katecms 0.0.0-stage → 1.0.0-beta.1

package/src/runtime/server/api/_katecms/query.get.ts

@@ -0,0 +1,332 @@
+import { defineEventHandler, getQuery } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import {
+  buildSlugPathMap,
+  can,
+  collectionListPaging,
+  collectionPerPage,
+  countQueryCollections,
+  DEFAULT_COLLECTION_PER_PAGE,
+  isCollectionQueryOrderBy,
+  parseDictionaryQuery,
+  parseFieldsQuery,
+  queryCollections,
+} from '@katecms/core'
+import type {
+  CollectionDefinition,
+  CollectionQueryOrderBy,
+  Collections,
+  DictionaryQuery,
+  FieldsQuery,
+  QueryCollectionsOptions,
+} from '@katecms/core'
+import { getDb } from '../../utils/db'
+import { rejectPublicRegexp } from '../../utils/public-fields-query'
+import { getCurrentUser } from '../../utils/session'
+import {
+  fail,
+  getCollectionDefinition,
+  getCollections,
+  readPage,
+  readPerPage,
+  readSearch,
+  toAdminEntry,
+  toCollectionMeta,
+} from '../../utils/collections'
+import { loadAssignedEntryDictionaries } from '../../utils/dictionaries'
+import {
+  isTruthyQueryParam,
+  parsePublicStatusParam,
+  resolvePublicStatuses,
+} from '../../../utils/preview'
+import type { QueryCollectionResponse } from '../../../utils/collections'
+
+const ORDER_ALIASES: Record<string, CollectionQueryOrderBy> = {
+  date: 'published_at',
+  modified: 'updated_at',
+  name: 'slug',
+  ID: 'id',
+}
+
+function firstQueryValue(value: unknown): unknown {
+  return Array.isArray(value) ? value[0] : value
+}
+
+function hasQueryParam(query: Record<string, unknown>, keys: string[]): boolean {
+  return keys.some(key => query[key] !== undefined)
+}
+
+function readStringList(value: unknown): string[] {
+  const parts = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : []
+  return [...new Set(parts.map(item => String(item).trim()).filter(Boolean))]
+}
+
+function readIdList(value: unknown): number[] {
+  const parts = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : value == null ? [] : [value]
+  const ids: number[] = []
+  const seen = new Set<number>()
+  for (const part of parts) {
+    const n = Number(part)
+    if (!Number.isInteger(n) || n < 1 || seen.has(n)) {
+      continue
+    }
+    seen.add(n)
+    ids.push(n)
+  }
+  return ids
+}
+
+function readParentIdList(value: unknown): number[] {
+  const parts = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : value == null ? [] : [value]
+  const ids: number[] = []
+  const seen = new Set<number>()
+  for (const part of parts) {
+    if (part === null || part === 'null') {
+      if (!seen.has(0)) {
+        seen.add(0)
+        ids.push(0)
+      }
+      continue
+    }
+    if (part === '') {
+      continue
+    }
+    const n = Number(part)
+    if (!Number.isInteger(n) || n < 0 || seen.has(n)) {
+      continue
+    }
+    seen.add(n)
+    ids.push(n)
+  }
+  return ids
+}
+
+function readOrderBy(value: unknown): CollectionQueryOrderBy | undefined {
+  const raw = firstQueryValue(value)
+  if (typeof raw !== 'string' || !raw.trim()) {
+    return undefined
+  }
+  const token = raw.trim()
+  if (token === 'includeIds') {
+    return 'includeIds'
+  }
+  const mapped = ORDER_ALIASES[token] ?? token
+  return isCollectionQueryOrderBy(mapped) ? mapped : undefined
+}
+
+function readOrder(value: unknown): 'asc' | 'desc' | undefined {
+  const raw = firstQueryValue(value)
+  if (typeof raw !== 'string') {
+    return undefined
+  }
+  const token = raw.trim().toLowerCase()
+  if (token === 'asc' || token === 'desc') {
+    return token
+  }
+  return undefined
+}
+
+function readDictionaryQuery(value: unknown): DictionaryQuery | undefined {
+  const raw = firstQueryValue(value)
+  if (raw == null || raw === '') {
+    return undefined
+  }
+  let parsed: unknown = raw
+  if (typeof raw === 'string') {
+    try {
+      parsed = JSON.parse(raw)
+    }
+    catch {
+      fail(400, 'Invalid dictionaryQuery.')
+    }
+  }
+  if (typeof parsed !== 'object' || parsed == null || Array.isArray(parsed)) {
+    fail(400, 'Invalid dictionaryQuery.')
