Add developer blog under /blog with admin editor and public RSS

Adds a full blog subsystem to the Downloads site so we can publish
release notes and API write-ups under blog.bentobox.world (or
download.bentobox.world/blog). Phase 1 + 2 in one drop:

- BlogManager backed by data/Blog.sqlite with posts + post_revisions
- markdown-it server-side rendering with highlight.js syntax highlighting
- GitHub-style alert blockquotes ([!NOTE], [!TIP], …) become callouts
- Admin tab with split-pane Markdown editor, live preview, autosave,
  image upload, tag input, datetime-local scheduling
- Public list + permalink + tag archive + RSS 2.0 + sitemap.xml
- /blog/p/:slug is server-rendered with OG / Twitter Card / JSON-LD
- Per-minute cron promotes scheduled posts and pings Discord webhook
- New canAuthorBlog flag on users (admins implied), pre-grantable via
  env.blog_author_discord_ids; cookie_domain support so a single
  Discord login covers download.* and blog.*

Author: tastybento

CLAUDE.md

@@ -46,13 +46,26 @@ yarn site               # Frontend-only dev rebuild + start server
 - Images live at `weblink/blueprints/images/<gameMode>/<name>.png` (recommended 800×450, with optional `<name>.thumb.png` at 400×225). The catalog auto-detects them at sync time when the overlay does not specify `image`. The Express handler at `src/index.ts` serves them under `/blueprints/images/...` with a path-traversal guard and PNG-only whitelist.
 - Endpoints: `GET /api/blueprints` (full catalog), `GET /api/blueprints/download?id=<gameMode>/<name>&type=blueprint|bundle` (single file), `GET /api/blueprints/zip?ids=[...]|gameMode=<gm>` (multi-select or whole-game-mode zip). IDs are validated against a strict regex and resolved paths are checked against the blueprints root before any read.
 
