@autumnsgrove/groveengine 0.1.0

package/README.md

@@ -0,0 +1,163 @@
+# @grove/engine
+
+Multi-tenant blog engine for the Grove Platform. Each Grove site runs as its own Cloudflare Worker, powered by this engine.
+
+## Features
+
+- **Gutter Annotations** - Unique sidebar annotation system for blog posts
+- **Markdown Editor** - Full-featured editor with live preview, themes, and drag-drop image upload
+- **Magic Code Auth** - Passwordless authentication via email codes
+- **Admin Panel** - Complete CMS for posts, pages, images, and settings
+- **Multi-Tenant Ready** - Designed for username.grove.place architecture
+- **Cloudflare Native** - D1 database, R2 storage, KV caching, Workers deployment
+
+## Architecture
+
+```
+Each Grove Site (Cloudflare Worker)
+├── src/
+│   ├── routes/
+│   │   ├── admin/        # CMS admin panel
+│   │   ├── api/          # REST API endpoints
+│   │   ├── auth/         # Magic code authentication
+│   │   ├── blog/         # Blog listing and posts
+│   │   ├── about/        # Static about page
+│   │   └── contact/      # Static contact page
+│   └── lib/
+│       ├── auth/         # JWT and session management
+│       ├── components/   # Svelte components
+│       │   ├── admin/    # MarkdownEditor, GutterManager
+│       │   ├── custom/   # ContentWithGutter, TableOfContents
+│       │   ├── gallery/  # ImageGallery, Lightbox, ZoomableImage
+│       │   └── ui/       # shadcn-svelte components
+│       ├── utils/        # Markdown parser, CSRF, sanitization
+│       └── styles/       # CSS and tokens
+├── UserContent/          # Site-specific content
+├── migrations/           # D1 database migrations
+└── static/fonts/         # Self-hosted fonts
+```
+
+## Cloudflare Bindings Required
+
+```toml
+# wrangler.toml
+[[d1_databases]]
+binding = "DB"
+database_name = "your-site-db"
+database_id = "your-database-id"
+
+[[r2_buckets]]
+binding = "IMAGES"
+bucket_name = "your-site-images"
+
+[[kv_namespaces]]
+binding = "CACHE"
+id = "your-kv-id"
+```
+
+## Environment Variables
+
+```bash
+# .dev.vars
+JWT_SECRET=your-secret-key
+ALLOWED_ADMIN_EMAILS=admin@example.com
+RESEND_API_KEY=re_xxxxx
+```
+
+## Quick Start
+
+1. **Clone and install**
+   ```bash
+   cd packages/engine
+   npm install
+   ```
+
+2. **Set up Cloudflare resources**
+   ```bash
+   npx wrangler d1 create your-site-db
+   npx wrangler r2 bucket create your-site-images
+   npx wrangler kv:namespace create CACHE
+   ```
+
+3. **Run migrations**
+   ```bash
+   npx wrangler d1 execute your-site-db --local --file=migrations/001_magic_codes.sql
+   npx wrangler d1 execute your-site-db --local --file=migrations/002_auth_security.sql
+   npx wrangler d1 execute your-site-db --local --file=migrations/003_site_settings.sql
+   npx wrangler d1 execute your-site-db --local --file=migrations/004_pages_table.sql
+   npx wrangler d1 execute your-site-db --local --file=migrations/005_multi_tenant.sql
+   ```
+
+4. **Configure environment**
+   ```bash
+   cp .dev.vars.example .dev.vars
+   # Edit .dev.vars with your values
+   ```
+
+5. **Start development**
+   ```bash
+   npm run dev
+   ```
+
+6. **Deploy**
+   ```bash
+   npx wrangler pages deploy
+   ```
+
+## Key Components
+
+### Gutter System
+The unique gutter annotation system allows sidebar notes on blog posts:
+- `ContentWithGutter.svelte` - Main content layout
+- `GutterItem.svelte` - Individual annotations
+- `LeftGutter.svelte` - Gutter container
+- `GutterManager.svelte` - Admin UI for managing gutters
+
+### Markdown Editor
+Full-featured editor with:
+- Live preview
+- Multiple themes (Grove, Amber, Matrix, Dracula, Nord, Rose)
+- Drag-drop image upload to R2
+- Mermaid diagram support
+- Slash commands
+- Zen mode
+
+### Authentication
+Passwordless magic code system:
+- Email-based verification codes
+- JWT sessions
+- Rate limiting
+- Constant-time comparison for security
+
+## Multi-Tenant Schema
+
+The engine supports multi-tenant deployment where each tenant gets isolated data:
+
+```sql
+-- Each tenant (subdomain)
+CREATE TABLE tenants (
+  id TEXT PRIMARY KEY,
+  subdomain TEXT UNIQUE NOT NULL,
+  plan TEXT DEFAULT 'starter',
+  -- ...
+);
+
+-- Posts scoped to tenant
+CREATE TABLE posts (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  slug TEXT NOT NULL,
+  -- ...
+  UNIQUE(tenant_id, slug)
+);
+```
+
+## Related Documentation
+
+- [Migration Strategy](../../docs/MIGRATION-STRATEGY.md)
+- [Agent Guide for New Sites](../../docs/guides/AGENT-GUIDE-NEW-GROVE-SITES.md)
+- [Customer Setup Guide](../../docs/guides/customer-setup.md)
+
+## License
+
+MIT

