kempo-inventory 0.2.0

package/admin/index.page.html

@@ -0,0 +1,203 @@
+<!--
+locked: true
+-->
+<page title="Inventory - Admin">
+<content>
+  <script type="module" src="/kempo-ui/components/Table.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcSearch.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcFilters.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcFieldSortHide.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcFirstPage.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcPrevPage.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcNextPage.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcLastPage.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcPageSelect.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcPageSize.js"></script>
+  <script type="module" src="/kempo-ui/components/controls/TcDeleteRecord.js"></script>
+  <script type="module" src="/kempo-ui/components/Toggle.js"></script>
+  <script type="module" src="/kempo-ui/components/Combobox.js"></script>
+  <script type="module" src="/kempo-ui/components/Icon.js"></script>
+  <script type="module" src="/kempo/components/Permission.js"></script>
+  <script type="module" src="/inventory/components/RowAction.js"></script>
+
+  <h1 class="mb">Inventory</h1>
+
+  <!--
+    Everything that acts on the table lives in the table: search, filters and the buttons above it,
+    paging below it, and the row actions beside each record.
+  -->
+  <k-table
+    id="itemsTable"
+    enable-pages
+    page-size="25"
+    page-size-options="[10,25,50,100]"
+    placeholder="No items yet."
+    filtered-placeholder="No items match your search."
+  >
+    <div slot="top" class="d-f full" style="align-items: center; gap: var(--spacer_h); flex-wrap: wrap;">
+      <kc-tc-search style="width: 16rem"></kc-tc-search>
+      <kc-tc-filters></kc-tc-filters>
+      <kc-tc-field-sort-hide></kc-tc-field-sort-hide>
+      <div class="flex"></div>
+      <k-permission has="kempo-inventory:fields:manage">
+        <button id="importBtn" class="btn m0"><k-icon name="arrow" direction="up"></k-icon> Import</button>
+      </k-permission>
+      <k-permission has="kempo-inventory:fields:manage">
+        <button id="exportBtn" class="btn m0"><k-icon name="download"></k-icon> Export</button>
+      </k-permission>
+      <a href="/admin/extension/kempo-inventory/categories" class="btn"><k-icon name="folder"></k-icon> Categories</a>
+      <k-permission has="kempo-inventory:fields:manage">
+        <a href="/admin/extension/kempo-inventory/fields" class="btn"><k-icon name="settings"></k-icon> Fields</a>
+      </k-permission>
+      <k-permission has="kempo-inventory:items:create">
+        <button id="newItemBtn" class="primary m0"><k-icon name="add"></k-icon> New Item</button>
+      </k-permission>
+    </div>
+    <div class="d-f full" style="align-items: center;">
+      <div>
+        <kc-tc-first-page></kc-tc-first-page>
+        <kc-tc-prev-page></kc-tc-prev-page>
+        <kc-tc-next-page></kc-tc-next-page>
+        <kc-tc-last-page></kc-tc-last-page>
+      </div>
+      <div class="flex"></div>
+      <div><kc-tc-page-select></kc-tc-page-select></div>
+      <div class="flex"></div>
+      <div><kc-tc-page-size></kc-tc-page-size></div>
+    </div>
+  </k-table>
+
+  <script type="module">
+    import { getItems, deleteItem, getFields } from '/inventory/sdk.js';
+    import { getAllCurrentUserPermissions } from '/kempo/sdk.js';
+    import Toast from '/kempo-ui/components/Toast.js';
+    import Dialog from '/kempo-ui/components/Dialog.js';
+    import { displayValue, applicableFields } from '/inventory/components/ItemFields.js';
+    import { openAdjustDialog } from '/inventory/components/ItemDialog.js';
+    import { openImportDialog, openExportDialog } from '/inventory/components/ImportExport.js';
+    import { showFlash } from '/inventory/components/flash.js';
+
+    await window.customElements.whenDefined('k-table');
+    await window.customElements.whenDefined('k-toggle');
+    const $table = document.getElementById('itemsTable');
+
+    const [, permData] = await getAllCurrentUserPermissions();
+    const myPerms = new Set(permData?.permissions ?? []);
+    const can = name => myPerms.has(`kempo-inventory:${name}`);
+
+    const addControl = (tag, slot, attributes = {}) => {
+      const $control = document.createElement(tag);
+      $control.setAttribute('slot', slot);
+      for(const [name, value] of Object.entries(attributes)) $control.setAttribute(name, value);
+      $table.appendChild($control);
+    };
+    if(can('items:update')) addControl('inventory-row-action', 'before', { action: 'edit', icon: 'edit', title: 'Edit' });
+    if(can('stock:adjust')) addControl('inventory-row-action', 'before', { action: 'adjust', icon: 'repeat', title: 'Adjust stock' });
