katecms 0.0.0-stage → 1.0.0-beta.1

package/dist/runtime/server/utils/options.d.ts

@@ -0,0 +1,17 @@
+import type { Fields, OptionFields, OptionPageDefinition, OptionPages, RoleHolder, RoleMap } from '@katecms/core';
+import { fail, readFields } from './collections.js';
+import type { AdminOptionMeta } from '../../utils/options.js';
+export { fail, readFields };
+export declare function getOptionPages(): OptionPages;
+export declare function getOptionPageDefinition(slug: string): OptionPageDefinition | undefined;
+export declare function requireOptionPage(slug: string): OptionPageDefinition;
+export declare function readOptionPageSlug(raw: string | undefined): string;
+export declare function toOptionMeta(slug: string, def: OptionPageDefinition): AdminOptionMeta;
+export declare function optionPageFields(fields: OptionFields | undefined): Fields;
+export declare function toStoredOptionValues(value: unknown): Record<string, unknown>;
+export declare function resolveOptionValues(fields: Fields, stored: unknown): Record<string, unknown>;
+export declare function requireOptionFields(fields: Fields, values: Record<string, unknown>): void;
+export declare function optionFlags(actor: RoleHolder | null, roles: RoleMap, slug: string): {
+    canRead: boolean;
+    canUpdate: boolean;
+};

package/dist/runtime/server/utils/options.js

@@ -0,0 +1,66 @@
+import { useRuntimeConfig } from "#imports";
+import {
+  buildFormValues,
+  can,
+  formatRequiredFieldsError,
+  validateRequiredFields
+} from "@katecms/core";
+import { fail, readFields } from "./collections.js";
+export { fail, readFields };
+export function getOptionPages() {
+  return useRuntimeConfig().katecms?.options ?? {};
+}
+export function getOptionPageDefinition(slug) {
+  return getOptionPages()[slug];
+}
+export function requireOptionPage(slug) {
+  const page = getOptionPageDefinition(slug);
+  if (!page) {
+    fail(404, "Options page not found.");
+  }
+  return page;
+}
+export function readOptionPageSlug(raw) {
+  const slug = typeof raw === "string" ? raw.trim() : "";
+  if (!slug) {
+    fail(400, "Options page is required.");
+  }
+  return slug;
+}
+export function toOptionMeta(slug, def) {
+  return {
+    slug,
+    label: def.label,
+    fields: def.fields ?? {}
+  };
+}
+export function optionPageFields(fields) {
+  return fields ?? {};
+}
+export function toStoredOptionValues(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return { ...value };
+  }
+  return {};
+}
+export function resolveOptionValues(fields, stored) {
+  return {
+    ...buildFormValues(fields),
+    ...toStoredOptionValues(stored)
+  };
+}
+export function requireOptionFields(fields, values) {
+  const issues = validateRequiredFields(fields, values);
+  if (issues.length > 0) {
+    fail(422, formatRequiredFieldsError(issues));
+  }
+}
+export function optionFlags(actor, roles, slug) {
+  if (!actor) {
+    return { canRead: false, canUpdate: false };
+  }
+  return {
+    canRead: can(actor, "options", "read", { roles, scope: slug }),
+    canUpdate: can(actor, "options", "update", { roles, scope: slug })
+  };
+}

package/dist/runtime/server/utils/permissions.d.ts

@@ -0,0 +1,13 @@
+import type { Resource, RoleAction, RoleHolder, RoleMap, SafeUser } from '@katecms/core';
+/**
+ * Like {@link can} but throws 403 when the actor lacks the permission.
+ * Pass `scope` for keyed resources (`collections`, `dictionaries`, `options`).
+ */
+export declare function requirePermission(user: RoleHolder, resource: Resource, action: RoleAction, roles: RoleMap, scope?: string): void;
+/**
+ * Like {@link canOnEntry} but throws 403. Used for update/delete of a stored
+ * collection row so authors can only change their own entries.
+ */
+export declare function requireEntryPermission(user: SafeUser, resource: Resource, action: RoleAction, entry: {
+    authorId: number | null;
+}, roles: RoleMap, scope?: string): void;

package/dist/runtime/server/utils/permissions.js

@@ -0,0 +1,20 @@
+import { createError } from "h3";
+import { can, canOnEntry } from "@katecms/core";
+export function requirePermission(user, resource, action, roles, scope) {
+  if (!can(user, resource, action, { roles, scope })) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Insufficient permissions."
+    });
+  }
+}
+export function requireEntryPermission(user, resource, action, entry, roles, scope) {
+  if (!canOnEntry(user, resource, action, entry, { roles, scope, userId: user.id })) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Insufficient permissions."
+    });
+  }
+}

