webspresso 0.0.76 → 0.0.78

package/core/content/schema.js

@@ -0,0 +1,75 @@
+/**
+ * Content type schema validation
+ * @module core/content/schema
+ */
+
+const { z } = require('zod');
+const { isValidFieldType } = require('./field-types');
+
+const SLUG_REGEX = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+
+const fieldDefinitionSchema = z.object({
+  name: z.string().min(1).max(64).regex(/^[a-z][a-z0-9_]*$/i, 'Field name must be alphanumeric'),
+  type: z.string().refine(isValidFieldType, 'Invalid field type'),
+  label: z.string().max(255).optional(),
+  required: z.boolean().optional(),
+  options: z.array(z.string()).optional(),
+  fields: z.lazy(() => z.array(fieldDefinitionSchema)).optional(),
+});
+
+const contentTypeSchemaSchema = z.object({
+  fields: z.array(fieldDefinitionSchema).min(0),
+});
+
+/**
+ * @param {string} slug
+ * @returns {boolean}
+ */
+function isValidSlug(slug) {
+  return typeof slug === 'string' && SLUG_REGEX.test(slug);
+}
+
+/**
+ * @param {unknown} schema
+ * @returns {import('./types').ContentTypeSchema}
+ */
+function parseContentTypeSchema(schema) {
+  const parsed = contentTypeSchemaSchema.parse(schema);
+  const names = new Set();
+  for (const field of parsed.fields) {
+    if (names.has(field.name)) {
+      throw new Error(`Duplicate field name "${field.name}"`);
+    }
+    names.add(field.name);
+    if (field.type === 'select' && (!field.options || field.options.length === 0)) {
+      throw new Error(`Select field "${field.name}" requires options`);
+    }
+    if (field.type === 'repeater') {
+      if (!field.fields || field.fields.length === 0) {
+        throw new Error(`Repeater field "${field.name}" requires nested fields`);
+      }
+      parseContentTypeSchema({ fields: field.fields });
+    }
+  }
+  return parsed;
+}
+
+/**
+ * @param {import('./types').ContentTypeSchema} schema
+ * @param {Record<string, unknown>} data
+ * @param {{ sanitizeRichHtml?: (v: string) => string }} [options]
+ * @returns {Record<string, unknown>}
+ */
+function validateEntryData(schema, data, options = {}) {
+  const { normalizeEntryData } = require('./field-types');
+  return normalizeEntryData(data, schema.fields, options);
+}
+
+module.exports = {
+  SLUG_REGEX,
+  isValidSlug,
+  parseContentTypeSchema,
+  validateEntryData,
+  fieldDefinitionSchema,
+  contentTypeSchemaSchema,
+};

