kilo-cms 0.1.0

package/src/routes/admin/collections/[collection]/options/route.ts

@@ -0,0 +1,38 @@
+import { ilike, asc } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { requireAction } from '../../../../../permissions'
+import { getCollection } from '../../../../../collections/registry'
+import { collectionColumn, findRow, idColumn, selectRows } from '../../../../../collections/query'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function GET(request: Request, { params }: { params: Promise<{ collection: string }> }) {
+  const { collection } = await params
+  const config = getCollection(collection)
+  if (!config) return notFound()
+  const result = await requireAction(config.slug, 'read')
+  if (!result) return unauthorized()
+
+  const url = new URL(request.url)
+  const q = url.searchParams.get('q')?.trim().slice(0, 100) || ''
+  // Comma-separated — a `relation.hasMany` field's currently-selected ids can be more than one.
+  const includeIds = (url.searchParams.get('include')?.trim() || '').split(',').map((id) => id.trim()).filter(Boolean)
+
+  const titleColumn = collectionColumn(config.slug, config.titleField) ?? idColumn(config.slug)
+  const rows = await selectRows(config.slug, {
+    where: q ? ilike(titleColumn, `%${q}%`) : undefined,
+    orderBy: [asc(titleColumn)],
+    limit: 200,
+  })
+
+  const options = rows.map((row) => ({ value: String(row.id), label: String(row[config.titleField] ?? row.id) }))
+
+  for (const id of includeIds) {
+    if (options.some((option) => option.value === id)) continue
+    const row = await findRow(config.slug, id)
+    if (row) options.unshift({ value: String(row.id), label: String(row[config.titleField] ?? row.id) })
+  }
+
+  return NextResponse.json(options)
+}

package/src/routes/admin/collections/[collection]/reorder/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { requireAction } from '../../../../../permissions'
+import { getCollection } from '../../../../../collections/registry'
+import { applyOrder } from '../../../../../collections/query'
+
+const schema = z.object({ ids: z.array(z.string().min(1).max(200)).min(1).max(500) })
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ collection: string }> }) {
+  const { collection } = await params
+  const config = getCollection(collection)
+  if (!config?.workflow?.sortOrder) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  const result = await requireAction(config.slug, 'update')
+  if (!result) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+  await applyOrder(config.slug, parsed.data.ids)
+  return NextResponse.json({ ok: true })
+}

