let editors read a draft page

Author: breftejk

apps/api/src/routes/pages.test.ts

@@ -154,6 +154,30 @@ describe("page routes", () => {
     await app.close()
   })
 
+  it("lets an editor read a draft the public cannot see", async () => {
+    await app.inject({
+      method: "POST",
+      url: "/api/pages/wip",
+      headers: { ...origin, cookie },
+      payload: { content: validPage },
+    })
+    // Public sees nothing (it is a draft).
+    const pub = await app.inject({ method: "GET", url: "/api/pages/wip" })
+    expect(pub.statusCode).toBe(404)
+    // The editor can read it.
+    const draft = await app.inject({
+      method: "GET",
+      url: "/api/pages/wip/draft",
+      headers: { cookie },
+    })
+    expect(draft.statusCode).toBe(200)
+    expect((draft.json() as { status: string }).status).toBe("draft")
+    // Without editor rights it is refused.
+    const anon = await app.inject({ method: "GET", url: "/api/pages/wip/draft" })
+    expect(anon.statusCode).toBe(401)
+    await app.close()
+  })
+
   it("rejects a page with an unsafe url", async () => {
     const res = await app.inject({
       method: "POST",

apps/api/src/routes/pages.ts

@@ -57,6 +57,21 @@ export async function registerPageRoutes(app: FastifyInstance, deps: PageDeps) {
     return { slug: page.slug, version: page.version, content: page.content }
   })
 
+  // Editor: read the current page including a draft, so an editor can reload
+  // work in progress that the public endpoint hides.
+  app.get("/api/pages/:slug/draft", async (req, reply) => {
+    if (!(await requireEditor(req, reply))) return
+    const { slug } = req.params as { slug: string }
+    const page = deps.pages.get(slug)
+    if (!page) return reply.code(404).send({ error: "not found" })
+    return {
+      slug: page.slug,
+      version: page.version,
+      status: page.status,
+      content: page.content,
+    }
+  })
+
   // Editor: create or update a page. The content is validated against the page
   // schema, so a stored page can never carry an unknown component or an unsafe
   // url no matter what the client or an AI generator sends.