kempo 4.2.15 → 4.2.17

package/server/utils/global-content/createGlobalContent.js

@@ -3,6 +3,7 @@ import { join } from 'path';
 import { existsSync } from 'fs';
 import crypto from 'crypto';
 import { GLOBAL_FILE, parseEntries } from './helpers.js';
+import triggerHook from '../hooks/triggerHook.js';
 
 const serializeEntries = entries => entries.map(e => {
   const attrs = [
@@ -54,5 +55,7 @@ export default async ({ rootDir, name, location, priority, author }) => {
   entries.push(entry);
   await writeFile(filePath, serializeEntries(entries) + '\n', 'utf-8');
 
+  await triggerHook('globalContent:created', { id: entry.id, name, location });
+
   return [null, entry];
 };

package/server/utils/global-content/deleteGlobalContent.js

@@ -2,6 +2,7 @@ import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
 import { GLOBAL_FILE, parseEntries } from './helpers.js';
+import triggerHook from '../hooks/triggerHook.js';
 
 const serializeEntries = entries => entries.map(e => {
   const attrs = [
@@ -37,9 +38,6 @@ export default async ({ rootDir, ids }) => {
 
   for(const entry of entries){
     if(!idSet.has(entry.id)) continue;
-    if(entry.locked){
-      return [{ code: 403, msg: `Cannot delete locked global content: ${entry.name}` }, null];
-    }
     if(entry.owner && entry.owner !== 'custom'){
       return [{ code: 403, msg: `Cannot delete global content: ${entry.name}` }, null];
     }
@@ -48,5 +46,7 @@ export default async ({ rootDir, ids }) => {
   const remaining = entries.filter(e => !idSet.has(e.id));
   await writeFile(filePath, remaining.length ? serializeEntries(remaining) + '\n' : '', 'utf-8');
 
+  for(const id of ids) await triggerHook('globalContent:deleted', { id });
+
   return [null, { deleted: ids.length }];
 };

package/server/utils/global-content/getGlobalContentMetadata.js

@@ -0,0 +1,37 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { GLOBAL_FILE, parseEntries } from './helpers.js';
+
+export default async ({ rootDir, id }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!id){
+    return [{ code: 400, msg: 'Global content ID is required' }, null];
+  }
+
+  const filePath = join(rootDir, GLOBAL_FILE);
+  if(!existsSync(filePath)){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  const raw = await readFile(filePath, 'utf-8');
+  const entries = parseEntries(raw);
+  const entry = entries.find(e => e.id === id);
+
+  if(!entry){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  return [null, {
+    name: entry.name,
+    owner: entry.owner,
+    locked: entry.locked,
+    author: entry.author,
+    createdAt: entry.createdAt,
+    updatedAt: entry.updatedAt,
+    location: entry.location,
+    priority: entry.priority
+  }];
+};

package/server/utils/global-content/setGlobalContentLocked.js

@@ -0,0 +1,44 @@
+import { readFile, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { GLOBAL_FILE, parseEntries } from './helpers.js';
+
+const serializeEntries = entries => entries.map(e => {
+  const attrs = [
+    `id="${e.id}"`,
+    `name="${e.name}"`,
+    `owner="${e.owner}"`,
+    `author="${e.author}"`,
+    `created="${e.createdAt}"`,
+    `updated="${e.updatedAt}"`,
+    `locked="${e.locked}"`,
+    `location="${e.location}"`,
+    `priority="${e.priority}"`
+  ].join(' ');
+  return `<content ${attrs}>\n${e.markup}\n</content>`;
+}).join('\n');
+
+export default async ({ rootDir, id, locked }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!id) return [{ code: 400, msg: 'Global content ID is required' }, null];
+  if(typeof locked !== 'boolean') return [{ code: 400, msg: 'locked must be a boolean' }, null];
+
+  const filePath = join(rootDir, GLOBAL_FILE);
+  if(!existsSync(filePath)){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  const raw = await readFile(filePath, 'utf-8');
+  const entries = parseEntries(raw);
+  const idx = entries.findIndex(e => e.id === id);
+
+  if(idx === -1){
+    return [{ code: 404, msg: 'Global content not found' }, null];
+  }
+
+  entries[idx].locked = locked;
+
+  await writeFile(filePath, serializeEntries(entries) + '\n', 'utf-8');
+
+  return [null, { id, locked }];
+};