+    if(can('items:delete')){
+      $table.setAttribute('request-delete', '');
+      addControl('kc-tc-delete-record', 'after');
+    }
+
+    /*
+      The custom fields are data, not code: the columns and the form below are all built from
+      whatever the field list says right now.
+    */
+    let fields = [];
+    /* The Managed by column only appears once an extension owns an item. */
+    let owners = false;
+
+    /*
+      Display-only values are precomputed as plain strings so the table never formats
+      user-supplied text itself.
+    */
+    const decorate = (item, ctx) => {
+      const record = { ...item, qtyText: String(item.quantity), tagsText: item.tags.join(', '), ownerText: item.owner };
+      /* Only the fields that apply to this item's category; a column another category's items fill stays blank here. */
+      for(const field of applicableFields(fields, item.category).filter(f => f.listed)) record[`f_${field.key}`] = displayValue(field, item.fields[field.key], ctx);
+      return record;
+    };
+
+    const columns = () => [
+      { name: 'sku', label: 'SKU', size: 130, editable: false },
+      { name: 'name', label: 'Name', size: 240, editable: false },
+      { name: 'category', label: 'Category', size: 140, editable: false },
+      { name: 'qtyText', label: 'Quantity', size: 100, editable: false },
+      { name: 'tagsText', label: 'Tags', size: 160, editable: false },
+      ...(owners ? [{ name: 'ownerText', label: 'Managed by', size: 170, editable: false }] : []),
+      /* One column per key: a key two categories both use is one column. */
+      ...fields.filter((f, i) => f.listed && fields.findIndex(o => o.listed && o.key === f.key) === i).map(f => ({ name: `f_${f.key}`, label: f.label, size: 130, editable: false })),
+    ];
+
+    /*
+      The table searches, filters and pages the records itself, so every item is loaded (the API
+      hands them over 200 at a time). A personal inventory is a few hundred items at most.
+    */
+    const loadEveryItem = async () => {
+      const items = [];
+      let context = { linked: {}, media: {} };
+      for(let offset = 0; ; offset += 200){
+        const [error, page] = await getItems({ limit: 200, offset });
+        if(error) return [error, null];
+        items.push(...page.items);
+        context = { linked: { ...context.linked, ...page.linked }, media: { ...context.media, ...page.media } };
+        if(!page.items.length || items.length >= page.total) return [null, { items, context }];
+      }
+    };
+
+    const load = async () => {
+      const [error, data] = await loadEveryItem();
+      if(error){
+        Toast.error(error.msg || 'Failed to load inventory');
+        return;
+      }
+      owners = data.items.some(i => i.owner);
+      $table.setData({ records: data.items.map(i => decorate(i, data.context)), fields: columns() });
+    };
+
+    const loadFields = async () => {
+      const [error, data] = await getFields();
+      if(error){
+        Toast.error(error.msg || 'Failed to load fields');
+        return;
+      }
+      fields = data.fields;
+    };
+
+    $table.addEventListener('requestDelete', ({ detail: { records, approve, reject } }) => {
+      const [record] = records;
+      if(record.owner){
+        reject();
+        Toast.error(`"${record.name}" is managed by the ${record.owner} extension and cannot be deleted here`);
+        return;
+      }
+      Dialog.confirm(`Delete "${record.name}" and its stock history? This action cannot be undone.`, async confirmed => {
+        if(!confirmed){ reject(); return; }
+        const [error] = await deleteItem(record.id);
+        if(error){
+          reject();
+          Toast.error(error.msg || 'Failed to delete item');
+          return;
+        }
+        approve();
+        Toast.success('Item deleted');
+        load();
+      });
+    });
+
+    $table.addEventListener('itemAction', ({ detail: { action, record } }) => {
+      /* Editing is a page of its own, like adding: a dialog is too easy to dismiss and loses what was entered. */
+      if(action === 'edit') location.href = `/admin/extension/kempo-inventory/edit?id=${encodeURIComponent(record.id)}`;
+      if(action === 'adjust') openAdjustDialog({ item: record, onSaved: load });
+    });
+
+    document.getElementById('importBtn')?.addEventListener('click', () => openImportDialog({ onDone: load }));
+    document.getElementById('exportBtn')?.addEventListener('click', () => openExportDialog());
+    /* Adding an item is a page of its own: a dialog is too easy to dismiss and loses everything entered. */
+    document.getElementById('newItemBtn')?.addEventListener('click', () => { location.href = '/admin/extension/kempo-inventory/new'; });
+
+    await loadFields();
+    await load();
+    showFlash();
+  </script>
+</content>
+</page>