package/src/routes/admin/collections/[collection]/route.ts

@@ -0,0 +1,88 @@
+import { NextResponse } from 'next/server'
+import { requireAction } from '../../../../permissions'
+import { applyFieldPermissions, blankFieldValues, redactFieldsForRead } from '../../../../content-types'
+import { getCollection, relationFields } from '../../../../collections/registry'
+import { buildOrderBy, buildWhere } from '../../../../collections/filters'
+import { countRows, findInvalidRelation, insertRow, isUniqueViolation, labelsForIds, nextSortOrder, selectRows } from '../../../../collections/query'
+import { resolveJoinFieldsForList } from '../../../../collections/join'
+import { parseCollectionBody, type ParseMode } from '../../../../collections/validation'
+import { creationWorkflowValues, entryRequiresApproval, fireWebhook } from '../../../../collections/workflow'
+import { applySlugFallbacks } from '../../../../collections/values'
+import { parseListQuery } from '../../../../listQuery'
+import { getLocaleConfig } from '../../../../locale-settings'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+export async function GET(request: Request, { params }: { params: Promise<{ collection: string }> }) {
+  const { collection } = await params
+  const config = getCollection(collection)
+  if (!config) return notFound()
+  const result = await requireAction(config.slug, 'read')
+  if (!result) return unauthorized()
+
+  const query = parseListQuery(request.url, config.workflow?.sortOrder ? 'sortOrder' : config.defaultSort.field)
+  const where = buildWhere(config, query)
+  const orderBy = buildOrderBy(config, query)
+
+  const total = await countRows(config.slug, where)
+  const rows =
+    query.pageSize === 'all'
+      ? await selectRows(config.slug, { where, orderBy })
+      : await selectRows(config.slug, { where, orderBy, limit: query.pageSize, offset: (query.page - 1) * query.pageSize })
+  const allowedFields = result.allowedFields(config.slug)
+  const withJoins = await resolveJoinFieldsForList(config, rows)
+  const items = withJoins.map((row) => redactFieldsForRead(config.slug, row, allowedFields))
+
+  const relationLabels: Record<string, Record<string, string>> = {}
+  for (const field of relationFields(config)) {
+    const target = getCollection(field.relationTo)!
+    const ids = [...new Set(items.flatMap((item) => {
+      const value = item[field.key]
+      return field.hasMany
+        ? (Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string' && entry !== '') : [])
+        : (typeof value === 'string' && value ? [value] : [])
+    }))]
+    relationLabels[field.key] = await labelsForIds(target.slug, ids, target.titleField)
+  }
+
+  return NextResponse.json({ items, total, relationLabels })
+}
+
+export async function POST(request: Request, { params }: { params: Promise<{ collection: string }> }) {
+  const { collection } = await params
+  const config = getCollection(collection)
+  if (!config) return notFound()
+  const result = await requireAction(config.slug, 'create')
+  if (!result) return unauthorized()
+
+  const body = await request.json()
+  const workflow = config.workflow
+  const wantsPublished = workflow?.publish ? Boolean(body.published) : false
+  if (wantsPublished && !result.can(config.slug, 'publish')) return unauthorized()
+  if (wantsPublished && await entryRequiresApproval(config)) return NextResponse.json({ error: 'This item has not been approved yet — publishing requires approval.' }, { status: 403 })
+
+  const mode: ParseMode = workflow?.publish ? (wantsPublished ? 'live' : 'draft') : 'live'
+  const parsed = parseCollectionBody(config, body, mode, result.allowedFields(config.slug), await getLocaleConfig())
+  if (!parsed.ok) return NextResponse.json({ error: parsed.error }, { status: 400 })
+  const id = typeof body.id === 'string' && body.id.trim() ? body.id.trim() : crypto.randomUUID()
+  const data = applySlugFallbacks(config, applyFieldPermissions(config.slug, parsed.data, result.allowedFields(config.slug), blankFieldValues[config.slug]), id)
+
+  const relationError = await findInvalidRelation(config, data)
+  if (relationError) return NextResponse.json({ error: relationError }, { status: 400 })
+
+  try {
+    const sortOrder = workflow?.sortOrder ? await nextSortOrder(config.slug) : 0
+    const row = await insertRow(config.slug, {
+      ...data,
+      id,
+      ...creationWorkflowValues(config, result.session.user.id, wantsPublished, sortOrder),
+      ...(workflow?.audit && typeof body.ownerId === 'string' && body.ownerId ? { ownerId: body.ownerId } : {}),
+    })
+    fireWebhook(config, 'created', row)
+    return NextResponse.json(row, { status: 201 })
+  } catch (error) {
+    if (isUniqueViolation(error)) return NextResponse.json({ error: 'A record with one of those unique values already exists.' }, { status: 409 })
+    throw error
+  }
+}

package/src/routes/admin/collections/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from 'next/server'
+import { getSessionWithPermissions } from '../../../permissions'
+import { collectionSlugs, getCollection } from '../../../collections/registry'
+
+export async function GET() {
+  const result = await getSessionWithPermissions()
+  if (!result) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  return NextResponse.json(
+    collectionSlugs
+      .filter((slug) => result.can(slug, 'read'))
+      .map((slug) => ({ slug, label: getCollection(slug)!.label })),
+  )
+}

package/src/routes/admin/content-views/[type]/route.ts

@@ -0,0 +1,25 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { defaultContentView, isContentViewType, normalizeContentView } from '../../../../collections/content-view'
+import { db } from '../../../../db'
+import { contentViews } from '../../../../schema'
+import { getSessionWithPermissions, requireSystem } from '../../../../permissions'
+
+function typeFrom(value: string): string | null { return isContentViewType(value) ? value : null }
+
+export async function GET(_: Request, { params }: { params: Promise<{ type: string }> }) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const type = typeFrom((await params).type)
+  if (!type) return NextResponse.json({ error: 'Unknown content type.' }, { status: 404 })
+  const [stored] = await db.select().from(contentViews).where(eq(contentViews.contentType, type)).limit(1)
+  return NextResponse.json(normalizeContentView(type, stored?.config || defaultContentView(type)))
+}
+
+export async function PUT(request: Request, { params }: { params: Promise<{ type: string }> }) {
+  if (!await requireSystem('views.manage')) return NextResponse.json({ error: 'Only administrators can change editor views.' }, { status: 403 })
+  const type = typeFrom((await params).type)
+  if (!type) return NextResponse.json({ error: 'Unknown content type.' }, { status: 404 })
+  const config = normalizeContentView(type, await request.json())
+  const [stored] = await db.insert(contentViews).values({ contentType: type, config }).onConflictDoUpdate({ target: contentViews.contentType, set: { config, updatedAt: new Date() } }).returning()
+  return NextResponse.json(stored.config)
+}

