@antelopejs/dms-frontend 0.0.1

package/templates/vue/server/auth/routes.mjs

@@ -0,0 +1,254 @@
+import { createHash } from "node:crypto";
+import { backend, body, json, UpstreamError } from "./backend.mjs";
+import { isSameOrigin } from "./client-ip.mjs";
+import {
+  oauthCallback,
+  oauthHandoff,
+  oauthStart,
+  sessionFrom,
+} from "./oauth.mjs";
+import {
+  clearSession,
+  persistAccountSession,
+  readAccount,
+  readSession,
+  removeAccount,
+  setRequestSession,
+} from "./session.mjs";
+
+const REFRESH_TTL_MS = 15_000;
+const refreshes = new Map();
+
+const PASSTHROUGH = new Map([
+  ["/auth/request-2fa-email", "/api/auth/request-2fa-email"],
+]);
+
+export function publicSession(session) {
+  if (!session) return {};
+  return {
+    user: session.user,
+    session: {
+      accountId: session.accountId,
+      activeTenantId: session.activeTenantId,
+    },
+  };
+}
+
+function refreshDigest(token) {
+  return createHash("sha256").update(token).digest("base64url");
+}
+
+function singleFlight(token, operation) {
+  const now = Date.now();
+  for (const [key, entry] of refreshes)
+    if (
+      entry.expiresAt &&
+      entry.expiresAt <= now &&
+      refreshes.get(key) === entry
+    )
+      refreshes.delete(key);
+  const key = refreshDigest(token);
+  const current = refreshes.get(key);
+  if (current) return current.promise;
+  const entry = { promise: undefined, expiresAt: undefined };
+  const promise = Promise.resolve().then(operation);
+  entry.promise = promise;
+  refreshes.set(key, entry);
+  const retain = () => {
+    entry.expiresAt = Date.now() + REFRESH_TTL_MS;
+    setTimeout(() => {
+      if (refreshes.get(key) === entry) refreshes.delete(key);
+    }, REFRESH_TTL_MS).unref();
+  };
+  promise.then(retain, retain);
+  return promise;
+}
+
+async function establish(request, response, endpoint) {
+  const result = await backend(endpoint, request, {
+    method: "POST",
+    body: await body(request),
+  });
+  if (result.requires_2fa || result.requires_tenant_assignment)
+    return json(response, 200, result);
+  const session = sessionFrom(result);
+  const account = persistAccountSession(request, response, session);
+  json(response, 200, { user: result.user, account });
+}
+
+export async function refreshSession(request, response) {
+  const session = readSession(request);
+  if (!session?.refreshToken) return undefined;
+  try {
+    const tokens = await singleFlight(session.refreshToken, () =>
+      backend("/api/auth/refresh", request, {
+        method: "POST",
+        token: session.accessToken,
+        body: { token: session.refreshToken },
+      }),
+    );
+    const user = await backend("/api/auth/me", request, {
+      token: tokens.access_token,
+    });
+    const refreshed = sessionFrom({ ...tokens, user });
+    persistAccountSession(request, response, refreshed, session.accountId);
+    setRequestSession(request, refreshed);
+    return refreshed;
+  } catch (error) {
+    const rejected =
+      error instanceof UpstreamError && [400, 401, 403].includes(error.status);
+    if (rejected) clearSession(response);
+    setRequestSession(request, undefined);
+    return undefined;
+  }
+}
+
+async function refresh(request, response) {
+  json(response, 200, publicSession(await refreshSession(request, response)));
+}
+
+async function logout(request, response) {
+  const session = readSession(request);
+  if (session?.refreshToken && session?.accessToken)
+    await backend("/api/auth/logout", request, {
+      method: "POST",
+      token: session.accessToken,
+      body: { token: session.refreshToken },
+    }).catch(() => {});
+  clearSession(response);
+  if (session?.accountId) removeAccount(request, response, session.accountId);
+  json(response, 200, {});
+}
+
+async function removeStoredAccount(request, response) {
+  const input = await body(request);
+  removeAccount(request, response, input.accountId);
+  json(response, 200, { success: true });
+}
+
+async function switchTenant(request, response) {
+  const session = readSession(request);
+  const input = await body(request);
+  if (!session) return json(response, 401, { message: "Not authenticated" });
+  if (!input.tenantId)
