studiocms 0.1.0-beta.10

package/dist/routes/dashboard/studiocms_api/dashboard/plugins/[plugin].js

@@ -0,0 +1,32 @@
+import { getUserData, verifyUserPermissionLevel } from "studiocms:auth/lib/user";
+import { developerConfig } from "studiocms:config";
+import pluginList from "studiocms:plugins";
+import { simpleResponse } from "../../../../../utils/simpleResponse.js";
+const { testingAndDemoMode } = developerConfig;
+const POST = async (context) => {
+  if (testingAndDemoMode) {
+    return simpleResponse(400, "Testing and demo mode is enabled, this action is disabled.");
+  }
+  const userData = await getUserData(context);
+  if (!userData.isLoggedIn) {
+    return simpleResponse(403, "Unauthorized");
+  }
+  const isAuthorized = await verifyUserPermissionLevel(userData, "admin");
+  if (!isAuthorized) {
+    return simpleResponse(403, "Unauthorized");
+  }
+  const { plugin } = context.params;
+  const filteredPluginList = pluginList.filter((plugin2) => !!plugin2.settingsPage);
+  const pluginData = filteredPluginList.find((pl) => pl.identifier === plugin);
+  if (!pluginData) {
+    return simpleResponse(404, "Plugin not found");
+  }
+  const { settingsPage } = pluginData;
+  if (!settingsPage) {
+    return simpleResponse(404, "Plugin does not have a settings page");
+  }
+  return settingsPage.onSave(context);
+};
+export {
+  POST
+};

package/dist/routes/dashboard/studiocms_api/dashboard/profile.d.ts

@@ -0,0 +1,4 @@
+import type { APIRoute } from 'astro';
+export declare const POST: APIRoute;
+export declare const OPTIONS: APIRoute;
+export declare const ALL: APIRoute;

package/dist/routes/dashboard/studiocms_api/dashboard/profile.js

@@ -0,0 +1,130 @@
+import { hashPassword, verifyPasswordStrength } from "studiocms:auth/lib/password";
+import {
+  getUserData,
+  verifyUserPermissionLevel,
+  verifyUsernameInput
+} from "studiocms:auth/lib/user";
+import { developerConfig } from "studiocms:config";
+import studioCMS_SDK from "studiocms:sdk";
+import { z } from "astro/zod";
+import { simpleResponse } from "../../../../utils/simpleResponse.js";
+const { testingAndDemoMode } = developerConfig;
+const POST = async (context) => {
+  if (testingAndDemoMode) {
+    return simpleResponse(400, "Testing and demo mode is enabled, this action is disabled.");
+  }
+  const userData = await getUserData(context);
+  if (!userData.isLoggedIn) {
+    return simpleResponse(403, "Unauthorized");
+  }
+  const isAuthorized = await verifyUserPermissionLevel(userData, "visitor");
+  if (!isAuthorized) {
+    return simpleResponse(403, "Unauthorized");
+  }
+  const userProfileUpdate = await context.request.json();
+  if (userProfileUpdate.mode === "basic") {
+    const { data: r } = userProfileUpdate;
+    const data = r;
+    if (!data.name) {
+      return simpleResponse(400, "Invalid form data, name is required");
+    }
+    if (!data.email) {
+      return simpleResponse(400, "Invalid form data, email is required");
+    }
+    if (!data.username) {
+      return simpleResponse(400, "Invalid form data, username is required");
+    }
+    if (verifyUsernameInput(data.username) !== true) {
+      return simpleResponse(
+        400,
+        "Username must be between 3 and 20 characters, only contain lowercase letters, numbers, -, and _ as well as not be a commonly used username (admin, root, etc.)"
+      );
+    }
+    const checkEmail = z.coerce.string().email({ message: "Email address is invalid" }).safeParse(data.email);
+    if (!checkEmail.success)
+      return simpleResponse(400, `Invalid email: ${checkEmail.error.message}`);
+    const { usernameSearch, emailSearch } = await studioCMS_SDK.AUTH.user.searchUsersForUsernameOrEmail(data.username, checkEmail.data);
+    if (userData.user?.username !== data.username) {
+      if (usernameSearch.length > 0)
+        return simpleResponse(400, "Invalid username: Username is already in use");
+    }
+    if (userData.user?.email !== data.email) {
+      if (emailSearch.length > 0)
+        return simpleResponse(400, "Invalid email: Email is already in use");
+    }
+    const toUpdate = {
+      name: data.name,
+      email: data.email,
+      username: data.username
+    };
+    try {
+      await studioCMS_SDK.AUTH.user.update(userData.user.id, toUpdate);
+      return simpleResponse(200, "User profile updated successfully");
+    } catch (error) {
+      return simpleResponse(500, "Error updating user profile");
+    }
+  } else if (userProfileUpdate.mode === "password") {
+    const { data: r } = userProfileUpdate;
+    const data = r;
+    const { currentPassword, newPassword, confirmNewPassword } = data;
+    if (!currentPassword) {
+      if (userData.user?.password) {
+        return simpleResponse(400, "Invalid form data, current password is required");
+      }
+    }
+    if (!newPassword) {
+      return simpleResponse(400, "Invalid form data, new password is required");
+    }
+    if (!confirmNewPassword) {
+      return simpleResponse(400, "Invalid form data, confirm new password is required");
+    }
+    if (newPassword !== confirmNewPassword) {
+      return simpleResponse(
+        400,
+        "Invalid form data, new password and confirm new password do not match"
+      );
+    }
+    if (await verifyPasswordStrength(newPassword) !== true) {
+      return simpleResponse(
+        400,
+        'Password must be between 6 and 255 characters, and not be in the <a href="https://haveibeenpwned.com/Passwords" target="_blank">pwned password database</a>.'
+      );
+    }
+    const userUpdate = {
+      password: await hashPassword(newPassword)
+    };
+    try {
+      await studioCMS_SDK.AUTH.user.update(userData.user.id, userUpdate);
+      return simpleResponse(200, "User password updated successfully");
+    } catch (error) {
+      return simpleResponse(500, "Error updating user password");
+    }
+  }
+  return simpleResponse(400, "Invalid form data, mode is required");
+};
+const OPTIONS = async () => {
+  return new Response(null, {
+    status: 204,
+    statusText: "No Content",
+    headers: {
+      Allow: "OPTIONS, POST",
+      "ALLOW-ACCESS-CONTROL-ORIGIN": "*",
+      "Cache-Control": "public, max-age=604800, immutable",
+      Date: (/* @__PURE__ */ new Date()).toUTCString()
+    }
+  });
+};
+const ALL = async () => {
+  return new Response(null, {
+    status: 405,
+    statusText: "Method Not Allowed",
+    headers: {
+      "ACCESS-CONTROL-ALLOW-ORIGIN": "*"
+    }
+  });
+};
+export {
+  ALL,
+  OPTIONS,
+  POST
+};