package/admin/nav.global.html

@@ -0,0 +1,3 @@
+<content id="kempo-inventory-nav" name="Inventory" owner="kempo-inventory" enabled="true" locked="true" location="admin-nav-extensions" priority="20">
+<k-aside-item icon="archive" href="/admin/extension/kempo-inventory/" no-expand>Inventory</k-aside-item>
+</content>

package/admin/new/index.page.html

@@ -0,0 +1,43 @@
+<!--
+locked: true
+-->
+<page title="New Item - Admin">
+<content>
+  <script type="module" src="/kempo-ui/components/Icon.js"></script>
+
+  <div class="d-f mb" style="align-items: center; gap: var(--spacer);">
+    <a href="/admin/extension/kempo-inventory/" class="btn" id="backLink"><k-icon name="arrow" direction="left"></k-icon> Inventory</a>
+    <h1 class="flex mb0">New Item</h1>
+  </div>
+
+  <div id="newItem" style="max-width: 44rem;"></div>
+
+  <script type="module">
+    import { getFields } from '/inventory/sdk.js';
+    import { getAllCurrentUserPermissions } from '/kempo/sdk.js';
+    import Toast from '/kempo-ui/components/Toast.js';
+    import { mountNewItemPage, safeNext } from '/inventory/components/NewItemPage.js';
+    import { showFlash } from '/inventory/components/flash.js';
+
+    const [, permData] = await getAllCurrentUserPermissions();
+    const $container = document.getElementById('newItem');
+    if(!new Set(permData?.permissions ?? []).has('kempo-inventory:items:create')){
+      $container.innerHTML = '<p class="tc-danger">Your account is not allowed to add items.</p>';
+    } else {
+      const [error, data] = await getFields();
+      if(error){
+        Toast.error(error.msg || 'Failed to load the item form');
+      } else {
+        /* ?category= starts the item in a category; ?next= is where to go after saving (a path on this site). */
+        const params = new URLSearchParams(location.search);
+        const defaults = {};
+        for(const key of ['category', 'sku', 'name']) if(params.get(key)) defaults[key] = params.get(key);
+        const next = safeNext(params.get('next'), '/admin/extension/kempo-inventory/');
+        document.getElementById('backLink').href = next;
+        mountNewItemPage({ $container, fields: data.fields, defaults, next });
+      }
+    }
+    showFlash();
+  </script>
+</content>
+</page>

package/install.js

@@ -0,0 +1,19 @@
+import { sql } from 'drizzle-orm';
+import db from 'kempo/server/db/index.js';
+
+/*
+  kempo's installer builds CREATE TABLE from the Drizzle columns only; indexes and unique
+  constraints declared in server/db/schema.js are not carried across. The unique SKU and field-key
+  indexes are correctness guarantees, so they are created here, matching the schema.
+*/
+const INDEXES = [
+  sql`CREATE UNIQUE INDEX IF NOT EXISTS "kempoInventoryItemSkuIdx" ON "kempoInventoryItem" ("sku")`,
+  sql`CREATE UNIQUE INDEX IF NOT EXISTS "kempoInventoryFieldKeyIdx" ON "kempoInventoryField" ("category", "key")`,
+  sql`CREATE UNIQUE INDEX IF NOT EXISTS "kempoInventoryCategoryKeyIdx" ON "kempoInventoryCategory" ("key")`,
+  sql`CREATE INDEX IF NOT EXISTS "kempoInventoryMovementItemIdx" ON "kempoInventoryMovement" ("itemId")`,
+  sql`CREATE INDEX IF NOT EXISTS "kempoInventoryItemOwnerIdx" ON "kempoInventoryItem" ("owner")`,
+];
+
+export default async () => {
+  for(const statement of INDEXES) await db.execute(statement);
+};