package/dist/auth/jwt.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Sign a JWT payload
+ * @param {Object} payload - The payload to sign
+ * @param {string} secret - The secret key
+ * @returns {Promise<string>} - The signed JWT token
+ */
+export function signJwt(payload: Object, secret: string): Promise<string>;
+/**
+ * Verify and decode a JWT token
+ * @param {string} token - The JWT token to verify
+ * @param {string} secret - The secret key
+ * @returns {Promise<Object|null>} - The decoded payload or null if invalid
+ */
+export function verifyJwt(token: string, secret: string): Promise<Object | null>;

package/dist/auth/jwt.js

@@ -0,0 +1,109 @@
+/**
+ * JWT utilities using Web Crypto API (Cloudflare Workers compatible)
+ */
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+/**
+ * Base64URL encode
+ */
+function base64UrlEncode(data) {
+  const base64 = btoa(String.fromCharCode(...new Uint8Array(data)));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+/**
+ * Base64URL decode
+ */
+function base64UrlDecode(str) {
+  const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = "=".repeat((4 - (base64.length % 4)) % 4);
+  const binary = atob(base64 + padding);
+  return Uint8Array.from(binary, (c) => c.charCodeAt(0));
+}
+
+/**
+ * Create HMAC key from secret
+ */
+async function createKey(secret) {
+  return await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"],
+  );
+}
+
+/**
+ * Sign a JWT payload
+ * @param {Object} payload - The payload to sign
+ * @param {string} secret - The secret key
+ * @returns {Promise<string>} - The signed JWT token
+ */
+export async function signJwt(payload, secret) {
+  const header = { alg: "HS256", typ: "JWT" };
+
+  const headerEncoded = base64UrlEncode(encoder.encode(JSON.stringify(header)));
+  const payloadEncoded = base64UrlEncode(
+    encoder.encode(JSON.stringify(payload)),
+  );
+
+  const message = `${headerEncoded}.${payloadEncoded}`;
+  const key = await createKey(secret);
+
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    encoder.encode(message),
+  );
+
+  const signatureEncoded = base64UrlEncode(signature);
+
+  return `${message}.${signatureEncoded}`;
+}
+
+/**
+ * Verify and decode a JWT token
+ * @param {string} token - The JWT token to verify
+ * @param {string} secret - The secret key
+ * @returns {Promise<Object|null>} - The decoded payload or null if invalid
+ */
+export async function verifyJwt(token, secret) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return null;
+    }
+
+    const [headerEncoded, payloadEncoded, signatureEncoded] = parts;
+    const message = `${headerEncoded}.${payloadEncoded}`;
+
+    const key = await createKey(secret);
+    const signature = base64UrlDecode(signatureEncoded);
+
+    const isValid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      signature,
+      encoder.encode(message),
+    );
+
+    if (!isValid) {
+      return null;
+    }
+
+    const payload = JSON.parse(decoder.decode(base64UrlDecode(payloadEncoded)));
+
+    // Check expiration
+    if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+      return null;
+    }
+
+    return payload;
+  } catch (error) {
+    console.error("JWT verification error:", error);
+    return null;
+  }
+}

