@407dev/cms-astro 0.1.0

package/src/dev/config.test.ts

@@ -0,0 +1,258 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { type DevConfigResult, refreshDevConfigToken, resolveDevConfig } from './config';
+
+function createMockJwt(payload: Record<string, unknown>): string {
+  const header = { alg: 'HS256', typ: 'JWT' };
+  const encode = (obj: unknown) =>
+    Buffer.from(JSON.stringify(obj))
+      .toString('base64')
+      .replace(/\+/g, '-')
+      .replace(/\//g, '_')
+      .replace(/=+$/, '');
+  return `${encode(header)}.${encode(payload)}.mocksignature`;
+}
+
+describe('resolveDevConfig', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  const mockFetchOk = vi.fn().mockImplementation(async (url: string) => {
+    if (url.includes('/sites/site-123')) {
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({ id: 'site-123', name: 'Test Site' }),
+      };
+    }
+    return {
+      ok: false,
+      status: 404,
+      statusText: 'Not Found',
+      json: async () => ({ error: 'Site not found' }),
+    };
+  });
+
+  it('auto-mints dev JWT and connects when targeting local API without explicit CMS_DEV_TOKEN', async () => {
+    vi.stubEnv('CMS_DEV_TOKEN', '');
+
+    const result = await resolveDevConfig({
+      siteId: 'site-123',
+      apiUrl: 'http://127.0.0.1:8787',
+      fetchFn: mockFetchOk,
+      loadCredential: async () => null,
+    });
+
+    expect(result.status).toBe('ok');
+    expect(result.siteId).toBe('site-123');
+    expect(result.tokenSource).toBe('local-mint');
+    expect(typeof result.devToken).toBe('string');
+    expect(result.devToken?.split('.').length).toBe(3);
+    expect(result.identity?.sub).toBe('00000000-0000-0000-0000-000000000003');
+    expect(result.identity?.workspaceRole).toBe('viewer');
+  });
+
+  it('marks unconfigured when targeting remote API without CMS_DEV_TOKEN and no stored CLI credential', async () => {
+    vi.stubEnv('CMS_DEV_TOKEN', '');
+
+    const result = await resolveDevConfig({
+      siteId: 'site-123',
+      apiUrl: 'https://api.cms.example.com',
+      fetchFn: mockFetchOk,
+      loadCredential: async () => null,
+    });
+
+    expect(result.status).toBe('unconfigured');
+    expect(result.reason).toContain('cms login');
+  });
+
+  it('uses CLI credential when env var is absent', async () => {
+    vi.stubEnv('CMS_DEV_TOKEN', '');
+
+    const cliToken = createMockJwt({
+      role: 'authenticated',
+      sub: 'usr-cli',
+      email: 'cli@example.com',
+      exp: Math.floor(Date.now() / 1000) + 3600,
+      app_metadata: {
+        role: 'viewer',
+      },
+    });
+
+    const loadCredential = vi.fn().mockResolvedValue(cliToken);
+
+    const result = await resolveDevConfig({
+      siteId: 'site-123',
+      apiUrl: 'https://api.cms.example.com',
+      fetchFn: mockFetchOk,
+      loadCredential,
+    });
+
+    expect(result.status).toBe('ok');
+    expect(result.devToken).toBe(cliToken);
+    expect(result.tokenSource).toBe('cli');
+    expect(result.identity?.email).toBe('cli@example.com');
+    expect(result.identity?.sub).toBe('usr-cli');
+    expect(loadCredential).toHaveBeenCalledWith('https://api.cms.example.com');
+  });
+
+  it('env var wins over CLI credential', async () => {
+    const envToken = createMockJwt({
+      role: 'authenticated',
+      sub: 'usr-env',
+      email: 'env@example.com',
+      exp: Math.floor(Date.now() / 1000) + 3600,
+      app_metadata: {
+        role: 'viewer',
+      },
+    });
+
+    const cliToken = createMockJwt({
+      role: 'authenticated',
+      sub: 'usr-cli',
+      email: 'cli@example.com',
+      exp: Math.floor(Date.now() / 1000) + 3600,
+      app_metadata: {
+        role: 'viewer',
+      },
+    });
+
+    vi.stubEnv('CMS_DEV_TOKEN', envToken);
+    const loadCredential = vi.fn().mockResolvedValue(cliToken);