package/dist/routes/dashboard/studiocms_api/dashboard/reset-password.d.ts

@@ -0,0 +1,4 @@
+import type { APIRoute } from 'astro';
+export declare const POST: APIRoute;
+export declare const OPTIONS: APIRoute;
+export declare const ALL: APIRoute;

package/dist/routes/dashboard/studiocms_api/dashboard/reset-password.js

@@ -0,0 +1,105 @@
+import { verifyPasswordStrength } from "studiocms:auth/lib/password";
+import { developerConfig } from "studiocms:config";
+import studioCMS_SDK from "studiocms:sdk";
+import { simpleResponse } from "../../../../utils/simpleResponse.js";
+const { testingAndDemoMode } = developerConfig;
+const POST = async (ctx) => {
+  if (testingAndDemoMode) {
+    return simpleResponse(400, "Testing and demo mode is enabled, this action is disabled.");
+  }
+  const jsonData = await ctx.request.json();
+  const { token, id, userid, password, confirm_password } = jsonData;
+  if (!token) {
+    return new Response(JSON.stringify({ error: "Invalid form data, token is required" }), {
+      headers: {
+        "content-type": "application/json"
+      },
+      status: 400
+    });
+  }
+  if (!id) {
+    return new Response(JSON.stringify({ error: "Invalid form data, id is required" }), {
+      headers: {
+        "content-type": "application/json"
+      },
+      status: 400
+    });
+  }
+  if (!userid) {
+    return new Response(JSON.stringify({ error: "Invalid form data, userid is required" }), {
+      headers: {
+        "content-type": "application/json"
+      },
+      status: 400
+    });
+  }
+  if (!password) {
+    return new Response(JSON.stringify({ error: "Invalid form data, password is required" }), {
+      headers: {
+        "content-type": "application/json"
+      },
+      status: 400
+    });
+  }
+  if (!confirm_password) {
+    return new Response(
+      JSON.stringify({ error: "Invalid form data, confirm_password is required" }),
+      {
+        headers: {
+          "content-type": "application/json"
+        },
+        status: 400
+      }
+    );
+  }
+  if (password !== confirm_password) {
+    return new Response(JSON.stringify({ error: "Passwords do not match" }), {
+      headers: {
+        "content-type": "application/json"
+      },
+      status: 400
+    });
+  }
+  if (await verifyPasswordStrength(password) !== true) {
+    return simpleResponse(
+      400,
+      'Password must be between 6 and 255 characters, and not be in the <a href="https://haveibeenpwned.com/Passwords" target="_blank">pwned password database</a>.'
+    );
+  }
+  const userUpdate = {
+    password
+  };
+  try {
+    await studioCMS_SDK.AUTH.user.update(userid, userUpdate);
+    await studioCMS_SDK.resetTokenBucket.delete(userid);
+    return simpleResponse(200, "User password updated successfully");
+  } catch (error) {
+    return simpleResponse(500, "Error updating user password");
+  }
+};
+const OPTIONS = async () => {
+  return new Response(null, {
+    status: 204,
+    statusText: "No Content",
+    headers: {
+      Allow: "OPTIONS, POST",
+      "ALLOW-ACCESS-CONTROL-ORIGIN": "*",
+      "Cache-Control": "public, max-age=604800, immutable",
+      Date: (/* @__PURE__ */ new Date()).toUTCString()
+    }
+  });
+};
+const ALL = async () => {
+  return new Response(null, {
+    status: 405,
+    statusText: "Method Not Allowed",
+    headers: {
+      "ACCESS-CONTROL-ALLOW-ORIGIN": "*"
+    }
+  });
+};
+export {
+  ALL,
+  OPTIONS,
+  POST
+};

