opacacms 0.1.0

package/src/schema/global.ts

@@ -0,0 +1,145 @@
+import type { ApiKey } from "@better-auth/api-key";
+import type { Session, User } from "better-auth";
+import { icons } from "lucide-react";
+import type { AccessConfig, Global as GlobalType, IconName } from "../types";
+import { type FieldBuilder, VirtualFieldBuilder } from "./fields";
+import type { InferFields } from "./infer";
+
+export type Global = GlobalType;
+
+/**
+ * A Fluent API Builder for defining OpacaCMS Globals.
+ */
+export class GlobalBuilder<TFields extends Record<string, any> = {}> {
+  protected config: Partial<Global> = {};
+  protected _fields: FieldBuilder<any, any>[] = [];
+
+  constructor(slug: string) {
+    this.config.slug = slug;
+    this.config.fields = [];
+    this.config.timestamps = true;
+  }
+
+  /**
+   * Enables or disables timestamps (createdAt, updatedAt) for this global.
+   * Defaults to true.
+   */
+  public timestamps(enabled: boolean | { createdAt?: string; updatedAt?: string } = true): this {
+    this.config.timestamps = enabled;
+    return this;
+  }
+
+  /**
+   * Sets the label for this global in the Admin UI.
+   */
+  public label(label: string): this {
+    this.config.label = label;
+    return this;
+  }
+
+  /**
+   * Sets the Lucide icon for this global.
+   */
+  public icon(iconName: IconName): this {
+    this.config.icon = iconName;
+    return this;
+  }
+
+  /**
+   * Defines the fields for this global schema.
+   */
+  public fields<T extends readonly any[]>(fields: [...T]): GlobalBuilder<InferFields<T>> {
+    const nextBuilder = new GlobalBuilder<InferFields<T>>(this.config.slug!);
+    nextBuilder.config = { ...this.config };
+    nextBuilder._fields = [...fields];
+    nextBuilder.config.fields = fields.map((f) => f.build());
+    return nextBuilder as any; // Cast safely due to generic transformation
+  }
+
+  /**
+   * Configuration for who can read and update this global.
+   */
+  public access(rules: AccessConfig): this {
+    this.config.access = rules;
+    return this;
+  }
+
+  /**
+   * Defines a virtual/computed field with full type inference of the current global data.
+   */
+  public virtual<TName extends string, TReturn = any>(
+    name: TName,
+    options: {
+      label?: string;
+      resolve: (args: {
+        data: TFields;
+        req: any;
+        user: any;
+        session: any;
+        apiKey?: any;
+      }) => TReturn | Promise<TReturn>;
+      returnType?: "string" | "number" | "boolean" | "json";
+    },
+  ): GlobalBuilder<TFields & { [K in TName]: TReturn }> {
+    const builder = new VirtualFieldBuilder<TName, TFields>(name);
+    if (options.label) builder.label(options.label);
+    if (options.resolve) builder.resolve(options.resolve as any);
+    if (options.returnType) builder.returnType(options.returnType);
+
+    const nextBuilder = new GlobalBuilder<TFields & { [K in TName]: TReturn }>(this.config.slug!);
+    nextBuilder.config = { ...this.config };
+    nextBuilder._fields = [...this._fields, builder];
+    // Update raw fields array
+    nextBuilder.config.fields = nextBuilder._fields.map((f) => f.build());
+    return nextBuilder;
+  }
+
+  /**
+   * Alias for .virtual()
+   */
+  public computed<TName extends string, TReturn = any>(
+    name: TName,
+    options: {
+      label?: string;
+      resolve: (args: {
+        data: TFields;
+        req: any;
+        user: any;
+        session: any;
+        apiKey?: any;
+      }) => TReturn | Promise<TReturn>;
+      returnType?: "string" | "number" | "boolean" | "json";
+    },
+  ): GlobalBuilder<TFields & { [K in TName]: TReturn }> {
+    return this.virtual<TName, TReturn>(name, options);
+  }
+
+  /**
+   * Extends the global with arbitrary configuration.
+   */
+  public extend(opts: Record<string, any>): this {
+    this.config = { ...this.config, ...opts };
+    return this;
+  }
+
+  /**
+   * Compiles the builder down into the raw Global object expected by OpacaCMS.
+   */
+  public build(): Global {
+    if (!this.config.slug) {
+      throw new Error("Globals must have a slug.");
+    }
+    if (!this.config.fields || this.config.fields.length === 0) {
+      throw new Error(`Global "${this.config.slug}" must have at least one field.`);
+    }
+
+    return this.config as Global;
+  }
+}
+
+/**
+ * Singleton factory for creating Globals.
+ */
+export const Global = {
+  create: (slug: string) => new GlobalBuilder(slug),
+};