+
+    const result = await resolveDevConfig({
+      siteId: 'site-123',
+      apiUrl: 'https://api.cms.example.com',
+      fetchFn: mockFetchOk,
+      loadCredential,
+    });
+
+    expect(result.status).toBe('ok');
+    expect(result.devToken).toBe(envToken);
+    expect(result.tokenSource).toBe('env');
+    expect(result.identity?.email).toBe('env@example.com');
+    expect(loadCredential).not.toHaveBeenCalled();
+  });
+
+  it('CLI rung accepts an owner/editor token', async () => {
+    vi.stubEnv('CMS_DEV_TOKEN', '');
+
+    const ownerToken = createMockJwt({
+      role: 'authenticated',
+      sub: 'usr-owner',
+      email: 'owner@example.com',
+      exp: Math.floor(Date.now() / 1000) + 3600,
+      app_metadata: {
+        workspace_id: 'ws-1',
+        role: 'owner',
+      },
+    });
+
+    const result = await resolveDevConfig({
+      siteId: 'site-123',
+      apiUrl: 'https://api.cms.example.com',
+      fetchFn: mockFetchOk,
+      loadCredential: async () => ownerToken,
+    });
+
+    expect(result.status).toBe('ok');
+    expect(result.tokenSource).toBe('cli');
+    expect(result.identity?.workspaceRole).toBe('owner');
+    expect(result.identity?.email).toBe('owner@example.com');
+  });
+
+  it('env var refuses an owner/editor token', async () => {
+    const ownerToken = createMockJwt({
+      role: 'authenticated',
+      sub: 'usr-owner',
+      email: 'owner@example.com',
+      exp: Math.floor(Date.now() / 1000) + 3600,
+      app_metadata: {
+        workspace_id: 'ws-1',
+        role: 'owner',
+      },
+    });
+
+    vi.stubEnv('CMS_DEV_TOKEN', ownerToken);
+
+    const result = await resolveDevConfig({
+      siteId: 'site-123',
+      apiUrl: 'https://api.cms.example.com',
+      fetchFn: mockFetchOk,
+    });
+
+    expect(result.status).toBe('refused');
+    expect(result.tokenSource).toBe('env');
+    expect(result.reason).toContain("workspace 'owner' scope");
+  });
+});
+
+describe('refreshDevConfigToken', () => {
+  const baseCliConfig: DevConfigResult = {
+    status: 'ok',
+    siteId: 'site-123',
+    apiUrl: 'https://api.cms.example.com',
+    devToken: 'stale.mock.token',
+    identity: { sub: 'usr-cli', exp: Math.floor(Date.now() / 1000) - 5 },
+    mismatch: null,
+    tokenSource: 'cli',
+  };
+
+  it('leaves non-CLI-rung tokens untouched', async () => {
+    const envConfig: DevConfigResult = { ...baseCliConfig, tokenSource: 'env' };
+    const loadCredential = vi.fn();
+
+    const result = await refreshDevConfigToken(envConfig, { loadCredential });
+
+    expect(loadCredential).not.toHaveBeenCalled();
+    expect(result.devToken).toBe('stale.mock.token');
+  });
+
+  it('leaves a CLI token untouched when it is not near expiry', async () => {
+    const freshConfig: DevConfigResult = {
+      ...baseCliConfig,
+      identity: { sub: 'usr-cli', exp: Math.floor(Date.now() / 1000) + 3600 },
+    };
+    const loadCredential = vi.fn();
+
+    const result = await refreshDevConfigToken(freshConfig, { loadCredential });
+
+    expect(loadCredential).not.toHaveBeenCalled();
+    expect(result.devToken).toBe('stale.mock.token');
+  });
+
+  it('refreshes and mutates in place when a CLI token is near expiry', async () => {
+    const refreshedToken = createMockJwt({
+      role: 'authenticated',
+      sub: 'usr-cli',
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    });
+    const loadCredential = vi.fn().mockResolvedValue(refreshedToken);
+    const config = { ...baseCliConfig };
+
+    const result = await refreshDevConfigToken(config, { loadCredential });
+
+    expect(loadCredential).toHaveBeenCalledWith('https://api.cms.example.com');
+    expect(result).toBe(config);
+    expect(result.devToken).toBe(refreshedToken);
+    expect(result.identity?.sub).toBe('usr-cli');
+  });
+
