@aaqu/fromcubes-portal-react 0.1.0-alpha.2 → 0.1.0-alpha.21

package/nodes/lib/assets.js

@@ -0,0 +1,212 @@
+/**
+ * Portal Assets — static file serving with security validation.
+ *
+ * Exports pure validation functions (for testing) and a registerAssets factory
+ * that mounts Express routes on RED.httpAdmin / RED.httpNode.
+ */
+
+const fs = require("fs");
+const path = require("path");
+
+// ── Constants ─────────────────────────────────────────────────
+
+const UNSAFE_EXTS = new Set([".html", ".htm", ".svg", ".js", ".mjs", ".xml", ".xhtml"]);
+const RESERVED_NAMES = /^(CON|PRN|AUX|NUL|COM\d|LPT\d)(\.|$)/i;
+const MAX_PATH_DEPTH = 10;
+const MAX_ASSETS_BYTES = 500 * 1024 * 1024; // 500 MB total
+const MAX_ASSETS_FILES = 1000;
+
+// ── Pure validators ───────────────────────────────────────────
+
+function isSafePathSegment(s) {
+  return (
+    typeof s === "string" &&
+    s.length > 0 &&
+    s.length <= 255 &&
+    !/[\\:*?"<>|\0]/.test(s) &&
+    !s.startsWith(".") &&
+    !s.endsWith(".") &&
+    !s.endsWith(" ") &&
+    s !== ".." &&
+    !RESERVED_NAMES.test(s)
+  );
+}
+
+function safePath(rel, assetsDir) {
+  if (!rel || typeof rel !== "string") return null;
+  const segments = rel.split("/").filter(Boolean);
+  if (segments.length === 0 || segments.length > MAX_PATH_DEPTH) return null;
+  if (!segments.every(isSafePathSegment)) return null;
+  const resolved = path.resolve(assetsDir, ...segments);
+  if (!resolved.startsWith(assetsDir + path.sep) && resolved !== assetsDir)
+    return null;
+  try {
+    const real = fs.realpathSync(resolved);
+    if (!real.startsWith(assetsDir + path.sep) && real !== assetsDir)
+      return null;
+  } catch (_e) { /* path doesn't exist yet — OK for mkdir/upload */ }
+  return resolved;
+}
+
+// ── Filesystem helpers ────────────────────────────────────────
+
+function scanDir(dir, prefix) {
+  const results = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) continue;
+    const rel = prefix ? prefix + "/" + entry.name : entry.name;
+    if (entry.isDirectory()) {
+      results.push({ name: rel, type: "dir" });
+      results.push(...scanDir(path.join(dir, entry.name), rel));
+    } else if (entry.isFile()) {
+      const stat = fs.statSync(path.join(dir, entry.name));
+      results.push({ name: rel, type: "file", size: stat.size, mtime: stat.mtimeMs });
+    }
+  }
+  return results;
+}
+
+function getAssetsStats(assetsDir) {
+  let size = 0, count = 0;
+  function walk(dir) {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (e.isSymbolicLink()) continue;
+      const p = path.join(dir, e.name);
+      if (e.isDirectory()) walk(p);
+      else if (e.isFile()) { size += fs.statSync(p).size; count++; }
+    }
+  }
+  try { walk(assetsDir); } catch (_e) { /* ignore */ }
+  return { size, count };
+}
+
+// ── Route registration ────────────────────────────────────────
+
+function registerAssets(RED, express, assetsDir) {
+  fs.mkdirSync(assetsDir, { recursive: true });
+
+  // Security middleware for public serving
+  RED.httpNode.use(
+    "/fromcubes/public",
+    (req, res, next) => {
+      res.set("X-Content-Type-Options", "nosniff");
+      res.set("Content-Security-Policy", "default-src 'none'");
+      const ext = path.extname(req.path).toLowerCase();
+      if (UNSAFE_EXTS.has(ext)) {
+        res.set("Content-Disposition", "attachment");
+      }
+      next();
+    },
+    express.static(assetsDir, { maxAge: "1d" }),
+  );
+
+  // List assets
+  RED.httpAdmin.get("/portal-react/assets", (_req, res) => {
+    try {
+      res.json(scanDir(assetsDir, ""));
+    } catch (e) {
+      res.json([]);
+    }
+  });
+
+  // Create directory