+**Blog** (`src/api/blog.ts`, `src/api/models/blog.ts`, `src/web/components/blog/`, `src/web/components/admin/BlogTab.tsx`, `src/web/components/admin/BlogEditor.tsx`):
+- Backed by `data/Blog.sqlite` via Sequelize. Models: `posts` (slug-keyed permalinks, draft/published, markdown source + sanitized HTML cache, view counter) and `post_revisions` (one row per save, pruned daily after 90 days).
+- Markdown source is rendered server-side with `markdown-it` + `sanitize-html` on every save; the HTML is what's served to readers, so the public path doesn't ship a markdown engine. The admin editor preview uses `react-markdown` + `remark-gfm` + `remark-breaks` client-side.
+- Permissions: an author is anyone with `users.isAdmin = true` OR `users.canAuthorBlog = true`. Pre-grant via `env.blog_author_discord_ids` (mirrors `admin_discord_ids`). `requireBlogAuthor` middleware in `auth.ts` gates writes; the Admin page filters its tab list to only "Blog" for users who are blog authors but not full admins.
+- Endpoints: `GET /api/blog/posts?page&tag` (paginated public list, optional tag filter), `GET /api/blog/posts/:slug` (public, bumps view count), `GET /api/blog/tags` (aggregated tag counts across published posts), `GET /api/blog/feed.xml` (RSS 2.0), `GET /blog/sitemap.xml` (sitemap), `GET /blog/highlight.css` (highlight.js theme served from the bundled github-dark theme with our background override). Author endpoints under `/api/blog/admin/posts` (CRUD), `/api/blog/admin/posts/:id/publish` (with optional `{ at: <epoch_ms> }` body to schedule), `/api/blog/admin/posts/:id/unpublish`, `/api/blog/admin/images` for multipart uploads (5 MB cap, PNG/JPG/WebP/GIF only). All writes require `X-Csrf-Token` and `requireBlogAuthor`.
+- Permalinks at `/blog/p/:slug` are server-rendered with OG/Twitter Card meta + JSON-LD Article schema + canonical URL by `BlogManager.renderPostPage()`. Express checks for the path in `src/index.ts` before falling through to the SPA. On `blog.bentobox.world`, the bare `/p/:slug` and `/feed.xml` paths also work via a hostname check (`isBlogHost`).
+- On `draft → published` transition the manager fires a Discord webhook configured by `env.discord_blog_webhook_url` (full URL or `/api/webhooks/...` path). Failures are logged and ignored — they never block the publish.
+- Subdomain plumbing: in production set `env.cookie_domain = ".bentobox.world"` so Discord sessions cover both `download.*` and `blog.*`. Recommended nginx config: a single `server` block for `blog.bentobox.world` that rewrites `/(.*)` to `/blog/$1` before proxying to the same upstream `:8080` — keeps the React Router and SSR paths uniform.
+- Uploaded images live under `data/blog/images/YYYY/MM/<sha256-prefix>.<ext>` and are served by Express via the `/blog/images/...` static handler (path-traversal guarded, MIME whitelist).
+- Markdown extras: code fences are server-side syntax-highlighted via `highlight.js` (auto-detect for unfenced langs); GitHub-style alert blockquotes (`> [!NOTE]`, `[!TIP]`, `[!IMPORTANT]`, `[!WARNING]`, `[!CAUTION]`) are post-processed into `<div class="callout callout-X">` boxes with coloured labels.
+- Scheduled posts have `status='scheduled'` and a future `publishedAt`. A per-minute cron promotes them to `published` and fires the Discord webhook at promotion time, not at scheduling time.
+- Phase scope: Phase 1 = list + permalink + RSS + OG + Discord webhook + image uploads + draft/publish, single author. Phase 2 (current) adds tags + tag archive, code highlighting, GFM callouts, scheduled publishing, sitemap. Phase 3 will add multi-author grant UI, comments (Giscus), search, dev.to cross-post, git backup, analytics.
+
 **Auth + submissions** (`src/api/auth.ts`, `src/api/submissions.ts`, `src/api/models/auth.ts`):
 - Discord OAuth (server-side authorization-code flow, `identify` scope only). Sessions stored in `data/Auth.sqlite` via Sequelize (`User`, `Session`, `Submission` tables). Session cookie is HttpOnly, `SameSite=Lax`, `Secure` in production, and carries an opaque server-generated session id. 30-day TTL, max 5 concurrent sessions per user, daily prune cron.
 - CSRF: per-session token returned by `GET /api/me`, required as `X-Csrf-Token` on every POST.
 - Rate limits: 30 OAuth callbacks/min/IP; 3 submissions/hour, 10/day per Discord user.
 - `POST /api/blueprints/submit` accepts a multipart upload (max 5 MB), JSON-parses, ajv-validates against `src/api/schemas/blueprint.schema.json` (vendored from `bentobox/`), runs `validateBlueprintSubmission` (rejects command-block materials and opaque `inventory` payloads), checks slug collision against the local clone, then opens a PR on `BentoBoxWorld/weblink` via Octokit using `env.weblink_github_token` — branch `submit/<discordId>/<slug>-<ts>` with two file commits (the `.blueprint` and the patched `catalog.json`).
 - Helmet config in `src/index.ts` is the canonical CSP — Discord OAuth navigation works without an explicit allowlist because helmet's CSP does not constrain top-level navigation.
-- `env.json` keys: `discord_client_id`, `discord_client_secret`, `discord_redirect_uri`, `weblink_github_token` (fine-grained PAT scoped to `BentoBoxWorld/weblink` with `contents: write` + `pull-requests: write`).
+- `env.json` keys: `discord_client_id`, `discord_client_secret`, `discord_redirect_uri`, `weblink_github_token` (fine-grained PAT scoped to `BentoBoxWorld/weblink` with `contents: write` + `pull-requests: write`), and the blog-related keys `blog_author_discord_ids`, `discord_blog_webhook_url`, `blog_base_url`, `cookie_domain`.
 