package/src/routes/admin/dashboard/data/route.ts

@@ -0,0 +1,39 @@
+import { NextResponse } from 'next/server'
+import { db } from '../../../../db'
+import { collectionTable } from '../../../../collections/query'
+import { getDashboardSources } from '../../../../dashboard'
+import { getSessionWithPermissions } from '../../../../permissions'
+import type { DashboardWidget } from '../../../../dashboard'
+
+const numericFields = new Set(['sortOrder'])
+
+export async function POST(request: Request) {
+  const result = await getSessionWithPermissions()
+  if (!result?.can('settings', 'read')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const widget = await request.json() as DashboardWidget
+  const source = getDashboardSources().find((item) => item.value === widget.source)
+  if (!source) return NextResponse.json({ error: 'Unknown dashboard source' }, { status: 400 })
+  const allowedFields = new Set(source.fields)
+  const table = collectionTable(widget.source)
+  const rows = await db.select().from(table)
+  const groupBy = widget.groupBy && allowedFields.has(widget.groupBy) ? widget.groupBy : undefined
+  const values = rows as Array<Record<string, unknown>>
+  if (widget.metric === 'count' && !groupBy) return NextResponse.json({ value: values.length })
+  if ((widget.metric === 'sum' || widget.metric === 'avg') && widget.field && numericFields.has(widget.field)) {
+    const numbers = values.map((row) => Number(row[widget.field!])).filter(Number.isFinite)
+    const total = numbers.reduce((sum, value) => sum + value, 0)
+    return NextResponse.json({ value: widget.metric === 'avg' ? (numbers.length ? total / numbers.length : 0) : total })
+  }
+  if ((widget.metric === 'true' || widget.metric === 'false') && widget.field && allowedFields.has(widget.field)) return NextResponse.json({ value: values.filter((row) => Boolean(row[widget.field!]) === (widget.metric === 'true')).length })
+  if (groupBy) {
+    const counts = new Map<string, number>()
+    for (const row of values) {
+      const key = String(row[groupBy] ?? 'Unknown')
+      const increment = widget.metric === 'count' ? 1 : widget.metric === 'true' || widget.metric === 'false' ? (Boolean(row[widget.field ?? groupBy]) === (widget.metric === 'true') ? 1 : 0) : widget.field && numericFields.has(widget.field) ? Number(row[widget.field]) || 0 : 0
+      counts.set(key, (counts.get(key) ?? 0) + increment)
+    }
+    const data = [...counts.entries()].sort((a, b) => b[1] - a[1]).slice(0, widget.limit).map(([name, value]) => ({ name, value }))
+    return NextResponse.json({ data })
+  }
+  return NextResponse.json({ value: values.length })
+}

package/src/routes/admin/dashboard/route.ts

@@ -0,0 +1,30 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../db'
+import { dashboards } from '../../../schema'
+import { getSessionWithPermissions } from '../../../permissions'
+import { defaultDashboard, type DashboardConfig } from '../../../dashboard'
+
+const widget = z.object({ id: z.string().min(1).max(80), title: z.string().min(1).max(100), source: z.enum(['services', 'projects', 'blog']), metric: z.enum(['count', 'sum', 'avg', 'true', 'false']), field: z.string().max(60).optional(), groupBy: z.string().max(60).optional(), visual: z.enum(['number', 'bar', 'line', 'donut', 'table']), limit: z.number().int().min(1).max(20), size: z.enum(['small', 'medium', 'large']).default('medium') })
+const configSchema = z.object({ widgets: z.array(widget).max(30) })
+
+// Reuses the 'settings' permission as the Dashboard builder's access gate — there's no single
+// type to ride on for this anymore (see collections/types.ts's SingleSlug comment).
+async function access() { const result = await getSessionWithPermissions(); return result?.can('settings', 'read') ? result : null }
+
+export async function GET() {
+  if (!await access()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const [dashboard] = await db.select().from(dashboards).where(eq(dashboards.id, 'main')).limit(1)
+  const config = (dashboard?.config as DashboardConfig | undefined) ?? defaultDashboard
+  return NextResponse.json({ widgets: config.widgets.map((widget) => ({ ...widget, size: widget.size ?? 'medium' })) })
+}
+
+export async function PUT(request: Request) {
+  const result = await access()
+  if (!result || !result.can('settings', 'update')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = configSchema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid dashboard configuration.' }, { status: 400 })
+  const [dashboard] = await db.insert(dashboards).values({ id: 'main', config: parsed.data, createdBy: result.session.user.id }).onConflictDoUpdate({ target: dashboards.id, set: { config: parsed.data, updatedAt: new Date() } }).returning()
+  return NextResponse.json(dashboard.config)
+}

