katecms 0.0.0-stage → 1.0.0-beta.1

package/src/runtime/server/api/_katecms/terms.get.ts

@@ -0,0 +1,258 @@
+import { defineEventHandler, getQuery } from 'h3'
+import {
+  isTermOrderBy,
+  isTermsReturn,
+  parseFieldsQuery,
+  queryTerms,
+  UNLIMITED_COLLECTION_PER_PAGE,
+} from '@katecms/core'
+import type {
+  Collections,
+  Dictionaries,
+  FieldsQuery,
+  FieldsQueryCast,
+  QueryTermsOptions,
+  QueryTermsResult,
+  TermOrderField,
+} from '@katecms/core'
+import { getDb } from '../../utils/db'
+import { rejectPublicRegexp } from '../../utils/public-fields-query'
+import { fail, getCollections, readPerPage } from '../../utils/collections'
+import { getDictionaries } from '../../utils/dictionaries'
+
+const CASTS = new Set<string>(['TEXT', 'INTEGER', 'NUMERIC', 'DATETIME', 'DATE', 'TIME'])
+
+function firstQueryValue(value: unknown): unknown {
+  return Array.isArray(value) ? value[0] : value
+}
+
+function readStringList(value: unknown): string[] {
+  const parts = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : []
+  return [...new Set(parts.map(item => String(item).trim()).filter(Boolean))]
+}
+
+function readIdList(value: unknown): number[] {
+  const parts = Array.isArray(value)
+    ? value
+    : typeof value === 'string'
+      ? value.split(',')
+      : value == null
+        ? []
+        : [value]
+  const ids: number[] = []
+  const seen = new Set<number>()
+  for (const part of parts) {
+    const n = Number(part)
+    if (!Number.isInteger(n) || n < 1 || seen.has(n)) {
+      continue
+    }
+    seen.add(n)
+    ids.push(n)
+  }
+  return ids
+}
+
+function hasQueryParam(query: Record<string, unknown>, key: string): boolean {
+  return query[key] !== undefined
+}
+
+function readBool(value: unknown, fallback: boolean): boolean {
+  const raw = firstQueryValue(value)
+  if (raw == null || raw === '') {
+    return fallback
+  }
+  if (typeof raw === 'boolean') {
+    return raw
+  }
+  const token = String(raw).trim().toLowerCase()
+  if (token === '1' || token === 'true' || token === 'yes') {
+    return true
+  }
+  if (token === '0' || token === 'false' || token === 'no') {
+    return false
+  }
+  return fallback
+}
+
+function readOffset(value: unknown): number {
+  const raw = firstQueryValue(value)
+  if (raw == null || raw === '') {
+    return 0
+  }
+  const n = Number(raw)
+  if (!Number.isInteger(n) || n < 0) {
+    fail(400, 'Invalid offset.')
+  }
+  return n
+}
+
+function readParentId(value: unknown): number | null {
+  const raw = firstQueryValue(value)
+  if (raw == null || raw === '' || raw === 'null' || raw === 0 || raw === '0') {
+    return null
+  }
+  const n = Number(raw)
+  if (!Number.isInteger(n) || n < 1) {
+    fail(400, 'Invalid parentId.')
+  }
+  return n
+}
+
+function readChildOf(value: unknown): number | undefined {
+  const raw = firstQueryValue(value)
+  if (raw == null || raw === '' || raw === 0 || raw === '0') {
+    return undefined
+  }
+  const n = Number(raw)
+  if (!Number.isInteger(n) || n < 1) {
+    fail(400, 'Invalid childOf.')
+  }
+  return n
+}
+
+function readFieldsQuery(value: unknown): FieldsQuery | undefined {
+  const raw = firstQueryValue(value)
+  if (raw == null || raw === '') {
+    return undefined
+  }
+  let parsed: unknown = raw
+  if (typeof raw === 'string') {
+    try {
+      parsed = JSON.parse(raw)
+    }
+    catch {
+      fail(400, 'Invalid fieldsQuery.')
+    }
+  }
+  if (typeof parsed !== 'object' || parsed == null || Array.isArray(parsed)) {
+    fail(400, 'Invalid fieldsQuery.')
+  }
+  return rejectPublicRegexp(parseFieldsQuery(parsed))
+}
+
+function readOrderByField(value: unknown): TermOrderField | undefined {
+  const raw = firstQueryValue(value)
+  if (raw == null || raw === '') {
+    return undefined
+  }
+  let parsed: unknown = raw
+  if (typeof raw === 'string') {
+    try {
+      parsed = JSON.parse(raw)
+    }
+    catch {
+      fail(400, 'Invalid orderByField.')
+    }
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    fail(400, 'Invalid orderByField.')
+  }
+  const key = typeof (parsed as { key?: unknown }).key === 'string'
