studiocms 0.2.0 → 0.4.0

package/frontend/pages/studiocms_api/_handlers/dashboard/_shared.ts

@@ -0,0 +1,57 @@
+import { DashboardAPIError } from '@withstudiocms/api-spec/dashboard';
+import { Schema } from 'effect';
+
+/**
+ * Shared database error handlers for the Dashboard API. These handlers convert common database-related errors into consistent DashboardAPIError responses, allowing for cleaner and more maintainable error handling across all endpoints that interact with the database.
+ */
+export const sharedDBErrors = {
+	DBCallbackFailure: () => new DashboardAPIError({ error: 'Database callback failed' }),
+	DBClientInitializationError: () =>
+		new DashboardAPIError({ error: 'Database client initialization failed' }),
+	NotFoundError: () => new DashboardAPIError({ error: 'Resource not found' }),
+	QueryError: () => new DashboardAPIError({ error: 'Database query failed' }),
+	QueryParseError: () => new DashboardAPIError({ error: 'Database query parsing failed' }),
+	SDKInitializationError: () => new DashboardAPIError({ error: 'SDK initialization failed' }),
+};
+
+/**
+ * Shared notification error handlers for the Dashboard API. These handlers convert common notification-related errors into consistent DashboardAPIError responses, allowing for cleaner and more maintainable error handling across all endpoints that involve sending notifications.
+ */
+export const sharedNotifierErrors = {
+	ConfigError: () =>
+		new DashboardAPIError({ error: 'Configuration error during notification sending' }),
+	SMTPError: () => new DashboardAPIError({ error: 'SMTP error during notification sending' }),
+	UnknownException: () =>
+		new DashboardAPIError({ error: 'An unknown error occurred during notification sending' }),
+};
+
+/**
+ * Shared page collection error handlers for the Dashboard API. These handlers convert common errors that can occur during the collection of pages for operations like category deletion into consistent DashboardAPIError responses, allowing for cleaner and more maintainable error handling in endpoints that involve complex data collection and manipulation.
+ */
+export const sharedPageCollectionErrors = {
+	ParseError: () => new DashboardAPIError({ error: 'Failed to parse data during page collection' }),
+	FolderTreeError: () =>
+		new DashboardAPIError({
+			error: 'Failed to retrieve folder tree during page collection',
+		}),
+	CollectorError: () =>
+		new DashboardAPIError({
+			error: 'Failed to collect necessary data during page collection',
+		}),
+	PaginateError: () =>
+		new DashboardAPIError({ error: 'Failed to paginate data during page collection' }),
+};
+
+/**
+ * Utility schema for encoding Arrays of Strings
+ */
+export const StringArrayCodec = Schema.transform(Schema.String, Schema.Array(Schema.String), {
+	strict: true,
+	decode: (data) => JSON.parse(data),
+	encode: (data) => JSON.stringify(data),
+});
+
+/**
+ * Function that uses the String Array Schema to create a JSON.stringify like function for string arrays
+ */
+export const encodeStringArray = Schema.encode(StringArrayCodec);

