@tanglemedia/directus-extension-publish

A Directus bundle that powers the "Publish Site" button. It renders a branded status page, triggers the site's configured build hooks, and reports the result of each one — all behind the Directus session, so only signed-in users can publish.

The extension is self-contained: it installs its own module-bar button and its own "Site Build Hooks" field, so adding it to a Directus instance is all that's needed.

What it does

Mounted at /publish. When an editor opens it (via the module-bar button), the page:

1. reads the project branding and the site's build hooks server-side,
2. POSTs each build hook and shows a live per-hook status (started / failed, with a plain-language reason on failure),
3. on a fully successful run, offers to close the tab (a countdown auto-closes it when the tab was opened by the button; see Auto-close).

The build-hook URLs never reach the browser — the page asks the server to fire each hook by index, so the credentials stay server-side and there is no CORS to negotiate.

Contents

This bundle ships two extension entries plus the migrations they rely on:

| Part | Source | Role | |---|---|---| | Endpoint | src/endpoint/index.js | Serves /publish and fires the hooks. | | Hook | src/hook/index.js | On boot, copies this package's migrations/ into Directus so they run on bootstrap. | | Migration 20260723A | migrations/…-add-module-bar-button.mjs | Installs the "Publish Site" module-bar button. | | Migration 20260723B | migrations/…-add-site-build-hooks-field.mjs | Installs the "Site Build Hooks" field on tngl_site_configuration. |

Routes

| Method & path | Purpose | |---|---| | GET /publish | The status page (HTML). | | GET /publish/app.js | The page's script, served same-origin to satisfy Directus's script-src 'self' CSP. | | POST /publish/hooks/:index | Trigger one build hook by its index; returns { ok, status?, error? }. |

All routes return 204 No Content for anonymous callers — the extension is signed-in only, and it fails silently rather than revealing itself.

What it installs

On first boot the hook copies the migrations into Directus, which runs them:

• Module-bar button (directus_settings.module_bar) — a "Publish Site" link pointing at <PUBLIC_URL>/publish?autoclose=1. Idempotent by button id; owns the button even if an older install created one.
• "Site Build Hooks" field (directus_fields + a site_build_hooks JSON column on tngl_site_configuration) — a repeater of { name, url } rows. The column is created only if missing and never dropped, so existing hook data is preserved.

Both are removed cleanly by the migrations' down (the field's down removes only the definition, never the data column).

Tables affected

| Table | Why | |---|---| | directus_settings | The module-bar button. | | directus_fields | The "Site Build Hooks" field definition. | | tngl_site_configuration | The site_build_hooks JSON column that stores the hooks. |

Requirements

• Directus ^11.0.0.
• directus-collection-site-config — provides the tngl_site_configuration singleton the field attaches to and the endpoint reads. If it isn't installed the field migration no-ops (it won't fail), but the extension has nothing to read, so install both.
• directus_settings branding — the page uses project_name, project_url, project_color, project_logo when present (all optional, with fallbacks).
• Build-hook URLs must point at api.netlify.com. This is enforced server-side: the field is hand-edited, so the allowlist is what stops it being used as an SSRF relay.

Auto-close

The button URL carries ?autoclose=1. After a fully successful publish the page counts down and calls window.close(). Browsers only honor that for a script-/link-opened tab, so:

• opened from the module-bar button → counts down and closes;
• typed URL / bookmark → no countdown, shows "You can close this window." instead.

Build

pnpm --filter @tanglemedia/directus-extension-publish build

Outputs dist/api.js (hook + endpoint) and dist/app.js. The published artifact is dist, src, and migrations (see files in package.json).

pnpm --filter @tanglemedia/directus-extension-publish validate runs the SDK validator.

Publishing

Versioned and published with Changesets from the monorepo root:

pnpm run build
pnpm changeset            # select this package, choose a bump
pnpm changeset version
pnpm changeset publish