modern-cms 1.0.0

package/template/apps/api/src/routes/blocks.routes.ts

@@ -0,0 +1,38 @@
+import { Router } from "express";
+import { PageNodeSchema } from "@pgcms/shared";
+import { z } from "zod";
+import { prisma } from "../prisma.js";
+import { requireAuth, requireRole } from "../middleware/auth.js";
+
+export const blocksRouter = Router();
+
+const CreateBlockSchema = z.object({
+  name: z.string().min(1).max(80),
+  content: PageNodeSchema,
+});
+
+// The whole block library is builder-only, so every route requires an editor session.
+blocksRouter.use(requireAuth, requireRole("ADMIN", "EDITOR"));
+
+blocksRouter.get("/", async (_req, res) => {
+  const blocks = await prisma.savedBlock.findMany({ orderBy: { createdAt: "desc" } });
+  res.json(blocks);
+});
+
+blocksRouter.post("/", async (req, res) => {
+  const parsed = CreateBlockSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+  const block = await prisma.savedBlock.create({
+    data: { name: parsed.data.name, content: parsed.data.content as object },
+  });
+  res.status(201).json(block);
+});
+
+blocksRouter.delete("/:id", async (req, res) => {
+  try {
+    await prisma.savedBlock.delete({ where: { id: req.params.id } });
+    res.json({ ok: true });
+  } catch {
+    res.status(404).json({ error: "Block not found" });
+  }
+});

