@407dev/cms-astro 0.1.0

package/src/dev/routes.test.ts

@@ -0,0 +1,354 @@
+import { EventEmitter } from 'node:events';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { describe, expect, it, vi } from 'vitest';
+import { getActiveBundle, setBuildBundle } from '../runtime/store';
+import type { DevConfigResult } from './config';
+import { createDevApiMiddleware } from './routes';
+
+function createMockJwt(payload: Record<string, unknown>): string {
+  const header = { alg: 'HS256', typ: 'JWT' };
+  const encode = (obj: unknown) => Buffer.from(JSON.stringify(obj)).toString('base64url');
+  return `${encode(header)}.${encode(payload)}.mocksignature`;
+}
+
+function createMockReq(options: {
+  url: string;
+  method: string;
+  remoteAddress?: string | null;
+  body?: unknown;
+}): IncomingMessage {
+  const req = new EventEmitter() as unknown as IncomingMessage;
+  req.url = options.url;
+  req.method = options.method;
+  req.socket = {
+    remoteAddress:
+      options.remoteAddress !== undefined ? (options.remoteAddress as string) : '127.0.0.1',
+  } as unknown as IncomingMessage['socket'];
+  req.headers = { host: 'localhost:4321' };
+
+  process.nextTick(() => {
+    if (options.body !== undefined) {
+      req.emit('data', JSON.stringify(options.body));
+    }
+    req.emit('end');
+  });
+
+  return req;
+}
+
+function createMockRes() {
+  let statusCode = 200;
+  const headers: Record<string, string> = {};
+  let body = '';
+  let resolvePromise: (val: {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+    json: Record<string, unknown>;
+  }) => void;
+
+  const promise = new Promise<{
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+    json: Record<string, unknown>;
+  }>((resolve) => {
+    resolvePromise = resolve;
+  });
+
+  const res = {
+    get statusCode() {
+      return statusCode;
+    },
+    set statusCode(code: number) {
+      statusCode = code;
+    },
+    setHeader(name: string, value: string) {
+      headers[name.toLowerCase()] = value;
+    },
+    end(chunk?: unknown) {
+      if (chunk) body += String(chunk);
+      let json = {};
+      try {
+        json = JSON.parse(body);
+      } catch {
+        json = {};
+      }
+      resolvePromise({ status: statusCode, headers, body, json });
+    },
+  } as unknown as ServerResponse;
+
+  return { res, getResult: () => promise };
+}
+
+describe('cmsDevApiPlugin middleware routes', () => {
+  const baseOkConfig: DevConfigResult = {
+    status: 'ok',
+    siteId: 'site-123',
+    devSiteId: 'site-123',
+    apiUrl: 'http://127.0.0.1:8787',
+    devToken: 'valid.mock.token',
+    identity: { sub: 'user-1', email: 'user@example.com' },
+    mismatch: null,
+  };
+
+  it('rejects non-loopback remoteAddress with 403 Forbidden', async () => {
+    const middleware = createDevApiMiddleware({
+      devConfig: baseOkConfig,
+    });
+
+    const req = createMockReq({
+      url: '/_cms/dev/status',
+      method: 'GET',
+      remoteAddress: '198.51.100.25', // External non-loopback IP
+    });
+    const { res, getResult } = createMockRes();
+
+    middleware(req, res, () => {});
+    const result = await getResult();
+
+    expect(result.status).toBe(403);
+    expect(result.json.error).toContain('loopback');
+  });
+
+  it('returns 503 for all dev routes when status is refused', async () => {
+    const refusedConfig: DevConfigResult = {
+      status: 'refused',
+      siteId: 'site-123',
+      apiUrl: 'http://127.0.0.1:8787',
+      reason: 'CMS_DEV_TOKEN is expired',
+    };
+
+    const middleware = createDevApiMiddleware({
+      devConfig: refusedConfig,
+    });
+
+    for (const path of ['status', 'bundle', 'value']) {