package/src/schema/index.ts

@@ -0,0 +1,4 @@
+export { Collection, CollectionBuilder } from "./collection";
+export { Field, FieldBuilder } from "./fields/index";
+export { Global, GlobalBuilder } from "./global";
+export type { AccessRules, InferFields } from "./infer";

package/src/schema/infer.ts

@@ -0,0 +1,72 @@
+import type { FieldBuilder } from "./fields/base";
+
+/**
+ * Helper to convert a union of types into an intersection.
+ */
+type UnionToIntersection<U> = (U extends any ? (k: U) => void : never) extends (k: infer I) => void
+  ? I
+  : never;
+
+type Flatten<T> = { [K in keyof T]: T[K] } & {};
+
+/**
+ * Extracts the TName and TValue from a single FieldBuilder.
+ */
+export type InferField<T extends FieldBuilder<any, any, any, any>> =
+  T extends FieldBuilder<any, any, infer TValue, any> ? TValue : any;
+
+/**
+ * Internal helper to distribute over a union of FieldBuilders.
+ * Matches against the class generics for maximum reliability.
+ */
+type ProcessField<F> =
+  F extends FieldBuilder<"group", infer N, any, infer Sub>
+    ? N extends string
+      ? { [K in N]: Sub extends readonly any[] ? InferFields<Sub> : unknown }
+      : {}
+    : F extends FieldBuilder<"array", infer N, any, infer Sub>
+      ? N extends string
+        ? { [K in N]: Sub extends readonly any[] ? InferFields<Sub>[] : unknown[] }
+        : {}
+      : F extends FieldBuilder<"row" | "collapsible", any, any, infer Sub>
+        ? Sub extends readonly any[]
+          ? InferFields<Sub>
+          : {}
+        : F extends FieldBuilder<"tabs", any, any, infer Sub>
+          ? Sub extends readonly any[]
+            ? UnionToIntersection<
+                Sub[number] extends { fields: infer S }
+                  ? S extends readonly any[]
+                    ? InferFields<S>
+                    : {}
+                  : {}
+              >
+            : {}
+          : F extends FieldBuilder<any, infer N, infer V, any>
+            ? N extends string
+              ? N extends ""
+                ? {}
+                : { [K in N]: V }
+              : {}
+            : {};
+
+/**
+ * Magically maps an array of FieldBuilders into a recursive object type representation.
+ *
+ * Performance Optimized:
+ * - Uses ProcessField helper for guaranteed union distribution.
+ * - UnionToIntersection merges individual field objects into a clean intersection.
+ */
+export type InferFields<T extends readonly any[]> = Flatten<
+  UnionToIntersection<ProcessField<T[number]>>
+>;
+
+/**
+ * Access rules with strongly typed hooks.
+ */
+export interface AccessRules<TFields extends Record<string, any>> {
+  read?: (args: { user: any; data?: TFields }) => boolean | Promise<boolean>;
+  create?: (args: { user: any; data: TFields }) => boolean | Promise<boolean>;
+  update?: (args: { user: any; data: TFields }) => boolean | Promise<boolean>;
+  delete?: (args: { user: any; data?: TFields }) => boolean | Promise<boolean>;
+}

