pandorga 1.2.1

data/functions/api/studio/[[path]].js

@@ -0,0 +1,562 @@
+/**
+ * Studio API — Cloudflare Pages Function.
+ * Spec: docs/features/studio.md §5 (AC-STU-01, AC-STU-02, AC-STU-09).
+ */
+
+import { verifyClerkRequest } from "./_lib/auth.js";
+import {
+  getFile,
+  putFile,
+  putBinaryFile,
+  getFileMeta,
+  listDir,
+  listEntries,
+  peekMeta,
+} from "./_lib/github.js";
+import { normalizeRepoPath, listSchemaCollections } from "./_lib/paths.js";
+import { clientAddress, isMutatingMethod, takeToken } from "./_lib/rate-limit.js";
+import { rewriteRateLimit, runRewrite } from "./_lib/rewrite.js";
+
+const WRITE_RATE = new Map();
+const WRITE_WINDOW_MS = 60_000;
+const WRITE_MAX = 60;
+
+/** Soft cap under GitHub Contents API 100 MB hard limit (base64 JSON body). */
+const MAX_MEDIA_BYTES = 25 * 1024 * 1024;
+const MEDIA_ROOT = "content/media";
+const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/** Bound per-request in onRequest so corsHeaders/json stay signature-stable. */
+let requestEnv = {};
+
+function allowedOrigins() {
+  const fromEnv = String(requestEnv.STUDIO_ALLOWED_ORIGINS || "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  // Local wrangler / jekyll serve always allowed; production must set the list.
+  return new Set([
+    ...fromEnv,
+    "http://localhost:4000",
+    "http://127.0.0.1:4000",
+    "http://localhost:8788",
+    "http://127.0.0.1:8788",
+  ]);
+}
+
+function corsHeaders(request) {
+  const origin = request.headers.get("Origin") || "";
+  const allow =
+    !origin ||
+    origin.includes("localhost") ||
+    origin.includes("127.0.0.1") ||
+    allowedOrigins().has(origin);
+  return {
+    "Access-Control-Allow-Origin": allow ? origin || "*" : "null",
+    "Access-Control-Allow-Headers": "Authorization, Content-Type",
+    "Access-Control-Allow-Methods": "GET, PUT, POST, OPTIONS",
+    "Access-Control-Max-Age": "86400",
+  };
+}
+
+function json(data, status, request, extraHeaders) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: {
+      "Content-Type": "application/json; charset=utf-8",
+      "Cache-Control": "no-store",
+      ...corsHeaders(request),
+      ...(extraHeaders || {}),
+    },
+  });
+}
+
+/**
+ * Spec §4 throttles mutating routes. Counting every GET (tree prefetch, open,
+ * cite search) shared one 60/min bucket with Save, so a normal editing
+ * session returned `rate_limited` on the commit.
+ */
+function tooManyChanges(request, userId) {
+  const decision = takeToken(
+    WRITE_RATE,
+    `${userId}:${clientAddress(request)}`,
+    Date.now(),
+    { windowMs: WRITE_WINDOW_MS, max: WRITE_MAX }
+  );
+  if (decision.allowed) return null;
+  return json(
+    {
+      error: "rate_limited",
+      message: "Too many changes in a short time. Wait a minute, then save again.",
+    },
+    429,
+    request,
+    { "Retry-After": String(decision.retryAfterSec) }
+  );
+}
+
+async function loadSchema(env) {
+  // Prefer in-repo schema via GitHub so the Function does not ship a stale copy.
+  try {
+    const file = await getFile(env, "studio/schema.yml");
+    if (file?.content) {
+      return parseMinimalYamlCollections(file.content);
+    }
+  } catch {
+    /* fall through */
+  }
+  return { content: [] };
+}
+
+/** Tiny YAML subset sufficient for tree routing (name/path/type nesting). */
+function parseMinimalYamlCollections(text) {
+  // For tree listing we only need collection path map; the SPA ships full schema.