 ## Key Patterns
 

env.example.json

@@ -13,6 +13,10 @@
   "discord_redirect_uri": "https://download.bentobox.world/api/auth/discord/callback",
   "weblink_github_token": "github_pat_REPLACE_ME",
   "admin_discord_ids": ["REPLACE_WITH_DISCORD_USER_ID"],
+  "blog_author_discord_ids": [],
+  "discord_blog_webhook_url": "/api/webhooks/xxxxxxxxxxxxxxxxxxxxxxxxxxx",
+  "blog_base_url": "https://blog.bentobox.world",
+  "cookie_domain": ".bentobox.world",
   "admin_github": {
     "owner": "BentoBoxWorld",
     "repo": "Downloads",

package.json

@@ -24,6 +24,7 @@
         "@fortawesome/free-solid-svg-icons": "^5.15.3",
         "@fortawesome/react-fontawesome": "^0.1.14",
         "@octokit/plugin-throttling": "^3.5.1",
+        "highlight.js": "^11.10.0",
         "@tailwindcss/custom-forms": "^0.2.1",
         "@types/archiver": "^5.1.1",
         "@types/cookie-parser": "^1.4.10",
@@ -43,6 +44,7 @@
         "express": "^4.17.1",
         "helmet": "^4.6.0",
         "jenkins": "^0.28.1",
+        "markdown-it": "^13.0.2",
         "mime-types": "^2.1.31",
         "multer": "^2.1.1",
         "node-cron": "^3.0.0",
@@ -54,7 +56,9 @@
         "react-markdown": "^6.0.3",
         "react-router-dom": "^5.2.0",
         "remark-breaks": "^2.0.2",
+        "remark-gfm": "^1.0.0",
         "sequelize": "^6.6.5",
+        "slugify": "^1.6.6",
         "source-map-loader": "^3.0.0",
         "sqlite3": "^6.0.1",
         "styled-components": "^5.3.0",
@@ -70,6 +74,7 @@
         "@babel/preset-react": "^7.13.13",
         "@babel/preset-typescript": "^7.13.0",
         "@babel/runtime": "^7.13.16",
+        "@types/markdown-it": "^13.0.7",
         "@types/multer": "^2.1.0",
         "@types/react": "^17.0.15",
         "@types/react-dom": "^17.0.3",

src/api/api.ts

@@ -24,6 +24,7 @@ import {
 } from './blueprintCatalog';
 import { AdminGithubConfig, AdminManager } from './admin';
 import { AuthConfig, AuthManager } from './auth';
+import { BlogConfig, BlogManager } from './blog';
 import { ConfigStore } from './configStore';
 import { SubmissionManager } from './submissions';
 
@@ -62,6 +63,14 @@ export default class ApiManager {
     admin: AdminManager;
     submissions: SubmissionManager = new SubmissionManager(this.auth, this.weblink, this.loadSubmissionsConfig());
 
+    blogSequelize = new Sequelize('blog', 'user', 'password', {
+        host: 'localhost',
+        dialect: 'sqlite',
+        logging: false,
+        storage: './../data/Blog.sqlite',
+    });
+    blog: BlogManager = new BlogManager(this.auth, this.blogSequelize, this.loadBlogConfig());
+
     jarSequelize = new Sequelize('database', 'user', 'password', {
         host: 'localhost',
         dialect: 'sqlite',
@@ -281,18 +290,42 @@ export default class ApiManager {
                 const adminDiscordIds = Array.isArray(env.admin_discord_ids)
                     ? (env.admin_discord_ids as unknown[]).filter((x): x is string => typeof x === 'string')
                     : [];
+                const blogAuthorDiscordIds = Array.isArray(env.blog_author_discord_ids)
+                    ? (env.blog_author_discord_ids as unknown[]).filter(
+                          (x): x is string => typeof x === 'string',
+                      )
+                    : [];
                 return {
                     clientId: env.discord_client_id,
                     clientSecret: env.discord_client_secret,
                     redirectUri: env.discord_redirect_uri,
                     cookieSecure: inProd,
                     adminDiscordIds,
+                    blogAuthorDiscordIds,
+                    cookieDomain: typeof env.cookie_domain === 'string' ? env.cookie_domain : undefined,
                 };
             }
         } catch (e) {}
         return null;
     }
 