package/template/apps/api/src/routes/collections.routes.ts

@@ -0,0 +1,185 @@
+import { Router } from "express";
+import {
+  CreateCollectionInputSchema,
+  CreateCollectionItemInputSchema,
+  UpdateCollectionItemInputSchema,
+  createEmptyPage,
+  extractSearchText,
+  type PageNode,
+} from "@pgcms/shared";
+import { prisma } from "../prisma.js";
+import { requireAuth, requireRole, canModify } from "../middleware/auth.js";
+import { triggerRevalidation } from "../lib/revalidate.js";
+
+export const collectionsRouter = Router();
+
+// --- Public reads (no auth) ---
+
+// Newest-first published items of a collection — powers the "Collection List" block.
+collectionsRouter.get("/public/:slug/items", async (req, res) => {
+  const collection = await prisma.collection.findUnique({ where: { slug: req.params.slug } });
+  if (!collection) return res.status(404).json({ error: "Collection not found" });
+  const limit = Math.min(50, Math.max(1, Number(req.query.limit) || 12));
+  const items = await prisma.collectionItem.findMany({
+    where: { collectionId: collection.id, status: "PUBLISHED" },
+    orderBy: [{ publishedAt: "desc" }, { createdAt: "desc" }],
+    take: limit,
+    select: { slug: true, title: true, excerpt: true, coverImage: true, publishedAt: true },
+  });
+  res.json(items);
+});
+
+collectionsRouter.get("/public/:slug/items/:itemSlug", async (req, res) => {
+  const collection = await prisma.collection.findUnique({ where: { slug: req.params.slug } });
+  if (!collection) return res.status(404).json({ error: "Not found" });
+  const item = await prisma.collectionItem.findFirst({
+    where: { collectionId: collection.id, slug: req.params.itemSlug, status: "PUBLISHED" },
+  });
+  if (!item) return res.status(404).json({ error: "Not found" });
+  res.json({ ...item, collectionSlug: collection.slug, collectionName: collection.name });
+});
+
+// All publicly-visible members of an item's translation group, mirroring
+// pages.routes.ts's /public-translations — the group root is the item's
+// translationOfId (or the item itself when it IS the root), scoped to items within the
+// same collection since a "translation of" only makes sense there.
+collectionsRouter.get("/public/:slug/items/:itemSlug/translations", async (req, res) => {
+  const collection = await prisma.collection.findUnique({ where: { slug: req.params.slug } });
+  if (!collection) return res.json([]);
+  const item = await prisma.collectionItem.findFirst({
+    where: { collectionId: collection.id, slug: req.params.itemSlug },
+  });
+  if (!item) return res.json([]);
+  const rootId = item.translationOfId ?? item.id;
+  const group = await prisma.collectionItem.findMany({
+    where: {
+      collectionId: collection.id,
+      OR: [{ id: rootId }, { translationOfId: rootId }],
+      status: "PUBLISHED",
+    },
+    select: { locale: true, slug: true, title: true },
+  });
+  res.json(group.map(({ locale, slug, title }) => ({ locale, slug: `${collection.slug}/${slug}`, title })));
+});
+
+// Everything the sitemap needs in one call: all published item URLs.
+collectionsRouter.get("/public-sitemap", async (_req, res) => {
+  const items = await prisma.collectionItem.findMany({
+    where: { status: "PUBLISHED" },
+    select: { slug: true, updatedAt: true, collection: { select: { slug: true } } },
+  });
+  res.json(items.map((i) => ({ path: `${i.collection.slug}/${i.slug}`, updatedAt: i.updatedAt })));
+});
+
+// --- Admin CRUD ---
+collectionsRouter.use(requireAuth);
+
+collectionsRouter.get("/", async (_req, res) => {
+  const collections = await prisma.collection.findMany({
+    orderBy: { createdAt: "asc" },
+    include: { _count: { select: { items: true } } },
+  });
+  res.json(collections);
+});
+
+collectionsRouter.post("/", requireRole("ADMIN", "EDITOR"), async (req, res) => {
+  const parsed = CreateCollectionInputSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+  const clash = await prisma.collection.findUnique({ where: { slug: parsed.data.slug } });
+  if (clash) return res.status(409).json({ error: "A collection with this slug already exists" });
+  const collection = await prisma.collection.create({ data: parsed.data });
+  res.status(201).json(collection);
+});
+
+collectionsRouter.delete("/:id", requireRole("ADMIN"), async (req, res) => {
+  try {
+    await prisma.collection.delete({ where: { id: req.params.id } });
+    res.json({ ok: true });
+  } catch {
+    res.status(404).json({ error: "Collection not found" });
+  }
+});
+
+collectionsRouter.get("/:id/items", async (req, res) => {
+  const items = await prisma.collectionItem.findMany({
+    where: { collectionId: req.params.id },
+    orderBy: { createdAt: "desc" },
+    select: {
+      id: true,
+      slug: true,
+      title: true,
+      status: true,
+      publishedAt: true,
+      updatedAt: true,
+      locale: true,
+      translationOfId: true,
+    },
+  });
+  res.json(items);
+});
+
+collectionsRouter.post("/:id/items", requireRole("ADMIN", "EDITOR", "AUTHOR"), async (req, res) => {
+  const parsed = CreateCollectionItemInputSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+  const clash = await prisma.collectionItem.findFirst({
+    where: { collectionId: req.params.id, slug: parsed.data.slug },
+  });
+  if (clash) return res.status(409).json({ error: "An item with this slug already exists in this collection" });
+  const item = await prisma.collectionItem.create({
+    data: {
+      collectionId: req.params.id,
+      title: parsed.data.title,
+      slug: parsed.data.slug,
+      content: createEmptyPage() as object,
+      createdById: req.user!.sub,
+      ...(parsed.data.locale ? { locale: parsed.data.locale } : {}),
+    },
+  });
+  res.status(201).json(item);
+});
+
+collectionsRouter.get("/items/:itemId", async (req, res) => {
+  const item = await prisma.collectionItem.findUnique({
+    where: { id: req.params.itemId },
+    include: { collection: { select: { name: true, slug: true } } },
+  });
+  if (!item) return res.status(404).json({ error: "Item not found" });
+  res.json(item);
+});
+
+collectionsRouter.put("/items/:itemId", requireRole("ADMIN", "EDITOR", "AUTHOR"), async (req, res) => {
+  const parsed = UpdateCollectionItemInputSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+
+  const existingForOwnership = await prisma.collectionItem.findUnique({ where: { id: req.params.itemId } });
+  if (!existingForOwnership) return res.status(404).json({ error: "Item not found" });
+  if (!canModify(req.user!, existingForOwnership)) return res.status(403).json({ error: "Forbidden" });
+
+  const data: Record<string, unknown> = { ...parsed.data };
+  // First publish stamps publishedAt (the list sort key); republish keeps the original.
+  if (parsed.data.status === "PUBLISHED" && !existingForOwnership.publishedAt) {
+    data.publishedAt = new Date();
+  }
+  if (parsed.data.content !== undefined) {
+    data.searchText = extractSearchText(parsed.data.content as PageNode);
+  }
+
+  try {
+    const item = await prisma.collectionItem.update({ where: { id: req.params.itemId }, data: data as never });
+    if (parsed.data.status === "PUBLISHED" || parsed.data.content !== undefined) {
+      void triggerRevalidation(["cms", "cms-sitemap", `collection:${item.collectionId}`]);
+    }
+    res.json(item);
+  } catch {
+    res.status(404).json({ error: "Item not found" });
+  }
+});
+
+collectionsRouter.delete("/items/:itemId", requireRole("ADMIN", "EDITOR"), async (req, res) => {
+  try {
+    await prisma.collectionItem.delete({ where: { id: req.params.itemId } });
+    res.json({ ok: true });
+  } catch {
+    res.status(404).json({ error: "Item not found" });
+  }
+});