+  // Keep Function free of a YAML dependency: SPA sends collection path, we validate prefix.
+  void text;
+  return { content: [] };
+}
+
+function routeParts(context) {
+  const raw = context.params.path;
+  if (Array.isArray(raw)) return raw.filter(Boolean);
+  if (typeof raw === "string" && raw.length) return raw.split("/").filter(Boolean);
+  return [];
+}
+
+export async function onRequestOptions(context) {
+  requestEnv = context.env || {};
+  return new Response(null, { status: 204, headers: corsHeaders(context.request) });
+}
+
+export async function onRequest(context) {
+  const { request, env } = context;
+  requestEnv = env || {};
+  if (request.method === "OPTIONS") {
+    return onRequestOptions(context);
+  }
+
+  const auth = await verifyClerkRequest(request, env);
+  if (auth.error) {
+    const body = { error: auth.error };
+    if (auth.email) body.email = auth.email;
+    if (auth.userId) body.userId = auth.userId;
+    return json(body, auth.status || 401, request);
+  }
+  if (isMutatingMethod(request.method)) {
+    const limited = tooManyChanges(request, auth.userId);
+    if (limited) return limited;
+  }
+
+  const parts = routeParts(context);
+  const head = parts[0] || "";
+
+  try {
+    if (head === "session" && request.method === "GET") {
+      return json(
+        { userId: auth.userId, email: auth.email || null, bypass: !!auth.bypass },
+        200,
+        request
+      );
+    }
+
+    if (head === "tree" && request.method === "GET") {
+      const url = new URL(request.url);
+      const collectionPath = normalizeRepoPath(url.searchParams.get("path") || "");
+      if (!collectionPath) {
+        return json({ error: "invalid_path" }, 400, request);
+      }
+      // Collection roots are directories under content/
+      if (!collectionPath.startsWith("content/")) {
+        return json({ error: "invalid_path" }, 400, request);
+      }
+      const entries = await listDir(env, collectionPath);
+      const files = entries
+        .filter((e) => /\.(md|markdown|yml|yaml)$/i.test(e.name))
+        .slice(0, 500);
+      // YAML cite keys (bibliography): list from directory only — per-file getFile
+      // on hundreds of entries times out / rate-limits (N+1 Contents API).
+      const yamlOnly = files.length > 0 && files.every((e) => /\.ya?ml$/i.test(e.name));
+      const items = [];
+      if (yamlOnly) {
+        for (const entry of files) {
+          const stem = entry.name.replace(/\.ya?ml$/i, "");
+          items.push({
+            path: entry.path,
+            name: entry.name,
+            title: stem,
+            date: null,
+            start_date: null,
+            end_date: null,
+            start: null,
+            end: null,
+            thumbnail: null,
+            key: stem,
+            published: null,
+            language: null,
+            category: null,
+            type: null,
+            company: null,
+            status: null,
+            engagement: null,
+            tags: null,
+            sha: entry.sha,
+          });
+        }
+        items.sort((a, b) => String(a.name).localeCompare(String(b.name)));
+      } else {
+        // Markdown: peek front matter in small parallel batches.