package/dist/runtime/server/utils/public-fields-query.d.ts

@@ -0,0 +1,6 @@
+import type { FieldsQuery } from '@katecms/core';
+/**
+ * Public collection and term queries accept field filters.
+ * Regexp compares are rejected: a pattern bound into PostgreSQL `~` can stall the database.
+ */
+export declare function rejectPublicRegexp(query: FieldsQuery | undefined): FieldsQuery | undefined;

package/dist/runtime/server/utils/public-fields-query.js

@@ -0,0 +1,8 @@
+import { fieldsQueryUsesRegexp } from "@katecms/core";
+import { fail } from "./collections.js";
+export function rejectPublicRegexp(query) {
+  if (fieldsQueryUsesRegexp(query)) {
+    fail(400, "Invalid fieldsQuery.");
+  }
+  return query;
+}

package/dist/runtime/server/utils/public-term.d.ts

@@ -0,0 +1,8 @@
+import type { Kysely } from 'kysely';
+import type { Database } from '@katecms/core';
+import type { ResolveTermResponse } from '../../utils/collections.js';
+/**
+ * Public term URL follows the dictionary `rewrite` (`/{dictionary}/%name%` by default).
+ * A collection rewrite that matches the same path wins before this is called.
+ */
+export declare function resolvePublicDictionaryTerm(db: Kysely<Database>, path: string): Promise<ResolveTermResponse | undefined>;

package/dist/runtime/server/utils/public-term.js

@@ -0,0 +1,80 @@
+import {
+  buildPublicPath,
+  buildSlugPathMap,
+  isCollectionPublic,
+  isDictionaryPublic,
+  listCollectionsByDictionary,
+  listDictionaries,
+  matchCollectionPath
+} from "@katecms/core";
+import { getCollections } from "./collections.js";
+import { getDictionaries } from "./dictionaries.js";
+export async function resolvePublicDictionaryTerm(db, path) {
+  const dictionaries = Object.fromEntries(
+    Object.entries(getDictionaries()).filter(([, def2]) => isDictionaryPublic(def2))
+  );
+  const matched = matchCollectionPath(dictionaries, path);
+  if (!matched) {
+    return void 0;
+  }
+  const type = matched.collectionSlug;
+  const def = dictionaries[type];
+  if (!def) {
+    return void 0;
+  }
+  const slugPath = matched.slugPath;
+  const rows = await listDictionaries(db, type);
+  const slugPaths = buildSlugPathMap(rows);
+  const row = rows.find((item) => (slugPaths.get(item.id) ?? item.slug) === slugPath);
+  if (!row) {
+    return void 0;
+  }
+  const term = {
+    id: row.id,
+    type: row.type,
+    slug: row.slug,
+    slugPath,
+    title: row.title,
+    fields: row.fields ?? {},
+    parentId: row.parent_id
+  };
+  const linked = await listCollectionsByDictionary(db, row.id);
+  const collections = getCollections();
+  const entries = [];
+  const types = [...new Set(linked.filter((item) => item.status === "published").map((item) => item.type))];
+  for (const collectionType of types) {
+    const collection = collections[collectionType];
+    if (!collection || !isCollectionPublic(collection)) {
+      continue;
+    }
+    const family = await db.selectFrom("collections").select(["id", "slug", "parent_id"]).where("type", "=", collectionType).where("status", "!=", "trash").execute();
+    const paths = buildSlugPathMap(family);
+    for (const item of linked) {
+      if (item.type !== collectionType || item.status !== "published") {
+        continue;
+      }
+      const itemPath = paths.get(item.id) ?? item.slug;
+      if (!itemPath) {
+        continue;
+      }
+      entries.push({
+        id: item.id,
+        title: item.title,
+        path: buildPublicPath(collection.rewrite, collectionType, itemPath)
+      });
+    }
+  }
+  return {
+    kind: "term",
+    dictionary: {
+      slug: type,
+      labels: {
+        name: def.labels.name,
+        singularName: def.labels.singularName || def.labels.name
+      }
+    },
+    term,
+    entries,
+    path: buildPublicPath(def.rewrite, type, slugPath)
+  };
+}

