@407dev/cms-astro 0.1.0

package/dist/dev/index.js

@@ -0,0 +1,662 @@
+import { mintDevPreviewToken } from '../chunk-7LMUFCWX.js';
+export { DEV_PREVIEW_TOKEN_TTL_SECONDS, mintDevPreviewToken } from '../chunk-7LMUFCWX.js';
+import { DEFAULT_DEV_API_URL } from '../chunk-B4YYLS7Y.js';
+import { updateBundleFieldValue } from '../chunk-DMLOBKYE.js';
+import { resolveEditorOrigins } from '../chunk-XJPVYMZM.js';
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import { hashSchema } from '@407dev/blocks';
+
+var WORKSPACE_ELEVATED_ROLES = /* @__PURE__ */ new Set(["owner", "editor"]);
+function collectWorkspaceRoles(payload) {
+  const appMetadata = payload.app_metadata;
+  if (!appMetadata || typeof appMetadata !== "object") return [];
+  const roles = [];
+  if (typeof appMetadata.workspace_id === "string" && typeof appMetadata.role === "string") {
+    roles.push(appMetadata.role);
+  }
+  const workspaces = appMetadata.workspaces;
+  if (workspaces && typeof workspaces === "object") {
+    for (const entry of Object.values(workspaces)) {
+      const role = entry?.role;
+      if (typeof role === "string") roles.push(role);
+    }
+  }
+  return roles;
+}
+function base64UrlDecode(str) {
+  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  while (base64.length % 4 !== 0) {
+    base64 += "=";
+  }
+  return Buffer.from(base64, "base64").toString("utf-8");
+}
+function validateDevToken(token, options) {
+  const allowElevated = typeof options === "boolean" ? options : Boolean(options?.allowElevated);
+  if (!token || typeof token !== "string" || !token.trim()) {
+    return { ok: false, reason: "CMS_DEV_TOKEN is missing or empty" };
+  }
+  const parts = token.trim().split(".");
+  if (parts.length !== 3) {
+    return { ok: false, reason: "CMS_DEV_TOKEN is not a valid 3-part JWT" };
+  }
+  let payload;
+  try {
+    const decoded = base64UrlDecode(parts[1]);
+    payload = JSON.parse(decoded);
+    if (!payload || typeof payload !== "object") {
+      return { ok: false, reason: "CMS_DEV_TOKEN payload is not a valid JSON object" };
+    }
+  } catch {
+    return { ok: false, reason: "CMS_DEV_TOKEN payload is not decodable" };
+  }
+  if (payload.role === "service_role") {
+    return {
+      ok: false,
+      reason: "CMS_DEV_TOKEN must not be a service_role key; authenticated user JWT required"
+    };
+  }
+  if (payload.role !== "authenticated") {
+    return {
+      ok: false,
+      reason: `CMS_DEV_TOKEN has invalid role '${String(payload.role || "none")}'; expected 'authenticated'`
+    };
+  }
+  if (typeof payload.exp === "number" && payload.exp * 1e3 <= Date.now()) {
+    return { ok: false, reason: "CMS_DEV_TOKEN has expired" };
+  }
+  const workspaceRoles = collectWorkspaceRoles(payload);
+  if (!allowElevated) {
+    const elevatedRole = workspaceRoles.find((role) => WORKSPACE_ELEVATED_ROLES.has(role));
+    if (elevatedRole) {
+      return {
+        ok: false,
+        reason: `CMS_DEV_TOKEN grants workspace '${elevatedRole}' scope; only workspace-member tokens are permitted`
+      };
+    }
+  }
+  const sub = typeof payload.sub === "string" ? payload.sub : "";
+  if (!sub) {
+    return { ok: false, reason: "CMS_DEV_TOKEN is missing sub claim" };
+  }
+  const email = typeof payload.email === "string" ? payload.email : typeof payload.user_metadata?.email === "string" ? payload.user_metadata.email : void 0;
+  const exp = typeof payload.exp === "number" ? payload.exp : void 0;
+  const workspaceRole = workspaceRoles[0];
+  return {
+    ok: true,
+    identity: {
+      sub,
+      email,
+      exp,
+      workspaceRole
+    }
+  };
+}
+function signDevToken(secret, siteIdOrOptions, workspaceIdParam, userIdParam) {
+  let siteId = "00000000-0000-0000-0000-000000000002";
+  let workspaceId = "00000000-0000-0000-0000-000000000001";
+  let userId = "00000000-0000-0000-0000-000000000003";
+  if (typeof siteIdOrOptions === "object" && siteIdOrOptions !== null) {
+    if (siteIdOrOptions.siteId) siteId = siteIdOrOptions.siteId;
+    if (siteIdOrOptions.workspaceId) workspaceId = siteIdOrOptions.workspaceId;
+    if (siteIdOrOptions.userId) userId = siteIdOrOptions.userId;
+  } else {
+    if (typeof siteIdOrOptions === "string") siteId = siteIdOrOptions;
+    if (typeof workspaceIdParam === "string") workspaceId = workspaceIdParam;