+        const CONCURRENCY = 8;
+        for (let i = 0; i < files.length; i += CONCURRENCY) {
+          const batch = files.slice(i, i + CONCURRENCY);
+          const peeked = await Promise.all(
+            batch.map(async (entry) => {
+              let meta = {};
+              try {
+                const file = await getFile(env, entry.path);
+                meta = peekMeta(file.content);
+              } catch {
+                meta = {};
+              }
+              return {
+                path: entry.path,
+                name: entry.name,
+                title: meta.title || entry.name,
+                date: meta.date,
+                start_date: meta.start_date,
+                end_date: meta.end_date,
+                start: meta.start,
+                end: meta.end,
+                thumbnail: meta.thumbnail,
+                key: meta.key,
+                published: meta.published,
+                language: meta.language,
+                category: meta.category,
+                type: meta.type,
+                company: meta.company,
+                status: meta.status,
+                engagement: meta.engagement,
+                tags: meta.tags,
+                sha: entry.sha,
+              };
+            })
+          );
+          items.push(...peeked);
+        }
+        items.sort((a, b) => String(b.date || "").localeCompare(String(a.date || "")));
+      }
+      return json({ items }, 200, request);
+    }
+
+    if (head === "file" && request.method === "GET") {
+      const url = new URL(request.url);
+      const path = normalizeRepoPath(url.searchParams.get("path") || "");
+      if (!path) return json({ error: "invalid_path" }, 400, request);
+      const file = await getFile(env, path);
+      if (!file) return json({ error: "not_found" }, 404, request);
+      const parsed = splitFrontMatter(file.content);
+      return json(
+        {
+          path: file.path,
+          sha: file.sha,
+          content: file.content,
+          front_matter: parsed.frontMatter,
+          body: parsed.body,
+        },
+        200,
+        request
+      );
+    }
+
+    if (head === "file" && request.method === "PUT") {
+      const body = await request.json();
+      const path = normalizeRepoPath(body.path || "");
+      if (!path) return json({ error: "invalid_path" }, 400, request);
+      if (typeof body.content !== "string") {
+        return json({ error: "content_required" }, 400, request);
+      }
+      let sha = body.sha || null;
+      if (!sha) {
+        const existing = await getFile(env, path);
+        sha = existing?.sha || null;
+      }
+      const result = await putFile(env, {
+        path,
+        content: body.content,
+        message: body.message,
+        sha,
+      });
+      return json(
+        {
+          ok: true,
+          path,
+          commit: result.commit?.sha || null,
+          content: result.content || null,
+        },
+        200,
+        request
+      );
+    }
+
+    if (head === "media" && request.method === "GET") {
+      const url = new URL(request.url);
+      const rawPath = url.searchParams.get("path") || MEDIA_ROOT;
+      const dirPath = normalizeMediaDir(rawPath);
+      if (!dirPath) {
+        return json({ error: "invalid_media_path" }, 400, request);
+      }
+      const entries = await listEntries(env, dirPath);
+      const items = entries
+        .filter((e) => e.name !== ".gitkeep")
+        .map((e) => ({
+          name: e.name,
+          path: e.path,
+          type: e.type,
+          size: e.size,
+          sha: e.sha,
+          public_path: e.type === "file" ? publicMediaPath(e.path) : null,
+        }))
+        .sort((a, b) => {
+          if (a.type !== b.type) return a.type === "dir" ? -1 : 1;
+          return String(a.name).localeCompare(String(b.name));
+        });
+      return json(
+        {
+          root: MEDIA_ROOT,
+          path: dirPath,
