@agent-native/core 0.96.0 → 0.97.0

package/corpus/templates/clips/server/routes/api/view-event.post.ts

@@ -11,7 +11,7 @@
  *         | "cta-click" | "reaction",
  *     timestampMs?: number,
  *     payload?: object,
- *     viewerEmail?: string,      // server falls back to session when present
+ *     viewerEmail?: string,      // ignored; authenticated session is authoritative
  *     viewerName?: string,
  *     sessionId: string,         // anonymous-viewer key (persisted in browser)
  *     viewSessionId?: string,    // per-player-open key for counted visits
@@ -27,10 +27,14 @@
 
 import { writeAppState } from "@agent-native/core/application-state";
 import { emit } from "@agent-native/core/event-bus";
-import { getSession, runWithRequestContext } from "@agent-native/core/server";
+import {
+  getSession,
+  readBodyWithSizeLimit,
+  runWithRequestContext,
+} from "@agent-native/core/server";
 import { resolveAccess } from "@agent-native/core/sharing";
-import { and, eq } from "drizzle-orm";
-import { defineEventHandler, readBody, setResponseStatus } from "h3";
+import { and, asc, eq, isNull, sql } from "drizzle-orm";
+import { defineEventHandler, getRequestIP, setResponseStatus } from "h3";
 
 import { getDb, schema } from "../../db/index.js";
 import { nanoid, shouldCountView } from "../../lib/recordings.js";
@@ -69,12 +73,29 @@ const ALLOWED_KINDS = new Set([
 // Simple in-memory rate limiter — per IP per 10s window.
 const RATE_LIMIT_WINDOW_MS = 10_000;
 const RATE_LIMIT_MAX = 60;
+const RATE_LIMIT_MAX_BUCKETS = 5000;
+const MAX_BODY_BYTES = 16 * 1024;
+const MAX_ID_CHARS = 256;
+const MAX_VIEWER_NAME_CHARS = 200;
+const MAX_EVENT_TIME_MS = 7 * 24 * 60 * 60 * 1000;
+const MAX_PAYLOAD_BYTES = 8 * 1024;
 const rateBuckets = new Map<string, { count: number; reset: number }>();
 
+function pruneExpiredRateBuckets(now: number): void {
+  for (const [key, bucket] of rateBuckets) {
+    if (bucket.reset < now) rateBuckets.delete(key);
+  }
+}
+
 function rateLimit(key: string): boolean {
   const now = Date.now();
   const existing = rateBuckets.get(key);
   if (!existing || existing.reset < now) {
+    if (existing) rateBuckets.delete(key);
+    if (rateBuckets.size >= RATE_LIMIT_MAX_BUCKETS) {
+      pruneExpiredRateBuckets(now);
+      if (rateBuckets.size >= RATE_LIMIT_MAX_BUCKETS) return false;
+    }
     rateBuckets.set(key, { count: 1, reset: now + RATE_LIMIT_WINDOW_MS });
     return true;
   }
@@ -83,47 +104,126 @@ function rateLimit(key: string): boolean {
   return true;
 }
 
+export function __resetViewEventRateLimitForTests(): void {
+  rateBuckets.clear();
+}
+
+function boundedString(value: unknown, maxChars: number): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed && trimmed.length <= maxChars ? trimmed : null;
+}
+
+function boundedNumber(
+  value: unknown,
+  defaultValue: number,
+  max: number,
+): number | null {
+  const resolved = value === undefined ? defaultValue : value;
+  return typeof resolved === "number" &&
+    Number.isFinite(resolved) &&
+    resolved >= 0 &&
+    resolved <= max
+    ? resolved
+    : null;
+}
+
+function serializedPayload(value: unknown): string | null {
+  if (
+    value === null ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    (Object.getPrototypeOf(value) !== Object.prototype &&
+      Object.getPrototypeOf(value) !== null)
+  ) {
+    return null;
+  }
+  try {
+    const serialized = JSON.stringify(value);
+    return new TextEncoder().encode(serialized).byteLength <= MAX_PAYLOAD_BYTES
+      ? serialized
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 export default defineEventHandler(async (event) => {
-  const body = (await readBody(event).catch(
-    () => null,
-  )) as ViewEventBody | null;
+  let body: ViewEventBody | null;
+  try {
+    body = await readBodyWithSizeLimit<ViewEventBody>(event, MAX_BODY_BYTES);
+  } catch (error) {
+    const statusCode = (error as { statusCode?: number })?.statusCode;
+    setResponseStatus(event, statusCode === 413 ? 413 : 400);
+    return {
+      error:
+        statusCode === 413 ? "Request body too large" : "Invalid request body",
+    };
+  }
   if (!body || typeof body !== "object") {
     setResponseStatus(event, 400);
     return { error: "Invalid body" };
   }
 