+    ? (parsed as { key: string }).key.trim()
+    : ''
+  if (!key) {
+    fail(400, 'Invalid orderByField.')
+  }
+  const typeRaw = (parsed as { type?: unknown }).type
+  const type = typeof typeRaw === 'string' && CASTS.has(typeRaw.trim().toUpperCase())
+    ? typeRaw.trim().toUpperCase() as FieldsQueryCast
+    : undefined
+  return type ? { key, type } : { key }
+}
+
+function publicCollectionSlugs(all: Collections): string[] {
+  return Object.keys(all).filter(slug => all[slug]?.public !== false)
+}
+
+function resolveDictionaries(requested: string[], all: Dictionaries): string[] {
+  const known = new Set(Object.keys(all))
+  return requested.filter(slug => known.has(slug))
+}
+
+/**
+ * Public dictionary-term query.
+ *
+ * Query:
+ * - `dictionary` (required) — comma-separated dictionary slugs
+ * - `perPage` (`-1` or omitted — all), `offset`
+ * - `includeIds`, `excludeIds`, `excludeTreeIds`
+ * - `parentId` (`0` = top-level), `childOf`, `childless`
+ * - `slug`, `title`, `search`
+ * - `hideEmpty` (default true), `hierarchical` (default true), `padCounts`
+ * - `fieldsQuery` — JSON object (`relation` + `queries`) against term `fields`.
+ *   `REGEXP` and `NOT REGEXP` are rejected.
+ * - `orderBy`, `order`, `orderByField` — JSON `{ key, type? }` when `orderBy=field`
+ * - `return` — `all`, `ids`, `titles`, `count`, `idParent`, `idSlug`, `idTitle`
+ *
+ * `count` is the number of published entries in public collections.
+ */
+export default defineEventHandler(async (event): Promise<QueryTermsResult> => {
+  const query = getQuery(event) as Record<string, unknown>
+  const requested = readStringList(query.dictionary)
+  if (requested.length === 0) {
+    fail(400, 'Missing dictionary.')
+  }
+
+  const dictionaries = resolveDictionaries(requested, getDictionaries())
+  const orderByRaw = firstQueryValue(query.orderBy)
+  const orderByToken = typeof orderByRaw === 'string' ? orderByRaw.trim() : ''
+  const orderBy = isTermOrderBy(orderByToken) ? orderByToken : undefined
+  const orderRaw = firstQueryValue(query.order)
+  const orderToken = typeof orderRaw === 'string' ? orderRaw.trim().toLowerCase() : ''
+  const order = orderToken === 'asc' || orderToken === 'desc' ? orderToken : undefined
+  const returnRaw = firstQueryValue(query.return)
+  const returnToken = typeof returnRaw === 'string' ? returnRaw.trim() : ''
+  const returnMode = isTermsReturn(returnToken) ? returnToken : undefined
+
+  const filters: QueryTermsOptions = {
+    dictionaries,
+    perPage: readPerPage(query.perPage, UNLIMITED_COLLECTION_PER_PAGE),
+    offset: readOffset(query.offset),
+    hideEmpty: readBool(query.hideEmpty, true),
+    hierarchical: readBool(query.hierarchical, true),
+    padCounts: readBool(query.padCounts, false),
+    childless: readBool(query.childless, false),
+    countTypes: publicCollectionSlugs(getCollections()),
+    search: typeof firstQueryValue(query.search) === 'string'
+      ? String(firstQueryValue(query.search))
+      : undefined,
+  }
+  if (orderBy) {
+    filters.orderBy = orderBy
+  }
+  if (order) {
+    filters.order = order
+  }
+  if (returnMode) {
+    filters.return = returnMode
+  }
+  if (hasQueryParam(query, 'includeIds')) {
+    filters.includeIds = readIdList(query.includeIds)
+  }
+  if (hasQueryParam(query, 'excludeIds')) {
+    filters.excludeIds = readIdList(query.excludeIds)
+  }
+  if (hasQueryParam(query, 'excludeTreeIds')) {
+    filters.excludeTreeIds = readIdList(query.excludeTreeIds)
+  }
+  if (hasQueryParam(query, 'slug')) {
+    filters.slug = readStringList(query.slug)
+  }
+  if (hasQueryParam(query, 'title')) {
+    filters.title = readStringList(query.title)
+  }
+  if (hasQueryParam(query, 'parentId')) {
+    filters.parentId = readParentId(query.parentId)
+  }
+  if (hasQueryParam(query, 'childOf')) {
+    filters.childOf = readChildOf(query.childOf)
+  }
+  if (hasQueryParam(query, 'fieldsQuery')) {
+    filters.fieldsQuery = readFieldsQuery(query.fieldsQuery)
+  }
+  if (orderBy === 'field') {
+    filters.orderByField = readOrderByField(query.orderByField)
+  }
+
+  return queryTerms(getDb(), filters)
+})