package/src/routes/admin/email-settings/route.ts

@@ -0,0 +1,49 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../db'
+import { emailSettings } from '../../../schema'
+import { encryptSecret } from '../../../secrets'
+import { requireSystem } from '../../../permissions'
+import { EMAIL_SECRET_DOMAIN, isEmailConfigured } from '../../../email'
+
+export async function GET() {
+  if (!await requireSystem('developers.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const [settings] = await db.select().from(emailSettings).where(eq(emailSettings.id, 'default')).limit(1)
+  return NextResponse.json({
+    host: settings?.host ?? '',
+    port: settings?.port ?? 587,
+    secure: settings?.secure ?? true,
+    username: settings?.username ?? '',
+    fromAddress: settings?.fromAddress ?? '',
+    fromName: settings?.fromName ?? '',
+    configured: isEmailConfigured(settings ?? null),
+    hasPassword: Boolean(settings?.encryptedPassword),
+  })
+}
+
+const schema = z.object({
+  host: z.string().trim().max(200),
+  port: z.number().int().min(1).max(65535),
+  secure: z.boolean(),
+  username: z.string().trim().max(200).optional().default(''),
+  password: z.string().max(500).optional(),
+  fromAddress: z.string().trim().email().or(z.literal('')),
+  fromName: z.string().trim().max(120).optional().default(''),
+})
+
+export async function PUT(request: Request) {
+  if (!await requireSystem('developers.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues.map((issue) => `${issue.path.join(' ')}: ${issue.message}`).join(' · ') }, { status: 400 })
+  const { password, ...rest } = parsed.data
+  const [existing] = await db.select().from(emailSettings).where(eq(emailSettings.id, 'default')).limit(1)
+  const encryptedPassword = password ? encryptSecret(password, EMAIL_SECRET_DOMAIN) : existing?.encryptedPassword ?? null
+  const data = { ...rest, username: rest.username || null, fromAddress: rest.fromAddress || null, fromName: rest.fromName || null, encryptedPassword, updatedAt: new Date() }
+  const [settings] = await db.insert(emailSettings).values({ id: 'default', ...data }).onConflictDoUpdate({ target: emailSettings.id, set: data }).returning()
+  return NextResponse.json({
+    host: settings.host ?? '', port: settings.port ?? 587, secure: settings.secure, username: settings.username ?? '',
+    fromAddress: settings.fromAddress ?? '', fromName: settings.fromName ?? '',
+    configured: isEmailConfigured(settings), hasPassword: Boolean(settings.encryptedPassword),
+  })
+}

package/src/routes/admin/email-settings/test/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { requireSystem } from '../../../../permissions'
+import { sendEmail } from '../../../../email'
+
+const schema = z.object({ to: z.string().trim().email() })
+
+export async function POST(request: Request) {
+  if (!await requireSystem('developers.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Enter a valid email address.' }, { status: 400 })
+  try {
+    await sendEmail({ to: parsed.data.to, subject: 'Test email from The Usual CMS', html: '<p>This is a test email from your CMS Email settings. If you received this, your SMTP configuration works.</p>' })
+    return NextResponse.json({ ok: true })
+  } catch (error) {
+    return NextResponse.json({ error: error instanceof Error ? error.message : 'Could not send test email.' }, { status: 400 })
+  }
+}