+  }
+  return parseDictionaryQuery(parsed)
+}
+
+function readFieldsQuery(value: unknown): FieldsQuery | undefined {
+  const raw = firstQueryValue(value)
+  if (raw == null || raw === '') {
+    return undefined
+  }
+  let parsed: unknown = raw
+  if (typeof raw === 'string') {
+    try {
+      parsed = JSON.parse(raw)
+    }
+    catch {
+      fail(400, 'Invalid fieldsQuery.')
+    }
+  }
+  if (typeof parsed !== 'object' || parsed == null || Array.isArray(parsed)) {
+    fail(400, 'Invalid fieldsQuery.')
+  }
+  return rejectPublicRegexp(parseFieldsQuery(parsed))
+}
+
+function defaultPerPage(defs: CollectionDefinition[]): number {
+  if (defs.length === 1) {
+    return collectionPerPage(defs[0])
+  }
+  return DEFAULT_COLLECTION_PER_PAGE
+}
+
+function publicCollectionSlugs(all: Collections): string[] {
+  return Object.keys(all).filter(slug => all[slug]?.public !== false)
+}
+
+function resolveQueryCollectionTypes(requested: string[], all: Collections): string[] {
+  if (requested.includes('any')) {
+    return publicCollectionSlugs(all)
+  }
+  return requested.filter((slug) => {
+    const def = all[slug]
+    return def != null && def.public !== false
+  })
+}
+
+/**
+ * Public list query.
+ *
+ * Query:
+ * - `collection` (required) — comma-separated collection slugs, or `any`
+ *   for every public collection
+ * - `preview` — `1`/`true`/`yes` to include drafts when the requester may
+ *   `collections:read` every queried collection
+ * - `status` — `published`, `draft`, or comma-separated; `draft` is ignored
+ *   unless preview is granted. Trash is never returned.
+ * - `page`, `perPage`
+ * - `search`, `title`, `includeIds`, `excludeIds`
+ * - `parentId` (`0` = top-level), `parentIds`, `excludeParentIds`
+ * - `authorIn`, `authorNotIn`, `slug`, `slugs`
+ * - `dictionaryQuery` — JSON object (`relation` + `queries`)
+ * - `fieldsQuery` — JSON object (`relation` + `queries`) against `fields`.
+ *   `REGEXP` and `NOT REGEXP` are rejected.
+ * - `orderBy` (`date`, `modified`, `name`, `includeIds`, or a column), `order`
+ *
+ * Collections with `public: false` are skipped. Unknown types are skipped.
+ */
+export default defineEventHandler(async (event): Promise<QueryCollectionResponse> => {
+  const query = getQuery(event) as Record<string, unknown>
+  const requested = readStringList(query.collection)
+  if (requested.length === 0) {
+    fail(400, 'Missing collection.')
+  }
+
+  const all = getCollections()
+  const types = resolveQueryCollectionTypes(requested, all)
+  const defs = types
+    .map(slug => getCollectionDefinition(slug))
+    .filter((def): def is CollectionDefinition => def != null)
+
+  if (types.length === 0) {
+    return {
+      entries: [],
+      collections: [],
+      preview: false,
+      page: readPage(query.page),
+      perPage: readPerPage(query.perPage, DEFAULT_COLLECTION_PER_PAGE),
+      total: 0,
+    }
+  }
+
+  const previewRequested = isTruthyQueryParam(query.preview)
+  const actor = previewRequested ? await getCurrentUser(event) : null
+  const roles = useRuntimeConfig().katecms?.roles ?? {}
+  const previewAllowed = actor != null
+    && types.every(slug => can(actor, 'collections', 'read', { roles, scope: slug }))
+
+  const { statuses, preview } = resolvePublicStatuses({
+    previewRequested,
+    previewAllowed,
+    requested: parsePublicStatusParam(query.status),
+  })
+
+  const page = readPage(query.page)
+  const perPage = readPerPage(query.perPage, defaultPerPage(defs))
+  const filters: QueryCollectionsOptions = {
+    types,
+    statuses,
+    search: readSearch(query.search) || undefined,
+    ...collectionListPaging(page, perPage),
+  }
+