package/src/runtime/server/api/_katecms/users/[id].delete.ts

@@ -0,0 +1,57 @@
+import { defineEventHandler, getRouterParam } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import {
+  can,
+  deleteUser,
+  findUserById,
+  isOwner,
+} from '@katecms/core'
+import { getDb } from '../../../utils/db'
+import { requireUser } from '../../../utils/session'
+import { fail } from '../../../utils/users'
+
+/**
+ * Delete another user.
+ *
+ * Requires `users` delete. You cannot delete yourself. A site owner can be
+ * deleted only by an owner, and never when they are the last owner.
+ * Entries and uploads they authored stay; the author link is cleared.
+ */
+export default defineEventHandler(async (event): Promise<{ ok: true }> => {
+  const actor = await requireUser(event)
+  const roles = useRuntimeConfig().katecms?.roles ?? {}
+  if (!can(actor, 'users', 'delete', { roles })) {
+    fail(403, 'Insufficient permissions.')
+  }
+
+  const id = Number(getRouterParam(event, 'id'))
+  if (!Number.isInteger(id) || id <= 0) {
+    fail(400, 'Invalid user id.')
+  }
+  if (id === actor.id) {
+    fail(403, 'You cannot delete your own account.')
+  }
+
+  const db = getDb()
+  const target = await findUserById(db, id)
+  if (!target) {
+    fail(404, 'User not found.')
+  }
+  if (isOwner(target, roles) && !isOwner(actor, roles)) {
+    fail(403, 'The site owner cannot be deleted.')
+  }
+
+  try {
+    const row = await deleteUser(db, id)
+    if (!row) {
+      fail(404, 'User not found.')
+    }
+    return { ok: true }
+  }
+  catch (error) {
+    if (error instanceof Error && error.message.includes('last owner')) {
+      fail(422, 'Cannot remove the last owner.')
+    }
+    throw error
+  }
+})