+    if (typeof userIdParam === "string") userId = userIdParam;
+  }
+  const header = { alg: "HS256", typ: "JWT" };
+  const payload = {
+    aud: "authenticated",
+    role: "authenticated",
+    sub: userId,
+    email: "dev@example.com",
+    app_metadata: {
+      workspace_id: workspaceId,
+      site_id: siteId,
+      role: "viewer",
+      workspaces: {
+        [workspaceId]: { role: "viewer" }
+      },
+      sites: {
+        [siteId]: { role: "editor", workspace_id: workspaceId }
+      },
+      site_roles: {
+        [siteId]: "editor"
+      }
+    },
+    user_metadata: { role: "viewer" },
+    iat: Math.floor(Date.now() / 1e3),
+    exp: Math.floor(Date.now() / 1e3) + 3600 * 24 * 365
+  };
+  const encodedHeader = Buffer.from(JSON.stringify(header)).toString("base64url");
+  const encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const data = `${encodedHeader}.${encodedPayload}`;
+  const signature = crypto.createHmac("sha256", secret).update(data).digest("base64url");
+  return `${data}.${signature}`;
+}
+
+// src/dev/config.ts
+async function defaultLoadCredential(apiUrl, fetchFn) {
+  try {
+    const cliPkg = "@407dev/cli";
+    const cliModule = await import(
+      /* @vite-ignore */
+      cliPkg
+    );
+    if (!cliModule?.getStoredCredentials || !cliModule?.refreshCredentialsIfNeeded) {
+      return null;
+    }
+    const creds = cliModule.getStoredCredentials(apiUrl);
+    if (!creds) {
+      return null;
+    }
+    const refreshed = await cliModule.refreshCredentialsIfNeeded(apiUrl, creds, void 0, fetchFn);
+    return refreshed?.access_token || null;
+  } catch {
+    return null;
+  }
+}
+async function refreshDevConfigToken(devConfig, options = {}) {
+  if (devConfig.tokenSource !== "cli") {
+    return devConfig;
+  }
+  const exp = devConfig.identity?.exp;
+  if (typeof exp === "number" && exp - Math.floor(Date.now() / 1e3) > 60) {
+    return devConfig;
+  }
+  const loadCredential = options.loadCredential ?? ((url) => defaultLoadCredential(url, options.fetchFn));
+  try {
+    const refreshedToken = await loadCredential(devConfig.apiUrl);
+    if (!refreshedToken?.trim()) {
+      return devConfig;
+    }
+    const validation = validateDevToken(refreshedToken, { allowElevated: true });
+    if (!validation.ok) {
+      return devConfig;
+    }
+    devConfig.devToken = refreshedToken.trim();
+    devConfig.identity = validation.identity;
+  } catch {
+  }
+  return devConfig;
+}
+async function resolveDevConfig(options = {}) {
+  const siteDir = options.siteDir ? path.resolve(options.siteDir) : process.cwd();
+  const fetchClient = options.fetchFn || fetch;
+  let env = {};
+  try {
+    const vitePkg = "vite";
+    const vite = await import(
+      /* @vite-ignore */
+      vitePkg
+    );
+    if (typeof vite.loadEnv === "function") {
+      env = vite.loadEnv("development", siteDir, "");
+    }
+  } catch {
+  }
+  let devToken = env.CMS_DEV_TOKEN || process.env.CMS_DEV_TOKEN || "";
+  let tokenSource = devToken ? "env" : void 0;
+  const devSiteId = env.CMS_DEV_SITE || process.env.CMS_DEV_SITE || "";
+  const apiUrl = (options.apiUrl || env.CMS_API_URL || process.env.CMS_API_URL || DEFAULT_DEV_API_URL).replace(/\/$/, "");
+  const siteId = options.siteId || env.CMS_SITE_ID || process.env.CMS_SITE_ID || "";
+  if (!devToken) {
+    const loadCredential = options.loadCredential ?? ((url) => defaultLoadCredential(url, fetchClient));
+    try {
+      const cliToken = await loadCredential(apiUrl);
+      if (cliToken?.trim()) {
+        devToken = cliToken.trim();
+        tokenSource = "cli";
+      }
+    } catch {
+    }
+  }
+  if (!devToken && (apiUrl.includes("127.0.0.1") || apiUrl.includes("localhost"))) {
+    const jwtSecret = env.SUPABASE_JWT_SECRET || process.env.SUPABASE_JWT_SECRET || "super-secret-jwt-token-with-at-least-32-characters-long";
+    try {
+      devToken = signDevToken(jwtSecret, siteId || devSiteId || void 0);
+      tokenSource = "local-mint";
+    } catch {
+    }
+  }
+  if (!devToken || !devToken.trim()) {
+    return {
+      status: "unconfigured",
+      siteId,
+      devSiteId: devSiteId || void 0,
+      apiUrl,
+      mismatch: null,
+      reason: "Not logged in. Run `cms login` to enable dev-time editing."