+    return json(response, 400, { message: "tenantId required" });
+  const tokens = await backend("/api/auth/switch-tenant", request, {
+    method: "POST",
+    token: session.accessToken,
+    body: { refreshToken: session.refreshToken, tenantId: input.tenantId },
+  });
+  const user = await backend("/api/auth/me", request, {
+    token: tokens.access_token,
+  });
+  const switched = sessionFrom({ ...tokens, user });
+  persistAccountSession(request, response, switched, session.accountId);
+  json(response, 200, { success: true, user });
+}
+
+async function switchAccount(request, response) {
+  const input = await body(request);
+  const account = readAccount(request, input.accountId);
+  if (!account) return json(response, 401, { message: "Account expired" });
+  try {
+    const tokens = await backend("/api/auth/refresh", request, {
+      method: "POST",
+      body: { token: account.refreshToken },
+    });
+    const user = await backend("/api/auth/me", request, {
+      token: tokens.access_token,
+    });
+    const session = sessionFrom({ ...tokens, user });
+    const descriptor = persistAccountSession(
+      request,
+      response,
+      session,
+      input.accountId,
+    );
+    json(response, 200, { success: true, user, account: descriptor });
+  } catch (error) {
+    if (
+      error instanceof UpstreamError &&
+      [400, 401, 403].includes(error.status)
+    )
+      removeAccount(request, response, input.accountId);
+    throw error;
+  }
+}
+
+async function validateAccount(request, response) {
+  const input = await body(request);
+  const account = readAccount(request, input.accountId);
+  if (!account) return json(response, 200, { valid: false });
+  try {
+    const tokens = await backend("/api/auth/refresh", request, {
+      method: "POST",
+      body: { token: account.refreshToken },
+    });
+    persistAccountSession(
+      request,
+      response,
+      sessionFrom({
+        ...tokens,
+        user: { id: account.userId, email: account.email, name: account.name },
+      }),
+      input.accountId,
+    );
+    json(response, 200, { valid: true });
+  } catch (error) {
+    const rejected =
+      error instanceof UpstreamError && [400, 401, 403].includes(error.status);
+    if (rejected) removeAccount(request, response, input.accountId);
+    json(response, 200, { valid: rejected ? false : null });
+  }
+}
+
+const actions = {
+  "/auth/login": (request, response) =>
+    establish(request, response, "/api/auth/login"),
+  "/auth/signup": (request, response) =>
+    establish(request, response, "/api/auth/signup"),
+  "/auth/verify-2fa": (request, response) =>
+    establish(request, response, "/api/auth/verify-2fa"),
+  "/auth/switch-account": switchAccount,
+  "/auth/switch-tenant": switchTenant,
+  "/auth/validate-account": validateAccount,
+  "/auth/remove-account": removeStoredAccount,
+};
+
+export async function handleAuth(request, response, url) {
+  if (url.pathname === "/api/_auth/session") {
+    if (request.method === "GET")
+      return json(response, 200, publicSession(readSession(request)));
+    if (!["POST", "DELETE"].includes(request.method)) {
+      response.setHeader("allow", "GET, POST, DELETE");
+      return json(response, 405, { error: "Method Not Allowed" });
+    }
+    if (!isSameOrigin(request))
+      return json(response, 403, { error: "Forbidden" });
+    return request.method === "DELETE"
+      ? logout(request, response)
+      : refresh(request, response);
+  }
+  const match = url.pathname.match(
+    /^\/auth\/oauth\/([^/]+)\/(start|callback)$/,
+  );
+  if (match)
+    return match[2] === "start"
+      ? oauthStart(request, response, match[1], url)
+      : oauthCallback(request, response, match[1], url);
+  if (request.method !== "POST" || !isSameOrigin(request))
+    return json(response, 403, { error: "Forbidden" });
+  if (url.pathname === "/auth/oauth/handoff")
+    return oauthHandoff(request, response);
+  const endpoint = PASSTHROUGH.get(url.pathname);
+  if (endpoint)
+    return json(
+      response,
+      200,
+      await backend(endpoint, request, {
+        method: "POST",
+        body: await body(request),
+      }),
+    );
+  return actions[url.pathname]?.(request, response);
+}