package/dist/runtime/server/utils/regenerate.d.ts

@@ -0,0 +1,12 @@
+import type { StoredMediaVariant } from '@katecms/core';
+export interface RegenerateTarget {
+    id: number;
+    filename: string;
+    mime_type: string;
+    variants: StoredMediaVariant[];
+}
+/**
+ * Rebuild one item's variants from the current media config and persist
+ * `ready` / `none` / `failed`. Safe to run after the HTTP response.
+ */
+export declare function regenerateMedia(target: RegenerateTarget): Promise<void>;

package/dist/runtime/server/utils/regenerate.js

@@ -0,0 +1,40 @@
+import {
+  hasImageWork,
+  isProcessableImage,
+  regenerateVariants,
+  updateMedia
+} from "@katecms/core";
+import { getDb } from "./db.js";
+import { getMediaConfig, getMediaStorage } from "./media.js";
+export async function regenerateMedia(target) {
+  const { id, filename, mime_type: mimeType, variants: oldVariants } = target;
+  if (!isProcessableImage(mimeType)) {
+    return;
+  }
+  const storage = getMediaStorage();
+  const config = getMediaConfig();
+  const willGenerate = hasImageWork(config);
+  try {
+    let variants = [];
+    if (willGenerate) {
+      variants = await regenerateVariants({
+        storage,
+        key: filename,
+        mimeType,
+        oldVariants,
+        config
+      });
+    } else {
+      await Promise.all(oldVariants.map((variant) => storage.delete(variant.filename).catch(() => {
+      })));
+    }
+    await updateMedia(getDb(), id, {
+      variants,
+      variants_status: willGenerate ? "ready" : "none"
+    });
+  } catch (error) {
+    console.error("[katecms] failed to regenerate image variants", error);
+    await updateMedia(getDb(), id, { variants_status: "failed" }).catch(() => {
+    });
+  }
+}

package/dist/runtime/server/utils/relation.d.ts

@@ -0,0 +1,18 @@
+import type { Collection, CollectionDefinition, MediaItem, RelationEntryValue } from '@katecms/core';
+export declare const RELATION_PICKER_LIMIT = 500;
+export declare function readStringList(raw: unknown): string[];
+/** First image found in `fields` for the given field keys (`image` or `gallery`). */
+export declare function pickFeaturedImage(fields: unknown, keys: string[]): MediaItem | null;
+export declare function toPickerEntry(row: Collection, def: CollectionDefinition, slugPath: string, extras?: {
+    featuredImage?: MediaItem | null;
+    termIds?: number[];
+}): RelationEntryValue & {
+    termIds?: number[];
+    featuredImage?: MediaItem | null;
+};
+export declare function collectionArchiveOption(slug: string, def: CollectionDefinition): {
+    url: string;
+    title: string;
+    type: string;
+} | null;
+export declare function pathMapForRows(rows: Collection[]): Map<number, string>;

package/dist/runtime/server/utils/relation.js

@@ -0,0 +1,77 @@
+import {
+  buildPublicPath,
+  buildSlugPathMap,
+  isImageMedia,
+  isMediaItem,
+  resolveArchivePath,
+  toRelationEntryValue
+} from "@katecms/core";
+export const RELATION_PICKER_LIMIT = 500;
+export function readStringList(raw) {
+  const parts = Array.isArray(raw) ? raw : typeof raw === "string" ? raw.split(",") : [];
+  return [...new Set(parts.map((item) => String(item).trim()).filter(Boolean))];
+}
+export function pickFeaturedImage(fields, keys) {
+  if (!keys.length || !fields || typeof fields !== "object" || Array.isArray(fields)) {
+    return null;
+  }
+  const record = fields;
+  for (const key of keys) {
+    const value = record[key];
+    if (isMediaItem(value) && isImageMedia(value)) {
+      return value;
+    }
+    if (Array.isArray(value)) {
+      const image = value.find((item) => isMediaItem(item) && isImageMedia(item));
+      if (image) {
+        return image;
+      }
+    }
+  }
+  return null;
+}
+export function toPickerEntry(row, def, slugPath, extras) {
+  const path = slugPath || row.slug;
+  const entry = toRelationEntryValue({
+    id: row.id,
+    type: row.type,
+    status: row.status,
+    title: row.title,
+    slug: row.slug,
+    slugPath: path,
+    url: def.public === false ? "" : buildPublicPath(def.rewrite, row.type, path),
+    fields: row.fields ?? {},
+    parentId: row.parent_id,
+    menuOrder: row.menu_order,
+    authorId: row.author_id,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    publishedAt: row.published_at
+  });
+  if (extras?.featuredImage !== void 0) {
+    entry.featuredImage = extras.featuredImage;
+  }
+  if (extras?.termIds) {
+    entry.termIds = extras.termIds;
+  }
+  return entry;
+}
+export function collectionArchiveOption(slug, def) {
+  const url = resolveArchivePath(def, slug);
+  if (!url || def.public === false) {
+    return null;
+  }
+  const name = def.labels.name;
+  return {
+    type: slug,
+    title: `${name} archive`,
+    url
+  };
+}
+export function pathMapForRows(rows) {
+  return buildSlugPathMap(rows.map((row) => ({
+    id: row.id,
+    slug: row.slug,
+    parent_id: row.parent_id
+  })));
+}