+      const method = path === 'value' ? 'PATCH' : 'GET';
+      const req = createMockReq({
+        url: `/_cms/dev/${path}`,
+        method,
+        remoteAddress: '127.0.0.1',
+      });
+      const { res, getResult } = createMockRes();
+
+      middleware(req, res, () => {});
+      const result = await getResult();
+
+      expect(result.status).toBe(503);
+      expect(result.json.status).toBe('refused');
+      expect(result.json.error).toBe('CMS_DEV_TOKEN is expired');
+    }
+  });
+
+  it('returns status info on GET /_cms/dev/status', async () => {
+    const middleware = createDevApiMiddleware({
+      devConfig: baseOkConfig,
+      editorOrigins: ['http://localhost:5173'],
+    });
+
+    const req = createMockReq({
+      url: '/_cms/dev/status',
+      method: 'GET',
+      remoteAddress: '127.0.0.1',
+    });
+    const { res, getResult } = createMockRes();
+
+    middleware(req, res, () => {});
+    const result = await getResult();
+
+    expect(result.status).toBe(200);
+    expect(result.json.status).toBe('ok');
+    expect(result.json.siteId).toBe('site-123');
+    expect(result.json.identity).toEqual({ sub: 'user-1', email: 'user@example.com' });
+    expect(result.json.editorOrigins).toEqual(['http://localhost:5173']);
+  });
+
+  it('returns resolved default editorOrigins on GET /_cms/dev/status when omitted', async () => {
+    const middleware = createDevApiMiddleware({
+      devConfig: baseOkConfig,
+    });
+
+    const req = createMockReq({
+      url: '/_cms/dev/status',
+      method: 'GET',
+      remoteAddress: '127.0.0.1',
+    });
+    const { res, getResult } = createMockRes();
+
+    middleware(req, res, () => {});
+    const result = await getResult();
+
+    expect(result.status).toBe(200);
+    expect(result.json.editorOrigins).toEqual(['https://web.localhost', 'http://localhost:5173']);
+  });
+
+  it('refuses with 403 on PATCH /_cms/dev/value when status is read-only', async () => {
+    const readOnlyConfig: DevConfigResult = {
+      status: 'read-only',
+      siteId: 'site-123',
+      devSiteId: 'wrong-site-456',
+      apiUrl: 'http://127.0.0.1:8787',
+      devToken: 'valid.mock.token',
+      mismatch: {
+        source: 'CMS_DEV_SITE',
+        expected: 'site-123',
+        actual: 'wrong-site-456',
+      },
+    };
+
+    const middleware = createDevApiMiddleware({
+      devConfig: readOnlyConfig,
+    });
+
+    const req = createMockReq({
+      url: '/_cms/dev/value',
+      method: 'PATCH',
+      remoteAddress: '127.0.0.1',
+      body: { key: 'home.hero.heading', value: 'New Heading' },
+    });
+    const { res, getResult } = createMockRes();
+
+    middleware(req, res, () => {});
+    const result = await getResult();
+
+    expect(result.status).toBe(403);
+    expect(result.json.error).toContain('read-only');
+    expect(result.json.mismatch).toEqual(readOnlyConfig.mismatch);
+  });
+
+  it('forwards Authorization header and mirrors upstream 422 validation errors verbatim', async () => {
+    const stubbedFetch = vi.fn().mockResolvedValue({
+      status: 422,
+      text: async () =>
+        JSON.stringify({
+          error: 'Validation failed',
+          errors: [{ message: 'Heading exceeds maximum length of 50' }],
+        }),
+    } as unknown as Response);
+
+    const middleware = createDevApiMiddleware({
+      devConfig: baseOkConfig,
+      fetchFn: stubbedFetch as unknown as typeof fetch,
+    });
+
+    const req = createMockReq({
+      url: '/_cms/dev/value',
+      method: 'PATCH',
+      remoteAddress: '127.0.0.1',
+      body: { key: 'home.hero.heading', value: 'Very Long Value...' },
+    });
+    const { res, getResult } = createMockRes();
+
+    middleware(req, res, () => {});