package/dist/routes/dashboard/studiocms_api/dashboard/search-list.d.ts

@@ -0,0 +1,4 @@
+import type { APIRoute } from 'astro';
+export declare const GET: APIRoute;
+export declare const OPTIONS: APIRoute;
+export declare const ALL: APIRoute;

package/dist/routes/dashboard/studiocms_api/dashboard/search-list.js

@@ -0,0 +1,55 @@
+import studioCMS_SDK_Cache from "studiocms:sdk/cache";
+const initFoldersCache = await studioCMS_SDK_Cache.GET.folderList();
+const initPagesCache = await studioCMS_SDK_Cache.GET.pages();
+const GET = async () => {
+  const { data: folderList } = await studioCMS_SDK_Cache.GET.folderList();
+  const pageList = await studioCMS_SDK_Cache.GET.pages();
+  const searchList = [];
+  for (const folder of folderList) {
+    searchList.push({
+      id: folder.id,
+      name: folder.name,
+      type: "folder"
+    });
+  }
+  for (const page of pageList) {
+    searchList.push({
+      id: page.data.id,
+      name: page.data.title,
+      slug: page.data.slug,
+      isDraft: page.data.draft ?? false,
+      type: "page"
+    });
+  }
+  return new Response(JSON.stringify(searchList), {
+    headers: {
+      "content-type": "application/json"
+    }
+  });
+};
+const OPTIONS = async () => {
+  return new Response(null, {
+    status: 204,
+    statusText: "No Content",
+    headers: {
+      Allow: "OPTIONS, GET",
+      "ALLOW-ACCESS-CONTROL-ORIGIN": "*",
+      "Cache-Control": "public, max-age=604800, immutable",
+      Date: (/* @__PURE__ */ new Date()).toUTCString()
+    }
+  });
+};
+const ALL = async () => {
+  return new Response(null, {
+    status: 405,
+    statusText: "Method Not Allowed",
+    headers: {
+      "ACCESS-CONTROL-ALLOW-ORIGIN": "*"
+    }
+  });
+};
+export {
+  ALL,
+  GET,
+  OPTIONS
+};

package/dist/routes/dashboard/studiocms_api/dashboard/users.d.ts

@@ -0,0 +1,5 @@
+import type { APIRoute } from 'astro';
+export declare const POST: APIRoute;
+export declare const DELETE: APIRoute;
+export declare const OPTIONS: APIRoute;
+export declare const ALL: APIRoute;