package/dist/runtime/server/utils/request-address.d.ts

@@ -0,0 +1,6 @@
+import type { H3Event } from 'h3';
+/**
+ * Socket address, or the client address added by a trusted proxy.
+ * `X-Forwarded-For` is ignored unless `MIRAICMS_TRUST_PROXY` is set.
+ */
+export declare function eventClientAddress(event: H3Event): string;

package/dist/runtime/server/utils/request-address.js

@@ -0,0 +1,10 @@
+import { getRequestHeader, getRequestIP } from "h3";
+import { clientAddress, trustedProxyHops } from "./client-address.js";
+export function eventClientAddress(event) {
+  const hops = trustedProxyHops();
+  return clientAddress({
+    forwardedFor: hops > 0 ? getRequestHeader(event, "x-forwarded-for") : void 0,
+    hops,
+    socketAddress: getRequestIP(event)
+  });
+}

package/dist/runtime/server/utils/revisions.d.ts

@@ -0,0 +1,20 @@
+import type { Kysely } from 'kysely';
+import type { Collection, CollectionStatus, Database } from '@katecms/core';
+import type { EntryRevisionItem } from '../../utils/collections.js';
+export interface EntryRevisionData {
+    title: string;
+    slug: string;
+    status: CollectionStatus;
+    parentId: number | null;
+    menuOrder: number;
+    publishedAt: string | null;
+    authorId: number | null;
+    fields: Record<string, unknown>;
+    dictionaryIds: Record<string, number[]>;
+}
+export declare function entryRevisionSnapshot(row: Collection, dictionaryIds: Record<string, number[]>): EntryRevisionData;
+export declare function readEntryRevisionData(value: unknown): EntryRevisionData;
+/** Store the saved entry when it differs from the latest revision. The first change also keeps the previous state. */
+export declare function recordEntryRevision(db: Kysely<Database>, entryId: number, actorId: number, previous: EntryRevisionData | null, next: EntryRevisionData): Promise<void>;
+export declare function listEntryRevisions(db: Kysely<Database>, entryId: number): Promise<EntryRevisionItem[]>;
+export declare function revisionAuthorId(db: Kysely<Database>, authorId: number | null): Promise<number | null>;