+  it('keeps the stale token when refresh fails', async () => {
+    const loadCredential = vi.fn().mockRejectedValue(new Error('refresh_token expired'));
+    const config = { ...baseCliConfig };
+
+    const result = await refreshDevConfigToken(config, { loadCredential });
+
+    expect(result.devToken).toBe('stale.mock.token');
+  });
+
+  it('keeps the stale token when the refreshed credential fails validation', async () => {
+    const loadCredential = vi.fn().mockResolvedValue('not-a-jwt');
+    const config = { ...baseCliConfig };
+
+    const result = await refreshDevConfigToken(config, { loadCredential });
+
+    expect(result.devToken).toBe('stale.mock.token');
+  });
+});

package/src/dev/config.ts

@@ -0,0 +1,319 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { DEFAULT_DEV_API_URL } from '@407dev/config';
+import { type DevTokenIdentity, signDevToken, validateDevToken } from './token';
+
+export type DevConfigStatus = 'ok' | 'read-only' | 'refused' | 'unconfigured';
+export type DevTokenSource = 'env' | 'cli' | 'local-mint';
+export type LoadCredentialFn = (apiUrl: string) => Promise<string | null> | string | null;
+
+export interface DevSiteMismatch {
+  source: string;
+  expected: string;
+  actual: string;
+}
+
+export interface DevConfigResult {
+  status: DevConfigStatus;
+  siteId: string;
+  devSiteId?: string;
+  apiUrl: string;
+  devToken?: string;
+  identity?: DevTokenIdentity | null;
+  mismatch?: DevSiteMismatch | null;
+  reason?: string;
+  tokenSource?: DevTokenSource;
+}
+
+export interface ResolveDevConfigOptions {
+  siteId?: string;
+  apiUrl?: string;
+  siteDir?: string;
+  fetchFn?: typeof fetch;
+  loadCredential?: LoadCredentialFn;
+}
+
+async function defaultLoadCredential(
+  apiUrl: string,
+  fetchFn?: typeof fetch,
+): Promise<string | null> {
+  try {
+    const cliPkg = '@407dev/cli';
+    const cliModule = await import(/* @vite-ignore */ cliPkg);
+    if (!cliModule?.getStoredCredentials || !cliModule?.refreshCredentialsIfNeeded) {
+      return null;
+    }
+    const creds = cliModule.getStoredCredentials(apiUrl);
+    if (!creds) {
+      return null;
+    }
+    const refreshed = await cliModule.refreshCredentialsIfNeeded(apiUrl, creds, undefined, fetchFn);
+    return refreshed?.access_token || null;
+  } catch {
+    return null;
+  }
+}
+
+export interface RefreshDevConfigTokenOptions {
+  loadCredential?: LoadCredentialFn;
+  fetchFn?: typeof fetch;
+}
+
+// resolveDevConfig runs once at startup, so the CLI rung's ~1h access_token needs refreshing on later requests; mutates devConfig in place since callers hold onto the single startup instance.
+export async function refreshDevConfigToken(
+  devConfig: DevConfigResult,
+  options: RefreshDevConfigTokenOptions = {},
+): Promise<DevConfigResult> {
+  if (devConfig.tokenSource !== 'cli') {
+    return devConfig;
+  }
+
+  const exp = devConfig.identity?.exp;
+  if (typeof exp === 'number' && exp - Math.floor(Date.now() / 1000) > 60) {
+    return devConfig;
+  }
+
+  const loadCredential =
+    options.loadCredential ?? ((url: string) => defaultLoadCredential(url, options.fetchFn));
+
+  try {
+    const refreshedToken = await loadCredential(devConfig.apiUrl);
+    if (!refreshedToken?.trim()) {
+      return devConfig;
+    }
+
+    const validation = validateDevToken(refreshedToken, { allowElevated: true });
+    if (!validation.ok) {
+      return devConfig;
+    }
+
+    devConfig.devToken = refreshedToken.trim();
+    devConfig.identity = validation.identity;
+  } catch {
+    // Keep the existing (possibly stale) token; the proxied upstream call surfaces the failure.
+  }
+
+  return devConfig;
+}
+
+/**
+ * Resolves dev environment configuration, validates the user dev JWT, probes
+ * the write API for site accessibility, and verifies site identity consistency.