package/server/utils/global-content/updateGlobalContent.js

@@ -2,6 +2,7 @@ import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
 import { GLOBAL_FILE, parseEntries } from './helpers.js';
+import triggerHook from '../hooks/triggerHook.js';
 
 const serializeEntries = entries => entries.map(e => {
   const attrs = [
@@ -39,10 +40,6 @@ export default async ({ rootDir, id, name, location, priority, markup }) => {
     return [{ code: 404, msg: 'Global content not found' }, null];
   }
 
-  if(entries[idx].locked){
-    return [{ code: 403, msg: 'This global content is locked and cannot be edited' }, null];
-  }
-
   const now = new Date().toISOString();
   if(name !== undefined) entries[idx].name = name;
   if(location !== undefined) entries[idx].location = location;
@@ -52,5 +49,7 @@ export default async ({ rootDir, id, name, location, priority, markup }) => {
 
   await writeFile(filePath, serializeEntries(entries) + '\n', 'utf-8');
 
+  await triggerHook('globalContent:updated', { id, updatedAt: now });
+
   return [null, { id, updatedAt: now }];
 };

package/server/utils/pages/createPage.js

@@ -1,6 +1,9 @@
 import { writeFile, mkdir } from 'fs/promises';
 import { join, dirname } from 'path';
 import { existsSync } from 'fs';
+import triggerHook from '../hooks/triggerHook.js';
+
+const RESERVED_KEYS = new Set(['owner', 'name', 'author', 'created', 'updated', 'locked', 'title', 'description']);
 
 const slugify = name => name
   .toLowerCase()
@@ -10,7 +13,7 @@ const slugify = name => name
   .replace(/-+/g, '-')
   .replace(/^-|-$/g, '');
 
-export default async ({ rootDir, directory, name, template, author }) => {
+export default async ({ rootDir, directory, name, template, author, locked = false, extraMetadata = {} }) => {
   if(!rootDir){
     return [{ code: 400, msg: 'Root directory is required' }, null];
   }
@@ -34,18 +37,24 @@ export default async ({ rootDir, directory, name, template, author }) => {
     return [{ code: 409, msg: 'A page with this name already exists in this location' }, null];
   }
 
+  const conflictingKeys = Object.keys(extraMetadata).filter(k => RESERVED_KEYS.has(k));
+  if(conflictingKeys.length){
+    return [{ code: 400, msg: `Cannot use reserved metadata keys: ${conflictingKeys.join(', ')}` }, null];
+  }
+
   const templateName = template || 'default';
 
   const now = new Date().toISOString();
-  const frontmatter = [
-    '<!--',
+  const defaultLines = [
     `  owner: custom`,
     `  name: ${name}`,
     `  author: ${author || ''}`,
     `  created: ${now}`,
-    `  updated: ${now}`,
-    '-->'
-  ].join('\n');
+    `  updated: ${now}`
+  ];
+  if(locked) defaultLines.push(`  locked: true`);
+  const extraLines = Object.entries(extraMetadata).map(([k, v]) => `  ${k}: ${v}`);
+  const frontmatter = ['<!--', ...defaultLines, ...extraLines, '-->'].join('\n');
 
   const pageContent = `${frontmatter}\n<page template="${templateName}" title="${name}">\n</page>\n`;
 
@@ -55,6 +64,9 @@ export default async ({ rootDir, directory, name, template, author }) => {
 
   const relPath = (dir ? `${dir}/${slug}` : slug);
   const url = '/' + relPath;
+  const result = { file: `${relPath}.page.html`, url, title: name, slug };
+
+  await triggerHook('page:created', { file: result.file, url, name, author, extraMetadata });
 