package/src/server/admin-router.ts

@@ -0,0 +1,20 @@
+import { Hono } from "hono";
+import type { Auth } from "../auth";
+import { getSystemCollections } from "../db/system-schema";
+import type { OpacaConfig } from "../types";
+import { createAdminHandlers } from "./admin";
+import { adminMiddleware } from "./middlewares/admin";
+import type { ApiContextVariables } from "./router";
+
+export function createAdminRouter(config: OpacaConfig, state: { auth: Auth | undefined }) {
+  const adminRouter = new Hono<{ Variables: ApiContextVariables }>();
+  const adminHandlers = createAdminHandlers(config, () => state.auth);
+
+  adminRouter.get("/collections", adminMiddleware, adminHandlers.getCollections);
+  adminRouter.get("/metadata", adminHandlers.getMetadata);
+  adminRouter.get("/config", adminMiddleware, adminHandlers.getConfig);
+  adminRouter.get("/setup", adminHandlers.getSetupStatus);
+  adminRouter.post("/api-key/create", adminMiddleware, adminHandlers.createApiKey);
+
+  return adminRouter;
+}

package/src/server/admin.ts

@@ -0,0 +1,142 @@
+import type { Context } from "hono";
+import type { Auth } from "../auth";
+import { sanitizeConfig } from "../config-utils";
+import type { OpacaConfig } from "../types";
+
+type AdminHandlers = {
+  getMetadata: (c: Context) => Response;
+  getCollections: (c: Context) => Response;
+  getConfig: (c: Context) => Promise<Response>;
+  getSetupStatus: (c: Context) => Promise<Response>;
+  createApiKey: (c: Context) => Promise<Response>;
+};
+
+/**
+ * Creates the admin handlers for the OpacaCMS.
+ * @param config The OpacaCMS configuration.
+ * @param getAuth A function that returns the authentication instance.
+ * @returns An object containing the admin handlers for hono integration.
+ */
+export function createAdminHandlers(
+  config: OpacaConfig,
+  getAuth: () => Auth | undefined,
+): AdminHandlers {
+  const getMetadata = (c: Context) => {
+    return c.json(sanitizeConfig(config));
+  };
+
+  const getCollections = (c: Context) => {
+    // Return collections with field details simplified if needed, or full config
+    // For now returning config.collections directly.
+    // Ideally we might strip internal server-only properties if any.
+
+    const collections = [...config.collections];
+
+    // Auto-inject system collections (auth + assets) if relevant features are enabled
+    const supportsAuth =
+      config.db.name === "sqlite" || config.db.name === "postgres" || config.db.name === "d1";
+
+    const { getSystemCollections } = require("../db/system-schema");
+    const systemCollections = getSystemCollections();
+
+    for (const systemCol of systemCollections) {
+      const isAsset = systemCol.slug === "_opaca_assets";
+      const isAuth = ["_users", "_sessions", "_accounts", "_verifications", "_api_keys"].includes(
+        systemCol.slug,
+      );
+
+      if ((isAsset && config.storages) || (isAuth && supportsAuth)) {
+        if (!collections.find((col) => col.slug === systemCol.slug)) {
+          collections.push({
+            ...systemCol,
+            admin: true, // Mark as system/admin collection
+          });
+        }
+      }
+    }
+
+    // Filter collections to returned only what's allowed in the UI
+    const filteredCollections = collections.filter((c) => !c.hidden);
+
+    return c.json({
+      collections: filteredCollections,
+      globals: config.globals,
+    });
+  };
+
+  const getConfig = async (c: Context) => {
+    return c.json({
+      serverURL: config.serverURL,
+      admin: config.admin,
+    });
+  };
+
+  const getSetupStatus = async (c: Context) => {
+    try {
+      let userCount = 0;
+      try {
+        userCount = await config.db.count("_users");
+      } catch (_e) {
+        // Fallback: the "_users" collection might not be in the OpacaCMS schema
+        const result = (await config.db.unsafe("SELECT COUNT(*) as count FROM _users")) as any;
+        const rows = result?.results || result || [];
+        userCount = Number(rows[0]?.count || rows[0]?.["count(*)"] || 0);
+      }
+
+      return c.json({
+        initialized: userCount > 0,
+      });
+    } catch (e) {
+      console.error("[OpacaCMS] Failed to check setup status:", e);
+
+      return c.json({
+        initialized: false,
+      });
+    }
+  };
+
+  const createApiKey = async (c: Context) => {
+    const auth = getAuth();
+    if (!auth) {
+      return c.json({ message: "Auth not initialized" }, 503);
+    }
+
+    const user = c.get("user");
+    if (!user) {
+      return c.json({ message: "Unauthorized" }, 401);
+    }
+
+    try {
+      const { name, expiresIn, permissions } = await c.req.json();
+
+      if (!name || typeof name !== "string") {
+        return c.json({ message: "Invalid or missing 'name'" }, 400);
+      }
+
+      const res = await auth.api.createApiKey({
+        body: {
+          name,
+          expiresIn: expiresIn ? Number(expiresIn) : undefined,
+          permissions,
+          userId: user.id,
+        },
+      });
+
+      return c.json(res);
+      // biome-ignore lint/suspicious/noExplicitAny: error shoulb be typed as any
+    } catch (err: any) {
+      console.error("[OpacaCMS] Failed to create API key:", err);
+      // Return full error details if possible
+      const message = err?.message || (typeof err === "string" ? err : JSON.stringify(err));
+      return c.json({ message, detail: err }, 400);
+    }
+  };
+
+  return {
+    getMetadata,
+    getCollections,
+    getConfig,
+    getSetupStatus,
+    createApiKey,
+  };
+}