package/dist/runtime/server/utils/revisions.js

@@ -0,0 +1,172 @@
+import {
+  createCollectionRevision,
+  findUserById
+} from "@katecms/core";
+import { fail } from "./collections.js";
+const KEEP_REVISIONS = 50;
+export function entryRevisionSnapshot(row, dictionaryIds) {
+  return {
+    title: row.title,
+    slug: row.slug,
+    status: row.status,
+    parentId: row.parent_id,
+    menuOrder: row.menu_order,
+    publishedAt: asIso(row.published_at),
+    authorId: row.author_id,
+    fields: isRecord(row.fields) ? row.fields : {},
+    dictionaryIds: sortDictionaryIds(dictionaryIds)
+  };
+}
+export function readEntryRevisionData(value) {
+  const snapshot = asSnapshot(value);
+  if (!snapshot) {
+    fail(422, "This revision cannot be restored.");
+  }
+  return snapshot;
+}
+export async function recordEntryRevision(db, entryId, actorId, previous, next) {
+  const latest = await db.selectFrom("collection_revisions").select("data").where("collection_id", "=", entryId).orderBy("created_at", "desc").orderBy("id", "desc").executeTakeFirst();
+  const latestSnapshot = latest ? asSnapshot(latest.data) : null;
+  if (previous && !sameSnapshot(previous, next) && (!latestSnapshot || !sameSnapshot(latestSnapshot, previous))) {
+    await insertRevision(db, entryId, null, previous);
+  }
+  if (!latestSnapshot || !sameSnapshot(latestSnapshot, next)) {
+    await insertRevision(db, entryId, actorId, next);
+  }
+  await pruneRevisions(db, entryId);
+}
+export async function listEntryRevisions(db, entryId) {
+  const rows = await db.selectFrom("collection_revisions").select(["id", "created_at", "data", "author_id"]).where("collection_id", "=", entryId).orderBy("created_at", "desc").orderBy("id", "desc").limit(KEEP_REVISIONS).execute();
+  const authorIds = [...new Set(rows.flatMap((row) => row.author_id == null ? [] : [row.author_id]))];
+  const authors = authorIds.length ? await db.selectFrom("users").select(["id", "name", "email"]).where("id", "in", authorIds).execute() : [];
+  const names = new Map(authors.map((user) => [user.id, authorLabel(user.name, user.email)]));
+  return rows.map((row) => {
+    const snapshot = asSnapshot(row.data);
+    return {
+      id: Number(row.id),
+      createdAt: asIso(row.created_at) ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+      authorName: row.author_id == null ? "Unknown" : names.get(row.author_id) ?? "Unknown",
+      title: snapshot?.title || "Revision",
+      status: snapshot?.status ?? "draft"
+    };
+  });
+}
+export async function revisionAuthorId(db, authorId) {
+  if (authorId == null) {
+    return null;
+  }
+  const user = await findUserById(db, authorId);
+  return user ? authorId : null;
+}
+async function insertRevision(db, entryId, authorId, data) {
+  await createCollectionRevision(db, {
+    collection_id: entryId,
+    author_id: authorId,
+    data,
+    created_at: /* @__PURE__ */ new Date()
+  });
+}
+async function pruneRevisions(db, entryId) {
+  const keep = await db.selectFrom("collection_revisions").select("id").where("collection_id", "=", entryId).orderBy("created_at", "desc").orderBy("id", "desc").limit(KEEP_REVISIONS).execute();
+  if (keep.length < KEEP_REVISIONS) {
+    return;
+  }
+  await db.deleteFrom("collection_revisions").where("collection_id", "=", entryId).where("id", "not in", keep.map((row) => Number(row.id))).execute();
+}
+function sameSnapshot(left, right) {
+  return canonical(left) === canonical(right);
+}
+function canonical(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => sortValue(item));
+  }
+  if (!isRecord(value)) {
+    return value;
+  }
+  const sorted = {};
+  for (const key of Object.keys(value).sort()) {
+    sorted[key] = sortValue(value[key]);
+  }
+  return sorted;
+}
+function asSnapshot(value) {
+  if (!isRecord(value)) {
+    return null;
+  }
+  if (typeof value.title !== "string" || !value.title.trim()) {
+    return null;
+  }
+  if (typeof value.slug !== "string" || !value.slug.trim()) {
+    return null;
+  }
+  if (value.status !== "published" && value.status !== "draft" && value.status !== "trash") {
+    return null;
+  }
+  const fields = value.fields == null ? {} : value.fields;
+  if (!isRecord(fields)) {
+    return null;
+  }
+  return {
+    title: value.title.trim(),
+    slug: value.slug.trim(),
+    status: value.status,
+    parentId: wholeId(value.parentId),
+    menuOrder: Number.isInteger(value.menuOrder) ? Number(value.menuOrder) : 0,
+    publishedAt: typeof value.publishedAt === "string" && value.publishedAt ? value.publishedAt : null,
+    authorId: wholeId(value.authorId),
+    fields,
+    dictionaryIds: sortDictionaryIds(readDictionaryIds(value.dictionaryIds))
+  };
+}
+function readDictionaryIds(value) {
+  if (!isRecord(value)) {
+    return {};
+  }
+  const ids = {};
+  for (const [slug, raw] of Object.entries(value)) {
+    if (!Array.isArray(raw)) {
+      continue;
+    }
+    ids[slug] = raw.map(wholeId).filter((id) => id != null);
+  }
+  return ids;
+}
+function sortDictionaryIds(value) {
+  const sorted = {};
+  for (const slug of Object.keys(value).sort()) {
+    sorted[slug] = [...value[slug] ?? []].sort((left, right) => left - right);
+  }
+  return sorted;
+}
+function wholeId(value) {
+  const id = typeof value === "number" ? value : Number(value);
+  return Number.isInteger(id) && id > 0 ? id : null;
+}
+function authorLabel(name, email) {
+  if (typeof name === "string" && name.trim()) {
+    return name.trim();
+  }
+  if (typeof email === "string" && email.trim()) {
+    return email.trim();
+  }
+  return "Unknown";
+}
+function asIso(value) {
+  if (value == null || value === "") {
+    return null;
+  }
+  if (value instanceof Date) {
+    return Number.isNaN(value.getTime()) ? null : value.toISOString();
+  }
+  if (typeof value === "string") {
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? value : date.toISOString();
+  }
+  return null;
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}