package/templates/vue/server/auth/session.mjs

@@ -0,0 +1,180 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+  randomUUID,
+} from "node:crypto";
+
+const SESSION_COOKIE = "dms_session";
+const ACCOUNT_INDEX_COOKIE = "dms_account_index";
+const ACCOUNT_COOKIE_PREFIX = "dms_account_";
+const REQUEST_SESSION = Symbol("dms-request-session");
+const MAX_AGE = 60 * 60 * 24 * 30;
+const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function key() {
+  const secret = process.env.DMS_SESSION_SECRET;
+  if (!secret || secret.length < 32)
+    throw new Error("DMS_SESSION_SECRET must contain at least 32 characters");
+  return createHash("sha256").update(secret).digest();
+}
+
+function encode(value) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key(), iv);
+  const encrypted = Buffer.concat([
+    cipher.update(JSON.stringify(value)),
+    cipher.final(),
+  ]);
+  return Buffer.concat([iv, cipher.getAuthTag(), encrypted]).toString(
+    "base64url",
+  );
+}
+
+function decode(value) {
+  try {
+    const payload = Buffer.from(value, "base64url");
+    const decipher = createDecipheriv(
+      "aes-256-gcm",
+      key(),
+      payload.subarray(0, 12),
+    );
+    decipher.setAuthTag(payload.subarray(12, 28));
+    return JSON.parse(
+      Buffer.concat([decipher.update(payload.subarray(28)), decipher.final()]),
+    );
+  } catch {
+    return undefined;
+  }
+}
+
+function cookieValue(request, name) {
+  const cookies = request.headers.cookie?.split(";") ?? [];
+  return cookies
+    .map((part) => part.trim().split("="))
+    .find(([key]) => key === name)?.[1];
+}
+
+function attributes(maxAge, path = "/") {
+  const secure = process.env.DMS_COOKIE_SECURE !== "false" ? "; Secure" : "";
+  return `Path=${path}; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}`;
+}
+
+function appendCookie(response, cookie) {
+  const current = response.getHeader("set-cookie");
+  response.setHeader(
+    "set-cookie",
+    current
+      ? [cookie, ...(Array.isArray(current) ? current : [current])]
+      : cookie,
+  );
+}
+
+function accountCookieName(accountId) {
+  if (!UUID.test(accountId)) throw new Error("Invalid account id");
+  return `${ACCOUNT_COOKIE_PREFIX}${accountId.replaceAll("-", "")}`;
+}
+
+function descriptor(session, accountId) {
+  return {
+    accountId,
+    userId: session.user?._id ?? session.user?.id,
+    email: session.user?.email,
+    name: session.user?.name,
+    activeTenantId: session.activeTenantId,
+  };
+}
+
+export function readSession(request) {
+  if (REQUEST_SESSION in request) return request[REQUEST_SESSION];
+  const value = cookieValue(request, SESSION_COOKIE);
+  return value ? decode(value) : undefined;
+}
+
+export function setRequestSession(request, session) {
+  request[REQUEST_SESSION] = session;
+}
+
+export function writeSession(response, session) {
+  appendCookie(
+    response,
+    `${SESSION_COOKIE}=${encode(session)}; ${attributes(MAX_AGE)}`,
+  );
+}
+
+export function clearSession(response) {
+  appendCookie(response, `${SESSION_COOKIE}=; ${attributes(0)}`);
+}
+
+export function readAccounts(request) {
+  const value = cookieValue(request, ACCOUNT_INDEX_COOKIE);
+  return value ? (decode(value) ?? {}) : {};
+}
+
+function writeAccountIndex(response, accounts) {
+  appendCookie(
+    response,
+    `${ACCOUNT_INDEX_COOKIE}=${encode(accounts)}; ${attributes(MAX_AGE)}`,
+  );
+}
+
+export function readAccount(request, accountId) {
+  if (!UUID.test(accountId ?? "")) return undefined;
+  const value = cookieValue(request, accountCookieName(accountId));
+  return value ? decode(value) : undefined;
+}
+
+export function storeAccount(request, response, session, accountId) {
+  const id = accountId ?? randomUUID();
+  const accountDescriptor = descriptor(session, id);
+  const accounts = { ...readAccounts(request), [id]: accountDescriptor };
+  writeAccountIndex(response, accounts);
+  appendCookie(
+    response,
+    `${accountCookieName(id)}=${encode({ refreshToken: session.refreshToken, ...accountDescriptor })}; ${attributes(MAX_AGE)}`,
+  );
+  return accountDescriptor;
+}
+
+export function assertAccountInvariant(session, accountId) {
+  if (!accountId || session.accountId !== accountId)
+    throw new Error("Account session invariant violated");
+}
+
+export function persistAccountSession(request, response, session, accountId) {
+  const id = accountId ?? session.accountId ?? randomUUID();
+  session.accountId = id;
+  const account = storeAccount(request, response, session, id);
+  assertAccountInvariant(session, account.accountId);
+  writeSession(response, session);
+  return account;
+}
+
+export function removeAccount(request, response, accountId) {
+  const accounts = { ...readAccounts(request) };
+  delete accounts[accountId];
+  writeAccountIndex(response, accounts);
+  if (UUID.test(accountId ?? ""))
+    appendCookie(
+      response,
+      `${accountCookieName(accountId)}=; ${attributes(0)}`,
+    );
+}
+
+export function readSealedCookie(request, name) {
+  const value = cookieValue(request, name);
+  return value ? decode(value) : undefined;
+}
+
+export function writeSealedCookie(response, name, value, maxAge) {
+  appendCookie(
+    response,
+    `${name}=${encode(value)}; ${attributes(maxAge, "/auth/oauth")}`,
+  );
+}
+
+export function clearSealedCookie(response, name) {
+  appendCookie(response, `${name}=; ${attributes(0, "/auth/oauth")}`);
+}