package/kempo-config.json

@@ -0,0 +1,103 @@
+{
+  "public-scope": "inventory",
+  "schema": "./server/db/schema.js",
+  "permissions": [
+    {
+      "name": "kempo-inventory:items:read",
+      "description": "View inventory items, fields and stock movements"
+    },
+    {
+      "name": "kempo-inventory:items:create",
+      "description": "Add new inventory items"
+    },
+    {
+      "name": "kempo-inventory:items:update",
+      "description": "Edit inventory items"
+    },
+    {
+      "name": "kempo-inventory:items:delete",
+      "description": "Delete inventory items"
+    },
+    {
+      "name": "kempo-inventory:stock:adjust",
+      "description": "Add or remove stock on inventory items"
+    },
+    {
+      "name": "kempo-inventory:fields:manage",
+      "description": "Create, edit and delete custom item fields"
+    }
+  ],
+  "groups": [
+    {
+      "name": "kempo-inventory:viewer",
+      "description": "Can view inventory",
+      "permissions": [
+        "system:admin:access",
+        "kempo-inventory:items:read"
+      ]
+    },
+    {
+      "name": "kempo-inventory:manager",
+      "description": "Can view and manage items and stock levels",
+      "permissions": [
+        "system:admin:access",
+        "kempo-inventory:items:read",
+        "kempo-inventory:items:create",
+        "kempo-inventory:items:update",
+        "kempo-inventory:items:delete",
+        "kempo-inventory:stock:adjust"
+      ]
+    },
+    {
+      "name": "kempo-inventory:admin",
+      "description": "Can manage items and stock levels, and set up the custom fields items have",
+      "permissions": [
+        "system:admin:access",
+        "kempo-inventory:items:read",
+        "kempo-inventory:items:create",
+        "kempo-inventory:items:update",
+        "kempo-inventory:items:delete",
+        "kempo-inventory:stock:adjust",
+        "kempo-inventory:fields:manage"
+      ]
+    }
+  ],
+  "settings": [
+    {
+      "name": "media_provider",
+      "value": "auto",
+      "type": "string",
+      "description": "Where new photos and files are uploaded: auto, kempo-media or kempo-files. Auto uses kempo-files when kempo-thumbs is installed to thumbnail it, otherwise kempo-media."
+    },
+    {
+      "name": "import_max_mb",
+      "value": 250,
+      "type": "number",
+      "description": "The largest import file (a .json or .zip made by Export) the admin Import accepts, in MB."
+    },
+    {
+      "name": "public_read",
+      "value": false,
+      "type": "boolean",
+      "description": "Let anyone, signed in or not, browse the inventory (items, categories, photos). They never see stock counts. Off by default: reading otherwise needs the items:read permission."
+    },
+    {
+      "name": "public_photos",
+      "value": true,
+      "type": "boolean",
+      "description": "Photos uploaded to kempo-files are viewable by anyone with the link, so every person who can read the inventory sees them (kempo-files otherwise needs each of them to have its files:download permission). Turn off to keep photos behind that permission."
+    },
+    {
+      "name": "category_image_ratio",
+      "value": "4:3",
+      "type": "string",
+      "description": "The aspect ratio category images are shown at, as width:height (4:3, 1:1, 16:9). Images are cropped to fit, never stretched."
+    },
+    {
+      "name": "item_image_ratio",
+      "value": "4:3",
+      "type": "string",
+      "description": "The aspect ratio item photos are shown at, as width:height (4:3, 1:1, 16:9). Images are cropped to fit, never stretched."
+    }
+  ]
+}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "kempo-inventory",
+  "version": "0.2.0",
+  "description": "A basic inventory management system for kempo cms",
+  "license": "MIT",
+  "author": "Dustin Poissant",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dustinpoissant/kempo-inventory.git"
+  },
+  "bugs": {
+    "url": "https://github.com/dustinpoissant/kempo-inventory/issues"
+  },
+  "homepage": "https://github.com/dustinpoissant/kempo-inventory#readme",
+  "type": "module",
+  "main": "sdk.js",
+  "scripts": {
+    "test": "node --test",
+    "link:local": "npm install ../kempo --no-save"
+  },
+  "kempo": {
+    "public-scope": "inventory"
+  },
+  "exports": {
+    "./install": "./install.js",
+    "./update": "./update.js",
+    "./sdk": "./sdk.js"
+  },
+  "files": [
+    "admin",
+    "public",
+    "server",
+    "install.js",
+    "update.js",
+    "sdk.js",
+    "kempo-config.json"
+  ],
+  "dependencies": {
+    "drizzle-orm": "^0.45.2"
+  },
+  "peerDependencies": {
+    "kempo": ">=4.3.0",
+    "kempo-ui": ">=0.5.0",
+    "kempo-media": ">=0.2.3",
+    "kempo-files": ">=0.1.3",
+    "kempo-thumbs": ">=0.1.3"
+  },
+  "peerDependenciesMeta": {
+    "kempo-media": {
+      "optional": true
+    },
+    "kempo-files": {
+      "optional": true
+    },
+    "kempo-thumbs": {
+      "optional": true
+    }
+  }
+}