-  const {
-    recordingId,
-    kind,
-    timestampMs = 0,
-    payload = {},
-    sessionId,
-    viewSessionId,
-    totalWatchMs = 0,
-    completedPct = 0,
-    scrubbedToEnd = false,
-  } = body;
+  const recordingId = boundedString(body.recordingId, MAX_ID_CHARS);
+  const sessionId = boundedString(body.sessionId, MAX_ID_CHARS);
+  const viewSessionId =
+    body.viewSessionId === undefined
+      ? null
+      : boundedString(body.viewSessionId, MAX_ID_CHARS);
+  const viewerName =
+    body.viewerName === undefined
+      ? null
+      : boundedString(body.viewerName, MAX_VIEWER_NAME_CHARS);
+  const timestampMs = boundedNumber(body.timestampMs, 0, MAX_EVENT_TIME_MS);
+  const totalWatchMs = boundedNumber(body.totalWatchMs, 0, MAX_EVENT_TIME_MS);
+  const completedPct = boundedNumber(body.completedPct, 0, 100);
+  const payload = serializedPayload(body.payload ?? {});
 
-  if (!recordingId || typeof recordingId !== "string") {
+  if (!recordingId) {
     setResponseStatus(event, 400);
-    return { error: "recordingId is required" };
+    return {
+      error: "recordingId is required and must be at most 256 characters",
+    };
   }
-  if (!kind || !ALLOWED_KINDS.has(kind)) {
+  if (!body.kind || !ALLOWED_KINDS.has(body.kind)) {
     setResponseStatus(event, 400);
-    return { error: `Invalid kind: ${kind}` };
+    return { error: `Invalid kind: ${body.kind}` };
   }
-  if (!sessionId || typeof sessionId !== "string") {
+  if (!sessionId) {
     setResponseStatus(event, 400);
-    return { error: "sessionId is required" };
+    return {
+      error: "sessionId is required and must be at most 256 characters",
+    };
+  }
+  if (body.viewSessionId !== undefined && !viewSessionId) {
+    setResponseStatus(event, 400);
+    return { error: "viewSessionId must be at most 256 characters" };
+  }
+  if (body.viewerName !== undefined && !viewerName) {
+    setResponseStatus(event, 400);
+    return { error: "viewerName must be at most 200 characters" };
+  }
+  if (timestampMs === null || totalWatchMs === null || completedPct === null) {
+    setResponseStatus(event, 400);
+    return { error: "Invalid view metrics" };
+  }
+  if (
+    body.scrubbedToEnd !== undefined &&
+    typeof body.scrubbedToEnd !== "boolean"
+  ) {
+    setResponseStatus(event, 400);
+    return { error: "scrubbedToEnd must be a boolean" };
+  }
+  if (payload === null) {
+    setResponseStatus(event, 400);
+    return { error: "payload must be a plain object no larger than 8 KiB" };
   }
 
   // Rate limit by IP + sessionId.
-  const ip =
-    (event.node?.req?.headers["x-forwarded-for"] as string | undefined)
-      ?.split(",")[0]
-      ?.trim() ||
-    event.node?.req?.socket?.remoteAddress ||
-    "unknown";
+  // Deliberately do not opt into x-forwarded-for parsing: only the hosting
+  // adapter's resolved peer address is trusted for this process-local guard.
+  const ip = getRequestIP(event) || "unknown";
   if (!rateLimit(`${ip}:${sessionId}`)) {
     setResponseStatus(event, 429);
     return { error: "Rate limit exceeded" };
@@ -132,8 +232,10 @@ export default defineEventHandler(async (event) => {
   const session = await getSession(event).catch(() => null);
   const sessionEmail = session?.email;
   const viewerEmail = sessionEmail ?? null;
-  const viewerName = body.viewerName ?? sessionEmail?.split("@")[0] ?? null;
+  const resolvedViewerName = viewerName ?? sessionEmail?.split("@")[0] ?? null;
   const now = new Date().toISOString();
+  const kind = body.kind;
+  const scrubbedToEnd = body.scrubbedToEnd ?? false;
 
   return runWithRequestContext(
     { userEmail: sessionEmail, orgId: session?.orgId },
@@ -152,106 +254,159 @@ export default defineEventHandler(async (event) => {
       // present) else sessionId. We store the session id in the viewer_name
       // column as a best-effort fallback so anon sessions don't conflate.
       const viewerKey = viewerEmail ?? `anon:${sessionId}`;
-      const countedViewSessionId =
-        typeof viewSessionId === "string" && viewSessionId.trim()
-          ? viewSessionId.trim()
-          : `legacy:${sessionId}`;
+      const countedViewSessionId = viewSessionId ?? `legacy:${sessionId}`;
 