+  RED.httpAdmin.post("/portal-react/assets/mkdir", express.json(), (req, res) => {
+    const target = safePath(req.body && req.body.path, assetsDir);
+    if (!target) return res.status(400).json({ error: "invalid path" });
+    try {
+      fs.mkdirSync(target, { recursive: true });
+      res.json({ ok: true });
+    } catch (e) {
+      RED.log.error("portal-react assets mkdir: " + e.message);
+      res.status(500).json({ error: "internal error" });
+    }
+  });
+
+  // Move / rename
+  RED.httpAdmin.post("/portal-react/assets/move", express.json(), (req, res) => {
+    const from = safePath(req.body && req.body.from, assetsDir);
+    const to = safePath(req.body && req.body.to, assetsDir);
+    if (!from || !to) return res.status(400).json({ error: "invalid path" });
+    const toName = path.basename(to);
+    if (!toName || !toName.trim()) return res.status(400).json({ error: "name cannot be empty" });
+    try {
+      const toDir = path.dirname(to);
+      fs.mkdirSync(toDir, { recursive: true });
+      fs.renameSync(from, to);
+      res.json({ ok: true });
+    } catch (e) {
+      RED.log.error("portal-react assets move: " + e.message);
+      res.status(500).json({ error: "internal error" });
+    }
+  });
+
+  // Upload
+  RED.httpAdmin.post(
+    "/portal-react/assets/upload/*",
+    express.raw({ type: "*/*", limit: "100mb" }),
+    (req, res) => {
+      const rel = req.params[0];
+      const target = safePath(rel, assetsDir);
+      if (!target) return res.status(400).json({ error: "invalid path" });
+      const stats = getAssetsStats(assetsDir);
+      if (stats.size + req.body.length > MAX_ASSETS_BYTES)
+        return res.status(413).json({ error: "storage limit exceeded (500MB)" });
+      if (stats.count >= MAX_ASSETS_FILES)
+        return res.status(413).json({ error: "file count limit exceeded (1000)" });
+      try {
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, req.body);
+        res.json({ ok: true });
+      } catch (e) {
+        RED.log.error("portal-react assets upload: " + e.message);
+        res.status(500).json({ error: "internal error" });
+      }
+    },
+  );
+
+  // Delete
+  RED.httpAdmin.delete("/portal-react/assets/*", (req, res) => {
+    const rel = req.params[0];
+    const target = safePath(rel, assetsDir);
+    if (!target) return res.status(400).json({ error: "invalid path" });
+    try {
+      fs.rmSync(target, { recursive: true, force: true });
+      res.json({ ok: true });
+    } catch (e) {
+      RED.log.error("portal-react assets delete: " + e.message);
+      res.status(404).json({ error: "not found" });
+    }
+  });
+
+  // Download
+  RED.httpAdmin.get("/portal-react/assets/download/*", (req, res) => {
+    const rel = req.params[0];
+    const target = safePath(rel, assetsDir);
+    if (!target) return res.status(400).json({ error: "invalid path" });
+    try {
+      const stat = fs.statSync(target);
+      if (stat.isDirectory()) return res.status(400).json({ error: "is a directory" });
+      const filename = path.basename(target);
+      res.set({
+        "Content-Disposition": 'attachment; filename="' + filename.replace(/"/g, '\\"') + '"',
+        "Content-Length": stat.size,
+      });
+      fs.createReadStream(target).pipe(res);
+    } catch (e) {
+      res.status(404).json({ error: "not found" });
+    }
+  });
+}
+
+module.exports = {
+  UNSAFE_EXTS,
+  RESERVED_NAMES,
+  MAX_PATH_DEPTH,
+  MAX_ASSETS_BYTES,
+  MAX_ASSETS_FILES,
+  isSafePathSegment,
+  safePath,
+  scanDir,
+  getAssetsStats,
+  registerAssets,
+};

package/nodes/lib/helpers.js

@@ -0,0 +1,314 @@
+/**
+ * Shared helper functions for portal-react.