package/core/content/service.js

@@ -0,0 +1,400 @@
+/**
+ * Content service — CRUD for content types and entries.
+ * @module core/content/service
+ */
+
+const { isValidSlug, parseContentTypeSchema, validateEntryData } = require('./schema');
+const { createContentCache } = require('./cache');
+
+/**
+ * @param {import('../orm').Database} db
+ * @param {Object} [options]
+ * @param {number|null} [options.cacheTtlMs] - null = in-memory until write invalidation
+ * @param {(html: string) => string} [options.sanitizeRichHtml]
+ */
+function createContentService(db, options = {}) {
+  if (!db) {
+    throw new Error('createContentService requires a database instance');
+  }
+
+  const TypeRepo = () => db.getRepository('ContentType');
+  const EntryRepo = () => db.getRepository('ContentEntry');
+  const cache = createContentCache(
+    options.cacheTtlMs !== undefined ? options.cacheTtlMs : null
+  );
+  const sanitizeRichHtml = options.sanitizeRichHtml;
+
+  function entryCacheKey(typeSlug, entrySlug, locale, includeDraft) {
+    return `entry:${typeSlug}:${entrySlug}:${locale ?? ''}:${includeDraft ? 'all' : 'pub'}`;
+  }
+
+  function invalidateType(typeSlug, typeId) {
+    if (typeSlug) {
+      cache.invalidatePrefix(`entry:${typeSlug}:`);
+      cache.invalidatePrefix(`entries:${typeSlug}:`);
+      cache.del(`type:slug:${typeSlug}`);
+    }
+    if (typeId != null) {
+      cache.del(`type:id:${typeId}`);
+    }
+    cache.invalidatePrefix('types:');
+  }
+
+  function invalidateEntry(entry, type) {
+    if (entry?.id != null) {
+      cache.del(`entry:id:${entry.id}`);
+    }
+    if (type?.slug && entry?.slug != null) {
+      cache.invalidatePrefix(`entry:${type.slug}:${entry.slug}:`);
+    }
+    if (type?.slug) {
+      cache.invalidatePrefix(`entries:${type.slug}:`);
+    }
+  }
+
+  function cacheTypeRow(row) {
+    if (!row) return;
+    cache.set(`type:slug:${row.slug}`, row);
+    cache.set(`type:id:${row.id}`, row);
+  }
+
+  /**
+   * @returns {Promise<import('./types').ContentTypeRecord[]>}
+   */
+  async function listTypes() {
+    const cached = cache.get('types:all');
+    if (cached) return cached;
+
+    const rows = await db.query('ContentType').orderBy('name', 'asc').list();
+    cache.set('types:all', rows);
+    for (const row of rows) {
+      cacheTypeRow(row);
+    }
+    return rows;
+  }
+
+  /**
+   * @param {number|string} id
+   */
+  async function getTypeById(id) {
+    const key = `type:id:${id}`;
+    const cached = cache.get(key);
+    if (cached) return cached;
+
+    const row = await TypeRepo().findById(id);
+    cacheTypeRow(row);
+    return row;
+  }
+
+  /**
+   * @param {string} slug
+   */
+  async function getTypeBySlug(slug) {
+    const key = `type:slug:${slug}`;
+    const cached = cache.get(key);
+    if (cached) return cached;
+
+    const row = await TypeRepo().findOne({ slug });
+    cacheTypeRow(row);
+    return row;
+  }
+
+  /**
+   * @param {Object} input
+   * @param {string} input.slug
+   * @param {string} input.name
+   * @param {string} [input.description]
+   * @param {import('./types').ContentTypeSchema} input.schema
+   * @param {Object} [input.settings]
+   */
+  async function createType(input) {
+    if (!isValidSlug(input.slug)) {
+      throw new Error('Invalid content type slug');
+    }
+    const schema = parseContentTypeSchema(input.schema);
+    const existing = await getTypeBySlug(input.slug);
+    if (existing) {
+      throw new Error(`Content type "${input.slug}" already exists`);
+    }
+
+    const row = await TypeRepo().create({
+      slug: input.slug,
+      name: input.name,
+      description: input.description ?? null,
+      schema,
+      settings: input.settings ?? null,
+    });
+
+    cache.invalidateAll();
+    return row;
+  }
+
+  /**
+   * @param {number|string} id
+   * @param {Object} input
+   */
+  async function updateType(id, input) {
+    const existing = await getTypeById(id);
+    if (!existing) {
+      throw new Error('Content type not found');
+    }
+
+    /** @type {Record<string, unknown>} */
+    const patch = {};
+
+    if (input.slug !== undefined) {
+      if (!isValidSlug(input.slug)) {
+        throw new Error('Invalid content type slug');
+      }
+      if (input.slug !== existing.slug) {
+        const conflict = await getTypeBySlug(input.slug);
+        if (conflict) {
+          throw new Error(`Content type "${input.slug}" already exists`);
+        }
+      }
+      patch.slug = input.slug;
+    }
+    if (input.name !== undefined) patch.name = input.name;
+    if (input.description !== undefined) patch.description = input.description;
+    if (input.settings !== undefined) patch.settings = input.settings;
+    if (input.schema !== undefined) {
+      patch.schema = parseContentTypeSchema(input.schema);
+    }
+
+    const row = await TypeRepo().update(id, patch);
+    invalidateType(existing.slug, existing.id);
+    if (patch.slug && patch.slug !== existing.slug) {
+      invalidateType(String(patch.slug), existing.id);
+    }
+    return row;
+  }
+
+  /**
+   * @param {number|string} id
+   */
+  async function deleteType(id) {
+    const existing = await getTypeById(id);
+    if (!existing) {
+      throw new Error('Content type not found');
+    }
+
+    const entries = await db.query('ContentEntry').where('content_type_id', existing.id).list();
+    for (const entry of entries) {
+      invalidateEntry(entry, existing);
+      await EntryRepo().delete(entry.id);
+    }
+
+    await TypeRepo().delete(id);
+    invalidateType(existing.slug, existing.id);
+    return { success: true };
+  }
+
+  /**