package/frontend/pages/studiocms_api/_handlers/dashboard/apiTokens.ts

@@ -0,0 +1,134 @@
+import { developerConfig } from 'studiocms:config';
+import { SDKCore } from 'studiocms:sdk';
+import routeConfig from 'virtual:studiocms/route-config';
+import { HttpApiBuilder } from '@effect/platform';
+import { StudioCMSDashboardApiSpec } from '@withstudiocms/api-spec';
+import { CurrentUser } from '@withstudiocms/api-spec/astro-context';
+import { DashboardAPIError } from '@withstudiocms/api-spec/dashboard';
+import { availablePermissionRanks } from '@withstudiocms/auth-kit/types';
+import { Effect } from 'effect';
+import { sharedDBErrors } from './_shared.js';
+
+/**
+ * Check if the Dashboard API is enabled in the route configuration.
+ */
+const dashboardAPIEnabled = routeConfig.dashboardAPIEnabled;
+
+/**
+ * Dashboard API Handlers - API Tokens group
+ */
+export const ApiTokensHandler = HttpApiBuilder.group(
+	StudioCMSDashboardApiSpec,
+	'apiTokens',
+	(handlers) =>
+		handlers
+			.handle(
+				'createApiToken',
+				Effect.fn(
+					function* ({ payload: { description } }) {
+						if (!dashboardAPIEnabled) {
+							return yield* new DashboardAPIError({ error: 'Dashboard API is disabled' });
+						}
+
+						if (developerConfig.demoMode !== false) {
+							return yield* new DashboardAPIError({
+								error: 'Demo mode is enabled, this action is not allowed.',
+							});
+						}
+
+						const [sdk, userData] = yield* Effect.all([SDKCore, CurrentUser]);
+
+						const isAuthorized = userData.userPermissionLevel.isEditor;
+
+						if (!userData.isLoggedIn || !userData.user || !isAuthorized) {
+							return yield* new DashboardAPIError({ error: 'Unauthorized' });
+						}
+
+						const newToken = yield* sdk.REST_API.tokens.new(userData.user.id, description);
+
+						return { token: newToken.key };
+					},
+					Effect.catchTags({
+						...sharedDBErrors,
+						GeneratorError: () => new DashboardAPIError({ error: 'Internal Server Error' }),
+					})
+				)
+			)
+			.handle(
+				'revokeApiToken',
+				Effect.fn(function* ({ payload: { tokenID } }) {
+					if (!dashboardAPIEnabled) {
+						return yield* new DashboardAPIError({ error: 'Dashboard API is disabled' });
+					}
+
+					if (developerConfig.demoMode !== false) {
+						return yield* new DashboardAPIError({
+							error: 'Demo mode is enabled, this action is not allowed.',
+						});
+					}
+
+					const [sdk, userData] = yield* Effect.all([SDKCore, CurrentUser]);
+
+					const isAuthorized = userData.userPermissionLevel.isEditor;
+
+					if (!userData.isLoggedIn || !userData.user || !isAuthorized) {
+						return yield* new DashboardAPIError({ error: 'Unauthorized' });
+					}
+
+					const tokenData = yield* sdk.REST_API.tokens.verify(tokenID);
+
+					if (!tokenData || tokenData.userId !== userData.user.id) {
+						return yield* new DashboardAPIError({ error: 'Unauthorized' });
+					}
+
+					yield* sdk.REST_API.tokens.delete({ tokenId: tokenID, userId: userData.user.id });
+
+					return {
+						message: 'Token deleted',
+					};
+				}, Effect.catchTags(sharedDBErrors))
+			)
+			.handle(
+				'adminRevokeUserApiToken',
+				Effect.fn(function* ({ payload: { tokenID, userID } }) {
+					if (!dashboardAPIEnabled) {
+						return yield* new DashboardAPIError({ error: 'Dashboard API is disabled' });
+					}
+
+					if (developerConfig.demoMode !== false) {
+						return yield* new DashboardAPIError({
+							error: 'Demo mode is enabled, this action is not allowed.',
+						});
+					}
+
+					const [sdk, userData] = yield* Effect.all([SDKCore, CurrentUser]);
+
+					const isAuthorized = userData.userPermissionLevel.isAdmin;
+
+					if (!userData.isLoggedIn || !isAuthorized) {
+						return yield* new DashboardAPIError({ error: 'Unauthorized' });
+					}
+
+					const tokenData = yield* sdk.REST_API.tokens.verify(tokenID);
+
+					if (!tokenData) {
+						return yield* new DashboardAPIError({ error: 'Token not found' });
+					}
+
+					const targetPerms = availablePermissionRanks.indexOf(tokenData.rank);
+					const userPerms = availablePermissionRanks.indexOf(userData.permissionLevel);
+
+					if (targetPerms >= userPerms) {
+						return yield* new DashboardAPIError({
+							error: 'Unauthorized - insufficient permissions to revoke this token',
+						});
+					}
+
+					yield* sdk.REST_API.tokens.delete({ tokenId: tokenID, userId: userID });
+
+					return {
+						message: 'Token deleted',
+					};
+				}, Effect.catchTags(sharedDBErrors))
+			)
+);

package/frontend/pages/studiocms_api/_handlers/dashboard/config.ts

@@ -0,0 +1,64 @@
+import { developerConfig } from 'studiocms:config';
+import { SDKCore } from 'studiocms:sdk';
+import routeConfig from 'virtual:studiocms/route-config';
+import { HttpApiBuilder } from '@effect/platform';
+import { StudioCMSDashboardApiSpec } from '@withstudiocms/api-spec';
+import { CurrentUser } from '@withstudiocms/api-spec/astro-context';
+import { DashboardAPIError } from '@withstudiocms/api-spec/dashboard';
+import { Effect } from 'effect';
+import { sharedDBErrors } from './_shared.js';
+
+/**
+ * Check if the Dashboard API is enabled in the route configuration.
+ */
+const dashboardAPIEnabled = routeConfig.dashboardAPIEnabled;
+
+/**
+ * Handlers for the Dashboard API configuration endpoints.
+ */
+export const ConfigHandlers = HttpApiBuilder.group(
+	StudioCMSDashboardApiSpec,
+	'config',
+	(handlers) =>
+		handlers.handle(
+			'updateSiteConfig',
+			Effect.fn(function* ({ payload }) {
+				if (!dashboardAPIEnabled) {
+					return yield* new DashboardAPIError({ error: 'Dashboard API is disabled' });
+				}
+
+				if (developerConfig.demoMode !== false) {
+					return yield* new DashboardAPIError({
+						error: 'Demo mode is enabled, this action is not allowed.',
+					});
+				}
+
+				const [sdk, userData] = yield* Effect.all([SDKCore, CurrentUser]);
+
+				const isAuthorized = userData.userPermissionLevel.isOwner;
+
+				if (!userData.isLoggedIn || !isAuthorized) {
+					return yield* new DashboardAPIError({ error: 'Unauthorized' });
+				}
+
+				if (!payload.loginPageBackground) {
+					return yield* new DashboardAPIError({
+						error: 'Invalid input: loginPageBackground is required',
+					});
+				}
+
+				if (payload.loginPageBackground === 'custom' && !payload.loginPageCustomImage) {
+					return yield* new DashboardAPIError({
+						error:
+							'Invalid input: loginPageCustomImage is required when loginPageBackground is set to custom',
+					});
+				}
+
+				yield* sdk.UPDATE.siteConfig(payload);
+
+				return {
+					message: 'Site configuration updated successfully',
+				};
+			}, Effect.catchTags(sharedDBErrors))
+		)
+);