+ */
+
+const crypto = require("crypto");
+const fs = require("fs");
+const path = require("path");
+const esbuild = require("esbuild");
+
+function hash(str) {
+  return crypto.createHash("sha256").update(str).digest("hex").slice(0, 16);
+}
+
+const twCompile = require("tailwindcss").compile;
+const CANDIDATE_RE = /[a-zA-Z0-9_\-:.\/\[\]#%]+/g;
+
+let twCompiled = null;
+async function getTwCompiled() {
+  if (twCompiled) return twCompiled;
+  twCompiled = await twCompile(`@import 'tailwindcss';`, {
+    loadStylesheet: async (id, base) => {
+      let resolved;
+      if (id === "tailwindcss") {
+        resolved = require.resolve("tailwindcss/index.css");
+      } else {
+        resolved = require.resolve(id, { paths: [base || __dirname] });
+      }
+      return {
+        content: fs.readFileSync(resolved, "utf8"),
+        base: path.dirname(resolved),
+      };
+    },
+  });
+  return twCompiled;
+}
+
+async function generateCSS(source) {
+  const cssHash = hash(source);
+  const compiled = await getTwCompiled();
+  const candidates = [...new Set(source.match(CANDIDATE_RE) || [])];
+  const css = compiled.build(candidates);
+  return { css, cssHash };
+}
+
+const FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+function isSafeName(name) {
+  return (
+    typeof name === "string" && name.length > 0 && !FORBIDDEN_KEYS.has(name)
+  );
+}
+
+const SUB_PATH_SEGMENT_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+const SUB_PATH_RESERVED = new Set(["public", "_ws"]);
+
+function validateSubPath(input) {
+  if (typeof input !== "string") {
+    return { ok: false, error: "Sub-path is required" };
+  }
+  const trimmed = input.trim();
+  if (trimmed.length === 0) {
+    return { ok: false, error: "Sub-path is required" };
+  }
+  if (/\s/.test(trimmed)) {
+    return { ok: false, error: "Sub-path must not contain whitespace" };
+  }
+  if (trimmed.startsWith("/")) {
+    return { ok: false, error: "Sub-path must not start with /" };
+  }
+  if (trimmed.endsWith("/")) {
+    return { ok: false, error: "Sub-path must not end with /" };
+  }
+  const segments = trimmed.split("/");
+  for (const seg of segments) {
+    if (seg.length === 0) {
+      return { ok: false, error: "Sub-path must not contain empty segments" };
+    }
+    if (seg === "." || seg === "..") {
+      return { ok: false, error: "Path traversal not allowed in sub-path" };
+    }
+    if (SUB_PATH_RESERVED.has(seg.toLowerCase())) {
+      return {
+        ok: false,
+        error: `Sub-path segment "${seg}" is reserved`,
+      };
+    }
+    if (!SUB_PATH_SEGMENT_RE.test(seg)) {
+      return {
+        ok: false,
+        error: `Sub-path segment "${seg}" contains invalid characters`,
+      };
+    }
+  }
+  return { ok: true, value: trimmed };
+}
+
+function extractPortalUser(headers) {
+  const user = {};
+  if (headers["x-portal-user-id"]) user.userId = headers["x-portal-user-id"];
+  if (headers["x-portal-user-name"])
+    user.userName = headers["x-portal-user-name"];
+  if (headers["x-portal-user-username"])
+    user.username = headers["x-portal-user-username"];
+  if (headers["x-portal-user-email"])
+    user.email = headers["x-portal-user-email"];
+  if (headers["x-portal-user-role"]) user.role = headers["x-portal-user-role"];
+  if (headers["x-portal-user-groups"]) {
+    try {
+      user.groups = JSON.parse(headers["x-portal-user-groups"]);
+    } catch (_) {
+      user.groups = headers["x-portal-user-groups"];
+    }
+  }
+  return Object.keys(user).length > 0 ? user : null;
+}
+
+function removeRoute(router, path) {
+  if (!router || !router.stack) return;
+  router.stack = router.stack.filter(
+    (layer) => !(layer.route && layer.route.path === path),
+  );
+}
+
+function formatEsbuildError(e) {
+  return e.errors?.length
+    ? e.errors
+        .map(
+          (err) =>
+            `${err.text}${err.location ? ` (line ${err.location.line})` : ""}`,
+        )
+        .join("\n")
+    : e.message;
+}
+
+// Fast JSX syntax validation (no bundling). Returns null on OK, error string on fail.