package/public/api/categories/DELETE.js

@@ -0,0 +1,12 @@
+import authorize from '../../../server/utils/authorize.js';
+import { deleteCategory } from '../../../server/utils/categories.js';
+
+export default async (request, response) => {
+  const [authError, auth] = await authorize(request, 'items:update');
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  const name = request.body?.name ?? request.query.name;
+  const [error, result] = await deleteCategory(name, { userId: auth.userId });
+  if(error) return response.status(error.code).json({ error: error.msg });
+  response.json(result);
+};

package/public/api/categories/GET.js

@@ -0,0 +1,12 @@
+import { authorizeRead } from '../../../server/utils/access.js';
+import { parseTagParam } from '../../../server/utils/tags.js';
+import { getCategories } from '../../../server/utils/categories.js';
+
+export default async (request, response) => {
+  const [authError] = await authorizeRead(request);
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  const [error, data] = await getCategories({ includeEmpty: request.query.includeEmpty === 'true', q: request.query.q, tag: parseTagParam(request.query.tag) });
+  if(error) return response.status(error.code).json({ error: error.msg });
+  response.json(data);
+};

package/public/api/categories/PUT.js

@@ -0,0 +1,20 @@
+import authorize from '../../../server/utils/authorize.js';
+import { saveCategory } from '../../../server/utils/categories.js';
+
+/*
+  Create or update a category by name. Only the properties present in the body change, so
+  { name, description } leaves the image alone and { name, image: null } clears it. `newName` renames.
+*/
+export default async (request, response) => {
+  const [authError, auth] = await authorize(request, 'items:update');
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  const body = request.body || {};
+  const changes = {};
+  for(const property of ['newName', 'image', 'description', 'tags']){
+    if(property in body) changes[property] = body[property];
+  }
+  const [error, category] = await saveCategory(body.name, changes, { userId: auth.userId });
+  if(error) return response.status(error.code).json({ error: error.msg });
+  response.json({ category });
+};

package/public/api/export/GET.js

@@ -0,0 +1,31 @@
+import authorize from '../../../server/utils/authorize.js';
+import { buildExport } from '../../../server/utils/importExport.js';
+import { buildZip } from '../../../server/utils/zip.js';
+
+/*
+  Downloads the inventory: ?format=json is the data on its own, ?format=zip is the data (inventory.json)
+  together with every photo and file it uses (media/). The whole inventory leaves in one file, so it is
+  limited to the top tier, the people who set the inventory up (the fields:manage permission, held by
+  the kempo-inventory:admin group).
+*/
+export default async (request, response) => {
+  const [authError] = await authorize(request, 'fields:manage');
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  const format = request.query.format === 'zip' ? 'zip' : 'json';
+  const [error, built] = await buildExport({ withMedia: format === 'zip' });
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  const stamp = new Date().toISOString().slice(0, 10);
+  const json = Buffer.from(JSON.stringify(built.data, null, 2), 'utf8');
+  const body = format === 'zip'
+    ? buildZip([{ name: 'inventory.json', data: json }, ...built.files.map(file => ({ name: file.path, data: file.bytes }))])
+    : json;
+
+  response.setHeader('Content-Type', format === 'zip' ? 'application/zip' : 'application/json; charset=utf-8');
+  response.setHeader('Content-Disposition', `attachment; filename="inventory-${stamp}.${format}"`);
+  response.setHeader('Cache-Control', 'no-store');
+  if(built.missingMedia) response.setHeader('X-Missing-Media', String(built.missingMedia));
+  response.status(200);
+  response.end(body);
+};