+ */
+export async function resolveDevConfig(
+  options: ResolveDevConfigOptions = {},
+): Promise<DevConfigResult> {
+  const siteDir = options.siteDir ? path.resolve(options.siteDir) : process.cwd();
+  const fetchClient = options.fetchFn || fetch;
+
+  // Load environment variables via Vite's loadEnv to match .env files
+  let env: Record<string, string> = {};
+  try {
+    const vitePkg = 'vite';
+    const vite = await import(/* @vite-ignore */ vitePkg);
+    if (typeof vite.loadEnv === 'function') {
+      env = vite.loadEnv('development', siteDir, '');
+    }
+  } catch {
+    // Fall back to process.env
+  }
+
+  let devToken = env.CMS_DEV_TOKEN || process.env.CMS_DEV_TOKEN || '';
+  let tokenSource: DevTokenSource | undefined = devToken ? 'env' : undefined;
+  const devSiteId = env.CMS_DEV_SITE || process.env.CMS_DEV_SITE || '';
+  const apiUrl = (
+    options.apiUrl ||
+    env.CMS_API_URL ||
+    process.env.CMS_API_URL ||
+    DEFAULT_DEV_API_URL
+  ).replace(/\/$/, '');
+  const siteId = options.siteId || env.CMS_SITE_ID || process.env.CMS_SITE_ID || '';
+
+  // 2nd rung: CLI session (stored credentials)
+  if (!devToken) {
+    const loadCredential =
+      options.loadCredential ?? ((url) => defaultLoadCredential(url, fetchClient));
+    try {
+      const cliToken = await loadCredential(apiUrl);
+      if (cliToken?.trim()) {
+        devToken = cliToken.trim();
+        tokenSource = 'cli';
+      }
+    } catch {
+      // Swallow failure and fall through
+    }
+  }
+
+  // 3rd rung: Auto-mint development JWT if running against local API and token is not explicitly configured
+  if (!devToken && (apiUrl.includes('127.0.0.1') || apiUrl.includes('localhost'))) {
+    const jwtSecret =
+      env.SUPABASE_JWT_SECRET ||
+      process.env.SUPABASE_JWT_SECRET ||
+      'super-secret-jwt-token-with-at-least-32-characters-long';
+    try {
+      devToken = signDevToken(jwtSecret, siteId || devSiteId || undefined);
+      tokenSource = 'local-mint';
+    } catch {
+      // Fall through to unconfigured check
+    }
+  }
+
+  // 1. Unconfigured check
+  if (!devToken || !devToken.trim()) {
+    return {
+      status: 'unconfigured',
+      siteId,
+      devSiteId: devSiteId || undefined,
+      apiUrl,
+      mismatch: null,
+      reason: 'Not logged in. Run `cms login` to enable dev-time editing.',
+    };
+  }
+
+  // 2. Token format and scope validation (CLI rung allows elevated roles)
+  const tokenValidation = validateDevToken(devToken, {
+    allowElevated: tokenSource === 'cli',
+  });
+  if (!tokenValidation.ok) {
+    return {
+      status: 'refused',
+      siteId,
+      devSiteId: devSiteId || undefined,
+      apiUrl,
+      mismatch: null,
+      reason: tokenValidation.reason,
+      tokenSource,
+    };
+  }
+
+  const identity = tokenValidation.identity;
+
+  // 3. Probe site accessibility on API via GET /sites/:id with token
+  const effectiveSiteId = siteId || devSiteId;
+  if (!effectiveSiteId) {
+    return {
+      status: 'refused',
+      siteId,
+      devSiteId: devSiteId || undefined,
+      apiUrl,
+      identity,
+      mismatch: null,
+      reason: 'No site ID provided (set CMS_SITE_ID or siteId option)',
+      tokenSource,
+    };
+  }
+
+  try {
+    const probeRes = await fetchClient(`${apiUrl}/sites/${encodeURIComponent(effectiveSiteId)}`, {
+      method: 'GET',
+      headers: {
+        Authorization: `Bearer ${devToken}`,
+      },
+    });
+
+    if (!probeRes.ok) {
+      let errorDetail = '';
+      try {
+        const body = (await probeRes.json()) as { error?: string };
+        errorDetail = body.error || '';
+      } catch {
+        errorDetail = probeRes.statusText || String(probeRes.status);
+      }
+      return {
+        status: 'refused',