+function quickCheckSyntax(jsx) {
+  if (!jsx || !jsx.trim()) return null;
+  try {
+    esbuild.transformSync(jsx, {
+      loader: "jsx",
+      jsx: "transform",
+      jsxFactory: "React.createElement",
+      jsxFragment: "React.Fragment",
+      logLevel: "silent",
+    });
+    return null;
+  } catch (e) {
+    return formatEsbuildError(e);
+  }
+}
+
+module.exports = function (RED) {
+  return createHelpers(RED);
+};
+
+module.exports.validateSubPath = validateSubPath;
+module.exports.isSafeName = isSafeName;
+module.exports.quickCheckSyntax = quickCheckSyntax;
+module.exports.formatEsbuildError = formatEsbuildError;
+
+function createHelpers(RED) {
+  // Package root — where react/react-dom live (this package's own node_modules)
+  const pkgRoot = path.join(__dirname, "../..");
+  // userDir — where dynamicModuleList installs user packages
+  const userDir = RED.settings.userDir || path.join(__dirname, "../../../..");
+
+  // Skip npm install for packages already present in node_modules (offline/Docker)
+  RED.hooks.add("preInstall.fcPortal", (event) => {
+    try {
+      const modDir = path.join(event.dir, "node_modules", event.module);
+      if (fs.existsSync(modDir)) {
+        RED.log.info(
+          `[portal-react] ${event.module} already in node_modules, skipping install`,
+        );
+        return false;
+      }
+    } catch (_) {}
+  });
+
+  // ── Disk cache for JS bundles and CSS ────────────────────────
+  const cacheDir = path.join(userDir, "fromcubes", "cache");
+  fs.mkdirSync(cacheDir, { recursive: true });
+
+  function readCachedJS(jsxHash) {
+    try {
+      const js = fs.readFileSync(path.join(cacheDir, jsxHash + ".js"), "utf8");
+      let metafile = null;
+      try {
+        metafile = JSON.parse(
+          fs.readFileSync(path.join(cacheDir, jsxHash + ".meta.json"), "utf8"),
+        );
+      } catch (_) {}
+      return { js, metafile, error: null };
+    } catch (_) {
+      return null;
+    }
+  }
+
+  function writeCachedJS(jsxHash, js, metafile) {
+    try {
+      fs.writeFileSync(path.join(cacheDir, jsxHash + ".js"), js, "utf8");
+      if (metafile) {
+        fs.writeFileSync(
+          path.join(cacheDir, jsxHash + ".meta.json"),
+          JSON.stringify(metafile),
+          "utf8",
+        );
+      }
+    } catch (e) {
+      RED.log.warn("[portal-react] cache write failed: " + e.message);
+    }
+  }
+
+  function readCachedCSS(jsxHash) {
+    try {
+      const css = fs.readFileSync(
+        path.join(cacheDir, jsxHash + ".css"),
+        "utf8",
+      );
+      return { css, cssHash: jsxHash };
+    } catch (_) {
+      return null;
+    }
+  }
+
+  function writeCachedCSS(jsxHash, css) {
+    try {
+      fs.writeFileSync(path.join(cacheDir, jsxHash + ".css"), css, "utf8");
+    } catch (e) {
+      RED.log.warn("[portal-react] CSS cache write failed: " + e.message);
+    }
+  }
+
+  function deleteCacheFiles(jsxHash) {
+    if (!jsxHash) return;
+    for (const ext of [".js", ".css", ".meta.json"]) {
+      try {
+        fs.unlinkSync(path.join(cacheDir, jsxHash + ext));
+      } catch (_) {}
+    }
+  }
+
+  function isHashInUse(jsxHash, pageState, excludeEndpoint) {
+    for (const ep in pageState) {
+      if (ep !== excludeEndpoint && pageState[ep]?.jsxHash === jsxHash)
+        return true;
+    }
+    return false;
+  }
+
+  function transpile(jsx) {
+    // Pre-validate with transformSync (fast, no bundling) to avoid esbuild buildSync deadlock on syntax errors
+    const syntaxErr = quickCheckSyntax(jsx);
+    if (syntaxErr) return { js: null, error: syntaxErr };
+    // Syntax OK — bundle with full resolution
+    try {
+      const buildResult = esbuild.buildSync({
+        stdin: {
+          contents: jsx,
+          resolveDir: pkgRoot,