+   * @param {string} typeSlug
+   * @param {Object} [filters]
+   */
+  async function listEntries(typeSlug, filters = {}) {
+    const status = filters.status ?? '';
+    const localeKey = filters.locale !== undefined ? String(filters.locale) : '';
+    const listKey = `entries:${typeSlug}:${status}:${localeKey}`;
+    const cached = cache.get(listKey);
+    if (cached) return cached;
+
+    const type = await getTypeBySlug(typeSlug);
+    if (!type) {
+      throw new Error(`Content type "${typeSlug}" not found`);
+    }
+
+    /** @type {Record<string, unknown>} */
+    const where = { content_type_id: type.id };
+    if (filters.status) where.status = filters.status;
+    if (filters.locale !== undefined) where.locale = filters.locale;
+
+    const rows = await db.query('ContentEntry')
+      .where(where)
+      .orderBy('updated_at', 'desc')
+      .list();
+
+    cache.set(listKey, rows);
+    return rows;
+  }
+
+  /**
+   * @param {string} typeSlug
+   * @param {string} entrySlug
+   * @param {import('./types').GetEntryOptions} [opts]
+   * @returns {Promise<import('./types').ContentEntryResult|null>}
+   */
+  async function getEntry(typeSlug, entrySlug, opts = {}) {
+    const locale = opts.locale ?? null;
+    const includeDraft = Boolean(opts.includeDraft);
+    const key = entryCacheKey(typeSlug, entrySlug, locale, includeDraft);
+    const cached = cache.get(key);
+    if (cached !== undefined) return cached;
+
+    const type = await getTypeBySlug(typeSlug);
+    if (!type) return null;
+
+    /** @type {Record<string, unknown>} */
+    const where = {
+      content_type_id: type.id,
+      slug: entrySlug,
+      locale,
+    };
+
+    if (!includeDraft) {
+      where.status = 'published';
+    }
+
+    const entry = await EntryRepo().findOne(where);
+    if (!entry) {
+      cache.set(key, null);
+      return null;
+    }
+
+    const result = {
+      data: entry.data || {},
+      meta: {
+        id: entry.id,
+        slug: entry.slug,
+        title: entry.title,
+        status: entry.status,
+        locale: entry.locale,
+        revision: entry.revision,
+        contentTypeId: type.id,
+        typeSlug: type.slug,
+        updatedAt: entry.updated_at,
+      },
+      type,
+    };
+
+    cache.set(key, result);
+    cache.set(`entry:id:${entry.id}`, { entry, type });
+    return result;
+  }
+
+  /**
+   * @param {number|string} id
+   */
+  async function getEntryById(id) {
+    const key = `entry:id:${id}`;
+    const cached = cache.get(key);
+    if (cached) return cached;
+
+    const entry = await EntryRepo().findById(id);
+    if (!entry) return null;
+
+    const type = await getTypeById(entry.content_type_id);
+    const bundle = { entry, type };
+    cache.set(key, bundle);
+    return bundle;
+  }
+
+  /**
+   * @param {string} typeSlug
+   * @param {Object} input
+   */
+  async function createEntry(typeSlug, input) {
+    const type = await getTypeBySlug(typeSlug);
+    if (!type) {
+      throw new Error(`Content type "${typeSlug}" not found`);
+    }
+    if (!isValidSlug(input.slug)) {
+      throw new Error('Invalid entry slug');
+    }
+
+    const locale = input.locale ?? null;
+    const existing = await EntryRepo().findOne({
+      content_type_id: type.id,
+      slug: input.slug,
+      locale,
+    });
+    if (existing) {
+      throw new Error(`Entry "${input.slug}" already exists for this content type`);
+    }
+
+    const data = validateEntryData(type.schema, input.data || {}, { sanitizeRichHtml });
+
+    const row = await EntryRepo().create({
+      content_type_id: type.id,
+      slug: input.slug,
+      title: input.title ?? null,
+      data,
+      status: input.status === 'draft' ? 'draft' : 'published',
+      locale,
+      revision: 1,
+    });
+
+    invalidateType(type.slug, type.id);
+    return row;
+  }
+
+  /**
+   * @param {number|string} id
+   * @param {Object} input
+   */
+  async function updateEntry(id, input) {
+    const bundle = await getEntryById(id);
+    if (!bundle) {
+      throw new Error('Content entry not found');
+    }
+    const { entry, type } = bundle;
+
+    /** @type {Record<string, unknown>} */
+    const patch = {};
+
+    if (input.slug !== undefined) {
+      if (!isValidSlug(input.slug)) {
+        throw new Error('Invalid entry slug');
+      }
+      patch.slug = input.slug;
+    }
+    if (input.title !== undefined) patch.title = input.title;
+    if (input.status !== undefined) {
+      patch.status = input.status === 'draft' ? 'draft' : 'published';
+    }
+    if (input.locale !== undefined) patch.locale = input.locale;
+    if (input.data !== undefined && type) {
+      patch.data = validateEntryData(type.schema, input.data, { sanitizeRichHtml });
+    }
+
+    patch.revision = (entry.revision || 1) + 1;
+
+    const row = await EntryRepo().update(id, patch);
+    invalidateEntry(entry, type);
+    if (type) invalidateType(type.slug, type.id);
+    return row;
+  }
+
+  /**
+   * @param {number|string} id
+   */
+  async function deleteEntry(id) {
+    const bundle = await getEntryById(id);
+    if (!bundle) {
+      throw new Error('Content entry not found');
+    }
+
+    await EntryRepo().delete(id);
+    invalidateEntry(bundle.entry, bundle.type);
+    if (bundle.type) invalidateType(bundle.type.slug, bundle.type.id);
+    return { success: true };
+  }
+
+  return {
+    listTypes,
+    getTypeById,
+    getTypeBySlug,
+    createType,
+    updateType,
+    deleteType,
+    listEntries,
+    getEntry,
+    getEntryById,
+    createEntry,
+    updateEntry,
+    deleteEntry,
+  };
+}
+
+module.exports = { createContentService };