package/src/runtime/server/api/_katecms/users/[id].patch.ts

@@ -0,0 +1,177 @@
+import { defineEventHandler, getRouterParam, readBody } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import {
+  can,
+  findUserById,
+  hashPassword,
+  isOwner,
+  isUniqueConstraintError,
+  isValidRole,
+  OWNER_ROLE,
+  updateUser,
+  validateEmail,
+  validatePassword,
+  verifyPassword,
+} from '@katecms/core'
+import type { UserStatus } from '@katecms/core'
+import type { AdminUser } from '../../../../utils/admin-users'
+import { getDb } from '../../../utils/db'
+import {
+  assertAuthAttemptAllowed,
+  recordAuthAttemptFailure,
+  recordAuthAttemptSuccess,
+  throwTooManyAttempts,
+} from '../../../utils/auth-rate-limit'
+import { requireUser, setUserSession } from '../../../utils/session'
+import {
+  fail,
+  readAvatar,
+  readName,
+  toAdminUser,
+} from '../../../utils/users'
+
+interface UpdateBody {
+  email?: unknown
+  password?: unknown
+  currentPassword?: unknown
+  name?: unknown
+  avatar?: unknown
+  role?: unknown
+  status?: unknown
+}
+
+const STATUSES: readonly UserStatus[] = ['active', 'banned']
+
+/**
+ * Update a user.
+ *
+ * Access rules:
+ * - editing your own account is always allowed (name / email / avatar);
+ * - changing your own password also requires `currentPassword`;
+ * - a manager may set another account's password without the old one;
+ * - editing someone else requires the `users` update permission;
+ * - `role` and `status` can only be changed by a manager editing *another*
+ *   account (you can't change your own role/status, which prevents both
+ *   self-lockout and privilege escalation);
+ * - the `owner` account can only be edited by the owner themselves, and the
+ *   reserved `owner` role can never be assigned.
+ */
+export default defineEventHandler(async (event): Promise<{ user: AdminUser }> => {
+  const actor = await requireUser(event)
+  const roles = useRuntimeConfig().katecms?.roles ?? {}
+
+  const id = Number(getRouterParam(event, 'id'))
+  if (!Number.isInteger(id) || id <= 0) {
+    fail(400, 'Invalid user id.')
+  }
+
+  const isSelf = actor.id === id
+  const canManage = can(actor, 'users', 'update', { roles })
+  if (!canManage && !isSelf) {
+    fail(403, 'Insufficient permissions.')
+  }
+
+  const db = getDb()
+  const target = await findUserById(db, id)
+  if (!target) {
+    fail(404, 'User not found.')
+  }
+
+  if (isOwner(target, roles) && !isSelf) {
+    fail(403, 'The site owner cannot be changed.')
+  }
+
+  const body = await readBody<UpdateBody>(event)
+  const patch: {
+    email?: string
+    password_hash?: string
+    name?: string | null
+    avatar?: ReturnType<typeof readAvatar>
+    role?: string
+    status?: UserStatus
+  } = {}
+
+  if (body?.email !== undefined) {
+    const email = typeof body.email === 'string' ? body.email.trim() : ''
+    const emailCheck = validateEmail(email)
+    if (!emailCheck.ok) {
+      fail(422, emailCheck.error)
+    }
+    patch.email = email
+  }
+
+  if (typeof body?.password === 'string' && body.password.length > 0) {
+    const passwordCheck = validatePassword(body.password)
+    if (!passwordCheck.ok) {
+      fail(422, passwordCheck.error)
+    }
+    if (isSelf) {
+      const attemptKey = `password:${actor.id}`
+      assertAuthAttemptAllowed(event, attemptKey)
+      const currentPassword = typeof body.currentPassword === 'string' ? body.currentPassword : ''
+      const matches = currentPassword.length > 0 && await verifyPassword(currentPassword, target.password_hash)
+      if (!matches) {
+        const { retryAfterMs } = recordAuthAttemptFailure(attemptKey)
+        if (retryAfterMs > 0) {
+          throwTooManyAttempts(event, retryAfterMs)
+        }
+        fail(422, 'Current password is incorrect.')
+      }
+      recordAuthAttemptSuccess(attemptKey)
+    }
+    patch.password_hash = await hashPassword(body.password)
+  }
+
+  if (body?.name !== undefined) {
+    patch.name = readName(body.name)
+  }
+
+  if (body?.avatar !== undefined) {
+    patch.avatar = readAvatar(body.avatar)
+  }
+
+  if (body?.role !== undefined) {
+    if (!canManage || isSelf) {
+      fail(403, 'Cannot change this account role.')
+    }
+    const role = typeof body.role === 'string' ? body.role : ''
+    if (role === OWNER_ROLE) {
+      fail(422, 'The owner role cannot be assigned.')
+    }
+    if (!isValidRole(roles, role)) {
+      fail(422, 'Unknown role.')
+    }
+    patch.role = role
+  }
+
+  if (body?.status !== undefined) {
+    if (!canManage || isSelf) {
+      fail(403, 'Cannot change this account status.')
+    }
+    const status = body.status as UserStatus
+    if (!STATUSES.includes(status)) {
+      fail(422, 'Invalid status.')
+    }
+    patch.status = status
+  }
+
+  try {
+    const row = await updateUser(db, id, patch)
+    if (!row) {
+      fail(404, 'User not found.')
+    }
+    if (isSelf && patch.password_hash) {
+      await setUserSession(event, row.id, row.session_version)
+    }
+    return { user: toAdminUser(row) }
+  }
+  catch (error) {
+    if (isUniqueConstraintError(error)) {
+      fail(409, 'A user with this email already exists.')
+    }
+    if (error instanceof Error && error.message.includes('last owner')) {
+      fail(422, 'Cannot remove the last owner.')
+    }
+    throw error
+  }
+})