package/dist/routes/dashboard/studiocms_api/dashboard/users.js

@@ -0,0 +1,92 @@
+import { getUserData, verifyUserPermissionLevel } from "studiocms:auth/lib/user";
+import { developerConfig } from "studiocms:config";
+import studioCMS_SDK from "studiocms:sdk";
+import { simpleResponse } from "../../../../utils/simpleResponse.js";
+const { testingAndDemoMode } = developerConfig;
+const POST = async (ctx) => {
+  if (testingAndDemoMode) {
+    return simpleResponse(400, "Testing and demo mode is enabled, this action is disabled.");
+  }
+  const userData = await getUserData(ctx);
+  if (!userData.isLoggedIn) {
+    return simpleResponse(403, "Unauthorized");
+  }
+  const isAuthorized = await verifyUserPermissionLevel(userData, "admin");
+  if (!isAuthorized) {
+    return simpleResponse(403, "Unauthorized");
+  }
+  const jsonData = await ctx.request.json();
+  const { id, rank } = jsonData;
+  if (!id || !rank) {
+    return simpleResponse(400, "Invalid request");
+  }
+  const insertData = {
+    user: id,
+    rank
+  };
+  const updatedData = await studioCMS_SDK.UPDATE.permissions(insertData);
+  if (!updatedData) {
+    return simpleResponse(400, "Failed to update user rank");
+  }
+  return simpleResponse(200, "User rank updated successfully");
+};
+const DELETE = async (ctx) => {
+  if (testingAndDemoMode) {
+    return simpleResponse(400, "Testing and demo mode is enabled, this action is disabled.");
+  }
+  const userData = await getUserData(ctx);
+  if (!userData.isLoggedIn) {
+    return simpleResponse(403, "Unauthorized");
+  }
+  const isAuthorized = await verifyUserPermissionLevel(userData, "admin");
+  if (!isAuthorized) {
+    return simpleResponse(403, "Unauthorized");
+  }
+  const jsonData = await ctx.request.json();
+  const { userId, username, usernameConfirm } = jsonData;
+  if (!userId || !username || !usernameConfirm) {
+    return simpleResponse(400, "Invalid request");
+  }
+  if (username !== usernameConfirm) {
+    return simpleResponse(400, "Username does not match");
+  }
+  try {
+    const response = await studioCMS_SDK.DELETE.user(userId);
+    if (!response) {
+      return simpleResponse(400, "Failed to delete user");
+    }
+    if (response.status === "error") {
+      return simpleResponse(400, response.message);
+    }
+    return simpleResponse(200, response.message);
+  } catch (error) {
+    return simpleResponse(400, "Failed to delete user");
+  }
+};
+const OPTIONS = async () => {
+  return new Response(null, {
+    status: 204,
+    statusText: "No Content",
+    headers: {
+      Allow: "OPTIONS, POST, DELETE",
+      "ALLOW-ACCESS-CONTROL-ORIGIN": "*",
+      "Cache-Control": "public, max-age=604800, immutable",
+      Date: (/* @__PURE__ */ new Date()).toUTCString()
+    }
+  });
+};
+const ALL = async () => {
+  return new Response(null, {
+    status: 405,
+    statusText: "Method Not Allowed",
+    headers: {
+      "ACCESS-CONTROL-ALLOW-ORIGIN": "*"
+    }
+  });
+};
+export {
+  ALL,
+  DELETE,
+  OPTIONS,
+  POST
+};

package/dist/routes/dashboard/studiocms_api/dashboard/verify-session.d.ts

@@ -0,0 +1,2 @@
+import type { APIRoute } from 'astro';
+export declare const POST: APIRoute;

package/dist/routes/dashboard/studiocms_api/dashboard/verify-session.js

@@ -0,0 +1,72 @@
+import {
+  deleteSessionTokenCookie,
+  sessionCookieName,
+  validateSessionToken
+} from "studiocms:auth/lib/session";
+import { StudioCMSRoutes } from "studiocms:lib";
+import studioCMS_SDK from "studiocms:sdk";
+import { simpleResponse } from "../../../../utils/simpleResponse.js";
+const POST = async (context) => {
+  const { cookies } = context;
+  const sessionToken = cookies.get(sessionCookieName)?.value ?? null;
+  if (!sessionToken) {
+    return simpleResponse(400, "No session token found");
+  }
+  const { session, user } = await validateSessionToken(sessionToken);
+  if (session === null) {
+    deleteSessionTokenCookie(context);
+    return simpleResponse(400, "Invalid session token");
+  }
+  if (!user || user === null) {
+    return simpleResponse(400, "Invalid user");
+  }
+  const result = await studioCMS_SDK.AUTH.permission.currentStatus(user.id);
+  if (!result) {
+    return simpleResponse(400, "Failed to get user permission level");
+  }
+  let permissionLevel = "unknown";
+  switch (result.rank) {
+    case "owner":
+      permissionLevel = "owner";
+      break;
+    case "admin":
+      permissionLevel = "admin";
+      break;
+    case "editor":
+      permissionLevel = "editor";
+      break;
+    case "visitor":
+      permissionLevel = "visitor";
+      break;
+    default:
+      permissionLevel = "unknown";
+      break;
+  }
+  return new Response(
+    JSON.stringify({
+      isLoggedIn: true,
+      user: {
+        id: user.id,
+        username: user.username,
+        email: user.email,
+        avatar: user.avatar,
+        name: user.name
+      },
+      permissionLevel,
+      routes: {
+        logout: StudioCMSRoutes.authLinks.logoutURL,
+        userProfile: StudioCMSRoutes.mainLinks.userProfile,
+        contentManagement: StudioCMSRoutes.mainLinks.contentManagement,
+        dashboardIndex: StudioCMSRoutes.mainLinks.dashboardIndex
+      }
+    }),
+    {
+      headers: {
+        "Content-Type": "application/json"
+      }
+    }
+  );
+};
+export {
+  POST
+};