nca-ai-cms-astro-plugin 1.0.16 → 1.0.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nca-ai-cms-astro-plugin",
-  "version": "1.0.16",
+  "version": "1.0.17",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",

package/src/api/db/download.ts

@@ -0,0 +1,35 @@
+import type { APIRoute } from 'astro';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { jsonError } from '../_utils';
+
+function getDbPath(): string {
+  const envPath = process.env.ASTRO_DATABASE_FILE;
+  if (envPath) {
+    const resolved = path.resolve(process.cwd(), envPath);
+    if (!resolved.startsWith(process.cwd())) {
+      throw new Error('Invalid database path');
+    }
+    return resolved;
+  }
+  return path.join(process.cwd(), '.astro', 'content.db');
+}
+
+export const GET: APIRoute = async () => {
+  try {
+    const dbPath = getDbPath();
+    const dbBuffer = await fs.readFile(dbPath);
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
+
+    return new Response(dbBuffer, {
+      status: 200,
+      headers: {
+        'Content-Type': 'application/x-sqlite3',
+        'Content-Disposition': `attachment; filename="content-${timestamp}.db"`,
+        'Content-Length': String(dbBuffer.length),
+      },
+    });
+  } catch {
+    return jsonError('Database file not found', 404);
+  }
+};

package/src/api/db/upload.ts

@@ -0,0 +1,74 @@
+import type { APIRoute } from 'astro';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { jsonResponse, jsonError } from '../_utils';
+
+const MAX_DB_SIZE = 50 * 1024 * 1024; // 50 MB
+
+function getDbPath(): string {
+  const envPath = process.env.ASTRO_DATABASE_FILE;
+  if (envPath) {
+    const resolved = path.resolve(process.cwd(), envPath);
+    if (!resolved.startsWith(process.cwd())) {
+      throw new Error('Invalid database path');
+    }
+    return resolved;
+  }
+  return path.join(process.cwd(), '.astro', 'content.db');
+}
+
+export const POST: APIRoute = async ({ request }) => {
+  try {
+    const dbPath = getDbPath();
+    const contentType = request.headers.get('content-type') || '';
+
+    let dbBuffer: Buffer;
+
+    if (contentType.includes('multipart/form-data')) {
+      const formData = await request.formData();
+      const file = formData.get('database') as File | null;
+
+      if (!file) {
+        return jsonError('No database file provided. Use field name "database".', 400);
+      }
+
+      if (file.size > MAX_DB_SIZE) {
+        return jsonError('File too large. Maximum 50 MB.', 413);
+      }
+
+      const arrayBuffer = await file.arrayBuffer();
+      dbBuffer = Buffer.from(arrayBuffer);
+    } else if (contentType.includes('application/octet-stream')) {
+      const arrayBuffer = await request.arrayBuffer();
+      dbBuffer = Buffer.from(arrayBuffer);
+
+      if (dbBuffer.length > MAX_DB_SIZE) {
+        return jsonError('File too large. Maximum 50 MB.', 413);
+      }
+    } else {
+      return jsonError('Invalid content type. Use multipart/form-data or application/octet-stream.', 400);
+    }
+
+    // SQLite validation
+    const header = dbBuffer.subarray(0, 16).toString('utf8');
+    if (!header.startsWith('SQLite format 3')) {
+      return jsonError('Invalid file: not a SQLite database.', 400);
+    }
+
+    // Backup current DB before overwriting
+    try {
+      await fs.copyFile(dbPath, `${dbPath}.backup`);
+    } catch {
+      // No existing DB to backup
+    }
+
+    await fs.writeFile(dbPath, dbBuffer);
+
+    return jsonResponse({
+      success: true,
+      size: dbBuffer.length,
+    });
+  } catch {
+    return jsonError('Database upload failed', 500);
+  }
+};

package/src/components/editor/SettingsTab.tsx

@@ -289,6 +289,50 @@ export function SettingsTab() {
         ))}
       </div>
 
+      {/* Database Management — only on Website tab */}
+      {activeSubTab === 'website' && (
+        <div style={{ ...styles.plannerForm, flexDirection: 'row', alignItems: 'center' }}>
+          <span style={{ ...styles.label, marginRight: 'auto' }}>Datenbank-Verwaltung</span>
+          <a
+            href="/api/db/download"
+            style={{ ...styles.editButton, textDecoration: 'none', display: 'inline-flex', alignItems: 'center', gap: '0.4rem' }}
+          >
+            ↓ DB herunterladen
+          </a>
+          <label style={{ ...styles.editButton, cursor: 'pointer', display: 'inline-flex', alignItems: 'center', gap: '0.4rem', margin: 0 }}>
+            ↑ DB hochladen
+            <input
+              type="file"
+              accept=".db,.sqlite,.sqlite3"
+              style={styles.srOnly}
+              onChange={async (e) => {
+                const file = e.target.files?.[0];
+                if (!file) return;
+                if (!confirm(`Datenbank "${file.name}" hochladen? Die aktuelle DB wird ueberschrieben.`)) {
+                  e.target.value = '';
+                  return;
+                }
+                const formData = new FormData();
+                formData.append('database', file);
+                try {
+                  const res = await fetch('/api/db/upload', { method: 'POST', body: formData });
+                  const data = await res.json();
+                  if (res.ok) {
+                    alert('Datenbank hochgeladen. Seite wird neu geladen.');
+                    window.location.reload();
+                  } else {
+                    alert('Fehler: ' + (data.error || 'Upload fehlgeschlagen'));
+                  }
+                } catch {
+                  alert('Upload fehlgeschlagen');
+                }
+                e.target.value = '';
+              }}
+            />
+          </label>
+        </div>
+      )}
+
       {loading && (
         <div style={styles.loadingBox}>Einstellungen werden geladen...</div>
       )}

package/src/index.ts

@@ -181,6 +181,18 @@ export default function ncaAiCms(
           prerender: false,
         });
 
+        // Inject DB management routes (auth-protected via middleware)
+        injectRoute({
+          pattern: '/api/db/download',
+          entrypoint: 'nca-ai-cms-astro-plugin/api/db/download.ts',
+          prerender: false,
+        });
+        injectRoute({
+          pattern: '/api/db/upload',
+          entrypoint: 'nca-ai-cms-astro-plugin/api/db/upload.ts',
+          prerender: false,
+        });
+
         // Inject auth routes
         injectRoute({
           pattern: '/api/auth/login',

package/update.md

@@ -1,3 +1,17 @@
+# v1.0.17
+
+## Feature: Database download/upload via Editor UI
+- New GET `/api/db/download` endpoint — exports SQLite database as file download with timestamp
+- New POST `/api/db/upload` endpoint — imports SQLite database with validation and backup
+- Download/Upload buttons in Editor → Einstellungen → Website tab
+- Path traversal protection: database path validated against project root
+- File size limit: 50 MB max upload
+- SQLite header validation on upload (rejects non-SQLite files)
+- Automatic backup of current DB before overwrite (`content.db.backup`)
+- Both routes auth-protected via existing middleware
+
+---
+
 # v1.0.16
 
 ## Feature: Pages content type with flat URL structure