package/src/server/assets.ts

@@ -0,0 +1,306 @@
+import type { Context } from "hono";
+import type { FileRecord } from "../storage/types";
+import type { OpacaConfig } from "../types";
+
+export function createAssetsHandlers(config: OpacaConfig) {
+  return {
+    async upload(c: Context) {
+      const user = c.get("user");
+      // Security: Only allow authenticated users to upload to the global registry
+      if (!user) return c.json({ error: "Unauthorized" }, 401);
+
+      const bucket = c.req.query("bucket") || "default";
+      if (!config.storages) return c.json({ error: "Storage not configured" }, 500);
+
+      const storageAdapter = config.storages[bucket];
+      if (!storageAdapter) {
+        return c.json({ error: `Bucket '${bucket}' not found` }, 404);
+      }
+
+      try {
+        // Auto-patch missing columns for DX
+        try {
+          if (config.db.name === "sqlite" || config.db.name === "d1") {
+            const tableInfo = (await config.db.unsafe(`PRAGMA table_info(_opaca_assets)`)) as any[];
+            const columns = tableInfo.map((c) => c.name);
+            if (!columns.includes("folder"))
+              await config.db.unsafe(`ALTER TABLE _opaca_assets ADD COLUMN folder TEXT`);
+            if (!columns.includes("alt_text"))
+              await config.db.unsafe(`ALTER TABLE _opaca_assets ADD COLUMN alt_text TEXT`);
+            if (!columns.includes("caption"))
+              await config.db.unsafe(`ALTER TABLE _opaca_assets ADD COLUMN caption TEXT`);
+          } else if (config.db.name === "postgres") {
+            const checkCols = (await config.db.unsafe(`
+              SELECT column_name FROM information_schema.columns 
+              WHERE table_name = '_opaca_assets' AND column_name IN ('folder', 'alt_text', 'caption')
+             `)) as any[];
+            const existing = checkCols.map((c) => c.column_name);
+            if (!existing.includes("folder"))
+              await config.db.unsafe(`ALTER TABLE _opaca_assets ADD COLUMN folder TEXT`);
+            if (!existing.includes("alt_text"))
+              await config.db.unsafe(`ALTER TABLE _opaca_assets ADD COLUMN "alt_text" TEXT`);
+            if (!existing.includes("caption"))
+              await config.db.unsafe(`ALTER TABLE _opaca_assets ADD COLUMN caption TEXT`);
+          }
+        } catch (e) {
+          console.error("Auto-patch columns failed", e);
+        }
+
+        // Read the folder before upload so we can prefix the storage key
+        const folder = c.req.query("folder") || null;
+        const keyPrefix = folder ? `${folder}/` : "";
+        const now = new Date().toISOString();
+
+        const formData = await c.req.parseBody({ all: true });
+        const fileRaw = formData["file"];
+        const file = (Array.isArray(fileRaw) ? fileRaw[0] : fileRaw) as any;
+
+        if (!file || (typeof file !== "object" && typeof file !== "string")) {
+          return c.json({ error: "No file provided" }, 400);
+        }
+
+        const fileName = file.name || "unnamed";
+        const fileType = file.type || "application/octet-stream";
+        const fileSize = file.size || 0;
+
+        const fileRecord: FileRecord = {
+          filename: fileName,
+          original_filename: fileName,
+          mime_type: fileType,
+          filesize: fileSize,
+          stream: typeof file.stream === "function" ? file.stream() : new Response(file).body!,
+        };
+
+        // Pipe stream directly to adapter, passing the folder as a key prefix
+        const uploadedFileData = await storageAdapter.upload(fileRecord, {
+          generateUniqueName: true,
+          keyPrefix,
+        });
+
+        // Ensure the stored key in the DB reflects the folder prefix
+        const storedKey = keyPrefix + uploadedFileData.filename;
+
+        try {
+          // Insert into hidden registry table
+          const assetId = (