+    private loadBlogConfig(): BlogConfig {
+        let baseUrl: string | undefined;
+        let discordWebhookPath: string | undefined;
+        try {
+            const env = require('./../../env.json');
+            if (typeof env?.blog_base_url === 'string') baseUrl = env.blog_base_url;
+            if (typeof env?.discord_blog_webhook_url === 'string') {
+                discordWebhookPath = env.discord_blog_webhook_url;
+            }
+        } catch (e) {}
+        return {
+            baseUrl,
+            discordWebhookPath,
+            imageDir: './../data/blog/images',
+        };
+    }
+
     async refreshBlueprints() {
         try {
             await this.weblink.sync();

src/api/auth.ts

@@ -19,6 +19,11 @@ export interface AuthConfig {
     redirectUri: string;
     cookieSecure: boolean; // true in prod, false on localhost dev
     adminDiscordIds?: string[];
+    blogAuthorDiscordIds?: string[];
+    /** When set, session cookies are issued with Domain=<value> so a single
+     *  Discord login covers download.* and blog.* under the same eTLD+1.
+     *  Use ".bentobox.world" in production; leave undefined for localhost. */
+    cookieDomain?: string;
 }
 
 const SESSION_COOKIE = 'bb_session';
@@ -63,16 +68,18 @@ export class AuthManager {
 
     private async bootstrap(sequelize: Sequelize): Promise<void> {
         await this.users.sync();
-        // Older Auth.sqlite databases predate the isAdmin column. Add it
+        // Older Auth.sqlite databases predate these columns. Add them
         // idempotently — addColumn throws if it already exists, which we ignore.
-        try {
-            await sequelize.getQueryInterface().addColumn('users', 'isAdmin', {
-                type: BOOLEAN,
-                defaultValue: false,
-                allowNull: false,
-            });
-        } catch (e) {
-            // Column already present.
+        for (const col of ['isAdmin', 'canAuthorBlog']) {
+            try {
+                await sequelize.getQueryInterface().addColumn('users', col, {
+                    type: BOOLEAN,
+                    defaultValue: false,
+                    allowNull: false,
+                });
+            } catch (e) {
+                // Column already present.
+            }
         }
         await this.sessions.sync();
         await this.submissions.sync();
@@ -81,6 +88,10 @@ export class AuthManager {
         for (const id of adminIds) {
             await this.setAdmin(id, true);
         }
+        const blogIds = this.config?.blogAuthorDiscordIds ?? [];
+        for (const id of blogIds) {
+            await this.setBlogAuthor(id, true);
+        }
     }
 
     /** Idempotent. Granting creates a stub user row when the Discord ID has
@@ -103,9 +114,55 @@ export class AuthManager {
             lastLoginAt: 0,
             acceptedTermsVersion: null,
             isAdmin: true,
+            canAuthorBlog: false,
         });
     }
 
+    /** Idempotent. Same pre-grant behavior as setAdmin. */
+    async setBlogAuthor(discordId: string, canAuthorBlog: boolean): Promise<void> {
+        const existing = await this.users.findByPk(discordId);
+        if (existing) {
+            if (existing.canAuthorBlog !== canAuthorBlog) await existing.update({ canAuthorBlog });
+            return;
+        }
+        if (!canAuthorBlog) return;
+        const now = Date.now();
+        await this.users.create({
+            id: discordId,
+            username: '',
+            globalName: null,
+            avatarHash: null,
+            createdAt: now,
+            lastLoginAt: 0,
+            acceptedTermsVersion: null,
+            isAdmin: false,
+            canAuthorBlog: true,
+        });
+    }
+
+    async listBlogAuthors(): Promise<
+        Array<{
+            id: string;
+            username: string;
+            globalName: string | null;
+            avatarUrl: string | null;
+            isAdmin: boolean;
+        }>
+    > {
+        const rows = await this.users.findAll({
+            where: { [Op.or]: [{ isAdmin: true }, { canAuthorBlog: true }] },
+        });
+        return rows.map((u) => ({
+            id: u.id,
+            username: u.username,
+            globalName: u.globalName,
+            avatarUrl: u.avatarHash
+                ? `https://cdn.discordapp.com/avatars/${u.id}/${u.avatarHash}.png?size=64`
+                : null,
+            isAdmin: !!u.isAdmin,
+        }));
+    }
+
     async listAdmins(): Promise<
         Array<{
             id: string;
@@ -141,12 +198,14 @@ export class AuthManager {
             return;
         }
         const state = randomToken();
+        const cookieDomain = this.config.cookieDomain;
         res.cookie(STATE_COOKIE, state, {
             httpOnly: true,
             secure: this.config.cookieSecure,
             sameSite: 'lax',
             maxAge: STATE_TTL_MS,
             path: '/',
+            ...(cookieDomain ? { domain: cookieDomain } : {}),
         });
         const returnTo = safeReturnPath(req.query.return);
         if (returnTo) {
@@ -156,10 +215,11 @@ export class AuthManager {
                 sameSite: 'lax',
                 maxAge: STATE_TTL_MS,
                 path: '/',
+                ...(cookieDomain ? { domain: cookieDomain } : {}),
             });
         } else {
             // Stale cookie from a prior aborted flow could otherwise win.
-            res.clearCookie(RETURN_COOKIE, { path: '/' });
+            res.clearCookie(RETURN_COOKIE, { path: '/', ...(cookieDomain ? { domain: cookieDomain } : {}) });
         }
         const params = new URLSearchParams({
             client_id: this.config.clientId,
@@ -185,9 +245,11 @@ export class AuthManager {
             res.status(400).send('OAuth state mismatch. Please try again.');
             return;
         }
-        res.clearCookie(STATE_COOKIE, { path: '/' });
+        const cookieDomain = this.config.cookieDomain;
+        const domainOpt = cookieDomain ? { domain: cookieDomain } : {};
+        res.clearCookie(STATE_COOKIE, { path: '/', ...domainOpt });
         const returnTo = safeReturnPath(cookies?.[RETURN_COOKIE]) ?? DEFAULT_POST_LOGIN_PATH;
-        res.clearCookie(RETURN_COOKIE, { path: '/' });
+        res.clearCookie(RETURN_COOKIE, { path: '/', ...domainOpt });
 