+          loader: "jsx",
+        },
+        bundle: true,
+        format: "iife",
+        minify: true,
+        write: false,
+        target: ["es2020"],
+        jsx: "transform",
+        jsxFactory: "React.createElement",
+        jsxFragment: "React.Fragment",
+        define: { "process.env.NODE_ENV": '"production"' },
+        metafile: true,
+        logLevel: "silent",
+        logOverride: { "import-is-undefined": "silent" },
+        nodePaths: [path.join(userDir, "node_modules")],
+        alias: {
+          react: path.dirname(
+            require.resolve("react/package.json", { paths: [pkgRoot] }),
+          ),
+          "react-dom": path.dirname(
+            require.resolve("react-dom/package.json", { paths: [pkgRoot] }),
+          ),
+        },
+      });
+      return {
+        js: buildResult.outputFiles[0].text,
+        metafile: buildResult.metafile,
+        error: null,
+      };
+    } catch (e) {
+      return { js: null, error: formatEsbuildError(e) };
+    }
+  }
+
+  return {
+    hash,
+    transpile,
+    quickCheckSyntax,
+    generateCSS,
+    extractPortalUser,
+    removeRoute,
+    isSafeName,
+    validateSubPath,
+    pkgRoot,
+    userDir,
+    cacheDir,
+    readCachedJS,
+    writeCachedJS,
+    readCachedCSS,
+    writeCachedCSS,
+    deleteCacheFiles,
+    isHashInUse,
+  };
+}

package/nodes/lib/hooks.js

@@ -0,0 +1,82 @@
+/**
+ * Plugin hook system for @aaqu/fromcubes-portal-react.
+ *
+ * Plugins register with Node-RED via:
+ *   RED.plugins.registerPlugin("my-plugin", {
+ *     type: "fromcubes-portal-react",
+ *     hooks: {
+ *       onIsValidConnection(request)         { return true },
+ *       onCanSendTo(ws, msg)                 { return true },
+ *       onInbound(msg, ws)                   { return msg },
+ *     },
+ *   })
+ *
+ * Semantics:
+ * - allow(name, ...args): every registered hook must return !== false
+ *   (no hooks registered -> allowed). AND logic across plugins.
+ * - transform(name, msg, ...args): runs each hook sequentially, each
+ *   may return a new msg. Returning undefined keeps the current msg.
+ * - Any thrown exception is treated as `false` for allow hooks and
+ *   logged via RED.log.error. Transform hooks log and skip the step.
+ */
+
+const PLUGIN_TYPE = "fromcubes-portal-react";
+
+module.exports = function (RED) {
+  function getHooks(name) {
+    let plugins = [];
+    try {
+      plugins = RED.plugins.getByType(PLUGIN_TYPE) || [];
+    } catch (_) {
+      return [];
+    }
+    const out = [];
+    for (const p of plugins) {
+      const fn = p && p.hooks && p.hooks[name];
+      if (typeof fn === "function") out.push({ fn, id: p.id || p.name || "?" });
+    }
+    return out;
+  }
+
+  function allow(name, ...args) {
+    const hooks = getHooks(name);
+    if (hooks.length === 0) return true;
+    for (const h of hooks) {
+      let result;
+      try {
+        result = h.fn(...args);
+      } catch (e) {
+        RED.log.error(
+          `[portal-react] hook ${name} (${h.id}) threw: ${e.message}`,
+        );
+        return false;
+      }
+      if (result === false) return false;
+    }
+    return true;
+  }
+
+  function transform(name, msg, ...args) {
+    const hooks = getHooks(name);
+    let current = msg;
+    for (const h of hooks) {
+      try {
+        const next = h.fn(current, ...args);
+        if (next !== undefined) current = next;
+      } catch (e) {
+        RED.log.error(
+          `[portal-react] hook ${name} (${h.id}) threw: ${e.message}`,
+        );
+      }
+    }
+    return current;
+  }
+
+  function hasHook(name) {
+    return getHooks(name).length > 0;
+  }
+
+  return { allow, transform, hasHook, PLUGIN_TYPE };
+};
+
+module.exports.PLUGIN_TYPE = PLUGIN_TYPE;