+    };
+  }
+  const tokenValidation = validateDevToken(devToken, {
+    allowElevated: tokenSource === "cli"
+  });
+  if (!tokenValidation.ok) {
+    return {
+      status: "refused",
+      siteId,
+      devSiteId: devSiteId || void 0,
+      apiUrl,
+      mismatch: null,
+      reason: tokenValidation.reason,
+      tokenSource
+    };
+  }
+  const identity = tokenValidation.identity;
+  const effectiveSiteId = siteId || devSiteId;
+  if (!effectiveSiteId) {
+    return {
+      status: "refused",
+      siteId,
+      devSiteId: devSiteId || void 0,
+      apiUrl,
+      identity,
+      mismatch: null,
+      reason: "No site ID provided (set CMS_SITE_ID or siteId option)",
+      tokenSource
+    };
+  }
+  try {
+    const probeRes = await fetchClient(`${apiUrl}/sites/${encodeURIComponent(effectiveSiteId)}`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${devToken}`
+      }
+    });
+    if (!probeRes.ok) {
+      let errorDetail = "";
+      try {
+        const body = await probeRes.json();
+        errorDetail = body.error || "";
+      } catch {
+        errorDetail = probeRes.statusText || String(probeRes.status);
+      }
+      return {
+        status: "refused",
+        siteId: effectiveSiteId,
+        devSiteId: devSiteId || void 0,
+        apiUrl,
+        identity,
+        mismatch: null,
+        reason: `Site '${effectiveSiteId}' inaccessible with dev token (HTTP ${probeRes.status}: ${errorDetail})`,
+        tokenSource
+      };
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      status: "refused",
+      siteId: effectiveSiteId,
+      devSiteId: devSiteId || void 0,
+      apiUrl,
+      identity,
+      mismatch: null,
+      reason: `Failed to connect to CMS API at ${apiUrl}: ${msg}`,
+      tokenSource
+    };
+  }
+  let mismatch = null;
+  if (devSiteId && siteId && devSiteId !== siteId) {
+    mismatch = {
+      source: "CMS_DEV_SITE",
+      expected: siteId,
+      actual: devSiteId
+    };
+  }
+  if (!mismatch) {
+    const bundlePath = path.join(siteDir, ".cms", "bundle.json");
+    if (fs.existsSync(bundlePath)) {
+      try {
+        const bundleContent = JSON.parse(fs.readFileSync(bundlePath, "utf-8"));
+        if (bundleContent?.site_id && siteId && bundleContent.site_id !== siteId) {
+          mismatch = {
+            source: ".cms/bundle.json",
+            expected: siteId,
+            actual: bundleContent.site_id
+          };
+        }
+      } catch {
+      }
+    }
+  }
+  if (!mismatch) {
+    const statePath = path.join(siteDir, ".cms", "state.json");
+    if (fs.existsSync(statePath)) {
+      try {
+        const stateContent = JSON.parse(fs.readFileSync(statePath, "utf-8"));
+        const stateSiteKeys = stateContent?.sites ? Object.keys(stateContent.sites) : [];
+        if (stateSiteKeys.length > 0 && siteId && !stateSiteKeys.includes(siteId)) {
+          mismatch = {
+            source: ".cms/state.json",
+            expected: siteId,
+            actual: stateSiteKeys.join(", ")
+          };
+        }
+      } catch {
+      }
+    }
+  }
+  if (mismatch) {
+    return {
+      status: "read-only",
+      siteId: effectiveSiteId,
+      devSiteId: devSiteId || void 0,
+      apiUrl,
+      devToken,
+      identity,
+      mismatch,
+      tokenSource
+    };
+  }
+  return {
+    status: "ok",
+    siteId: effectiveSiteId,
+    devSiteId: devSiteId || effectiveSiteId,
+    apiUrl,
+    devToken,
+    identity,
+    mismatch: null,
+    tokenSource
+  };
+}
+
+// src/dev/routes.ts
+function isLoopbackAddress(remoteAddress) {
+  if (!remoteAddress) return false;
+  const cleaned = remoteAddress.trim();
+  if (cleaned === "127.0.0.1" || cleaned === "::1" || cleaned === "::ffff:127.0.0.1" || cleaned === "localhost") {
+    return true;
+  }
+  if (cleaned.startsWith("::ffff:127.") || cleaned === "0:0:0:0:0:0:0:1") {
+    return true;
+  }
+  return false;
+}
+function sendJson(res, statusCode, data) {
+  res.statusCode = statusCode;
+  res.setHeader("Content-Type", "application/json");
+  res.end(JSON.stringify(data));
+}
+async function readJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    let body = "";