package/src/routes/admin/locales/[code]/route.ts

@@ -0,0 +1,38 @@
+import { asc, eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../../db'
+import { cmsLocales } from '../../../../schema'
+import { requireSystem } from '../../../../permissions'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const notFound = () => NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+const updateSchema = z.object({ label: z.string().trim().min(1).max(60), isDefault: z.boolean() })
+
+export async function PUT(request: Request, { params }: { params: Promise<{ code: string }> }) {
+  if (!await requireSystem('locales.manage')) return unauthorized()
+  const { code } = await params
+  const parsed = updateSchema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues.map((issue) => `${issue.path.join(' ')}: ${issue.message}`).join(' · ') }, { status: 400 })
+
+  if (parsed.data.isDefault) await db.update(cmsLocales).set({ isDefault: false }) // exactly one default
+  const [row] = await db.update(cmsLocales).set({ label: parsed.data.label, isDefault: parsed.data.isDefault }).where(eq(cmsLocales.code, code)).returning()
+  if (!row) return notFound()
+  return NextResponse.json(row)
+}
+
+export async function DELETE(_request: Request, { params }: { params: Promise<{ code: string }> }) {
+  if (!await requireSystem('locales.manage')) return unauthorized()
+  const { code } = await params
+  const [deleted] = await db.delete(cmsLocales).where(eq(cmsLocales.code, code)).returning()
+  if (!deleted) return notFound()
+  // If the deleted locale was the default, promote whichever remains first (by sortOrder) — a
+  // `localized` field with zero locales, or with no default at all, has nowhere to store its
+  // required-locale value, so this table should never end up in that state via the admin UI.
+  if (deleted.isDefault) {
+    const [next] = await db.select().from(cmsLocales).orderBy(asc(cmsLocales.sortOrder)).limit(1)
+    if (next) await db.update(cmsLocales).set({ isDefault: true }).where(eq(cmsLocales.code, next.code))
+  }
+  return NextResponse.json({ ok: true })
+}

package/src/routes/admin/locales/reorder/route.ts

@@ -0,0 +1,18 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../../db'
+import { cmsLocales } from '../../../../schema'
+import { requireSystem } from '../../../../permissions'
+
+const schema = z.object({ codes: z.array(z.string().min(1).max(10)).min(1).max(50) })
+
+export async function PATCH(request: Request) {
+  if (!await requireSystem('locales.manage')) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+  await db.transaction(async (tx: any) => {
+    for (const [index, code] of parsed.data.codes.entries()) await tx.update(cmsLocales).set({ sortOrder: index }).where(eq(cmsLocales.code, code))
+  })
+  return NextResponse.json({ ok: true })
+}

package/src/routes/admin/locales/route.ts

@@ -0,0 +1,46 @@
+import { asc } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../db'
+import { cmsLocales } from '../../../schema'
+import { getSessionWithPermissions, requireSystem } from '../../../permissions'
+
+const unauthorized = () => NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+const codePattern = /^[a-z]{2}(-[A-Z]{2})?$/ // 'id', 'en', or 'en-US' style
+
+// GET is readable by any signed-in admin user (not gated behind 'locales.manage') — every editor
+// working on a `localized` field needs this list to render its locale tabs, not just whoever
+// manages the list itself.
+export async function GET() {
+  if (!await getSessionWithPermissions()) return unauthorized()
+  const rows = await db.select().from(cmsLocales).orderBy(asc(cmsLocales.sortOrder))
+  return NextResponse.json(rows)
+}
+
+const createSchema = z.object({
+  code: z.string().regex(codePattern, "Use a short code like 'id', 'en', or 'en-US'.").max(10),
+  label: z.string().trim().min(1).max(60),
+  isDefault: z.boolean().default(false),
+})
+
+export async function POST(request: Request) {
+  if (!await requireSystem('locales.manage')) return unauthorized()
+  const parsed = createSchema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: parsed.error.issues.map((issue) => `${issue.path.join(' ')}: ${issue.message}`).join(' · ') }, { status: 400 })
+
+  const existing = await db.select().from(cmsLocales)
+  if (parsed.data.isDefault || !existing.length) {
+    // Exactly one default — demoting the others is cheap enough to just always do it here
+    // instead of a separate "set default" endpoint.
+    if (existing.some((row: any) => row.isDefault)) await db.update(cmsLocales).set({ isDefault: false })
+  }
+  try {
+    const [row] = await db.insert(cmsLocales).values({
+      code: parsed.data.code,
+      label: parsed.data.label,
+      isDefault: parsed.data.isDefault || !existing.length,
+      sortOrder: existing.length,
+    }).returning()
+    return NextResponse.json(row, { status: 201 })
+  } catch { return NextResponse.json({ error: 'A locale with that code already exists.' }, { status: 409 }) }
+}