package/src/runtime/server/api/_katecms/users.get.ts

@@ -0,0 +1,48 @@
+import { defineEventHandler } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import {
+  can,
+  findUserById,
+  listUsers,
+} from '@katecms/core'
+import type { User } from '@katecms/core'
+import { getDb } from '../../utils/db'
+import { requireUser } from '../../utils/session'
+import { roleOptions, toAdminUser } from '../../utils/users'
+import type { UsersResponse } from '../../../utils/admin-users'
+
+/**
+ * Accounts for the admin users UI and the `user` field picker.
+ *
+ * Password hashes are never returned. Managers (read/create/update on `users`)
+ * see every account; others see only themselves. Extra capability flags power
+ * the admin list; the picker only reads `users`.
+ */
+export default defineEventHandler(async (event): Promise<UsersResponse> => {
+  const actor = await requireUser(event)
+  const roles = useRuntimeConfig().katecms?.roles ?? {}
+  const db = getDb()
+
+  const canCreate = can(actor, 'users', 'create', { roles })
+  const canUpdate = can(actor, 'users', 'update', { roles })
+  const canDelete = can(actor, 'users', 'delete', { roles })
+  const isManager = can(actor, 'users', 'read', { roles }) || canCreate || canUpdate || canDelete
+
+  let rows: User[]
+  if (isManager) {
+    rows = await listUsers(db)
+  }
+  else {
+    const row = await findUserById(db, actor.id)
+    rows = row ? [row] : []
+  }
+
+  return {
+    users: rows.map(toAdminUser),
+    roles: roleOptions(roles),
+    currentUserId: actor.id,
+    canCreate,
+    canUpdate,
+    canDelete,
+  }
+})