package/templates/vue/server/client-manifest.mjs

@@ -0,0 +1,116 @@
+// Reading the built client manifest and turning a rendered page into the style
+// and module-preload tags its HTML needs.
+//
+// Lives apart from server.mjs so the file stays under the size the linter
+// allows. Production-only: in dev, Vite serves these itself.
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const PROJECT_ROOT = fileURLToPath(new URL("../", import.meta.url));
+const BUILT_TEMPLATE_PATH = join(PROJECT_ROOT, "dist/client/index.html");
+const CLIENT_MANIFEST_PATH = join(
+  PROJECT_ROOT,
+  "dist/client/.vite/manifest.json",
+);
+const SOURCE_TEMPLATE_PATH = join(PROJECT_ROOT, "index.html");
+
+// Read once and kept: both files are build output and cannot change while the
+// server is up.
+let clientManifest;
+let productionTemplate;
+
+export function productionHtmlTemplate() {
+  if (productionTemplate) return productionTemplate;
+  const templatePath = existsSync(BUILT_TEMPLATE_PATH)
+    ? BUILT_TEMPLATE_PATH
+    : SOURCE_TEMPLATE_PATH;
+  productionTemplate = readFileSync(templatePath, "utf8");
+  return productionTemplate;
+}
+
+export function normalizeDmsName(name) {
+  return name
+    .replace(/^lazy/i, "")
+    .replace(/^dms[-_]?/i, "")
+    .replace(/[^a-z0-9]/gi, "")
+    .toLowerCase();
+}
+
+export function collectRenderedComponentNames(value, names) {
+  if (!value || typeof value !== "object") return;
+  if (Array.isArray(value)) {
+    value.forEach((entry) => {
+      collectRenderedComponentNames(entry, names);
+    });
+    return;
+  }
+  if (typeof value.componentName === "string")
+    names.add(normalizeDmsName(value.componentName));
+  Object.values(value).forEach((entry) => {
+    collectRenderedComponentNames(entry, names);
+  });
+}
+
+function productionClientManifest() {
+  if (clientManifest) return clientManifest;
+  if (!existsSync(CLIENT_MANIFEST_PATH)) return undefined;
+  clientManifest = JSON.parse(readFileSync(CLIENT_MANIFEST_PATH, "utf8"));
+  return clientManifest;
+}
+
+function sourceComponentName(source) {
+  const filename =
+    source
+      .split("/")
+      .at(-1)
+      ?.replace(/\.vue$/, "") ?? "";
+  return normalizeDmsName(filename);
+}
+
+function matchedPageManifestEntries(page, manifest) {
+  const names = new Set();
+  const layout = page.props?.page?.layout;
+  collectRenderedComponentNames(layout, names);
+  [
+    page.props?.page?.componentName,
+    layout?.componentName,
+    layout?.layout?.componentName,
+  ].forEach((name) => {
+    if (typeof name === "string") names.add(normalizeDmsName(name));
+  });
+  return Object.entries(manifest)
+    .filter(
+      ([source, entry]) =>
+        entry.isDynamicEntry && names.has(sourceComponentName(source)),
+    )
+    .map(([key]) => key);
+}
+
+function collectManifestStyles(manifest, key, styles, visited) {
+  if (visited.has(key)) return;
+  visited.add(key);
+  const entry = manifest[key];
+  if (!entry) return;
+  for (const file of entry.css ?? []) styles.add(file);
+  for (const imported of entry.imports ?? [])
+    collectManifestStyles(manifest, imported, styles, visited);
+}
+
+export function pageModuleStyles(page) {
+  const manifest = productionClientManifest();
+  const styles = new Set();
+  if (!manifest) return styles;
+  const visited = new Set();
+  for (const key of matchedPageManifestEntries(page, manifest))
+    collectManifestStyles(manifest, key, styles, visited);
+  return styles;
+}
+
+export function pageModulePreloads(page, template) {
+  return [...pageModuleStyles(page)]
+    .filter((file) => !template.includes(`href="/${file}"`))
+    .map((file) => `<link rel="stylesheet" href="/${file}">`)
+    .join("");
+}

