app/lib/content.server.ts

Functions

Imports

It imports app/db/schema.ts, app/lib/index.server.ts, app/lib/legal.server.ts, app/lib/people.server.ts, app/lib/projects.server.ts, app/lib/roles.ts, app/lib/sites.server.ts, app/lib/social/queue.server.ts, app/lib/voice.server.ts. Imported by app/lib/ai.server.ts, app/lib/bulk.server.ts, app/lib/google/drive.server.ts, app/lib/mcp/tools.ts, app/lib/voice.server.ts, app/lib/waiting.server.ts, app/routes/ai-draft.tsx, app/routes/book.file.tsx, app/routes/book.history.tsx, app/routes/editor.tsx, app/routes/history.tsx, app/routes/legal.tsx, app/routes/preview.ts, app/routes/project.new.tsx, app/routes/project.tsx, app/routes/unpublish.tsx.

Source

1// Every read and write of a site's content that Carrel performs for a person: autosave to D1, and
2// the writes it sends through site-api. Roles are checked here, not only in the route, so every
3// door (the UI now, MCP tools in stage 5) is held to the same rule.
4
5import type { ContentDoc } from "@dustinedwards/site-api";
6import { SiteApiError } from "@dustinedwards/site-api/client";
7import { and, eq } from "drizzle-orm";
8import { drizzle } from "drizzle-orm/d1";
9
10import { changes, drafts } from "~/db/schema";
11import { indexDoc, removeFromIndex } from "~/lib/index.server";
12import { checkLegalWrite } from "~/lib/legal.server";
13import type { Viewer } from "~/lib/people.server";
14import type { SiteProject } from "~/lib/projects.server";
15import { can, type Action, type Role } from "~/lib/roles";
16import { siteClient, siteConnection } from "~/lib/sites.server";
17import { recordPublication, summaryFrom } from "~/lib/social/queue.server";
18import { recordCuts } from "~/lib/voice.server";
19
20export type Draft = { source: string; baseVersion: string | null; updatedAt: string };
21
22type WriteAction = "save" | "publish" | "schedule" | "unpublish";
23
24export type WriteOutcome =
25  | { ok: true; action: WriteAction; version: string; status: ContentDoc["status"]; changeId: string }
26  | { ok: false; reason: "conflict"; currentVersion: string | null; message: string }
27  | { ok: false; reason: "refused" | "failed"; message: string };
28
29function forbid(): never {
30  throw new Response("Forbidden", { status: 403 });
31}
32
33/** Enough of a project to check a role on it: a site or a book. Drafts are keyed by project and item either way. */
34export type ProjectRole = { id: number; role: Role };
35
36function requireCan(project: { role: Role }, action: Action) {
37  if (!can(project.role, action)) forbid();
38}
39
40/** A 404 from the site means the item is not there yet, which is how a new post starts. */
41export async function readDoc(env: Env, project: SiteProject, itemId: string, fetcher?: typeof fetch) {
42  requireCan(project, "read");
43  try {
44    return await siteClient(env, project.site, fetcher).get(itemId);
45  } catch (error) {
46    if (error instanceof SiteApiError && error.status === 404) return null;
47    throw error;
48  }
49}
50
51export async function readDraft(db: D1Database, project: ProjectRole, viewer: Viewer, itemId: string) {
52  requireCan(project, "read");
53  const row = await drizzle(db)
54    .select({ source: drafts.source, baseVersion: drafts.baseVersion, updatedAt: drafts.updatedAt })
55    .from(drafts)
56    .where(and(eq(drafts.projectId, project.id), eq(drafts.itemId, itemId), eq(drafts.personId, viewer.id)))
57    .get();
58  return row ?? null;
59}
60
61/** The working copy is private to the person: an Editor may autosave a live post, never send it. The same for a book's files. */
62export async function autosave(
63  db: D1Database,
64  project: ProjectRole,
65  viewer: Viewer,
66  itemId: string,
67  input: { source: string; baseVersion: string | null },
68  now = new Date(),
69): Promise<Draft> {
70  requireCan(project, "edit");
71  const updatedAt = now.toISOString();
72  await drizzle(db)
73    .insert(drafts)
74    .values({ projectId: project.id, itemId, personId: viewer.id, source: input.source, baseVersion: input.baseVersion, updatedAt })
75    .onConflictDoUpdate({
76      target: [drafts.projectId, drafts.itemId, drafts.personId],
77      set: { source: input.source, baseVersion: input.baseVersion, updatedAt },
78    });
79  return { source: input.source, baseVersion: input.baseVersion, updatedAt };
80}
81
82export async function discardDraft(db: D1Database, project: ProjectRole, viewer: Viewer, itemId: string) {
83  requireCan(project, "edit");
84  await drizzle(db)
85    .delete(drafts)
86    .where(and(eq(drafts.projectId, project.id), eq(drafts.itemId, itemId), eq(drafts.personId, viewer.id)));
87}
88
89/**
90 * What a write needs. Saving changes to a published or scheduled item changes the public site, so it