-      // Try to find an existing row for this viewer.
-      // (Using a simple scan is acceptable here — indexes are per-DB-dialect.)
-      const existingRows = await db
-        .select()
-        .from(schema.recordingViewers)
-        .where(eq(schema.recordingViewers.recordingId, recordingId));
-      const existing = existingRows.find((r) => {
-        if (viewerEmail) return r.viewerEmail === viewerEmail;
-        return r.viewerEmail === null && r.viewerName === viewerKey;
-      });
+      const selectViewerByKey = () =>
+        db
+          .select({
+            id: schema.recordingViewers.id,
+            totalWatchMs: schema.recordingViewers.totalWatchMs,
+            completedPct: schema.recordingViewers.completedPct,
+            countedView: schema.recordingViewers.countedView,
+            ctaClicked: schema.recordingViewers.ctaClicked,
+          })
+          .from(schema.recordingViewers)
+          .where(
+            and(
+              eq(schema.recordingViewers.recordingId, recordingId),
+              eq(schema.recordingViewers.viewerKey, viewerKey),
+            ),
+          )
+          .limit(1);
+
+      let [existing] = await selectViewerByKey();
+      if (!existing) {
+        const legacyIdentity = viewerEmail
+          ? eq(schema.recordingViewers.viewerEmail, viewerEmail)
+          : and(
+              isNull(schema.recordingViewers.viewerEmail),
+              eq(schema.recordingViewers.viewerName, viewerKey),
+            );
+        const [legacy] = await db
+          .select({ id: schema.recordingViewers.id })
+          .from(schema.recordingViewers)
+          .where(
+            and(
+              eq(schema.recordingViewers.recordingId, recordingId),
+              isNull(schema.recordingViewers.viewerKey),
+              legacyIdentity,
+            ),
+          )
+          .orderBy(
+            asc(schema.recordingViewers.firstViewedAt),
+            asc(schema.recordingViewers.id),
+          )
+          .limit(1);
+
+        if (legacy) {
+          await db
+            .update(schema.recordingViewers)
+            .set({ viewerKey })
+            .where(
+              and(
+                eq(schema.recordingViewers.id, legacy.id),
+                eq(schema.recordingViewers.recordingId, recordingId),
+                isNull(schema.recordingViewers.viewerKey),
+              ),
+            );
+        } else {
+          await db
+            .insert(schema.recordingViewers)
+            .values({
+              id: nanoid(),
+              recordingId,
+              viewerKey,
+              viewerEmail,
+              viewerName: viewerEmail ? resolvedViewerName : viewerKey,
+              firstViewedAt: now,
+              lastViewedAt: now,
+              totalWatchMs: 0,
+              completedPct: 0,
+              countedView: false,
+              ctaClicked: false,
+            })
+            .onConflictDoNothing();
+        }
+        [existing] = await selectViewerByKey();
+      }
+
+      if (!existing) {
+        throw new Error("Failed to resolve canonical recording viewer");
+      }
 
-      let viewerId: string;
-      const wasCountedBefore = existing?.countedView ?? false;
-      let countedView = wasCountedBefore;
+      const viewerId = existing.id;
       const newTotalWatchMs = Math.max(
-        existing?.totalWatchMs ?? 0,
+        existing.totalWatchMs,
         Math.floor(totalWatchMs),
       );
       const newCompletedPct = Math.max(
-        existing?.completedPct ?? 0,
+        existing.completedPct,
         Math.floor(completedPct),
       );
-
       const meetsThreshold = shouldCountView(
         newTotalWatchMs,
         newCompletedPct,
-        Boolean(scrubbedToEnd),
+        scrubbedToEnd,
       );
-      if (meetsThreshold) countedView = true;
-
-      const ctaClicked =
-        kind === "cta-click" ? true : (existing?.ctaClicked ?? false);
 