package/src/routes/admin/media/[id]/restore/route.ts

@@ -0,0 +1,13 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { db } from '../../../../../db'
+import { media } from '../../../../../schema'
+import { getSessionWithPermissions } from '../../../../../permissions'
+
+export async function POST(_request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const [row] = await db.update(media).set({ deletedAt: null }).where(eq(media.id, id)).returning()
+  if (!row) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  return NextResponse.json(row)
+}

package/src/routes/admin/media/[id]/route.ts

@@ -0,0 +1,56 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../../db'
+import { media, mediaFolders } from '../../../../schema'
+import { getSessionWithPermissions } from '../../../../permissions'
+import { removeUploadedFile } from '../../../../media-storage'
+
+export const runtime = 'nodejs'
+
+const schema = z.object({
+  starred: z.boolean().optional(),
+  filename: z.string().trim().min(1).max(200).optional(),
+  folder: z.string().optional(),
+}).refine((data) => Object.keys(data).length > 0, { message: 'Nothing to update.' })
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+  const [existing] = await db.select().from(media).where(eq(media.id, id))
+  if (!existing) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+  const updates: Partial<typeof media.$inferInsert> = {}
+  if (parsed.data.starred !== undefined) updates.starred = parsed.data.starred
+  if (parsed.data.filename !== undefined) updates.filename = parsed.data.filename
+  // Folder is pure organization — the file's URL never changes when it moves.
+  if (parsed.data.folder !== undefined && parsed.data.folder !== existing.folder) {
+    if (parsed.data.folder !== 'uploads') {
+      const [target] = await db.select().from(mediaFolders).where(eq(mediaFolders.slug, parsed.data.folder))
+      if (!target) return NextResponse.json({ error: 'Folder not found' }, { status: 400 })
+    }
+    updates.folder = parsed.data.folder
+  }
+
+  const [row] = await db.update(media).set(updates).where(eq(media.id, id)).returning()
+  return NextResponse.json(row)
+}
+
+export async function DELETE(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const permanent = new URL(request.url).searchParams.get('permanent') === '1'
+
+  if (permanent) {
+    const [row] = await db.delete(media).where(eq(media.id, id)).returning()
+    if (!row) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+    await removeUploadedFile(row.url)
+    return NextResponse.json({ ok: true })
+  }
+
+  const [row] = await db.update(media).set({ deletedAt: new Date() }).where(eq(media.id, id)).returning()
+  if (!row) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  return NextResponse.json(row)
+}

package/src/routes/admin/media/bulk/route.ts

@@ -0,0 +1,46 @@
+import { eq, inArray } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../../db'
+import { media, mediaFolders } from '../../../../schema'
+import { getSessionWithPermissions } from '../../../../permissions'
+import { removeUploadedFile } from '../../../../media-storage'
+
+export const runtime = 'nodejs'
+
+const schema = z.object({
+  ids: z.array(z.string()).min(1),
+  action: z.enum(['restore', 'delete', 'trash', 'move']),
+  folder: z.string().optional(),
+}).refine((data) => data.action !== 'move' || !!data.folder, { message: 'A target folder is required to move items.' })
+
+export async function POST(request: Request) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const parsed = schema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+  const { ids, action, folder } = parsed.data
+
+  if (action === 'restore') {
+    await db.update(media).set({ deletedAt: null }).where(inArray(media.id, ids))
+    return NextResponse.json({ ok: true, count: ids.length })
+  }
+
+  if (action === 'trash') {
+    await db.update(media).set({ deletedAt: new Date() }).where(inArray(media.id, ids))
+    return NextResponse.json({ ok: true, count: ids.length })
+  }
+
+  if (action === 'move') {
+    // Folder is pure organization — moving never touches the file's URL.
+    if (folder !== 'uploads') {
+      const [target] = await db.select().from(mediaFolders).where(eq(mediaFolders.slug, folder!))
+      if (!target) return NextResponse.json({ error: 'Folder not found' }, { status: 400 })
+    }
+    await db.update(media).set({ folder }).where(inArray(media.id, ids))
+    return NextResponse.json({ ok: true, count: ids.length })
+  }
+
+  const rows = await db.delete(media).where(inArray(media.id, ids)).returning()
+  await Promise.all(rows.map((row: any) => removeUploadedFile(row.url)))
+  return NextResponse.json({ ok: true, count: rows.length })
+}

