+        filtered = rows.filter((row) => allowed.has(row.id));
+      }
+    }
+    const paths = pathMapForRows(rows);
+    for (const row of filtered) {
+      entries.push(toPickerEntry(row, def, paths.get(row.id) ?? row.slug, {
+        featuredImage: imageFields.length ? pickFeaturedImage(row.fields, imageFields) : void 0,
+        termIds: termIdsByEntry.get(row.id) ?? []
+      }));
+    }
+  }
+  const archives = query.archives === "1" || query.archives === "true" ? readable.flatMap((slug) => {
+    const def = collections[slug];
+    const option = def ? collectionArchiveOption(slug, def) : null;
+    return option ? [option] : [];
+  }) : [];
+  return { entries, archives };
+});

package/dist/runtime/server/api/_katecms/relation/terms.get.d.ts

@@ -0,0 +1,17 @@
+import type { RelationTermValue } from '@katecms/core';
+/**
+ * Dictionary terms for the `dictionary` field and relationship filters.
+ * Readable with `dictionaries:read` or `collections:read` on an attached collection.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    dictionary: {
+        slug: string;
+        labels: {
+            name: string;
+            singularName: string;
+        };
+    };
+    terms: RelationTermValue[];
+    canCreate: boolean;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/relation/terms.get.js

@@ -0,0 +1,51 @@
+import { defineEventHandler, getQuery } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { can, listDictionaries, toRelationTermValue } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { requireUser } from "../../../utils/session.js";
+import {
+  flattenDictionaryTerms,
+  readDictionarySlug,
+  requireDictionary
+} from "../../../utils/dictionaries.js";
+import { fail } from "../../../utils/collections.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  const query = getQuery(event);
+  const dictionarySlug = readDictionarySlug(
+    typeof query.dictionary === "string" ? query.dictionary : void 0
+  );
+  const def = requireDictionary(dictionarySlug);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  const canReadDictionary = can(actor, "dictionaries", "read", { roles, scope: dictionarySlug });
+  const canReadCollection = def.collections.some((slug) => can(actor, "collections", "read", { roles, scope: slug }));
+  if (!canReadDictionary && !canReadCollection) {
+    fail(403, "Insufficient permissions.");
+  }
+  const db = getDb();
+  const rows = await listDictionaries(db, dictionarySlug);
+  const listed = flattenDictionaryTerms(rows);
+  const terms = listed.map(({ row, depth, slugPath }) => toRelationTermValue({
+    id: row.id,
+    type: row.type,
+    title: row.title,
+    slug: row.slug,
+    slugPath,
+    fields: row.fields ?? {},
+    parentId: row.parent_id,
+    depth,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  }));
+  return {
+    dictionary: {
+      slug: dictionarySlug,
+      labels: {
+        name: def.labels.name,
+        singularName: def.labels.singularName ?? def.labels.name
+      }
+    },
+    terms,
+    canCreate: can(actor, "dictionaries", "create", { roles, scope: dictionarySlug })
+  };
+});

package/dist/runtime/server/api/_katecms/resolve.get.d.ts

@@ -0,0 +1,17 @@
+import type { ResolveResponse } from '../../../utils/collections.js';
+/**
+ * Public resolve: map a frontend path to a collection entry or archive.
+ *
+ * Query:
+ * - `path` (required) — public URL, e.g. `/inf/about` or archive `/inf`
+ * - `preview` — `1`/`true`/`yes` to include drafts when the requester may
+ *   `collections:read` the matched collection
+ * - `status` — `published`, `draft`, or comma-separated; `draft` is ignored
+ *   unless preview is granted. Trash is never returned.
+ * - `page` / `perPage` — archive listing only
+ *
+ * Unauthorized preview requests still resolve published entries only (404 if
+ * the path is a draft), so existence is not leaked.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<ResolveResponse>>;
+export default _default;