+          public_root: "/media",
+          items,
+        },
+        200,
+        request
+      );
+    }
+
+    if (head === "media" && parts[1] === "folder" && request.method === "POST") {
+      const body = await request.json();
+      const dirPath = normalizeMediaDir(body.path || "");
+      if (!dirPath || dirPath === MEDIA_ROOT) {
+        return json({ error: "invalid_media_path" }, 400, request);
+      }
+      const keepPath = `${dirPath}/.gitkeep`;
+      const existing = await getFileMeta(env, keepPath);
+      if (existing) {
+        return json(
+          { ok: true, path: dirPath, public_path: publicMediaPath(dirPath), existed: true },
+          200,
+          request
+        );
+      }
+      const result = await putFile(env, {
+        path: keepPath,
+        content: "\n",
+        message: body.message || `studio: mkdir ${dirPath}`,
+        sha: null,
+      });
+      return json(
+        {
+          ok: true,
+          path: dirPath,
+          public_path: publicMediaPath(dirPath),
+          commit: result.commit?.sha || null,
+          existed: false,
+        },
+        200,
+        request
+      );
+    }
+
+    if (head === "media" && request.method === "POST") {
+      const body = await request.json();
+      const path = normalizeMediaFile(body.path || "");
+      if (!path) {
+        return json({ error: "invalid_media_path" }, 400, request);
+      }
+      if (typeof body.content_base64 !== "string" || !body.content_base64) {
+        return json({ error: "content_base64_required" }, 400, request);
+      }
+      let byteLength = 0;
+      try {
+        byteLength = Math.floor((body.content_base64.replace(/\s/g, "").length * 3) / 4);
+      } catch {
+        return json({ error: "invalid_base64" }, 400, request);
+      }
+      if (byteLength > MAX_MEDIA_BYTES) {
+        return json(
+          {
+            error: "file_too_large",
+            max_bytes: MAX_MEDIA_BYTES,
+            size_bytes: byteLength,
+          },
+          413,
+          request
+        );
+      }
+      const existing = await getFileMeta(env, path);
+      const result = await putBinaryFile(env, {
+        path,
+        contentBase64: body.content_base64.replace(/\s/g, ""),
+        message: body.message || `studio: upload ${path}`,
+        sha: existing?.sha || null,
+      });
+      return json(
+        {
+          ok: true,
+          path,
+          public_path: publicMediaPath(path),
+          commit: result.commit?.sha || null,
+          size_bytes: byteLength,
+        },
+        200,
+        request
+      );
+    }
+
+    if (head === "search" && parts[1] === "xcite" && request.method === "GET") {
+      const q = String(new URL(request.url).searchParams.get("q") || "")
+        .trim()
+        .toLowerCase();
+      const indexPath = "content/collections"; // search filenames + keys via tree peeks
+      const results = await searchKeys(env, q, ["articles", "posts", "products", "projects"]);
+      return json({ results }, 200, request);
+    }
+
+    if (head === "search" && parts[1] === "cite" && request.method === "GET") {
+      const q = String(new URL(request.url).searchParams.get("q") || "")
+        .trim()
+        .toLowerCase();
+      const entries = await listDir(env, "content/collections/bibliography");
+      const results = entries
+        .map((e) => e.name.replace(/\.ya?ml$/i, ""))
+        .filter((k) => !q || k.toLowerCase().includes(q))
+        .slice(0, 30)
+        .map((key) => ({ key, label: key }));
+      return json({ results }, 200, request);
+    }
+
+    if (head === "schema" && request.method === "GET") {
+      const file = await getFile(env, "studio/schema.yml");
+      if (!file) return json({ error: "schema_missing" }, 404, request);
+      return json({ yaml: file.content }, 200, request);
+    }
+
+    // AC-PRF-01…17 — Correct / Refine (docs/features/studio-proof.md).