+            globalThis.crypto?.randomUUID?.() || Math.random().toString(36).slice(2)
+          ).replace(/-/g, "");
+
+          await config.db.create("_opaca_assets", {
+            id: assetId,
+            key: storedKey,
+            filename: fileName,
+            originalFilename: fileName,
+            mimeType: uploadedFileData.mime_type,
+            filesize: uploadedFileData.filesize,
+            bucket,
+            folder,
+            altText: null,
+            caption: null,
+            uploadedBy: user.id || null,
+          });
+
+          // Return the standardized JSON payload for embedded file fields
+          return c.json(
+            {
+              assetId,
+              ...uploadedFileData,
+              key: storedKey,
+            },
+            201,
+          );
+        } catch (dbError: any) {
+          // Rollback mechanism
+          console.error(
+            `[OpacaCMS] Registry insert failed, rolling back physical file upload: ${storedKey}`,
+          );
+          storageAdapter.delete(storedKey).catch((cleanupError: any) => {
+            console.error(
+              `[OpacaCMS] CRITICAL: Failed to clean up orphaned file ${storedKey}!`,
+              cleanupError,
+            );
+          });
+          throw dbError;
+        }
+      } catch (error: any) {
+        return c.json({ error: error.message }, 400);
+      }
+    },
+
+    async list(c: Context) {
+      const user = c.get("user");
+      if (!user || (user.role !== "admin" && !user.role?.includes("admin"))) {
+        return c.json({ error: "Unauthorized" }, 401);
+      }
+
+      const bucket = c.req.query("bucket") || "all";
+      const page = parseInt(c.req.query("page") || "1", 10);
+      const limit = parseInt(c.req.query("limit") || "20", 10);
+      const offset = (page - 1) * limit;
+      const folder = c.req.query("folder") || null;
+
+      try {
+        let query: any = {};
+        if (bucket !== "all") query.bucket = bucket;
+
+        if (folder !== null && folder !== "") {
+          query.folder = folder;
+        } else {
+          // Handle root folder (NULL or empty string)
+          // If we have a bucket filter, we should combine it
+          if (bucket !== "all") {
+            query = {
+              and: [{ bucket: bucket }, { or: [{ folder: null }, { folder: "" }] }],
+            };
+          } else {
+            query = { or: [{ folder: null }, { folder: "" }] };
+          }
+        }
+
+        const result = await config.db.find<any>("_opaca_assets", query, {
+          page,
+          limit,
+          sort: "created_at:desc",
+        });
+
+        const rows = result.docs;
+        const total = result.totalDocs;
+
+        // Discover subfolders (isolated by bucket)
+        let folderRows: any[] = [];
+        const bucketFilter = bucket !== "all" ? `AND bucket = ?` : "";
+        const bucketParam = bucket !== "all" ? [bucket] : [];
+
+        if (config.db.name === "postgres") {
+          const pgBucketFilter = bucketFilter.replace("?", "$1");
+          if (folder === null || folder === "") {
+            folderRows = (await config.db.unsafe(
+              `SELECT DISTINCT split_part(folder, '/', 1) as subfolder, bucket FROM _opaca_assets WHERE folder IS NOT NULL AND folder != '' ${pgBucketFilter}`,
+              bucketParam,
+            )) as any[];
+          } else {
+            folderRows = (await config.db.unsafe(
+              `SELECT DISTINCT split_part(substring(folder from length($1) + 2), '/', 1) as subfolder, bucket FROM _opaca_assets WHERE folder LIKE $2 ${bucket !== "all" ? "AND bucket = $3" : ""}`,
+              [folder, `${folder}/%`, ...bucketParam],
+            )) as any[];
+          }
+        } else {
+          if (folder === null || folder === "") {
+            folderRows = (await config.db.unsafe(
+              `