+  if (hasQueryParam(query, ['title'])) {
+    filters.title = readStringList(query.title)
+  }
+  if (hasQueryParam(query, ['includeIds'])) {
+    filters.includeIds = readIdList(query.includeIds)
+  }
+  if (hasQueryParam(query, ['excludeIds'])) {
+    filters.excludeIds = readIdList(query.excludeIds)
+  }
+  if (hasQueryParam(query, ['parentId', 'parentIds'])) {
+    filters.parentIds = [
+      ...readParentIdList(query.parentIds),
+      ...readParentIdList(query.parentId),
+    ]
+  }
+  if (hasQueryParam(query, ['excludeParentIds'])) {
+    filters.excludeParentIds = readParentIdList(query.excludeParentIds)
+  }
+  if (hasQueryParam(query, ['authorIn'])) {
+    filters.authorIn = readIdList(query.authorIn)
+  }
+  if (hasQueryParam(query, ['authorNotIn'])) {
+    filters.authorNotIn = readIdList(query.authorNotIn)
+  }
+  if (hasQueryParam(query, ['slug', 'slugs'])) {
+    filters.slugs = [
+      ...readStringList(query.slugs),
+      ...readStringList(query.slug),
+    ]
+  }
+  if (hasQueryParam(query, ['dictionaryQuery'])) {
+    filters.dictionaryQuery = readDictionaryQuery(query.dictionaryQuery)
+  }
+  if (hasQueryParam(query, ['fieldsQuery'])) {
+    filters.fieldsQuery = readFieldsQuery(query.fieldsQuery)
+  }
+  filters.orderBy = readOrderBy(query.orderBy) ?? 'published_at'
+  const order = readOrder(query.order)
+  if (order) {
+    filters.order = order
+  }
+
+  const db = getDb()
+  const [rows, total, pathRows] = await Promise.all([
+    queryCollections(db, filters),
+    countQueryCollections(db, filters),
+    db.selectFrom('collections')
+      .select(['id', 'slug', 'parent_id', 'type'])
+      .where('type', 'in', types)
+      .execute(),
+  ])
+
+  const pathsByType = new Map<string, ReturnType<typeof buildSlugPathMap>>()
+  for (const type of types) {
+    pathsByType.set(
+      type,
+      buildSlugPathMap(pathRows.filter(row => row.type === type)),
+    )
+  }
+
+  const entries = await Promise.all(rows.map(async (row) => {
+    const dictionaries = await loadAssignedEntryDictionaries(db, row.id, row.type)
+    return toAdminEntry(row, pathsByType.get(row.type)?.get(row.id) ?? row.slug, { dictionaries })
+  }))
+
+  return {
+    entries,
+    collections: types.flatMap((slug) => {
+      const def = getCollectionDefinition(slug)
+      return def ? [toCollectionMeta(slug, def)] : []
+    }),
+    preview,
+    page,
+    perPage,
+    total,
+  }
+})

package/src/runtime/server/api/_katecms/relation/entries.get.ts

@@ -0,0 +1,98 @@
+import { defineEventHandler, getQuery } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import {
+  can,
+  listCollections,
+} from '@katecms/core'
+import { getDb } from '../../../utils/db'
+import { requireUser } from '../../../utils/session'
+import { getCollections, fail } from '../../../utils/collections'
+import {
+  RELATION_PICKER_LIMIT,
+  collectionArchiveOption,
+  pathMapForRows,
+  pickFeaturedImage,
+  readStringList,
+  toPickerEntry,
+} from '../../../utils/relation'
+
+/**
+ * Collection entries for `post_object`, `page_link`, and `relationship`.
+ * Query: `postType` (comma-separated slugs), `q`, `elements` (image field keys), `archives=1`.
+ * Lists published and draft entries (not trash).
+ */
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event)
+  const roles = useRuntimeConfig().katecms?.roles ?? {}
+  const collections = getCollections()
+  const query = getQuery(event)
+  const requested = readStringList(query.postType)
+  const wanted = requested.length > 0
+    ? requested.filter(slug => slug in collections)
+    : Object.keys(collections)
+  if (requested.length > 0 && wanted.length === 0) {
+    fail(404, 'Collection not found.')