+    if (head === "rewrite" && request.method === "POST") {
+      const rewriteBudget = rewriteRateLimit(request, auth.userId);
+      if (!rewriteBudget.allowed) {
+        return json(
+          {
+            error: "rate_limited",
+            message: "AI Proof is limited to a few runs a minute. Wait, then try again.",
+          },
+          429,
+          request,
+          { "Retry-After": String(rewriteBudget.retryAfterSec) }
+        );
+      }
+      let body;
+      try {
+        body = await request.json();
+      } catch {
+        return json({ error: "invalid_body" }, 400, request);
+      }
+      try {
+        const result = await runRewrite(env, body);
+        return json(result, 200, request);
+      } catch (err) {
+        const code = err.code || "server_error";
+        const status = err.status || 500;
+        return json({ error: code, message: String(err.message || err) }, status, request);
+      }
+    }
+
+    void listSchemaCollections;
+    return json({ error: "not_found", path: parts }, 404, request);
+  } catch (err) {
+    const status = err.status || 500;
+    const body = {
+      error: err.code || "server_error",
+      message: String(err.message || err),
+    };
+    if (err.detail) body.detail = String(err.detail).slice(0, 400);
+    return json(body, status, request);
+  }
+}
+
+function splitFrontMatter(raw) {
+  const text = String(raw || "");
+  if (!text.startsWith("---")) {
+    return { frontMatter: {}, body: text, rawFm: "" };
+  }
+  const end = text.indexOf("\n---", 3);
+  if (end < 0) return { frontMatter: {}, body: text, rawFm: "" };
+  const rawFm = text.slice(4, end).trimEnd();
+  const body = text.slice(end + 4).replace(/^\r?\n/, "");
+  const frontMatter = {};
+  for (const line of rawFm.split(/\r?\n/)) {
+    const m = line.match(/^([A-Za-z0-9_]+):\s*(.*)$/);
+    if (m && !m[2].startsWith("|") && !m[2].startsWith(">") && m[2] !== "") {
+      let v = m[2].trim();
+      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+        v = v.slice(1, -1);
+      }
+      if (v === "true") v = true;
+      else if (v === "false") v = false;
+      frontMatter[m[1]] = v;
+    }
+  }
+  return { frontMatter, body, rawFm };
+}
+
+/** Repo path → cite path (`content/media/images/x.png` → `/media/images/x.png`). */
+function publicMediaPath(repoPath) {
+  const path = String(repoPath || "");
+  if (path === MEDIA_ROOT || path.startsWith(`${MEDIA_ROOT}/`)) {
+    return path.replace(/^content/, "") || "/media";
+  }
+  return null;
+}
+
+function mediaSegmentsOk(path) {
+  const rest = path.slice(MEDIA_ROOT.length).replace(/^\//, "");
+  if (!rest) return true;
+  return rest.split("/").every((seg) => SAFE_SEGMENT.test(seg));
+}
+
+/** Directory under content/media (inclusive of root). */
+function normalizeMediaDir(raw) {
+  let path = normalizeRepoPath(raw);
+  if (!path) return null;
+  path = path.replace(/\/+$/, "");
+  if (path === MEDIA_ROOT) return MEDIA_ROOT;
+  if (!path.startsWith(`${MEDIA_ROOT}/`)) return null;
+  if (!mediaSegmentsOk(path)) return null;
+  return path;
+}
+
+/** File path under content/media (not a bare directory root). */
+function normalizeMediaFile(raw) {
+  const path = normalizeRepoPath(raw);
+  if (!path || !path.startsWith(`${MEDIA_ROOT}/`)) return null;
+  if (path.endsWith("/")) return null;
+  if (!mediaSegmentsOk(path)) return null;
+  const name = path.split("/").pop();
+  if (!name || name === ".gitkeep") return null;
+  return path;
+}
+
+async function searchKeys(env, q, collections) {
+  const results = [];
+  for (const name of collections) {
+    const entries = await listDir(env, `content/collections/${name}`);
+    for (const entry of entries) {
+      const stem = entry.name.replace(/\.(md|markdown)$/i, "");
+      const keyGuess = stem.includes("-") ? stem.replace(/^\d{4}-\d{2}-\d{2}-/, "") : stem;
+      if (q && !keyGuess.toLowerCase().includes(q) && !stem.toLowerCase().includes(q)) {
+        continue;
+      }
+      results.push({ key: keyGuess, path: entry.path, collection: name, label: keyGuess });
+      if (results.length >= 30) return results;
+    }
+  }
+  return results;
+}

data/functions/api/studio/_lib/auth.js

@@ -0,0 +1,131 @@
+/**
+ * Clerk JWT verification + allowlist. Spec: docs/features/studio.md §4.
+ */
+
+function parseAllowlist(raw) {
+  return String(raw || "")
+    .split(/[,\s]+/)
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+async function fetchJwks(publishableOrSecretHint, env) {
+  // Prefer explicit issuer; fall back to Clerk Frontend API from publishable key.