package/public/api/fields/GET.js

@@ -0,0 +1,23 @@
+import { authorizeRead } from '../../../server/utils/access.js';
+import { getFields } from '../../../server/utils/fields.js';
+import { FIELD_TYPES, OPTIONAL_TYPES, CONVERSIONS } from '../../../server/utils/fieldTypes.js';
+import { capabilities as mediaCapabilities, getImageRatios } from '../../../server/utils/media.js';
+
+export default async (request, response) => {
+  const [authError] = await authorizeRead(request);
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  /* ?category=Paint returns just what an item in that category shows (default fields plus its own). */
+  const scoped = request.query.category !== undefined;
+  const [error, fields] = await getFields(scoped ? { category: request.query.category } : {});
+  if(error) return response.status(error.code).json({ error: error.msg });
+
+  /*
+    `types` is what can be created right now: a type backed by an extension that is not installed
+    is left out, so a client never offers something that would be refused.
+  */
+  const capabilities = await mediaCapabilities();
+  const types = FIELD_TYPES.filter(type => !OPTIONAL_TYPES[type] || capabilities[type]);
+  /* `imageRatios` is the aspect ratio (CSS) category and item images are shown at. */
+  response.json({ fields, types, capabilities, conversions: CONVERSIONS, imageRatios: await getImageRatios() });
+};

package/public/api/fields/POST.js

@@ -0,0 +1,12 @@
+import authorize from '../../../server/utils/authorize.js';
+import { createField } from '../../../server/utils/fields.js';
+
+export default async (request, response) => {
+  const [authError] = await authorize(request, 'fields:manage');
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  const { key, label, type, description, required, listed, suggest, options, position, category, imageRatio, imageMax } = request.body || {};
+  const [error, field] = await createField({ key, label, type, description, required, listed, suggest, options, position, category, imageRatio, imageMax });
+  if(error) return response.status(error.code).json({ error: error.msg });
+  response.status(201).json({ field });
+};

package/public/api/fields/[key]/DELETE.js

@@ -0,0 +1,11 @@
+import authorize from '../../../../server/utils/authorize.js';
+import { deleteField } from '../../../../server/utils/fields.js';
+
+export default async (request, response) => {
+  const [authError] = await authorize(request, 'fields:manage');
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  const [error, result] = await deleteField(request.params.key, { category: request.query.category ?? '' });
+  if(error) return response.status(error.code).json({ error: error.msg });
+  response.json(result);
+};

package/public/api/fields/[key]/PATCH.js

@@ -0,0 +1,16 @@
+import authorize from '../../../../server/utils/authorize.js';
+import { updateField } from '../../../../server/utils/fields.js';
+
+export default async (request, response) => {
+  const [authError] = await authorize(request, 'fields:manage');
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  const body = request.body || {};
+  const changes = {};
+  for(const property of ['label', 'description', 'required', 'listed', 'suggest', 'options', 'position', 'type', 'imageRatio', 'imageMax']){
+    if(body[property] !== undefined) changes[property] = body[property];
+  }
+  const [error, field] = await updateField(request.params.key, changes, { category: request.query.category ?? '' });
+  if(error) return response.status(error.code).json({ error: error.msg });
+  response.json({ field });
+};

package/public/api/fields/[key]/suggestions/GET.js

@@ -0,0 +1,12 @@
+import authorize from '../../../../../server/utils/authorize.js';
+import { getSuggestions } from '../../../../../server/utils/suggestions.js';
+
+export default async (request, response) => {
+  const [authError] = await authorize(request, 'items:read');
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  const { q, limit, category } = request.query;
+  const [error, suggestions] = await getSuggestions(request.params.key, { q, limit: parseInt(limit) || 8, category: category ?? '' });
+  if(error) return response.status(error.code).json({ error: error.msg });
+  response.json({ suggestions });
+};

package/public/api/import/apply/POST.js

@@ -0,0 +1,25 @@
+import authorize from '../../../../server/utils/authorize.js';
+import { applyImport } from '../../../../server/utils/importFile.js';
+import { readStaged, discardStaged } from '../../../../server/utils/importStage.js';
+
+/*
+  Step two: { importId, onMatch: 'skip' | 'update' } runs the import of the file uploaded in step one. An
+  item or category that already exists is left alone ('skip') or updated with the file's values ('update').
+
+  Top tier only, checked first, and the file must be the caller's own staged upload.
+*/
+export default async (request, response) => {
+  const [authError, auth] = await authorize(request, 'fields:manage');
+  if(authError) return response.status(authError.code).json({ error: authError.msg });
+
+  const { importId, onMatch } = request.body || {};
+  if(!['skip', 'update'].includes(onMatch)) return response.status(400).json({ error: 'onMatch must be "skip" or "update"' });
+
+  const staged = await readStaged(importId, auth.userId);
+  if(!staged) return response.status(404).json({ error: 'That upload has expired. Choose the file again.' });
+
+  const [error, report] = await applyImport(staged.bytes, { onMatch, userId: auth.userId });
+  await discardStaged(importId);
+  if(error) return response.status(error.code).json({ error: error.msg });
+  response.json(report);
+};