package/template/apps/api/src/routes/forms.routes.ts

@@ -0,0 +1,114 @@
+import { Router } from "express";
+import { z } from "zod";
+import { prisma } from "../prisma.js";
+import { requireAuth, requireRole } from "../middleware/auth.js";
+import { rateLimit } from "../middleware/rateLimit.js";
+import { env } from "../env.js";
+
+export const formsRouter = Router();
+
+const SubmitFormSchema = z.object({
+  formName: z.string().min(1).max(100),
+  pageSlug: z.string().max(200).default(""),
+  data: z.record(z.string(), z.string().max(5000)),
+  /** Honeypot — real users leave this empty; bots often fill every field. */
+  _hp: z.string().optional(),
+});
+
+const submitLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 20, keyPrefix: "forms" });
+
+async function notifyFormWebhook(payload: {
+  formName: string;
+  pageSlug: string;
+  data: Record<string, string>;
+  id: string;
+  createdAt: Date;
+}) {
+  if (!env.formsWebhookUrl) return;
+  try {
+    await fetch(env.formsWebhookUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ event: "form.submission", ...payload }),
+    });
+  } catch (err) {
+    console.warn("Form webhook delivery failed:", err);
+  }
+}
+
+// Public: anyone visiting the site can submit a Contact Form block.
+formsRouter.post("/submit", submitLimiter, async (req, res) => {
+  const parsed = SubmitFormSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+
+  if (parsed.data._hp) {
+    // Silently accept so bots don't retry with different payloads.
+    return res.status(201).json({ id: "ok" });
+  }
+
+  const { formName, pageSlug, data } = parsed.data;
+  const submission = await prisma.formSubmission.create({
+    data: { formName, pageSlug, data },
+  });
+
+  void notifyFormWebhook({
+    id: submission.id,
+    formName,
+    pageSlug,
+    data,
+    createdAt: submission.createdAt,
+  });
+
+  res.status(201).json({ id: submission.id });
+});
+
+// Admin: view submissions.
+formsRouter.use(requireAuth, requireRole("ADMIN", "EDITOR"));
+
+formsRouter.get("/submissions", async (req, res) => {
+  const formName = typeof req.query.formName === "string" ? req.query.formName : undefined;
+  const submissions = await prisma.formSubmission.findMany({
+    where: formName ? { formName } : undefined,
+    orderBy: { createdAt: "desc" },
+    take: 200,
+  });
+  res.json(submissions);
+});
+
+formsRouter.get("/submissions/export", async (req, res) => {
+  const formName = typeof req.query.formName === "string" ? req.query.formName : undefined;
+  const submissions = await prisma.formSubmission.findMany({
+    where: formName ? { formName } : undefined,
+    orderBy: { createdAt: "desc" },
+    take: 5000,
+  });
+
+  const fieldKeys = Array.from(new Set(submissions.flatMap((s) => Object.keys(s.data as Record<string, string>))));
+  const header = ["id", "formName", "pageSlug", "createdAt", ...fieldKeys];
+  const escape = (v: string) => `"${v.replace(/"/g, '""')}"`;
+  const rows = submissions.map((s) => {
+    const data = s.data as Record<string, string>;
+    return [
+      s.id,
+      s.formName,
+      s.pageSlug,
+      s.createdAt.toISOString(),
+      ...fieldKeys.map((k) => data[k] ?? ""),
+    ]
+      .map(escape)
+      .join(",");
+  });
+
+  res.setHeader("Content-Type", "text/csv; charset=utf-8");
+  res.setHeader("Content-Disposition", `attachment; filename="form-submissions${formName ? `-${formName}` : ""}.csv"`);
+  res.send([header.map(escape).join(","), ...rows].join("\n"));
+});
+
+formsRouter.delete("/submissions/:id", requireRole("ADMIN"), async (req, res) => {
+  try {
+    await prisma.formSubmission.delete({ where: { id: req.params.id } });
+    res.status(204).end();
+  } catch {
+    res.status(404).json({ error: "Not found" });
+  }
+});