package/core/content/types.js

@@ -0,0 +1,59 @@
+/**
+ * @typedef {'text'|'textarea'|'rich-text'|'number'|'boolean'|'image'|'url'|'date'|'select'|'repeater'} ContentFieldType
+ */
+
+/**
+ * @typedef {Object} ContentFieldDefinition
+ * @property {string} name
+ * @property {ContentFieldType} type
+ * @property {string} [label]
+ * @property {boolean} [required]
+ * @property {string[]} [options] - for select
+ * @property {ContentFieldDefinition[]} [fields] - for repeater
+ */
+
+/**
+ * @typedef {Object} ContentTypeSchema
+ * @property {ContentFieldDefinition[]} fields
+ */
+
+/**
+ * @typedef {Object} ContentTypeRecord
+ * @property {number} id
+ * @property {string} slug
+ * @property {string} name
+ * @property {string|null} [description]
+ * @property {ContentTypeSchema} schema
+ * @property {Object|null} [settings]
+ * @property {string} [created_at]
+ * @property {string} [updated_at]
+ */
+
+/**
+ * @typedef {Object} ContentEntryRecord
+ * @property {number} id
+ * @property {number} content_type_id
+ * @property {string} slug
+ * @property {string|null} [title]
+ * @property {Record<string, unknown>} data
+ * @property {'published'|'draft'} status
+ * @property {string|null} [locale]
+ * @property {number} [revision]
+ * @property {string} [created_at]
+ * @property {string} [updated_at]
+ */
+
+/**
+ * @typedef {Object} ContentEntryResult
+ * @property {Record<string, unknown>} data
+ * @property {Object} meta
+ * @property {ContentTypeRecord|null} [type]
+ */
+
+/**
+ * @typedef {Object} GetEntryOptions
+ * @property {string|null} [locale]
+ * @property {boolean} [includeDraft]
+ */
+
+module.exports = {};

package/index.d.ts

@@ -595,6 +595,23 @@ export interface RateLimitPluginOptions {
 
 export function rateLimitPlugin(options?: RateLimitPluginOptions): WebspressoPlugin;
 
+export interface ContentPluginOptions {
+  db: import('./index').Database;
+  adminPath?: string;
+  publicApiPath?: string;
+  inlineEdit?: boolean;
+  cacheTtlMs?: number | null;
+}
+
+export function contentPlugin(options: ContentPluginOptions): WebspressoPlugin;
+
+export const content: {
+  createContentService: typeof import('./core/content').createContentService;
+  parseContentTypeSchema: typeof import('./core/content').parseContentTypeSchema;
+  validateEntryData: typeof import('./core/content').validateEntryData;
+  wrapEditable: typeof import('./core/content').wrapEditable;
+};
+
 export interface RestResourcePluginOptions {
   path?: string;
   middleware?: RequestHandler[];

package/index.js

@@ -62,8 +62,11 @@ const {
   dataExchangePlugin,
   redirectPlugin,
   rateLimitPlugin,
+  contentPlugin,
 } = require('./plugins');
 