+    const result = await getResult();
+
+    expect(stubbedFetch).toHaveBeenCalledWith(
+      'http://127.0.0.1:8787/sites/site-123/fields/home.hero.heading',
+      expect.objectContaining({
+        method: 'PATCH',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: 'Bearer valid.mock.token',
+        },
+        body: JSON.stringify({ value: 'Very Long Value...' }),
+      }),
+    );
+
+    expect(result.status).toBe(422);
+    expect(result.json.error).toBe('Validation failed');
+    expect(result.json.errors).toEqual([{ message: 'Heading exceeds maximum length of 50' }]);
+  });
+
+  it('refreshes a near-expired CLI-rung token before proxying a write', async () => {
+    const staleConfig: DevConfigResult = {
+      status: 'ok',
+      siteId: 'site-123',
+      devSiteId: 'site-123',
+      apiUrl: 'http://127.0.0.1:8787',
+      devToken: 'stale.mock.token',
+      identity: { sub: 'user-1', exp: Math.floor(Date.now() / 1000) - 5 },
+      mismatch: null,
+      tokenSource: 'cli',
+    };
+
+    const refreshedToken = createMockJwt({
+      role: 'authenticated',
+      sub: 'user-1',
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    });
+    const loadCredential = vi.fn().mockResolvedValue(refreshedToken);
+
+    const stubbedFetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      text: async () =>
+        JSON.stringify({ ok: true, data: { key: 'home.hero.heading', value: 'Updated' } }),
+    } as unknown as Response);
+
+    const middleware = createDevApiMiddleware({
+      devConfig: staleConfig,
+      fetchFn: stubbedFetch as unknown as typeof fetch,
+      loadCredential,
+    });
+
+    const req = createMockReq({
+      url: '/_cms/dev/value',
+      method: 'PATCH',
+      remoteAddress: '127.0.0.1',
+      body: { key: 'home.hero.heading', value: 'Updated' },
+    });
+    const { res, getResult } = createMockRes();
+
+    middleware(req, res, () => {});
+    await getResult();
+
+    expect(loadCredential).toHaveBeenCalledWith('http://127.0.0.1:8787');
+    expect(stubbedFetch).toHaveBeenCalledWith(
+      'http://127.0.0.1:8787/sites/site-123/fields/home.hero.heading',
+      expect.objectContaining({
+        headers: expect.objectContaining({ Authorization: `Bearer ${refreshedToken}` }),
+      }),
+    );
+  });
+
+  it('updates in-memory bundle when field patch succeeds', async () => {
+    setBuildBundle({
+      bundleVersion: 1,
+      site_id: 'site-123',
+      fields: { 'home.hero.heading': 'Initial Heading' },
+      collections: {},
+      entries: {},
+      routes: [],
+      redirects: [],
+      settings: { default_seo: {} },
+    });
+
+    const stubbedFetch = vi.fn().mockResolvedValue({
+      ok: true,
+      status: 200,
+      text: async () =>
+        JSON.stringify({ ok: true, data: { key: 'home.hero.heading', value: 'Updated Heading' } }),
+    } as unknown as Response);
+
+    const middleware = createDevApiMiddleware({
+      devConfig: baseOkConfig,
+      fetchFn: stubbedFetch as unknown as typeof fetch,
+    });
+
+    const req = createMockReq({
+      url: '/_cms/dev/value',
+      method: 'PATCH',
+      remoteAddress: '127.0.0.1',
+      body: { key: 'home.hero.heading', value: 'Updated Heading' },
+    });
+    const { res, getResult } = createMockRes();
+
+    middleware(req, res, () => {});
+    const result = await getResult();
+
+    expect(result.status).toBe(200);
+    const active = getActiveBundle();
+    expect(active?.fields['home.hero.heading']).toBe('Updated Heading');
+  });
+});

package/src/dev/routes.ts

@@ -0,0 +1,245 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Plugin, ViteDevServer } from 'vite';