package/src/runtime/server/api/_katecms/users.post.ts

@@ -0,0 +1,85 @@
+import { defineEventHandler, readBody } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import {
+  createUser,
+  hashPassword,
+  isUniqueConstraintError,
+  isValidRole,
+  OWNER_ROLE,
+  validateEmail,
+  validatePassword,
+} from '@katecms/core'
+import type { AdminUser } from '../../../utils/admin-users'
+import { getDb } from '../../utils/db'
+import { requirePermission } from '../../utils/permissions'
+import { requireUser } from '../../utils/session'
+import {
+  defaultAssignableRole,
+  fail,
+  readAvatar,
+  readName,
+  toAdminUser,
+} from '../../utils/users'
+
+interface CreateBody {
+  email?: unknown
+  password?: unknown
+  name?: unknown
+  avatar?: unknown
+  role?: unknown
+}
+
+/**
+ * Create a user. Requires the `users` create permission (the `owner` superuser
+ * always passes). The reserved `owner` role can't be assigned — ownership is
+ * only ever granted to the first registered account.
+ */
+export default defineEventHandler(async (event): Promise<{ user: AdminUser }> => {
+  const actor = await requireUser(event)
+  const roles = useRuntimeConfig().katecms?.roles ?? {}
+  requirePermission(actor, 'users', 'create', roles)
+
+  const body = await readBody<CreateBody>(event)
+  const email = typeof body?.email === 'string' ? body.email.trim() : ''
+  const password = typeof body?.password === 'string' ? body.password : ''
+  const name = readName(body?.name)
+  const avatar = readAvatar(body?.avatar)
+  const role = typeof body?.role === 'string' && body.role.trim()
+    ? body.role.trim()
+    : defaultAssignableRole(roles)
+
+  const emailCheck = validateEmail(email)
+  if (!emailCheck.ok) {
+    fail(422, emailCheck.error)
+  }
+  const passwordCheck = validatePassword(password)
+  if (!passwordCheck.ok) {
+    fail(422, passwordCheck.error)
+  }
+
+  if (role === OWNER_ROLE) {
+    fail(422, 'The owner role cannot be assigned.')
+  }
+  if (!isValidRole(roles, role)) {
+    fail(422, 'Unknown role.')
+  }
+
+  const passwordHash = await hashPassword(password)
+
+  try {
+    const row = await createUser(getDb(), {
+      email,
+      password_hash: passwordHash,
+      name,
+      avatar,
+      role,
+    })
+    return { user: toAdminUser(row) }
+  }
+  catch (error) {
+    if (isUniqueConstraintError(error)) {
+      fail(409, 'A user with this email already exists.')
+    }
+    throw error
+  }
+})

package/src/runtime/server/api/uploads/[...key].get.ts

@@ -0,0 +1,33 @@
+import { createError, defineEventHandler, getRequestURL, setHeader } from 'h3'
+import { getMediaStorage } from '../../utils/media'
+import { uploadResponseHeaders } from '../../utils/upload-headers'
+
+/** Serve uploaded files from the media storage directory. */
+export default defineEventHandler(async (event) => {
+  const pathname = getRequestURL(event).pathname
+  const prefix = '/uploads/'
+  if (!pathname.startsWith(prefix)) {
+    throw createError({ statusCode: 404, statusMessage: 'File not found.' })
+  }
+
+  const key = decodeURIComponent(pathname.slice(prefix.length))
+  const storage = getMediaStorage()
+  let data: Buffer
+  try {
+    if (!key || !(await storage.exists(key))) {
+      throw createError({ statusCode: 404, statusMessage: 'File not found.' })
+    }
+    data = await storage.get(key)
+  }
+  catch (error) {
+    if (error && typeof error === 'object' && 'statusCode' in error) {
+      throw error
+    }
+    throw createError({ statusCode: 404, statusMessage: 'File not found.' })
+  }
+
+  for (const [name, value] of Object.entries(uploadResponseHeaders(key))) {
+    setHeader(event, name, value)
+  }
+  return data
+})

package/src/runtime/server/kit.ts

@@ -0,0 +1,5 @@
+export { getDb } from './utils/db'
+export { requireUser } from './utils/session'
+export { requireEntryPermission, requirePermission } from './utils/permissions'
+export { clientAddress, trustedProxyHops } from './utils/client-address'
+export { eventClientAddress } from './utils/request-address'

package/src/runtime/server/middleware/admin-headers.ts

@@ -0,0 +1,14 @@
+import { appendResponseHeader, defineEventHandler, getRequestURL, setResponseHeader } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { isCmsAdminPath } from '../../utils/cms-paths'
+
+/** Keep the admin shell out of foreign frames and stop MIME sniffing. */
+export default defineEventHandler((event) => {
+  const adminPath = String(useRuntimeConfig().katecms?.adminPath || 'admin')
+  const path = getRequestURL(event).pathname
+  if (!isCmsAdminPath(path, adminPath)) {
+    return
+  }
+  setResponseHeader(event, 'X-Content-Type-Options', 'nosniff')
+  appendResponseHeader(event, 'Content-Security-Policy', 'frame-ancestors \'none\'')
+})