+    req.on("data", (chunk) => {
+      body += chunk;
+    });
+    req.on("end", () => {
+      try {
+        resolve(body ? JSON.parse(body) : {});
+      } catch (err) {
+        reject(err);
+      }
+    });
+    req.on("error", reject);
+  });
+}
+function createDevApiMiddleware(options) {
+  const {
+    devConfig,
+    client,
+    verifier,
+    previewSecret,
+    editorOrigins,
+    fetchFn = fetch,
+    loadCredential
+  } = options;
+  return async function devApiMiddleware(req, res, next) {
+    const rawUrl = req.url || "";
+    const [pathname] = rawUrl.split("?");
+    if (!pathname.startsWith("/_cms/dev")) {
+      return next();
+    }
+    const remoteAddress = req.socket?.remoteAddress;
+    if (!isLoopbackAddress(remoteAddress)) {
+      return sendJson(res, 403, {
+        error: "Forbidden: CMS dev routes accept loopback callers only"
+      });
+    }
+    await refreshDevConfigToken(devConfig, { loadCredential, fetchFn });
+    if (devConfig.status === "refused" || devConfig.status === "unconfigured") {
+      return sendJson(res, 503, {
+        error: devConfig.reason || "CMS dev routes unconfigured",
+        status: devConfig.status
+      });
+    }
+    if (pathname === "/_cms/dev/status" && req.method === "GET") {
+      const diag = verifier ? await verifier.getDiagnostics() : {
+        available: false,
+        errors: [],
+        warnings: [],
+        localHash: null,
+        pushedHash: null,
+        fresh: true
+      };
+      return sendJson(res, 200, {
+        status: devConfig.status,
+        siteId: devConfig.siteId,
+        devSiteId: devConfig.devSiteId,
+        apiUrl: devConfig.apiUrl,
+        env: { CMS_API_URL: devConfig.apiUrl },
+        identity: devConfig.identity || null,
+        mismatch: devConfig.mismatch || null,
+        manifest: {
+          fresh: diag.fresh,
+          localHash: diag.localHash,
+          pushedHash: diag.pushedHash
+        },
+        verifier: {
+          available: diag.available,
+          errors: diag.errors,
+          warnings: diag.warnings
+        },
+        editorOrigins: resolveEditorOrigins(editorOrigins)
+      });
+    }
+    if (pathname === "/_cms/dev/bundle" && req.method === "GET") {
+      try {
+        let bundle = null;
+        if (client) {
+          try {
+            const previewToken = await mintDevPreviewToken(
+              devConfig.siteId,
+              previewSecret || client.previewSecret
+            );
+            bundle = await client.getBundle(previewToken ? { previewToken } : void 0);
+          } catch {
+            bundle = null;
+          }
+        }
+        let fields = [];
+        try {
+          const fieldsRes = await fetchFn(
+            `${devConfig.apiUrl}/sites/${encodeURIComponent(devConfig.siteId)}/fields?include_orphaned=1`,
+            {
+              method: "GET",
+              headers: {
+                Authorization: `Bearer ${devConfig.devToken}`
+              }
+            }
+          );
+          if (fieldsRes.ok) {
+            const fieldsJson = await fieldsRes.json();
+            fields = Array.isArray(fieldsJson.data) ? fieldsJson.data : [];
+          }
+        } catch {
+        }
+        return sendJson(res, 200, {
+          bundle,
+          fields
+        });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return sendJson(res, 500, { error: `Failed to load bundle: ${msg}` });
+      }
+    }
+    if (pathname === "/_cms/dev/value" && req.method === "PATCH") {
+      if (devConfig.status === "read-only") {
+        return sendJson(res, 403, {
+          error: "Toolbar is in read-only mode due to site ID mismatch",
+          mismatch: devConfig.mismatch
+        });
+      }
+      let body;
+      try {
+        body = await readJsonBody(req);
+      } catch {
+        return sendJson(res, 400, { error: "Invalid JSON request body" });
+      }
+      if (!body.key || typeof body.key !== "string") {
+        return sendJson(res, 400, { error: "Field key is required" });
+      }
+      try {
+        const upstreamRes = await fetchFn(
+          `${devConfig.apiUrl}/sites/${encodeURIComponent(devConfig.siteId)}/fields/${encodeURIComponent(body.key)}`,