package/templates/vue/server/email.mjs

@@ -0,0 +1,36 @@
+import { body } from "./auth/backend.mjs";
+import { validRenderToken } from "./render-token.mjs";
+
+const JSON_TYPE = "application/json";
+
+/** Renders an email template for an authenticated backend request. */
+export async function handleEmailRender(request, response) {
+  if (!validRenderToken(request.headers["x-dms-service-token"])) {
+    response.writeHead(401, { "content-type": JSON_TYPE });
+    return response.end(JSON.stringify({ message: "Invalid service token" }));
+  }
+  const input = await body(request);
+  if (
+    typeof input.templateName !== "string" ||
+    input.templateName.trim() === "" ||
+    typeof input.props !== "object"
+  ) {
+    response.writeHead(400, { "content-type": JSON_TYPE });
+    return response.end(JSON.stringify({ message: "Invalid request body" }));
+  }
+  try {
+    const { renderEmail } = await import("../dist/server/email-renderer.js");
+    const html = await renderEmail(input.templateName, input.props ?? {}, {
+      locale: request.headers["x-content-language"],
+    });
+    response.writeHead(200, { "content-type": JSON_TYPE });
+    response.end(JSON.stringify({ html }));
+  } catch {
+    response.writeHead(404, { "content-type": JSON_TYPE });
+    response.end(
+      JSON.stringify({
+        message: `Template "${input.templateName}" not found or render failed`,
+      }),
+    );
+  }
+}

package/templates/vue/server/inertia.mjs

@@ -0,0 +1,79 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const CLIENT_MANIFEST_PATH = fileURLToPath(
+  new URL("../dist/client/.vite/manifest.json", import.meta.url),
+);
+let productionAssetVersion;
+
+export function assetVersion() {
+  if (process.env.DMS_DEV === "true" || !existsSync(CLIENT_MANIFEST_PATH))
+    return "development";
+  productionAssetVersion ??= createHash("sha256")
+    .update(readFileSync(CLIENT_MANIFEST_PATH))
+    .digest("hex");
+  return productionAssetVersion;
+}
+
+export function inertiaAppHtml(page) {
+  const serialized = JSON.stringify(page).replaceAll("/", "\\/");
+  return `<script data-page="app" type="application/json">${serialized}</script><div id="app"></div>`;
+}
+
+export function createInertiaPage(url, props, version = assetVersion()) {
+  return {
+    component: "DmsDynamicPage",
+    props: { ...props, errors: props?.errors ?? {} },
+    url,
+    version,
+  };
+}
+
+export function inertiaHeaders(version = assetVersion()) {
+  return {
+    "content-type": "application/json",
+    "x-inertia": "true",
+    vary: "X-Inertia",
+    "x-inertia-version": version,
+  };
+}
+
+export function handleAssetVersionMismatch(request, response) {
+  if (
+    !request.headers["x-inertia"] ||
+    !request.headers["x-inertia-version"] ||
+    request.headers["x-inertia-version"] === assetVersion()
+  )
+    return false;
+  response.writeHead(409, {
+    vary: "X-Inertia",
+    "x-inertia-location": request.url,
+    "x-inertia-version": assetVersion(),
+  });
+  response.end();
+  return true;
+}
+
+export function redirectFrontendVisit(request, response, location) {
+  const vary = { vary: "X-Inertia" };
+  if (!request.headers["x-inertia"]) {
+    response.writeHead(request.method === "GET" ? 302 : 303, {
+      ...vary,
+      location,
+    });
+  } else if (location.includes("#") && !request.headers["x-inertia-prefetch"]) {
+    response.writeHead(409, { ...vary, "x-inertia-redirect": location });
+  } else if (
+    new URL(location, "http://frontend.local").origin !==
+    "http://frontend.local"
+  ) {
+    response.writeHead(409, { ...vary, "x-inertia-location": location });
+  } else {
+    response.writeHead(request.method === "GET" ? 302 : 303, {
+      ...vary,
+      location,
+    });
+  }
+  response.end();
+}