+  const issuer =
+    env.CLERK_JWT_ISSUER ||
+    env.CLERK_FRONTEND_API ||
+    inferIssuerFromPublishable(env.CLERK_PUBLISHABLE_KEY);
+  if (!issuer) {
+    throw new Error("CLERK_JWT_ISSUER or CLERK_PUBLISHABLE_KEY required");
+  }
+  const base = issuer.replace(/\/$/, "");
+  const res = await fetch(`${base}/.well-known/jwks.json`);
+  if (!res.ok) throw new Error(`JWKS fetch failed: ${res.status}`);
+  return { jwks: await res.json(), issuer: base };
+}
+
+function inferIssuerFromPublishable(key) {
+  // pk_test_… / pk_live_… — Frontend API host is not fully recoverable from
+  // the key alone in all Clerk versions; prefer CLERK_JWT_ISSUER.
+  void key;
+  return null;
+}
+
+function b64urlToBytes(str) {
+  const pad = "=".repeat((4 - (str.length % 4)) % 4);
+  const b64 = (str + pad).replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(b64);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes;
+}
+
+function decodeJwtPart(part) {
+  return JSON.parse(new TextDecoder().decode(b64urlToBytes(part)));
+}
+
+async function importClerkKey(jwk) {
+  return crypto.subtle.importKey(
+    "jwk",
+    jwk,
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+}
+
+export async function verifyClerkRequest(request, env) {
+  if (env.STUDIO_DEV_BYPASS === "1" && env.ENVIRONMENT !== "production") {
+    return {
+      userId: "dev_bypass",
+      email: "dev@localhost",
+      bypass: true,
+    };
+  }
+
+  const header = request.headers.get("Authorization") || "";
+  const match = header.match(/^Bearer\s+(.+)$/i);
+  if (!match) {
+    return { error: "missing_bearer", status: 401 };
+  }
+  const token = match[1].trim();
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return { error: "malformed_jwt", status: 401 };
+  }
+
+  let headerJson;
+  let payload;
+  try {
+    headerJson = decodeJwtPart(parts[0]);
+    payload = decodeJwtPart(parts[1]);
+  } catch {
+    return { error: "malformed_jwt", status: 401 };
+  }
+
+  const { jwks, issuer } = await fetchJwks(null, env);
+  const jwk = (jwks.keys || []).find((k) => k.kid === headerJson.kid) || jwks.keys?.[0];
+  if (!jwk) {
+    return { error: "no_jwk", status: 401 };
+  }
+
+  const key = await importClerkKey(jwk);
+  const data = new TextEncoder().encode(`${parts[0]}.${parts[1]}`);
+  const sig = b64urlToBytes(parts[2]);
+  const ok = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, sig, data);
+  if (!ok) {
+    return { error: "bad_signature", status: 401 };
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+  if (payload.exp && payload.exp < now) {
+    return { error: "expired", status: 401 };
+  }
+  if (payload.nbf && payload.nbf > now + 5) {
+    return { error: "not_yet_valid", status: 401 };
+  }
+  if (issuer && payload.iss && !String(payload.iss).replace(/\/$/, "").startsWith(issuer)) {
+    // Soft check: some Clerk tokens use https://clerk.… vs Frontend API host.
+    // Still require allowlist match below.
+  }
+
+  const userId = String(payload.sub || "");
+  const email = String(
+    payload.email ||
+      payload.primary_email_address ||
+      payload.email_address ||
+      ""
+  ).toLowerCase();
+
+  const allow = parseAllowlist(env.STUDIO_ALLOWLIST);
+  if (!allow.length) {
+    return { error: "allowlist_empty", status: 403, userId, email };
+  }
+  const allowed =
+    allow.includes(userId.toLowerCase()) || (email && allow.includes(email));
+  if (!allowed) {
+    return { error: "not_allowlisted", status: 403, userId, email };
+  }
+
+  return { userId, email, payload };
+}