         let identity: { id: string; username: string; global_name: string | null; avatar: string | null };
         try {
@@ -234,6 +296,7 @@ export class AuthManager {
                 lastLoginAt: now,
                 acceptedTermsVersion: null,
                 isAdmin: false,
+                canAuthorBlog: false,
             });
         }
 
@@ -263,6 +326,7 @@ export class AuthManager {
             sameSite: 'lax',
             maxAge: SESSION_TTL_MS,
             path: '/',
+            ...domainOpt,
         });
         res.redirect(returnTo);
     };
@@ -272,7 +336,8 @@ export class AuthManager {
         if (session) {
             await session.destroy();
         }
-        res.clearCookie(SESSION_COOKIE, { path: '/' });
+        const cookieDomain = this.config?.cookieDomain;
+        res.clearCookie(SESSION_COOKIE, { path: '/', ...(cookieDomain ? { domain: cookieDomain } : {}) });
         res.json({ ok: true });
     };
 
@@ -298,6 +363,7 @@ export class AuthManager {
             csrfToken: session.csrfToken,
             currentTermsVersion: TERMS_VERSION,
             isAdmin: !!user.isAdmin,
+            canAuthorBlog: !!user.isAdmin || !!user.canAuthorBlog,
         });
     };
 
@@ -310,7 +376,8 @@ export class AuthManager {
         const userId = session.userId;
         await this.sessions.destroy({ where: { userId } });
         await this.users.destroy({ where: { id: userId } });
-        res.clearCookie(SESSION_COOKIE, { path: '/' });
+        const cookieDomain = this.config?.cookieDomain;
+        res.clearCookie(SESSION_COOKIE, { path: '/', ...(cookieDomain ? { domain: cookieDomain } : {}) });
         res.json({ ok: true });
     };
 
@@ -371,6 +438,21 @@ export class AuthManager {
         next();
     };
 
+    /** Admins always count as blog authors. */
+    requireBlogAuthor: RequestHandler = async (req, res, next) => {
+        const session = (req as AuthedRequest).session;
+        if (!session) {
+            res.status(401).json({ error: 'unauthenticated' });
+            return;
+        }
+        const user = await this.users.findByPk(session.userId);
+        if (!user || (!user.isAdmin && !user.canAuthorBlog)) {
+            res.status(403).json({ error: 'forbidden' });
+            return;
+        }
+        next();
+    };
+
     // -------- Rate limiting --------
     //
     // Sliding-window in-memory limiter keyed by IP for the OAuth callback,