-  return [null, { file: `${relPath}.page.html`, url, title: name, slug }];
+  return [null, result];
 };

package/server/utils/pages/deletePage.js

@@ -1,6 +1,6 @@
-import { readFile, unlink } from 'fs/promises';
+import { unlink } from 'fs/promises';
 import { join, normalize, sep } from 'path';
-import parseFrontmatter from '../fs/parseFrontmatter.js';
+import triggerHook from '../hooks/triggerHook.js';
 
 export default async ({ rootDir, files }) => {
   if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
@@ -13,22 +13,13 @@ export default async ({ rootDir, files }) => {
     }
 
     const fullPath = join(rootDir, normalized);
-    let content;
     try {
-      content = await readFile(fullPath, 'utf-8');
+      await unlink(fullPath);
     } catch {
       continue;
     }
 
-    const meta = parseFrontmatter(content);
-    if(meta.locked === 'true'){
-      return [{ code: 403, msg: `Cannot delete locked page: ${file}` }, null];
-    }
-    if(meta.owner && meta.owner !== 'custom'){
-      return [{ code: 403, msg: `Cannot delete page: ${file}` }, null];
-    }
-
-    await unlink(fullPath);
+    await triggerHook('page:deleted', { file });
   }
 
   return [null, { deleted: files.length }];

package/server/utils/pages/disablePage.js

@@ -23,9 +23,6 @@ export default async ({ rootDir, file }) => {
 
   const content = await readFile(fullPath, 'utf-8');
   const meta = parseFrontmatter(content);
-  if(meta.locked === 'true'){
-    return [{ code: 403, msg: 'Cannot disable a locked page' }, null];
-  }
 
   const disabledPath = fullPath.replace(/\.page\.html$/, '.page-disabled.html');
   if(existsSync(disabledPath)){

package/server/utils/pages/getPage.js

@@ -3,6 +3,8 @@ import { join } from 'path';
 import { existsSync } from 'fs';
 import parseFrontmatter from '../fs/parseFrontmatter.js';
 
+const RESERVED_KEYS = new Set(['owner', 'name', 'author', 'created', 'updated', 'locked', 'title', 'description']);
+
 const parseContents = content => {
   const blocks = [];
   const regex = /<content(?:\s+location="([^"]*)")?\s*>([\s\S]*?)<\/content>/g;
@@ -37,6 +39,10 @@ export default async ({ rootDir, file }) => {
   const templateMatch = raw.match(/<page\s[^>]*template="([^"]*)"/);
   const contents = parseContents(raw);
 
+  const extraMetadata = Object.fromEntries(
+    Object.entries(meta).filter(([k]) => !RESERVED_KEYS.has(k))
+  );
+
   return [null, {
     file: safePath,
     name: meta.name || '',
@@ -48,6 +54,7 @@ export default async ({ rootDir, file }) => {
     description: meta.description || '',
     createdAt: meta.created || '',
     updatedAt: meta.updated || '',
+    extraMetadata,
     contents
   }];
 };

package/server/utils/pages/getPageMetadata.js

@@ -0,0 +1,32 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!file){
+    return [{ code: 400, msg: 'File path is required' }, null];
+  }
+
+  const safePath = file.replace(/\.\./g, '').replace(/^\//, '');
+  const fullPath = join(rootDir, safePath);
+
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Page not found' }, null];
+  }
+
+  const raw = await readFile(fullPath, 'utf-8');
+  const meta = parseFrontmatter(raw);
+
+  return [null, {
+    name: meta.name,
+    owner: meta.owner,
+    locked: meta.locked === 'true',
+    author: meta.author,
+    created: meta.created,
+    updated: meta.updated
+  }];
+};

package/server/utils/pages/listPages.js

@@ -3,7 +3,9 @@ import { relative } from 'path';
 import scanDir from '../fs/scanDir.js';
 import parseFrontmatter from '../fs/parseFrontmatter.js';
 
-export default async ({ rootDir }) => {
+const RESERVED_KEYS = new Set(['owner', 'name', 'author', 'created', 'updated', 'locked', 'title', 'description']);
+
+export default async ({ rootDir, owner }) => {
   if(!rootDir){
     return [{ code: 400, msg: 'Root directory is required' }, null];
   }
@@ -20,6 +22,9 @@ export default async ({ rootDir }) => {
       .replace(/\.page-disabled\.html$/, '')
       .replace(/\.page\.html$/, '')
       .replace(/(^|\/)index$/, '$1');
+    const extraMetadata = Object.fromEntries(
+      Object.entries(meta).filter(([k]) => !RESERVED_KEYS.has(k))
+    );
     return {
       file: relPath,
       url: urlPath || '/',
@@ -31,10 +36,13 @@ export default async ({ rootDir }) => {
       author: meta.author || '',
       description: meta.description || '',
       createdAt: meta.created || '',
-      updatedAt: meta.updated || ''
+      updatedAt: meta.updated || '',
+      extraMetadata
     };
   });
 