+        siteId: effectiveSiteId,
+        devSiteId: devSiteId || undefined,
+        apiUrl,
+        identity,
+        mismatch: null,
+        reason: `Site '${effectiveSiteId}' inaccessible with dev token (HTTP ${probeRes.status}: ${errorDetail})`,
+        tokenSource,
+      };
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      status: 'refused',
+      siteId: effectiveSiteId,
+      devSiteId: devSiteId || undefined,
+      apiUrl,
+      identity,
+      mismatch: null,
+      reason: `Failed to connect to CMS API at ${apiUrl}: ${msg}`,
+      tokenSource,
+    };
+  }
+
+  // 4. Site identity comparison (Wrong-site guard)
+  // Check against CMS_DEV_SITE, .cms/bundle.json, and .cms/state.json
+  let mismatch: DevSiteMismatch | null = null;
+
+  if (devSiteId && siteId && devSiteId !== siteId) {
+    mismatch = {
+      source: 'CMS_DEV_SITE',
+      expected: siteId,
+      actual: devSiteId,
+    };
+  }
+
+  if (!mismatch) {
+    const bundlePath = path.join(siteDir, '.cms', 'bundle.json');
+    if (fs.existsSync(bundlePath)) {
+      try {
+        const bundleContent = JSON.parse(fs.readFileSync(bundlePath, 'utf-8'));
+        if (bundleContent?.site_id && siteId && bundleContent.site_id !== siteId) {
+          mismatch = {
+            source: '.cms/bundle.json',
+            expected: siteId,
+            actual: bundleContent.site_id,
+          };
+        }
+      } catch {
+        // Ignore unreadable bundle.json
+      }
+    }
+  }
+
+  if (!mismatch) {
+    const statePath = path.join(siteDir, '.cms', 'state.json');
+    if (fs.existsSync(statePath)) {
+      try {
+        const stateContent = JSON.parse(fs.readFileSync(statePath, 'utf-8'));
+        const stateSiteKeys = stateContent?.sites ? Object.keys(stateContent.sites) : [];
+        if (stateSiteKeys.length > 0 && siteId && !stateSiteKeys.includes(siteId)) {
+          mismatch = {
+            source: '.cms/state.json',
+            expected: siteId,
+            actual: stateSiteKeys.join(', '),
+          };
+        }
+      } catch {
+        // Ignore unreadable state.json
+      }
+    }
+  }
+
+  if (mismatch) {
+    return {
+      status: 'read-only',
+      siteId: effectiveSiteId,
+      devSiteId: devSiteId || undefined,
+      apiUrl,
+      devToken,
+      identity,
+      mismatch,
+      tokenSource,
+    };
+  }
+
+  return {
+    status: 'ok',
+    siteId: effectiveSiteId,
+    devSiteId: devSiteId || effectiveSiteId,
+    apiUrl,
+    devToken,
+    identity,
+    mismatch: null,
+    tokenSource,
+  };
+}

package/src/dev/index.ts

@@ -0,0 +1,5 @@
+export * from './config';
+export * from './preview-token';
+export * from './routes';
+export * from './token';
+export * from './verifier';

package/src/dev/preview-token.ts

@@ -0,0 +1,39 @@
+import { getJwtSecret } from '@407dev/config';
+import { signPreviewToken } from '../jwt';
+
+export const DEV_PREVIEW_TOKEN_TTL_SECONDS = 60 * 60 * 12;
+
+/** Self-mints a preview token for dev-mode draft reads using the shared preview secret. */
+export async function mintDevPreviewToken(
+  siteId: string,
+  previewSecret: string | undefined,
+): Promise<string | null> {
+  const secret =
+    previewSecret ||
+    (typeof process !== 'undefined'
+      ? process.env?.CMS_PREVIEW_SECRET || process.env?.JWT_SECRET
+      : undefined) ||
+    (() => {
+      try {
+        return getJwtSecret();
+      } catch {
+        return undefined;
+      }
+    })();
+
+  if (!secret || !siteId) {
+    return null;
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+  return signPreviewToken(
+    {
+      site_id: siteId,
+      sub: 'astro-dev',
+      scope: 'cms:preview',
+      iat: now,
+      exp: now + DEV_PREVIEW_TOKEN_TTL_SECONDS,
+    },
+    secret,
+  );
+}