+const content = require('./core/content');
+
 module.exports = {
   // Main API
   createApp,
@@ -129,4 +132,8 @@ module.exports = {
   dataExchangePlugin,
   redirectPlugin,
   rateLimitPlugin,
+  contentPlugin,
+
+  // Schema-driven CMS core (framework-agnostic)
+  content,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.76",
+  "version": "0.0.78",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",

package/plugins/admin-panel/app.js

@@ -45,7 +45,7 @@ function getUserManagementModel() {
 async function guardUserManagementRoutes() {
   var isAuth = await checkAuth();
   if (!isAuth) {
-    m.route.set('/login');
+    redirectToLogin();
     return false;
   }
   if (!getUserManagementModel()) {
@@ -135,7 +135,7 @@ var routes = {
     onmatch: async () => {
       const isAuth = await checkAuth();
       if (isAuth) {
-        m.route.set('/');
+        m.route.set(consumeIntendedRoute('/'));
         return;
       }
       return LoginForm;
@@ -155,7 +155,7 @@ var routes = {
     onmatch: async () => {
       const isAuth = await checkAuth();
       if (!isAuth) {
-        m.route.set('/login');
+        redirectToLogin();
         return;
       }
       return SettingsPage;
@@ -193,7 +193,7 @@ var routes = {
     onmatch: async () => {
       const isAuth = await checkAuth();
       if (!isAuth) {
-        m.route.set('/login');
+        redirectToLogin();
         return;
       }
       return RecordList;
@@ -203,7 +203,7 @@ var routes = {
     onmatch: async () => {
       const isAuth = await checkAuth();
       if (!isAuth) {
-        m.route.set('/login');
+        redirectToLogin();
         return;
       }
       return RecordForm;
@@ -213,7 +213,7 @@ var routes = {
     onmatch: async () => {
       const isAuth = await checkAuth();
       if (!isAuth) {
-        m.route.set('/login');
+        redirectToLogin();
         return;
       }
       return RecordForm;
@@ -230,7 +230,7 @@ if (config && config.pages) {
         onmatch: async () => {
           const isAuth = await checkAuth();
           if (!isAuth) {
-            m.route.set('/login');
+            redirectToLogin();
             return;
           }
           if (window.__customPages && window.__customPages[page.id]) {

package/plugins/admin-panel/client/parts/01-state-api-breadcrumb.js

@@ -15,6 +15,9 @@ const api = {
     
     if (!response.ok) {
       const error = await response.json().catch(() => ({ error: 'Request failed' }));
+      if (response.status === 401 && path.indexOf('/auth/') !== 0) {
+        redirectToLogin();
+      }
       throw new Error(error.error || 'Request failed');
     }
     
@@ -101,6 +104,44 @@ const state = {
   selectAllMode: false, // true = all records selected (not just current page)
 };
 
+var INTENDED_ROUTE_KEY = 'webspresso.admin.intendedRoute';
+
+function isSafeIntendedRoute(path) {
+  if (!path || typeof path !== 'string') return false;
+  if (path.charAt(0) !== '/') return false;
+  if (path === '/login' || path === '/setup') return false;
+  return true;
+}
+
+function saveIntendedRoute() {
+  try {
+    var path = m.route.get();
+    if (!isSafeIntendedRoute(path)) return;
+    sessionStorage.setItem(INTENDED_ROUTE_KEY, path);
+  } catch (e) {}
+}
+
+function clearIntendedRoute() {
+  try {
+    sessionStorage.removeItem(INTENDED_ROUTE_KEY);
+  } catch (e) {}
+}
+
+function consumeIntendedRoute(defaultPath) {
+  defaultPath = defaultPath || '/';
+  try {
+    var path = sessionStorage.getItem(INTENDED_ROUTE_KEY);
+    sessionStorage.removeItem(INTENDED_ROUTE_KEY);
+    if (isSafeIntendedRoute(path)) return path;
+  } catch (e) {}
+  return defaultPath;
+}
+
+function redirectToLogin() {
+  saveIntendedRoute();
+  m.route.set('/login');
+}
+
 // Breadcrumb Component
 const Breadcrumb = {
   view: (vnode) => {