-  return [null, { pages, total: pages.length }];
+  const filtered = owner ? pages.filter(page => page.owner === owner) : pages;
+
+  return [null, { pages: filtered, total: filtered.length }];
 };
 

package/server/utils/pages/movePage.js

@@ -28,9 +28,6 @@ export default async ({ rootDir, file, newFile }) => {
   }
 
   const meta = parseFrontmatter(content);
-  if(meta.locked === 'true'){
-    return [{ code: 403, msg: 'Cannot move a locked page' }, null];
-  }
   if(meta.owner && meta.owner !== 'custom'){
     return [{ code: 403, msg: 'Cannot move system pages' }, null];
   }

package/server/utils/pages/searchByMetadata.js

@@ -0,0 +1,61 @@
+import { readFile } from 'fs/promises';
+import { relative } from 'path';
+import scanDir from '../fs/scanDir.js';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+const RESERVED_KEYS = new Set(['owner', 'name', 'author', 'created', 'updated', 'locked', 'title', 'description']);
+
+export default async ({ rootDir, query = {} }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!Object.keys(query).length){
+    return [{ code: 400, msg: 'Search query must have at least one key' }, null];
+  }
+
+  const queryKeys = Object.keys(query);
+  const reservedConflicts = queryKeys.filter(k => RESERVED_KEYS.has(k));
+  if(reservedConflicts.length){
+    return [{ code: 400, msg: `Cannot search reserved metadata keys: ${reservedConflicts.join(', ')}` }, null];
+  }
+
+  const pages = await scanDir(rootDir, rootDir, async (fullPath, entry, root) => {
+    if(entry.isDirectory() || !entry.name.endsWith('.page.html')) return null;
+    const content = await readFile(fullPath, 'utf-8');
+    const meta = parseFrontmatter(content);
+
+    const matches = queryKeys.every(k => {
+      const val = meta[k];
+      if(val === undefined) return false;
+      const expected = String(query[k]);
+      return val === expected;
+    });
+
+    if(!matches) return null;
+
+    const relPath = relative(root, fullPath).replace(/\\/g, '/');
+    const urlPath = '/' + relPath
+      .replace(/\.page\.html$/, '')
+      .replace(/(^|\/)index$/, '$1');
+
+    const extraMetadata = Object.fromEntries(
+      Object.entries(meta).filter(([k]) => !RESERVED_KEYS.has(k))
+    );
+
+    return {
+      file: relPath,
+      url: urlPath || '/',
+      name: meta.name || meta.title || '',
+      title: meta.title || '',
+      owner: meta.owner || 'custom',
+      locked: meta.locked === 'true',
+      author: meta.author || '',
+      description: meta.description || '',
+      createdAt: meta.created || '',
+      updatedAt: meta.updated || '',
+      extraMetadata
+    };
+  });
+
+  return [null, { pages, total: pages.length }];
+};