package/template/apps/api/src/routes/globalSections.routes.ts

@@ -0,0 +1,43 @@
+import { Router } from "express";
+import { PageNodeSchema } from "@pgcms/shared";
+import { z } from "zod";
+import { prisma } from "../prisma.js";
+import { requireAuth, requireRole } from "../middleware/auth.js";
+
+export const globalSectionsRouter = Router();
+
+const KINDS = new Set(["header", "footer", "goToTop"]);
+
+const UpdateGlobalSectionSchema = z.object({
+  enabled: z.boolean().optional(),
+  content: PageNodeSchema.optional(),
+});
+
+// Public: both global sections in one response — the public site fetches this once
+// per request alongside the page/theme.
+globalSectionsRouter.get("/", async (_req, res) => {
+  const sections = await prisma.globalSection.findMany();
+  res.json(sections);
+});
+
+globalSectionsRouter.put("/:kind", requireAuth, requireRole("ADMIN", "EDITOR"), async (req, res) => {
+  const kind = req.params.kind;
+  if (!KINDS.has(kind)) return res.status(400).json({ error: "kind must be 'header' or 'footer'" });
+
+  const parsed = UpdateGlobalSectionSchema.safeParse(req.body);
+  if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+
+  const section = await prisma.globalSection.upsert({
+    where: { kind },
+    update: {
+      ...(parsed.data.enabled !== undefined ? { enabled: parsed.data.enabled } : {}),
+      ...(parsed.data.content !== undefined ? { content: parsed.data.content as object } : {}),
+    },
+    create: {
+      kind,
+      enabled: parsed.data.enabled ?? false,
+      content: (parsed.data.content ?? { id: "root", type: "root", props: {}, style: {}, children: [] }) as object,
+    },
+  });
+  res.json(section);
+});

package/template/apps/api/src/routes/media.routes.ts

@@ -0,0 +1,77 @@
+import { Router } from "express";
+import multer from "multer";
+import { nanoid } from "nanoid";
+import { prisma } from "../prisma.js";
+import { requireAuth, requireRole } from "../middleware/auth.js";
+import { uploadBuffer, deleteObject } from "../lib/storage/index.js";
+
+export const mediaRouter = Router();
+
+const upload = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: 100 * 1024 * 1024 }, // 100MB, enough for background videos
+  fileFilter: (_req, file, cb) => {
+    const allowed = /^image\/(png|jpeg|jpg|gif|webp|svg\+xml)$|^video\/(mp4|webm|ogg)$/;
+    if (allowed.test(file.mimetype)) cb(null, true);
+    else cb(new Error("Unsupported file type"));
+  },
+});
+
+mediaRouter.use(requireAuth);
+
+mediaRouter.get("/", async (req, res) => {
+  const search = typeof req.query.search === "string" ? req.query.search.trim() : "";
+  const assets = await prisma.mediaAsset.findMany({
+    where: search
+      ? {
+          OR: [
+            { filename: { contains: search, mode: "insensitive" } },
+            { alt: { contains: search, mode: "insensitive" } },
+            { key: { contains: search, mode: "insensitive" } },
+          ],
+        }
+      : undefined,
+    orderBy: { createdAt: "desc" },
+  });
+  res.json(assets);
+});
+
+mediaRouter.post("/", requireRole("ADMIN", "EDITOR"), upload.single("file"), async (req, res) => {
+  if (!req.file) return res.status(400).json({ error: "No file uploaded" });
+
+  const ext = req.file.originalname.split(".").pop() ?? "bin";
+  const key = `${nanoid(16)}.${ext}`;
+  const url = await uploadBuffer(key, req.file.buffer, req.file.mimetype);
+
+  const asset = await prisma.mediaAsset.create({
+    data: {
+      key,
+      url,
+      mimeType: req.file.mimetype,
+      size: req.file.size,
+      filename: req.file.originalname,
+    },
+  });
+  res.status(201).json(asset);
+});
+
+// Metadata-only update — currently just alt text, the accessibility default used
+// anywhere the asset renders without a per-usage alt.
+mediaRouter.put("/:id", requireRole("ADMIN", "EDITOR"), async (req, res) => {
+  const alt = typeof req.body.alt === "string" ? req.body.alt : undefined;
+  if (alt === undefined) return res.status(400).json({ error: "alt (string) is required" });
+  try {
+    const asset = await prisma.mediaAsset.update({ where: { id: req.params.id }, data: { alt } });
+    res.json(asset);
+  } catch {
+    res.status(404).json({ error: "Not found" });
+  }
+});
+
+mediaRouter.delete("/:id", requireRole("ADMIN", "EDITOR"), async (req, res) => {
+  const asset = await prisma.mediaAsset.findUnique({ where: { id: req.params.id } });
+  if (!asset) return res.status(404).json({ error: "Not found" });
+  await deleteObject(asset.key);
+  await prisma.mediaAsset.delete({ where: { id: asset.id } });
+  res.status(204).end();
+});