+              SELECT DISTINCT 
+                CASE 
+                  WHEN INSTR(folder, '/') > 0 THEN SUBSTR(folder, 1, INSTR(folder, '/') - 1)
+                  ELSE folder 
+                END as subfolder,
+                bucket
+              FROM _opaca_assets WHERE folder IS NOT NULL AND folder != '' ${bucketFilter}
+            `,
+              bucketParam,
+            )) as any[];
+          } else {
+            const skipLen = folder.length + 2;
+            folderRows = (await config.db.unsafe(
+              `
+              SELECT DISTINCT 
+                CASE 
+                  WHEN INSTR(SUBSTR(folder, ?), '/') > 0 THEN SUBSTR(SUBSTR(folder, ?), 1, INSTR(SUBSTR(folder, ?), '/') - 1)
+                  ELSE SUBSTR(folder, ?)
+                END as subfolder,
+                bucket
+              FROM _opaca_assets WHERE folder LIKE ? ${bucketFilter}
+            `,
+              [skipLen, skipLen, skipLen, skipLen, `${folder}/%`, ...bucketParam],
+            )) as any[];
+          }
+        }
+
+        // Group shared folders by name
+        const folderMap: Record<string, string[]> = {};
+        for (const row of folderRows) {
+          if (!row.subfolder) continue;
+          if (!folderMap[row.subfolder]) folderMap[row.subfolder] = [];
+          if (!folderMap[row.subfolder]?.includes(row.bucket)) {
+            folderMap[row.subfolder]?.push(row.bucket);
+          }
+        }
+
+        const folders = Object.entries(folderMap).map(([name, buckets]) => ({
+          name,
+          buckets,
+        }));
+
+        return c.json({
+          docs: rows,
+          folders,
+          totalDocs: total,
+          limit,
+          page,
+          totalPages: Math.ceil(total / limit),
+        });
+      } catch (e: any) {
+        return c.json({ error: e.message }, 500);
+      }
+    },
+
+    async presign(c: Context) {
+      const user = c.get("user");
+      if (!user) return c.json({ error: "Unauthorized" }, 401);
+
+      const { filename, bucket = "default", operation = "write" } = await c.req.json();
+      if (!config.storages || !config.storages[bucket]) {
+        return c.json({ error: "Bucket not found" }, 404);
+      }
+
+      const adapter = config.storages[bucket];
+      if (!adapter.generatePresignedUrl) {
+        return c.json({ error: "Adapter does not support presigned URLs" }, 400);
+      }
+
+      try {
+        const url = await adapter.generatePresignedUrl(
+          filename,
+          operation as "read" | "write",
+          3600,
+        );
+        return c.json({ uploadUrl: url, filename });
+      } catch (e: any) {
+        return c.json({ error: e.message }, 500);
+      }
+    },
+
+    async serve(c: Context) {
+      const id = c.req.param("id");
+
+      try {
+        const asset = await config.db.findOne<any>("_opaca_assets", { id });
+
+        if (!asset) {
+          return c.json({ error: "Asset not found" }, 404);
+        }
+
+        const bucket = asset.bucket || "default";
+        if (!config.storages || !config.storages[bucket]) {
+          return c.json({ error: "Storage bucket not configured" }, 500);
+        }
+
+        const adapter = config.storages[bucket];
+        if (!adapter.download) {
+          return c.json({ error: "Storage adapter does not support direct downloads" }, 400);
+        }
+
+        const stream = await adapter.download(asset.key || asset.filename);
+
+        c.header("Content-Type", asset.mimeType || "application/octet-stream");
+        c.header("Content-Length", asset.filesize.toString());
+        // Cache for 1 day
+        c.header("Cache-Control", "public, max-age=86400");
+
+        return c.body(stream as any);
+      } catch (e: any) {
+        console.error(`[OpacaCMS] Failed to serve asset ${id}:`, e);
+        return c.json({ error: e.message }, 500);
+      }
+    },
+  };
+}