Prod release

apps/cms/.env.example

@@ -17,6 +17,18 @@ ENCRYPTION_KEY=tobemodified
 BETTER_AUTH_DEBUG=false
 BETTER_AUTH_SECRET=tobemodified
 BETTER_AUTH_URL=tobemodified
+# Authenticates the better-auth "dash" dashboard integration (lib/auth.ts).
+# Required — there is no insecure fallback if this is left unset.
+BETTER_AUTH_DASHBOARD_SECRET=tobemodified
+
+# Social sign-in for the community hub (better-auth). Distinct from the
+# "Strapi SSO" GOOGLE_CLIENT_ID/SECRET below, which authenticate the Strapi
+# admin panel — these need their own OAuth app(s) with redirect URIs set to
+# {BETTER_AUTH_URL}/api/auth/callback/google and .../callback/github.
+BETTER_AUTH_GOOGLE_CLIENT_ID=tobemodified
+BETTER_AUTH_GOOGLE_CLIENT_SECRET=tobemodified
+BETTER_AUTH_GITHUB_CLIENT_ID=tobemodified
+BETTER_AUTH_GITHUB_CLIENT_SECRET=tobemodified
 
 WEBSITE_URL=http://localhost:3000
 SITE_NAME=Strapi Community

apps/cms/config/middlewares.ts

@@ -1,4 +1,4 @@
-export default [
+export default ({ env }) => [
   "strapi::logger",
   "strapi::errors",
   {
@@ -27,7 +27,22 @@ export default [
       },
     },
   },
-  "strapi::cors",
+  {
+    name: "strapi::cors",
+    config: {
+      // Strapi's own default (`origin: '*'`) reflects *any* request Origin
+      // verbatim while still sending `Access-Control-Allow-Credentials:
+      // true` — effectively "allow every website, with cookies". The
+      // better-auth extension's custom content-api routes (organizations/
+      // users/packages/templates — see `extensions/better-auth`) are
+      // deliberately cookie-authenticated (`is-authenticated` policy) with
+      // no CSRF token of their own, so an unrestricted origin here would
+      // let any external site ride a logged-in visitor's session to read
+      // or modify their account data. Restrict to the web app's own origin
+      // instead.
+      origin: [env("WEBSITE_URL")],
+    },
+  },
   "strapi::poweredBy",
   "strapi::query",
   "strapi::body",

apps/cms/config/plugins.ts

@@ -43,6 +43,17 @@ export default ({ env }) => ({
           defaultFieldValues: {
             labels: { official: false, featured: false, paid: false },
           },
+          submitFields: [
+            "name",
+            "slug",
+            "description",
+            "git_repository",
+            "package_location",
+            "type",
+            "readme",
+            "readme_auto_sync",
+            "icon",
+          ],
           checks: [
             "repo_public",
             "readme_exists",
@@ -66,6 +77,16 @@ export default ({ env }) => ({
           defaultFieldValues: {
             labels: { official: false, featured: false, paid: false },
           },
+          submitFields: [
+            "name",
+            "slug",
+            "description",
+            "git_repository",
+            "preview_link",
+            "readme",
+            "readme_auto_sync",
+            "preview_image",
+          ],
           checks: ["repo_public", "readme_exists", "mit_license"],
           webhooks: {
             submissionReceived: `${N8N_WEBHOOK_NS}/template-submission-received`,

apps/cms/package.json

@@ -17,7 +17,7 @@
     "upgrade:dry": "npx @strapi/upgrade latest --dry"
   },
   "dependencies": {
-    "@better-auth-ui/react": "^1.6.3",
+    "@better-auth-ui/react": "^1.6.44",
     "@better-auth/infra": "^0.2.5",
     "@piksail/strapi-provider-email-mailpit": "^1.0.0",
     "@react-email/render": "^1.4.0",
@@ -31,13 +31,17 @@
     "@strapi/strapi": "catalog:strapi",
     "@strapi/types": "catalog:strapi",
     "@strapi/typescript-utils": "catalog:strapi",
+    "@strapi/utils": "catalog:strapi",
     "airtable": "^0.12.2",
     "better-auth": "catalog:better-auth",
     "better-sqlite3": "12.4.1",
+    "isomorphic-dompurify": "^4.2.0",
+    "lodash": "^4.17.21",
     "passport-google-oauth2": "^0.2.0",
     "pg": "^8.21.0",
     "react": "^18.0.0",
     "react-dom": "^18.0.0",
+    "react-email": "^6.6.8",
     "react-query": "^3.39.3",
     "react-router-dom": "^6.0.0",
     "strapi-lucide-icons": "^1.14.0",
@@ -50,6 +54,7 @@
   "devDependencies": {
     "@biomejs/biome": "^2.3.11",
     "@repo/biome-config": "workspace:*",
+    "@types/lodash": "^4.17.13",
     "@types/node": "^20",
     "@types/react": "^18",
     "@types/react-dom": "^18",

apps/cms/src/api/package/content-types/package/schema.json

@@ -24,11 +24,13 @@
     },
     "name": {
       "type": "string",
-      "required": true
+      "required": true,
+      "maxLength": 50
     },
     "description": {
       "type": "text",
-      "required": true
+      "required": true,
+      "maxLength": 300
     },
     "icon": {
       "type": "media",
@@ -37,10 +39,12 @@
       "allowedTypes": ["images", "files", "videos", "audios"]
     },
     "git_repository": {
-      "type": "string"
+      "type": "string",
+      "required": true
     },
     "package_location": {
-      "type": "string"
+      "type": "string",
+      "required": true
     },
     "type": {
       "type": "enumeration",
@@ -125,14 +129,19 @@
       ]
     },
     "submitter_ip": {
-      "type": "string"
+      "type": "string",
+      "private": true
     },
     "submitter_agreed_to_terms": {
       "type": "boolean",
       "default": false
     },
     "submission_notes": {
       "type": "text"
+    },
+    "readme_auto_sync": {
+      "type": "boolean",
+      "default": true
     }
   }
 }

apps/cms/src/api/package/controllers/package.ts

@@ -4,4 +4,84 @@
 
 import { factories } from "@strapi/strapi";
 