package/src/routes/admin/media/folders/[id]/route.ts

@@ -0,0 +1,34 @@
+import { eq } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { db } from '../../../../../db'
+import { media, mediaFolders } from '../../../../../schema'
+import { getSessionWithPermissions } from '../../../../../permissions'
+
+const patchSchema = z.object({ pinned: z.boolean().optional(), name: z.string().trim().min(1).max(80).optional() })
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const parsed = patchSchema.safeParse(await request.json())
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request.' }, { status: 400 })
+  if (parsed.data.pinned === undefined && parsed.data.name === undefined) return NextResponse.json({ error: 'Nothing to update.' }, { status: 400 })
+  const [row] = await db.update(mediaFolders).set(parsed.data).where(eq(mediaFolders.id, id)).returning()
+  if (!row) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  return NextResponse.json(row)
+}
+
+export async function DELETE(_request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const { id } = await params
+  const [folder] = await db.select().from(mediaFolders).where(eq(mediaFolders.id, id))
+  if (!folder) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+
+  // Files inside the folder are kept, not deleted — they move back to Uploads. Folder is pure
+  // organization, so this is a plain metadata update; the files' URLs never change.
+  await db.transaction(async (tx: any) => {
+    await tx.update(media).set({ folder: 'uploads' }).where(eq(media.folder, folder.slug))
+    await tx.delete(mediaFolders).where(eq(mediaFolders.id, id))
+  })
+  return NextResponse.json({ ok: true })
+}

package/src/routes/admin/media/route.ts

@@ -0,0 +1,41 @@
+import { and, asc, count as sqlCount, desc, eq, isNotNull, isNull } from 'drizzle-orm'
+import { NextResponse } from 'next/server'
+import { db } from '../../../db'
+import { media, mediaFolders } from '../../../schema'
+import { getSessionWithPermissions } from '../../../permissions'
+
+const slugify = (value: string) => value.toLowerCase().trim().replace(/[^a-z0-9]+/g, '-').replace(/(^-|-$)/g, '')
+const RECENT_LIMIT = 60
+
+export async function GET(request: Request) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const params = new URL(request.url).searchParams
+  const view = params.get('view') || 'folder'
+  const folder = params.get('folder') || 'uploads'
+  const [customFolders, items, counts] = await Promise.all([
+    db.select().from(mediaFolders).orderBy(asc(mediaFolders.name)),
+    view === 'recent'
+      ? db.select().from(media).where(isNull(media.deletedAt)).orderBy(desc(media.createdAt)).limit(RECENT_LIMIT)
+      : view === 'starred'
+        ? db.select().from(media).where(and(eq(media.starred, true), isNull(media.deletedAt))).orderBy(desc(media.createdAt))
+        : view === 'trash'
+          ? db.select().from(media).where(isNotNull(media.deletedAt)).orderBy(desc(media.deletedAt))
+          : db.select().from(media).where(and(eq(media.folder, folder), isNull(media.deletedAt))).orderBy(desc(media.createdAt)),
+    db.select({ folder: media.folder, count: sqlCount() }).from(media).where(isNull(media.deletedAt)).groupBy(media.folder),
+  ])
+  const countByFolder = Object.fromEntries(counts.map((row: any) => [row.folder, Number(row.count)]))
+  const folders = [{ id: 'uploads', name: 'Uploads', slug: 'uploads' }, ...customFolders].map((item) => ({ ...item, count: countByFolder[item.slug] ?? 0 }))
+  return NextResponse.json({ folders, media: items })
+}
+
+export async function POST(request: Request) {
+  if (!await getSessionWithPermissions()) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const body = await request.json() as { name?: string }
+  const name = body.name?.trim() || ''
+  const slug = slugify(name)
+  if (!name || !slug) return NextResponse.json({ error: 'Enter a valid folder name.' }, { status: 400 })
+  try {
+    const [folder] = await db.insert(mediaFolders).values({ id: crypto.randomUUID(), name, slug }).returning()
+    return NextResponse.json(folder, { status: 201 })
+  } catch { return NextResponse.json({ error: 'That folder already exists.' }, { status: 409 }) }
+}