package/server/utils/pages/setPageLocked.js

@@ -0,0 +1,48 @@
+import { readFile, writeFile } from 'fs/promises';
+import { join, normalize, sep } from 'path';
+import { existsSync } from 'fs';
+
+export default async ({ rootDir, file, locked }) => {
+  if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
+  if(!file) return [{ code: 400, msg: 'File path is required' }, null];
+  if(typeof locked !== 'boolean') return [{ code: 400, msg: 'locked must be a boolean' }, null];
+
+  const normalized = normalize(file);
+  if(normalized.startsWith('..') || normalized.includes('..' + sep)){
+    return [{ code: 400, msg: 'Invalid file path' }, null];
+  }
+
+  const fullPath = join(rootDir, normalized);
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Page not found' }, null];
+  }
+
+  const raw = await readFile(fullPath, 'utf-8');
+  const frontmatterMatch = raw.match(/^<!--\s*\n([\s\S]*?)\n\s*-->/);
+  const existingMeta = {};
+
+  if(frontmatterMatch){
+    for(const line of frontmatterMatch[1].split('\n')){
+      const idx = line.indexOf(':');
+      if(idx === -1) continue;
+      const key = line.slice(0, idx).trim();
+      const value = line.slice(idx + 1).trim();
+      if(key) existingMeta[key] = value;
+    }
+  }
+
+  if(locked){
+    existingMeta.locked = 'true';
+  } else {
+    delete existingMeta.locked;
+  }
+
+  const frontmatter = '<!--\n' +
+    Object.entries(existingMeta).map(([k, v]) => `  ${k}: ${v}`).join('\n') +
+    '\n-->';
+
+  const body = frontmatterMatch ? raw.slice(frontmatterMatch[0].length) : '\n' + raw;
+  await writeFile(fullPath, frontmatter + body, 'utf-8');
+
+  return [null, { file: normalized, locked }];
+};

package/server/utils/pages/updatePage.js

@@ -1,8 +1,11 @@
 import { readFile, writeFile } from 'fs/promises';
 import { join } from 'path';
 import { existsSync } from 'fs';
+import triggerHook from '../hooks/triggerHook.js';
 
-export default async ({ rootDir, file, name, title, description, author, template, contents }) => {
+const RESERVED_KEYS = new Set(['owner', 'name', 'author', 'created', 'updated', 'locked', 'title', 'description']);
+
+export default async ({ rootDir, file, name, title, description, author, template, contents, extraMetadata, force = false }) => {
   if(!rootDir){
     return [{ code: 400, msg: 'Root directory is required' }, null];
   }
@@ -20,8 +23,7 @@ export default async ({ rootDir, file, name, title, description, author, templat
   const raw = await readFile(fullPath, 'utf-8');
 
   const frontmatterMatch = raw.match(/^<!--\s*\n([\s\S]*?)\n\s*-->/);
-  const lockedMatch = raw.match(/^<!--[\s\S]*?locked:\s*true[\s\S]*?-->/);
-  if(lockedMatch) return [{ code: 403, msg: 'This page is locked and cannot be edited' }, null];
+
   const existingMeta = {};
   if(frontmatterMatch){
     for(const line of frontmatterMatch[1].split('\n')){
@@ -33,6 +35,13 @@ export default async ({ rootDir, file, name, title, description, author, templat
     }
   }
 
+  if(extraMetadata !== undefined){
+    const conflictingKeys = Object.keys(extraMetadata).filter(k => RESERVED_KEYS.has(k));
+    if(conflictingKeys.length){
+      return [{ code: 400, msg: `Cannot use reserved metadata keys: ${conflictingKeys.join(', ')}` }, null];
+    }
+  }
+
   const now = new Date().toISOString();
   const newMeta = {
     ...existingMeta,
@@ -42,6 +51,11 @@ export default async ({ rootDir, file, name, title, description, author, templat
   if(title !== undefined) newMeta.title = title;
   if(description !== undefined) newMeta.description = description;
   if(author !== undefined) newMeta.author = author;
+  if(extraMetadata !== undefined){
+    for(const [k, v] of Object.entries(extraMetadata)){
+      newMeta[k] = v;
+    }
+  }
 
   const templateMatch = raw.match(/<page\s[^>]*template="([^"]*)"/)
   const resolvedTemplate = template !== undefined ? template : (templateMatch ? templateMatch[1] : 'default');
@@ -70,5 +84,7 @@ export default async ({ rootDir, file, name, title, description, author, templat
 
   await writeFile(fullPath, newPageContent, 'utf-8');
 
+  await triggerHook('page:updated', { file: safePath, updatedAt: now });
+
   return [null, { file: safePath, updatedAt: now }];
 };

package/server/utils/templates/createTemplate.js

@@ -1,6 +1,7 @@
 import { readFile, writeFile, mkdir } from 'fs/promises';
 import { join, dirname } from 'path';
 import { existsSync } from 'fs';
+import triggerHook from '../hooks/triggerHook.js';
 
 const slugify = name => name
   .toLowerCase()
@@ -10,7 +11,7 @@ const slugify = name => name
   .replace(/-+/g, '-')
   .replace(/^-|-$/g, '');
 