+import { resolveEditorOrigins } from '../preview/origins';
+import { updateBundleFieldValue } from '../runtime/store';
+import type { CmsClient, ContentBundle } from '../types';
+import { type DevConfigResult, type LoadCredentialFn, refreshDevConfigToken } from './config';
+import { mintDevPreviewToken } from './preview-token';
+import type { VerifierInstance } from './verifier';
+
+export interface CmsDevApiPluginOptions {
+  devConfig: DevConfigResult;
+  client?: CmsClient | null;
+  verifier?: VerifierInstance;
+  previewSecret?: string;
+  editorOrigins?: string[];
+  fetchFn?: typeof fetch;
+  loadCredential?: LoadCredentialFn;
+}
+
+export function isLoopbackAddress(remoteAddress?: string | null): boolean {
+  if (!remoteAddress) return false;
+  const cleaned = remoteAddress.trim();
+  if (
+    cleaned === '127.0.0.1' ||
+    cleaned === '::1' ||
+    cleaned === '::ffff:127.0.0.1' ||
+    cleaned === 'localhost'
+  ) {
+    return true;
+  }
+  // IPv6 loopback variants or IPv4 mapped loopback
+  if (cleaned.startsWith('::ffff:127.') || cleaned === '0:0:0:0:0:0:0:1') {
+    return true;
+  }
+  return false;
+}
+
+function sendJson(res: ServerResponse, statusCode: number, data: unknown) {
+  res.statusCode = statusCode;
+  res.setHeader('Content-Type', 'application/json');
+  res.end(JSON.stringify(data));
+}
+
+async function readJsonBody<T = unknown>(req: IncomingMessage): Promise<T> {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    req.on('data', (chunk) => {
+      body += chunk;
+    });
+    req.on('end', () => {
+      try {
+        resolve(body ? (JSON.parse(body) as T) : ({} as T));
+      } catch (err) {
+        reject(err);
+      }
+    });
+    req.on('error', reject);
+  });
+}
+
+export function createDevApiMiddleware(options: CmsDevApiPluginOptions) {
+  const {
+    devConfig,
+    client,
+    verifier,
+    previewSecret,
+    editorOrigins,
+    fetchFn = fetch,
+    loadCredential,
+  } = options;
+
+  return async function devApiMiddleware(
+    req: IncomingMessage,
+    res: ServerResponse,
+    next: () => void,
+  ) {
+    const rawUrl = req.url || '';
+    const [pathname] = rawUrl.split('?');
+
+    if (!pathname.startsWith('/_cms/dev')) {
+      return next();
+    }
+
+    // 1. Loopback-only security gate
+    const remoteAddress = req.socket?.remoteAddress;
+    if (!isLoopbackAddress(remoteAddress)) {
+      return sendJson(res, 403, {
+        error: 'Forbidden: CMS dev routes accept loopback callers only',
+      });
+    }
+
+    await refreshDevConfigToken(devConfig, { loadCredential, fetchFn });
+
+    // 2. Refused or unconfigured gate
+    if (devConfig.status === 'refused' || devConfig.status === 'unconfigured') {
+      return sendJson(res, 503, {
+        error: devConfig.reason || 'CMS dev routes unconfigured',
+        status: devConfig.status,
+      });
+    }
+
+    // 3. Dispatch routes
+    if (pathname === '/_cms/dev/status' && req.method === 'GET') {
+      const diag = verifier
+        ? await verifier.getDiagnostics()
+        : {
+            available: false,
+            errors: [],
+            warnings: [],
+            localHash: null,
+            pushedHash: null,
+            fresh: true,
+          };
+
+      return sendJson(res, 200, {
+        status: devConfig.status,
+        siteId: devConfig.siteId,
+        devSiteId: devConfig.devSiteId,
+        apiUrl: devConfig.apiUrl,
+        env: { CMS_API_URL: devConfig.apiUrl },
+        identity: devConfig.identity || null,
+        mismatch: devConfig.mismatch || null,
+        manifest: {
+          fresh: diag.fresh,
+          localHash: diag.localHash,
+          pushedHash: diag.pushedHash,
+        },
+        verifier: {