+  }
+
+  const readable = wanted.filter(slug => can(actor, 'collections', 'read', { roles, scope: slug }))
+  const search = typeof query.q === 'string' ? query.q.trim() : ''
+  const imageFields = readStringList(query.elements)
+  const db = getDb()
+  const entries = []
+
+  for (const slug of readable) {
+    const def = collections[slug]
+    if (!def) {
+      continue
+    }
+    const rows = await listCollections(db, slug, {
+      status: 'active',
+      search: search || undefined,
+      limit: RELATION_PICKER_LIMIT,
+    })
+    const dictionarySlugs = readStringList(query.dictionary)
+    let filtered = rows
+    const ids = rows.map(row => row.id)
+    const termIdsByEntry = new Map<number, number[]>()
+    if (ids.length > 0) {
+      const links = await db
+        .selectFrom('collection_dictionaries')
+        .select(['collection_id', 'dictionary_id'])
+        .where('collection_id', 'in', ids)
+        .execute()
+      for (const link of links) {
+        const current = termIdsByEntry.get(link.collection_id) ?? []
+        current.push(link.dictionary_id)
+        termIdsByEntry.set(link.collection_id, current)
+      }
+      if (dictionarySlugs.length > 0) {
+        const typed = await db
+          .selectFrom('collection_dictionaries')
+          .innerJoin('dictionaries', 'dictionaries.id', 'collection_dictionaries.dictionary_id')
+          .select('collection_dictionaries.collection_id as collection_id')
+          .where('collection_dictionaries.collection_id', 'in', ids)
+          .where('dictionaries.type', 'in', dictionarySlugs)
+          .execute()
+        const allowed = new Set(typed.map(link => link.collection_id))
+        filtered = rows.filter(row => allowed.has(row.id))
+      }
+    }
+    const paths = pathMapForRows(rows)
+    for (const row of filtered) {
+      entries.push(toPickerEntry(row, def, paths.get(row.id) ?? row.slug, {
+        featuredImage: imageFields.length ? pickFeaturedImage(row.fields, imageFields) : undefined,
+        termIds: termIdsByEntry.get(row.id) ?? [],
+      }))
+    }
+  }
+
+  const archives = query.archives === '1' || query.archives === 'true'
+    ? readable.flatMap((slug) => {
+        const def = collections[slug]
+        const option = def ? collectionArchiveOption(slug, def) : null
+        return option ? [option] : []
+      })
+    : []
+
+  return { entries, archives }
+})

package/src/runtime/server/api/_katecms/relation/terms.get.ts

@@ -0,0 +1,61 @@
+import { defineEventHandler, getQuery } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { can, listDictionaries, toRelationTermValue } from '@katecms/core'
+import type { RelationTermValue } from '@katecms/core'
+import { getDb } from '../../../utils/db'
+import { requireUser } from '../../../utils/session'
+import {
+  flattenDictionaryTerms,
+  readDictionarySlug,
+  requireDictionary,
+} from '../../../utils/dictionaries'
+import { fail } from '../../../utils/collections'
+
+/**
+ * Dictionary terms for the `dictionary` field and relationship filters.
+ * Readable with `dictionaries:read` or `collections:read` on an attached collection.
+ */
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event)
+  const query = getQuery(event)
+  const dictionarySlug = readDictionarySlug(
+    typeof query.dictionary === 'string' ? query.dictionary : undefined,
+  )
+  const def = requireDictionary(dictionarySlug)
+  const roles = useRuntimeConfig().katecms?.roles ?? {}
+  const canReadDictionary = can(actor, 'dictionaries', 'read', { roles, scope: dictionarySlug })
+  const canReadCollection = def.collections.some(slug => (
+    can(actor, 'collections', 'read', { roles, scope: slug })
+  ))
+  if (!canReadDictionary && !canReadCollection) {
+    fail(403, 'Insufficient permissions.')
+  }
+
+  const db = getDb()
+  const rows = await listDictionaries(db, dictionarySlug)
+  const listed = flattenDictionaryTerms(rows)
+  const terms: RelationTermValue[] = listed.map(({ row, depth, slugPath }) => toRelationTermValue({
+    id: row.id,
+    type: row.type,
+    title: row.title,
+    slug: row.slug,
+    slugPath,
+    fields: row.fields ?? {},
+    parentId: row.parent_id,
+    depth,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  }))
+
+  return {
+    dictionary: {
+      slug: dictionarySlug,
+      labels: {
+        name: def.labels.name,
+        singularName: def.labels.singularName ?? def.labels.name,
+      },
+    },
+    terms,
+    canCreate: can(actor, 'dictionaries', 'create', { roles, scope: dictionarySlug }),
+  }
+})

package/src/runtime/server/api/_katecms/resolve.get.ts

@@ -0,0 +1,148 @@
+import { defineEventHandler, getQuery } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import {
+  buildSlugPathMap,
+  can,
+  collectionListPaging,
+  collectionPerPage,
+  countCollections,
+  findCollectionBySlugPath,
+  listCollections,
+  matchPublicCollectionRoute,
+} from '@katecms/core'
+import type { CollectionListStatus, CollectionStatus } from '@katecms/core'
+import { getDb } from '../../utils/db'
+import { getCurrentUser } from '../../utils/session'
+import {
+  fail,
+  getCollectionDefinition,
+  getCollections,
+  readPage,
+  readPerPage,
+  toAdminEntry,
+  toCollectionMeta,
+} from '../../utils/collections'
+import { loadAssignedEntryDictionaries } from '../../utils/dictionaries'
+import { resolvePublicDictionaryTerm } from '../../utils/public-term'
+import {
+  isTruthyQueryParam,
+  parsePublicStatusParam,
+  resolvePublicStatuses,
+} from '../../../utils/preview'
+import type { ResolveResponse } from '../../../utils/collections'
+
+function listStatusFromPublic(statuses: CollectionStatus[]): CollectionListStatus {
+  const published = statuses.includes('published')
+  const draft = statuses.includes('draft')
+  if (published && draft) {
+    return 'active'
+  }
+  if (draft) {
+    return 'draft'
+  }
+  return 'published'
+}
+
+/**
+ * Public resolve: map a frontend path to a collection entry or archive.