-export default async ({ rootDir, directory, name, author, copyFrom }) => {
+export default async ({ rootDir, directory, name, author, copyFrom, locked = false }) => {
   if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
   if(!name) return [{ code: 400, msg: 'Template name is required' }, null];
 
@@ -33,6 +34,7 @@ export default async ({ rootDir, directory, name, author, copyFrom }) => {
     `  author: ${author || ''}`,
     `  created: ${now}`,
     `  updated: ${now}`,
+    ...(locked ? ['  locked: true'] : []),
     '-->'
   ].join('\n');
 
@@ -67,5 +69,7 @@ export default async ({ rootDir, directory, name, author, copyFrom }) => {
 
   const relPath = dir ? `${dir}/${slug}.template.html` : `${slug}.template.html`;
 
+  await triggerHook('template:created', { file: relPath, name, slug });
+
   return [null, { file: relPath, name, slug }];
 };

package/server/utils/templates/deleteTemplate.js

@@ -1,6 +1,7 @@
 import { readFile, unlink } from 'fs/promises';
 import { join, normalize, sep } from 'path';
 import parseFrontmatter from '../fs/parseFrontmatter.js';
+import triggerHook from '../hooks/triggerHook.js';
 
 export default async ({ rootDir, files }) => {
   if(!rootDir) return [{ code: 400, msg: 'Root directory is required' }, null];
@@ -21,14 +22,12 @@ export default async ({ rootDir, files }) => {
     }
 
     const meta = parseFrontmatter(content);
-    if(meta.locked === 'true'){
-      return [{ code: 403, msg: `Cannot delete locked template: ${file}` }, null];
-    }
     if(meta.owner && meta.owner !== 'custom'){
       return [{ code: 403, msg: `Cannot delete template: ${file}` }, null];
     }
 
     await unlink(fullPath);
+    await triggerHook('template:deleted', { file });
   }
 
   return [null, { deleted: files.length }];

package/server/utils/templates/disableTemplate.js

@@ -23,9 +23,6 @@ export default async ({ rootDir, file }) => {
 
   const content = await readFile(fullPath, 'utf-8');
   const meta = parseFrontmatter(content);
-  if(meta.locked === 'true'){
-    return [{ code: 403, msg: 'Cannot disable a locked template' }, null];
-  }
 
   const disabledPath = fullPath.replace(/\.template\.html$/, '.template-disabled.html');
   if(existsSync(disabledPath)){

package/server/utils/templates/getTemplateMetadata.js

@@ -0,0 +1,32 @@
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+import { existsSync } from 'fs';
+import parseFrontmatter from '../fs/parseFrontmatter.js';
+
+export default async ({ rootDir, file }) => {
+  if(!rootDir){
+    return [{ code: 400, msg: 'Root directory is required' }, null];
+  }
+  if(!file){
+    return [{ code: 400, msg: 'File path is required' }, null];
+  }
+
+  const safePath = file.replace(/\.\./g, '').replace(/^\//, '');
+  const fullPath = join(rootDir, safePath);
+
+  if(!existsSync(fullPath)){
+    return [{ code: 404, msg: 'Template not found' }, null];
+  }
+
+  const raw = await readFile(fullPath, 'utf-8');
+  const meta = parseFrontmatter(raw);
+
+  return [null, {
+    name: meta.name,
+    owner: meta.owner,
+    locked: meta.locked === 'true',
+    author: meta.author,
+    created: meta.created,
+    updated: meta.updated
+  }];
+};

package/server/utils/templates/moveTemplate.js

@@ -28,9 +28,6 @@ export default async ({ rootDir, file, newFile }) => {
   }
 
   const meta = parseFrontmatter(content);
-  if(meta.locked === 'true'){
-    return [{ code: 403, msg: 'Cannot move a locked template' }, null];
-  }
   if(meta.owner && meta.owner !== 'custom'){
     return [{ code: 403, msg: 'Cannot move system templates' }, null];
   }