-      if (existing) {
-        viewerId = existing.id;
-        await db
+      const persisted = await db.transaction(async (tx) => {
+        await tx
           .update(schema.recordingViewers)
           .set({
             lastViewedAt: now,
-            totalWatchMs: newTotalWatchMs,
-            completedPct: newCompletedPct,
-            countedView,
-            ctaClicked,
+            totalWatchMs: sql`CASE WHEN ${schema.recordingViewers.totalWatchMs} > ${Math.floor(totalWatchMs)} THEN ${schema.recordingViewers.totalWatchMs} ELSE ${Math.floor(totalWatchMs)} END`,
+            completedPct: sql`CASE WHEN ${schema.recordingViewers.completedPct} > ${Math.floor(completedPct)} THEN ${schema.recordingViewers.completedPct} ELSE ${Math.floor(completedPct)} END`,
+            ...(meetsThreshold ? { countedView: true } : {}),
+            ...(kind === "cta-click" ? { ctaClicked: true } : {}),
           })
           .where(
             and(
-              eq(schema.recordingViewers.id, existing.id),
               eq(schema.recordingViewers.recordingId, recordingId),
+              eq(schema.recordingViewers.viewerKey, viewerKey),
             ),
           );
-      } else {
-        viewerId = nanoid();
-        await db.insert(schema.recordingViewers).values({
-          id: viewerId,
+
+        await tx.insert(schema.recordingEvents).values({
+          id: nanoid(),
           recordingId,
-          viewerEmail,
-          viewerName: viewerEmail ? viewerName : viewerKey,
-          firstViewedAt: now,
-          lastViewedAt: now,
-          totalWatchMs: newTotalWatchMs,
-          completedPct: newCompletedPct,
-          countedView,
-          ctaClicked,
+          viewerId,
+          kind,
+          timestampMs: Math.floor(timestampMs),
+          payload,
+          createdAt: now,
         });
-      }
 
-      await db.insert(schema.recordingEvents).values({
-        id: nanoid(),
-        recordingId,
-        viewerId,
-        kind,
-        timestampMs: Math.max(0, Math.floor(timestampMs)),
-        payload: JSON.stringify(payload ?? {}),
-        createdAt: now,
-      });
+        if (meetsThreshold) {
+          await tx
+            .insert(schema.recordingViews)
+            .values({
+              id: nanoid(),
+              recordingId,
+              viewerId,
+              viewerKey,
+              viewSessionId: countedViewSessionId,
+              viewerEmail,
+              viewerName: viewerEmail ? resolvedViewerName : viewerKey,
+              viewedAt: now,
+            })
+            .onConflictDoNothing();
+        }
 
-      // Record a per-open counted view when this request itself satisfies the
-      // count threshold. Returning viewers can therefore appear again in the
-      // owner-facing timeline, while repeated threshold/progress posts from the
-      // same player-open session collapse through the unique index.
-      if (meetsThreshold) {
-        await db
-          .insert(schema.recordingViews)
-          .values({
-            id: nanoid(),
-            recordingId,
-            viewerId,
-            viewerKey,
-            viewSessionId: countedViewSessionId,
-            viewerEmail,
-            viewerName: viewerEmail ? viewerName : viewerKey,
-            viewedAt: now,
+        const [updated] = await tx
+          .select({
+            countedView: schema.recordingViewers.countedView,
           })
-          .onConflictDoNothing();
-      }
+          .from(schema.recordingViewers)
+          .where(
+            and(
+              eq(schema.recordingViewers.recordingId, recordingId),
+              eq(schema.recordingViewers.viewerKey, viewerKey),
+            ),
+          )
+          .limit(1);
+        if (!updated) throw new Error("Canonical recording viewer disappeared");
+        return updated;
+      });
 
       // Only broadcast a refresh signal on "meaningful" events to avoid
       // spamming the polling clients every 2s with watch-progress
@@ -279,7 +434,7 @@ export default defineEventHandler(async (event) => {
         }
       }
 
-      return { ok: true, viewerId, countedView };
+      return { ok: true, viewerId, countedView: persisted.countedView };
     },
   );
 });

package/corpus/templates/content/.agents/skills/notion-integration/SKILL.md

@@ -114,6 +114,22 @@ find a page to link to).
 pnpm action search-notion-pages --query "meeting notes"
 ```
 
+### list-notion-database-sources
+
+List Notion data sources visible to the current user's OAuth connection before
+attaching one to a Content database:
+
+```bash
+pnpm action list-notion-database-sources --query "projects"
+```
+
+The database-source pilot is read-only and uses the same per-user OAuth
+connection as page sync. Choose a returned data-source ID, run
+`suggest-source-join-key`, then attach it with
+`attach-content-database-source --sourceType notion-database
+--relationshipMode details`. Use `refresh-content-database-source` to pull a
+new bounded snapshot. Never use a pasted token or claim Notion write-back.
+
 ### disconnect-notion
 
 Disconnect the current user's Notion OAuth connection.