+          {
+            method: "PATCH",
+            headers: {
+              "Content-Type": "application/json",
+              Authorization: `Bearer ${devConfig.devToken}`
+            },
+            body: JSON.stringify({ value: body.value })
+          }
+        );
+        const upstreamBodyText = await upstreamRes.text();
+        if (upstreamRes.ok) {
+          updateBundleFieldValue(body.key, body.value);
+        }
+        res.statusCode = upstreamRes.status;
+        res.setHeader("Content-Type", "application/json");
+        res.end(upstreamBodyText);
+        return;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return sendJson(res, 502, { error: `Upstream API request failed: ${msg}` });
+      }
+    }
+    return sendJson(res, 404, { error: "Not Found" });
+  };
+}
+function cmsDevApiPlugin(options) {
+  return {
+    name: "cms-dev-api",
+    apply: "serve",
+    enforce: "pre",
+    configureServer(server) {
+      if (options.verifier) {
+        options.verifier.attachServer(server);
+      }
+      server.middlewares.use(createDevApiMiddleware(options));
+    }
+  };
+}
+async function createVerifier(options) {
+  const { siteDir, siteId } = options;
+  let cliModule = null;
+  try {
+    const cliPkg = "@407dev/cli";
+    cliModule = await import(
+      /* @vite-ignore */
+      cliPkg
+    );
+  } catch {
+    cliModule = null;
+  }
+  let cachedState = {
+    available: Boolean(cliModule),
+    errors: [],
+    warnings: [],
+    localHash: null,
+    pushedHash: null,
+    fresh: true
+  };
+  let activeServer = null;
+  let debounceTimer = null;
+  async function run() {
+    if (!cliModule) {
+      cachedState = {
+        available: false,
+        errors: [],
+        warnings: [],
+        localHash: null,
+        pushedHash: null,
+        fresh: true
+      };
+      return cachedState;
+    }
+    try {
+      const extractResult = await cliModule.extractProject(siteDir, { noSync: true });
+      const localHash = hashSchema(extractResult.manifest);
+      const stateStorePath = path.join(siteDir, ".cms", "state.json");
+      const store = new cliModule.StateStore(stateStorePath);
+      const pushedHash = store.getSiteManifestHash(siteId);
+      const fresh = Boolean(localHash && pushedHash && localHash === pushedHash);
+      const errors = (extractResult.errors || []).map((e) => ({
+        type: "error",
+        message: e.message,
+        file: e.file,
+        line: e.line,
+        column: e.column,
+        code: e.code
+      }));
+      const warnings = (extractResult.warnings || []).map((w) => ({
+        type: "warning",
+        message: w.message,
+        file: w.file,
+        line: w.line,
+        column: w.column,
+        code: w.code
+      }));
+      cachedState = {
+        available: true,
+        errors,
+        warnings,
+        localHash,
+        pushedHash,
+        fresh
+      };
+      if (activeServer?.hot) {
+        activeServer.hot.send({
+          type: "custom",
+          event: "cms:diagnostics",
+          data: cachedState
+        });
+      }
+      return cachedState;
+    } catch (_err) {
+      return cachedState;
+    }
+  }
+  function handleFileEvent(filePath) {
+    const normalized = filePath.replace(/\\/g, "/");
+    if (normalized.includes("/src/") && /\.(astro|ts|tsx|js|mjs)$/.test(normalized) && !normalized.endsWith(".d.ts")) {
+      if (debounceTimer) {
+        clearTimeout(debounceTimer);
+      }
+      debounceTimer = setTimeout(() => {
+        debounceTimer = null;
+        run();
+      }, 300);
+    }
+  }
+  function attachServer(server) {
+    activeServer = server;
+    server.watcher.on("change", handleFileEvent);
+    server.watcher.on("add", handleFileEvent);
+    server.watcher.on("unlink", handleFileEvent);
+  }
+  if (cliModule) {
+    await run();
+  }
+  return {
+    getDiagnostics: async () => cachedState,
+    run,
+    attachServer
+  };
+}
+
+export { cmsDevApiPlugin, createDevApiMiddleware, createVerifier, isLoopbackAddress, refreshDevConfigToken, resolveDevConfig, signDevToken, validateDevToken };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map