-export default factories.createCoreController("api::package.package");
+const READ_ONLY_FIELDS = ["git_repository", "package_location"] as const;
+
+const EDITABLE_FIELDS = [
+  "name",
+  "description",
+  // "icon" — deliberately not editable here: a media field written by id
+  // would let the caller point it at *any* file in the media library, which
+  // the icon upload route would then delete as the "previous" icon. Icons
+  // only change through `POST /packages/:documentId/icon`.
+  "categories",
+  // "maintainers" — temporarily not editable, pending an invite flow so the
+  // added user consents first (see the commented-out `MaintainerPicker` in
+  // apps/web/.../submission-edit-form.tsx). Re-add once that's built.
+  "readme",
+  "readme_auto_sync",
+] as const;
+
+export default factories.createCoreController("api::package.package", () => ({
+  /**
+   * PUT /api/packages/:id — reused by the web app's "Submissions" edit
+   * form. The route's `is-content-owner` policy already restricts who
+   * can reach this action at all (see `routes/package.ts`); this
+   * override adds three more layers on top of that:
+   *
+   * - blocks the edit entirely unless the submission is already
+   *   `approved` — while it's still `submitted`/`under_review`/
+   *   `changes_requested`/`rejected`, moderation is reviewing (or has
+   *   reviewed) the content as originally submitted, so the owner can't
+   *   change it out from under that review. Entries predating the
+   *   moderation workflow have no `overall_status` at all (`null`), so
+   *   those are left editable rather than permanently locked out;
+   * - rejects the request outright if `git_repository`/`package_location`
+   *   are present and differ from the current value — the edit form
+   *   shows these as read-only ("we do not support updating this atm"),
+   *   this is the server-side backstop for anyone calling the API
+   *   directly;
+   * - whitelists everything else down to just the fields the edit form
+   *   actually exposes, so nothing else can be smuggled into this
+   *   content-api-facing write path.
+   */
+  async update(ctx) {
+    const entry = ctx.state.contentEntry as Record<string, unknown>;
+    const documentId = ctx.params.id as string;
+    const incoming = (ctx.request.body?.data ?? {}) as Record<string, unknown>;
+
+    if (entry.overall_status && entry.overall_status !== "approved") {
+      return ctx.badRequest(
+        "This submission cannot be edited until it has been approved.",
+      );
+    }
+
+    for (const field of READ_ONLY_FIELDS) {
+      if (field in incoming && incoming[field] !== entry[field]) {
+        return ctx.badRequest(`${field} cannot be changed.`);
+      }
+    }
+
+    ctx.request.body.data = Object.fromEntries(
+      Object.entries(incoming).filter(([key]) =>
+        (EDITABLE_FIELDS as readonly string[]).includes(key),
+      ),
+    );
+
+    const result = await super.update(ctx);
+
+    // Per product decision, an owner's edit applies immediately — no
+    // re-entering moderation review. If this submission was already
+    // approved and published, republish right away so the live version
+    // picks up the change. A submission still awaiting its first
+    // approval has no published version yet; leave it as a draft so
+    // moderation still gates when it first goes live.
+    const published = await strapi
+      .documents("api::package.package")
+      .findOne({ documentId, status: "published", fields: ["documentId"] });
+    if (published) {
+      await strapi.documents("api::package.package").publish({ documentId });
+    }
+
+    return result;
+  },
+}));

apps/cms/src/api/package/routes/package.ts

@@ -4,4 +4,21 @@
 
 import { factories } from "@strapi/strapi";
 
-export default factories.createCoreRouter("api::package.package");
+export default factories.createCoreRouter("api::package.package", {
+  config: {
+    update: {
+      // Reused by the web app's "Submissions" edit form, called directly
+      // from the browser with a better-auth session cookie rather than a
+      // Strapi API token — same reasoning as `organization.updateProfile`
+      // (apps/cms/src/extensions/better-auth/routes/organization.ts).
+      auth: false,
+      policies: [
+        "plugin::better-auth.is-authenticated",
+        {
+          name: "plugin::better-auth.is-content-owner",
+          config: { uid: "api::package.package" },
+        },
+      ],
+    },
+  },
+});

apps/cms/src/api/profile/content-types/profile/schema.json

@@ -19,10 +19,12 @@
   },
   "attributes": {
     "bio": {
-      "type": "text"
+      "type": "text",
+      "maxLength": 300
     },
     "subtitle": {
-      "type": "string"
+      "type": "string",
+      "maxLength": 50
     },
     "website": {
       "type": "string"

apps/cms/src/api/template/content-types/template/schema.json

@@ -23,10 +23,12 @@
     },
     "name": {
       "type": "string",
-      "required": true
+      "required": true,
+      "maxLength": 50
     },
     "description": {
-      "type": "text"
+      "type": "text",
+      "maxLength": 300
     },
     "git_repository": {
       "type": "string"
@@ -112,14 +114,19 @@
       ]
     },
     "submitter_ip": {
-      "type": "string"
+      "type": "string",
+      "private": true
     },
     "submitter_agreed_to_terms": {
       "type": "boolean",
       "default": false
     },
     "submission_notes": {
       "type": "text"
+    },
+    "readme_auto_sync": {
+      "type": "boolean",
+      "default": true
     }
   }
 }