91 * is a publish, not an edit: an Editor may save drafts only.
92 */
93function actionNeeded(action: WriteAction, current: ContentDoc | null): Action {
94  if (action !== "save") return "publish";
95  return current && current.status !== "draft" ? "publish" : "edit";
96}
97
98export async function writeToSite(
99  env: Env,
100  project: SiteProject,
101  viewer: Viewer,
102  itemId: string,
103  request:
104    | { action: "save"; source: string; expectedVersion: string | null }
105    | { action: "publish"; expectedVersion: string; source?: string }
106    | { action: "schedule"; expectedVersion: string; publishAt: string; source?: string }
107    | { action: "unpublish"; expectedVersion: string },
108  fetcher?: typeof fetch,
109  /** The AI client, when the write came through the AI door; the authorship record credits it. */
110  opts: { client?: string } = {},
111): Promise<WriteOutcome> {
112  // Checked twice: before any request, from the role alone, and again against the item's live state.
113  requireCan(project, request.action === "save" ? "edit" : "publish");
114  const client = siteClient(env, project.site, fetcher);
115  const current = await readDoc(env, project, itemId, fetcher);
116  requireCan(project, actionNeeded(request.action, current));
117
118  // A legal page has its shared sections written in and its date stamped; a page the site keeps public is not taken down.
119  const legal = await checkLegalWrite(env.DB, project, itemId, request, current, new Date());
120  if (!legal.ok) return { ok: false, reason: "refused", message: legal.message };
121  if ("source" in request && request.source !== undefined) request = { ...request, source: legal.source };
122
123  const changeId = crypto.randomUUID();
124  let result;
125  try {
126    switch (request.action) {
127      case "save":
128        result = await client.saveDraft(itemId, { source: request.source, expectedVersion: request.expectedVersion, changeId });
129        break;
130      case "publish":
131        result = await client.publish(itemId, { expectedVersion: request.expectedVersion, changeId, source: request.source });
132        break;
133      case "schedule":
134        result = await client.schedule(itemId, {
135          expectedVersion: request.expectedVersion,
136          changeId,
137          publishAt: request.publishAt,
138          source: request.source,
139        });
140        break;
141      case "unpublish":
142        result = await client.unpublish(itemId, { expectedVersion: request.expectedVersion, changeId });
143        break;
144    }
145  } catch (error) {
146    if (error instanceof SiteApiError && error.body?.error === "version-conflict") {
147      return {
148        ok: false,
149        reason: "conflict",
150        currentVersion: error.body.currentVersion ?? null,
151        message: "The post changed on the site since you opened it. Your text is kept here; reload the site's version to compare before saving.",
152      };
153    }
154    // The site's own words for a refusal, a text it cannot take or a write it does not do for this kind.
155    if (error instanceof SiteApiError && error.body && ["refused", "invalid", "not-implemented"].includes(error.body.error)) {
156      return { ok: false, reason: "refused", message: error.body.message };
157    }
158    console.error(JSON.stringify({ write: "failed", itemId, action: request.action, error: String(error) }));
159    return { ok: false, reason: "failed", message: "The site did not accept the write. Your text is kept here." };
160  }
161
162  await drizzle(env.DB).insert(changes).values({
163    id: changeId,
164    projectId: project.id,
165    itemId,
166    personId: viewer.id,
167    action: request.action,
168    versionBefore: current?.version ?? null,
169    versionAfter: result.version,
170    client: opts.client ?? null,
171  });
172
173  // The draft is done once its text reached the site; an unpublish sends no text, so it stays.
174  if ("source" in request && request.source !== undefined) {
175    await drizzle(env.DB)
176      .delete(drafts)
177      .where(and(eq(drafts.projectId, project.id), eq(drafts.itemId, itemId), eq(drafts.personId, viewer.id)));
178  }
179
180  // The write landed; a failed re-read only leaves the index to the next refresh.
181  try {
182    const doc = await client.get(itemId);
183    await indexDoc(env.DB, project.id, doc);
184    // A piece going live is the one event social posts may announce (design decision 5).
185    if (request.action === "publish" && doc.status === "published") {
186      const connection = siteConnection(env, project.site);
187      const url = connection.state === "connected" && doc.path ? new URL(doc.path, connection.origin).href : "";