package/dist/runtime/server/utils/session.d.ts

@@ -0,0 +1,18 @@
+import type { H3Event } from 'h3';
+import type { SafeUser } from '@katecms/core';
+/** Persist the authenticated user's id and password session version. */
+export declare function setUserSession(event: H3Event, userId: number, sessionVersion?: number): Promise<void>;
+/** Drop the session cookie (logout). */
+export declare function clearUserSession(event: H3Event): Promise<void>;
+/**
+ * Resolve the currently authenticated user from the session cookie.
+ *
+ * Returns null when there is no session, the referenced user no longer exists,
+ * or the account is banned — so callers can treat all of these as "logged out".
+ */
+export declare function getCurrentUser(event: H3Event): Promise<SafeUser | null>;
+/**
+ * Like {@link getCurrentUser} but throws a 401 when there is no authenticated
+ * user, so protected handlers can assume a non-null result.
+ */
+export declare function requireUser(event: H3Event): Promise<SafeUser>;

package/dist/runtime/server/utils/session.js

@@ -0,0 +1,71 @@
+import { createError, getRequestURL, useSession } from "h3";
+import { findUserById, toSafeUser } from "@katecms/core";
+import { getDb } from "./db.js";
+const SESSION_COOKIE = "katecms_session";
+const MIN_PASSWORD_LENGTH = 32;
+const SESSION_MAX_AGE = 60 * 60 * 24 * 7;
+const DEV_FALLBACK = "katecms-dev-session-password-change-me";
+let warnedMissingPassword = false;
+function getSessionPassword() {
+  const password = typeof process.env.MIRAICMS_SESSION_PASSWORD === "string" ? process.env.MIRAICMS_SESSION_PASSWORD : "";
+  if (password.length >= MIN_PASSWORD_LENGTH) {
+    return password;
+  }
+  if (process.env.NODE_ENV === "production") {
+    throw createError({
+      statusCode: 500,
+      statusMessage: `MIRAICMS_SESSION_PASSWORD must be set to a random string of at least ${MIN_PASSWORD_LENGTH} characters.`
+    });
+  }
+  if (!warnedMissingPassword) {
+    warnedMissingPassword = true;
+    console.warn(
+      `[KateCMS] MIRAICMS_SESSION_PASSWORD is missing or shorter than ${MIN_PASSWORD_LENGTH} characters; using a development fallback. Set it before deploying.`
+    );
+  }
+  return DEV_FALLBACK;
+}
+function getCmsSession(event) {
+  return useSession(event, {
+    name: SESSION_COOKIE,
+    password: getSessionPassword(),
+    maxAge: SESSION_MAX_AGE,
+    cookie: {
+      path: "/",
+      httpOnly: true,
+      secure: getRequestURL(event).protocol === "https:",
+      sameSite: "lax"
+    }
+  });
+}
+export async function setUserSession(event, userId, sessionVersion = 0) {
+  const session = await getCmsSession(event);
+  await session.update({ userId, sessionVersion });
+}
+export async function clearUserSession(event) {
+  const session = await getCmsSession(event);
+  await session.clear();
+}
+export async function getCurrentUser(event) {
+  const session = await getCmsSession(event);
+  const userId = session.data.userId;
+  if (!userId) {
+    return null;
+  }
+  const user = await findUserById(getDb(), userId);
+  if (!user || user.status === "banned") {
+    return null;
+  }
+  const sessionVersion = session.data.sessionVersion ?? 0;
+  if ((user.session_version ?? 0) !== sessionVersion) {
+    return null;
+  }
+  return toSafeUser(user);
+}
+export async function requireUser(event) {
+  const user = await getCurrentUser(event);
+  if (!user) {
+    throw createError({ statusCode: 401, statusMessage: "Unauthorized", message: "Authentication required." });
+  }
+  return user;
+}