package/dist/auth/session.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Create a session token for a user
+ * @param {Object} user - User data
+ * @param {string} user.email - User email address
+ * @param {string} secret - Session secret
+ * @returns {Promise<string>} - Signed JWT token
+ */
+export function createSession(user: {
+    email: string;
+}, secret: string): Promise<string>;
+/**
+ * Verify a session token and return user data
+ * @param {string} token - Session token
+ * @param {string} secret - Session secret
+ * @returns {Promise<Object|null>} - User data or null if invalid
+ */
+export function verifySession(token: string, secret: string): Promise<Object | null>;
+/**
+ * Create Set-Cookie header value for session
+ * @param {string} token - Session token
+ * @param {boolean} isProduction - Whether in production (for secure flag)
+ * @returns {string} - Cookie header value
+ */
+export function createSessionCookie(token: string, isProduction?: boolean): string;
+/**
+ * Create Set-Cookie header value to clear session
+ * @returns {string} - Cookie header value
+ */
+export function clearSessionCookie(): string;
+/**
+ * Parse session token from cookie header
+ * @param {string} cookieHeader - Cookie header value
+ * @returns {string|null} - Session token or null
+ */
+export function parseSessionCookie(cookieHeader: string): string | null;
+/**
+ * Check if an email is in the allowed admin list
+ * @param {string} email - Email address to check
+ * @param {string} allowedList - Comma-separated list of allowed emails
+ * @returns {boolean} - Whether the user is allowed
+ */
+export function isAllowedAdmin(email: string, allowedList: string): boolean;

package/dist/auth/session.js

@@ -0,0 +1,105 @@
+/**
+ * Session management utilities
+ */
+
+import { signJwt, verifyJwt } from "./jwt.js";
+
+const SESSION_COOKIE_NAME = "session";
+const SESSION_DURATION_SECONDS = 60 * 60 * 24 * 7; // 7 days
+
+/**
+ * Create a session token for a user
+ * @param {Object} user - User data
+ * @param {string} user.email - User email address
+ * @param {string} secret - Session secret
+ * @returns {Promise<string>} - Signed JWT token
+ */
+export async function createSession(user, secret) {
+  const payload = {
+    sub: user.email,
+    email: user.email,
+    exp: Math.floor(Date.now() / 1000) + SESSION_DURATION_SECONDS,
+  };
+
+  return await signJwt(payload, secret);
+}
+
+/**
+ * Verify a session token and return user data
+ * @param {string} token - Session token
+ * @param {string} secret - Session secret
+ * @returns {Promise<Object|null>} - User data or null if invalid
+ */
+export async function verifySession(token, secret) {
+  const payload = await verifyJwt(token, secret);
+
+  if (!payload) {
+    return null;
+  }
+
+  return {
+    email: payload.email,
+  };
+}
+
+/**
+ * Create Set-Cookie header value for session
+ * @param {string} token - Session token
+ * @param {boolean} isProduction - Whether in production (for secure flag)
+ * @returns {string} - Cookie header value
+ */
+export function createSessionCookie(token, isProduction = true) {
+  const parts = [
+    `${SESSION_COOKIE_NAME}=${token}`,
+    "Path=/",
+    `Max-Age=${SESSION_DURATION_SECONDS}`,
+    "HttpOnly",
+    "SameSite=Lax",
+  ];
+
+  if (isProduction) {
+    parts.push("Secure");
+  }
+
+  return parts.join("; ");
+}
+
+/**
+ * Create Set-Cookie header value to clear session
+ * @returns {string} - Cookie header value
+ */
+export function clearSessionCookie() {
+  return `${SESSION_COOKIE_NAME}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax`;
+}
+
+/**
+ * Parse session token from cookie header
+ * @param {string} cookieHeader - Cookie header value
+ * @returns {string|null} - Session token or null
+ */
+export function parseSessionCookie(cookieHeader) {
+  if (!cookieHeader) {
+    return null;
+  }
+
+  const cookies = cookieHeader.split(";").reduce((acc, cookie) => {
+    const [key, value] = cookie.trim().split("=");
+    if (key && value) {
+      acc[key] = value;
+    }
+    return acc;
+  }, {});
+
+  return cookies[SESSION_COOKIE_NAME] || null;
+}
+
+/**
+ * Check if an email is in the allowed admin list
+ * @param {string} email - Email address to check
+ * @param {string} allowedList - Comma-separated list of allowed emails
+ * @returns {boolean} - Whether the user is allowed
+ */
+export function isAllowedAdmin(email, allowedList) {
+  const allowed = allowedList.split(",").map((e) => e.trim().toLowerCase());
+  return allowed.includes(email.toLowerCase());
+}