188      await recordPublication(env.DB, project.id, { id: itemId, title: doc.title, url, summary: summaryFrom(doc.source) });
189      // The author's own publish of a post an AI session drafted teaches the Voice page what they cut.
190      if (!opts.client) await recordCuts(env.DB, project.id, viewer.id, itemId, doc.source);
191    }
192  } catch (error) {
193    console.error(JSON.stringify({ index: "after-write-failed", itemId, error: String(error) }));
194  }
195
196  return { ok: true, action: request.action, version: result.version, status: result.status, changeId };
197}
198
199export type DeleteOutcome =
200  | { ok: true; changeId: string; version: string; title: string; recorded: boolean }
201  | { ok: false; reason: "missing" | "conflict" | "refused" | "not-implemented" | "failed"; message: string };
202
203/**
204 * Whether the site can delete a post, from its meta. A site on an older site API, or one whose adapter
205 * has no delete, says no and the reason is plain; a site that does not answer says that.
206 */
207export async function contentDeleteOffered(
208  env: Env,
209  project: SiteProject,
210  fetcher?: typeof fetch,
211): Promise<{ offered: true } | { offered: false; reason: string }> {
212  requireCan(project, "read");
213  try {
214    const meta = await siteClient(env, project.site, fetcher).meta();
215    return meta.capabilities.contentDelete === true ? { offered: true } : { offered: false, reason: "The site does not delete posts through Carrel yet." };
216  } catch (error) {
217    console.error(JSON.stringify({ meta: "failed", error: String(error) }));
218    return { offered: false, reason: "The site did not answer, so Carrel cannot tell whether it deletes posts." };
219  }
220}
221
222/**
223 * Deletes one post from the site. Owner only, checked before the site is asked anything. The version
224 * sent is the one the site holds now, so a post that changed between reading it and this call is
225 * refused as stale and stays. The authorship record is written only for a delete the site carried out;
226 * the person's own working drafts of the post stay in Carrel.
227 */
228export async function deleteFromSite(
229  env: Env,
230  project: SiteProject,
231  viewer: Viewer,
232  itemId: string,
233  fetcher?: typeof fetch,
234  opts: { client?: string } = {},
235): Promise<DeleteOutcome> {
236  requireCan(project, "delete_content");
237  const client = siteClient(env, project.site, fetcher);
238  const current = await readDoc(env, project, itemId, fetcher);
239  if (!current) {
240    await removeFromIndex(env.DB, project.id, itemId);
241    return { ok: false, reason: "missing", message: "The site has no post with this id, so there is nothing to delete." };
242  }
243
244  const changeId = crypto.randomUUID();
245  try {
246    await client.delete(itemId, { expectedVersion: current.version, changeId });
247  } catch (error) {
248    if (error instanceof SiteApiError) {
249      if (error.status === 501) return { ok: false, reason: "not-implemented", message: "The site does not delete posts through Carrel yet." };
250      if (error.body?.error === "version-conflict") {
251        return { ok: false, reason: "conflict", message: "The post changed on the site while this ran. It was not deleted; open it to see the new version." };
252      }
253      if (error.status === 404) {
254        await removeFromIndex(env.DB, project.id, itemId);
255        return { ok: false, reason: "missing", message: "The post was already gone from the site." };
256      }
257      if (error.body?.error === "refused") return { ok: false, reason: "refused", message: error.body.message };
258    }
259    console.error(JSON.stringify({ write: "failed", itemId, action: "content-delete", error: String(error) }));
260    return { ok: false, reason: "failed", message: "The site did not accept the delete. The post is still there." };
261  }
262
263  await removeFromIndex(env.DB, project.id, itemId);
264  // The site has deleted the post. If the record cannot be written, say so rather than report a
265  // clean success: the screen shows the post as deleted and the record as missing.
266  let recorded = true;
267  try {
268    await drizzle(env.DB).insert(changes).values({
269      id: changeId,
270      projectId: project.id,
271      itemId,
272      personId: viewer.id,
273      action: "content-delete",
274      versionBefore: current.version,
275      versionAfter: null,
276      client: opts.client ?? null,
277    });
278  } catch (error) {
279    recorded = false;
280    console.error(JSON.stringify({ record: "failed", itemId, action: "content-delete", changeId, error: String(error) }));
281  }
282  return { ok: true, changeId, version: current.version, title: current.title, recorded };
283}