+ *
+ * Query:
+ * - `path` (required) — public URL, e.g. `/inf/about` or archive `/inf`
+ * - `preview` — `1`/`true`/`yes` to include drafts when the requester may
+ *   `collections:read` the matched collection
+ * - `status` — `published`, `draft`, or comma-separated; `draft` is ignored
+ *   unless preview is granted. Trash is never returned.
+ * - `page` / `perPage` — archive listing only
+ *
+ * Unauthorized preview requests still resolve published entries only (404 if
+ * the path is a draft), so existence is not leaked.
+ */
+export default defineEventHandler(async (event): Promise<ResolveResponse> => {
+  const query = getQuery(event)
+  const path = typeof query.path === 'string' ? query.path : ''
+  if (!path.trim()) {
+    fail(400, 'Missing path.')
+  }
+
+  const collections = getCollections()
+  const matched = matchPublicCollectionRoute(collections, path)
+  if (!matched) {
+    const db = getDb()
+    const termPage = await resolvePublicDictionaryTerm(db, path)
+    if (termPage) {
+      return termPage
+    }
+    fail(404, 'Page not found.')
+  }
+
+  const def = getCollectionDefinition(matched.collectionSlug)
+  if (!def || def.public === false) {
+    fail(404, 'Page not found.')
+  }
+
+  const previewRequested = isTruthyQueryParam(query.preview)
+  const actor = previewRequested ? await getCurrentUser(event) : null
+  const roles = useRuntimeConfig().katecms?.roles ?? {}
+  const previewAllowed = actor != null
+    && can(actor, 'collections', 'read', { roles, scope: matched.collectionSlug })
+
+  const { statuses, preview } = resolvePublicStatuses({
+    previewRequested,
+    previewAllowed,
+    requested: parsePublicStatusParam(query.status),
+  })
+
+  const db = getDb()
+  const meta = toCollectionMeta(matched.collectionSlug, def)
+
+  if (matched.kind === 'archive') {
+    const page = readPage(query.page)
+    const perPage = readPerPage(query.perPage, collectionPerPage(def))
+    const listStatus = listStatusFromPublic(statuses)
+    const [rows, total, pathRows] = await Promise.all([
+      listCollections(db, matched.collectionSlug, {
+        status: listStatus,
+        ...collectionListPaging(page, perPage),
+      }),
+      countCollections(db, matched.collectionSlug, { status: listStatus }),
+      db.selectFrom('collections')
+        .select(['id', 'slug', 'parent_id'])
+        .where('type', '=', matched.collectionSlug)
+        .execute(),
+    ])
+    const paths = buildSlugPathMap(pathRows)
+    const entries = await Promise.all(rows.map(async (row) => {
+      const dictionaries = await loadAssignedEntryDictionaries(db, row.id, matched.collectionSlug)
+      return toAdminEntry(row, paths.get(row.id) ?? row.slug, { dictionaries })
+    }))
+
+    return {
+      kind: 'archive',
+      collection: meta,
+      entries,
+      preview,
+      page,
+      perPage,
+      total,
+    }
+  }
+
+  const row = await findCollectionBySlugPath(
+    db,
+    matched.collectionSlug,
+    matched.segments,
+    statuses,
+  )
+  if (!row) {
+    fail(404, 'Page not found.')
+  }
+
+  const dictionaries = await loadAssignedEntryDictionaries(db, row.id, matched.collectionSlug)
+
+  return {
+    kind: 'entry',
+    collection: meta,
+    entry: toAdminEntry(row, matched.slugPath, { dictionaries }),
+    preview,
+  }
+})