+          available: diag.available,
+          errors: diag.errors,
+          warnings: diag.warnings,
+        },
+        editorOrigins: resolveEditorOrigins(editorOrigins),
+      });
+    }
+
+    if (pathname === '/_cms/dev/bundle' && req.method === 'GET') {
+      try {
+        let bundle: ContentBundle | null = null;
+        if (client) {
+          try {
+            const previewToken = await mintDevPreviewToken(
+              devConfig.siteId,
+              previewSecret || client.previewSecret,
+            );
+            bundle = await client.getBundle(previewToken ? { previewToken } : undefined);
+          } catch {
+            bundle = null;
+          }
+        }
+
+        // Fetch fields from write API
+        let fields: unknown[] = [];
+        try {
+          const fieldsRes = await fetchFn(
+            `${devConfig.apiUrl}/sites/${encodeURIComponent(devConfig.siteId)}/fields?include_orphaned=1`,
+            {
+              method: 'GET',
+              headers: {
+                Authorization: `Bearer ${devConfig.devToken}`,
+              },
+            },
+          );
+          if (fieldsRes.ok) {
+            const fieldsJson = (await fieldsRes.json()) as { ok?: boolean; data?: unknown[] };
+            fields = Array.isArray(fieldsJson.data) ? fieldsJson.data : [];
+          }
+        } catch {
+          // Keep empty fields on failure
+        }
+
+        return sendJson(res, 200, {
+          bundle,
+          fields,
+        });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return sendJson(res, 500, { error: `Failed to load bundle: ${msg}` });
+      }
+    }
+
+    if (pathname === '/_cms/dev/value' && req.method === 'PATCH') {
+      if (devConfig.status === 'read-only') {
+        return sendJson(res, 403, {
+          error: 'Toolbar is in read-only mode due to site ID mismatch',
+          mismatch: devConfig.mismatch,
+        });
+      }
+
+      let body: { key?: string; value?: unknown };
+      try {
+        body = await readJsonBody<{ key?: string; value?: unknown }>(req);
+      } catch {
+        return sendJson(res, 400, { error: 'Invalid JSON request body' });
+      }
+
+      if (!body.key || typeof body.key !== 'string') {
+        return sendJson(res, 400, { error: 'Field key is required' });
+      }
+
+      try {
+        const upstreamRes = await fetchFn(
+          `${devConfig.apiUrl}/sites/${encodeURIComponent(devConfig.siteId)}/fields/${encodeURIComponent(body.key)}`,
+          {
+            method: 'PATCH',
+            headers: {
+              'Content-Type': 'application/json',
+              Authorization: `Bearer ${devConfig.devToken}`,
+            },
+            body: JSON.stringify({ value: body.value }),
+          },
+        );
+
+        const upstreamBodyText = await upstreamRes.text();
+        if (upstreamRes.ok) {
+          updateBundleFieldValue(body.key, body.value);
+        }
+        res.statusCode = upstreamRes.status;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(upstreamBodyText);
+        return;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return sendJson(res, 502, { error: `Upstream API request failed: ${msg}` });
+      }
+    }
+
+    // Unmatched /_cms/dev path
+    return sendJson(res, 404, { error: 'Not Found' });
+  };
+}
+
+export function cmsDevApiPlugin(options: CmsDevApiPluginOptions): Plugin {
+  return {
+    name: 'cms-dev-api',
+    apply: 'serve',
+    enforce: 'pre',
+    configureServer(server: ViteDevServer) {
+      if (options.verifier) {
+        options.verifier.attachServer(server);
+      }
+      server.middlewares.use(createDevApiMiddleware(options));
+    },
+  };
+}