@bygghammar/cms-platform 0.34.1 → 0.36.0

package/src/server/injections-core.ts

@@ -0,0 +1,223 @@
+/**
+ * Host-agnostic logic for the "Code & tracking" admin area (`site_injections`).
+ *
+ * The host owns the server-function wrappers and the clients; this module owns
+ * the row mapping, validation-independent CRUD, the audit trail action names and
+ * the request-time resolution of the merged injection bundle, so every site
+ * behaves identically.
+ */
+
+import {
+  EMPTY_BUNDLE,
+  mergeBundles,
+  normalizeHostname,
+  selectProfiles,
+  type InjectionBundle,
+  type InjectionProfile,
+} from "../tracking/injections";
+import { actorEmail, assertRole, type PlatformAuthContext } from "./guards";
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/** Structural subset of a Supabase-shaped client used by this core. */
+export type InjectionsClient = { from: (table: string) => any };
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+export const INJECTION_SELECT_COLS =
+  "id, name, scope_type, scope_value, enabled, head_html, body_start_html, body_end_html, gtm_id, ga4_id, meta_pixel_id, tiktok_pixel_id, extra_meta, sort_order, updated_at";
+
+/** Normalize a database row into the profile shape the UI works with. */
+export function rowToInjectionProfile(row: Record<string, unknown>): InjectionProfile {
+  return {
+    id: String(row.id),
+    name: String(row.name ?? ""),
+    scope_type: (row.scope_type as InjectionProfile["scope_type"]) ?? "global",
+    scope_value: String(row.scope_value ?? ""),
+    enabled: Boolean(row.enabled),
+    head_html: String(row.head_html ?? ""),
+    body_start_html: String(row.body_start_html ?? ""),
+    body_end_html: String(row.body_end_html ?? ""),
+    gtm_id: String(row.gtm_id ?? ""),
+    ga4_id: String(row.ga4_id ?? ""),
+    meta_pixel_id: String(row.meta_pixel_id ?? ""),
+    tiktok_pixel_id: String(row.tiktok_pixel_id ?? ""),
+    extra_meta: Array.isArray(row.extra_meta)
+      ? (row.extra_meta as InjectionProfile["extra_meta"])
+      : [],
+    sort_order: Number(row.sort_order ?? 100),
+    updated_at: row.updated_at ? String(row.updated_at) : undefined,
+  };
+}
+
+/** Signed-in staff read of every profile, in scope then sort order. */
+export async function listInjectionsCore(client: InjectionsClient): Promise<InjectionProfile[]> {
+  const { data, error } = await client
+    .from("site_injections")
+    .select(INJECTION_SELECT_COLS)
+    .order("scope_type")
+    .order("sort_order");
+  if (error) throw new Error(error.message);
+  return ((data ?? []) as Record<string, unknown>[]).map(rowToInjectionProfile);
+}
+
+export type InjectionInput = Omit<InjectionProfile, "id" | "updated_at"> & { id?: string };
+
+/** Host-provided audit-log writer; keeps privileged clients out of the core. */
+export type AuditWriter = (entry: {
+  actorId: string;
+  actorEmail: string | null;
+  action: string;
+  entity: string;
+  entityId: string | null;
+  meta: Record<string, unknown>;
+}) => Promise<void>;
+
+function toRow(input: InjectionInput) {
+  return {
+    name: input.name,
+    scope_type: input.scope_type,
+    scope_value: input.scope_type === "global" ? "" : input.scope_value,
+    enabled: input.enabled,
+    head_html: input.head_html,
+    body_start_html: input.body_start_html,
+    body_end_html: input.body_end_html,
+    gtm_id: input.gtm_id,
+    ga4_id: input.ga4_id,
+    meta_pixel_id: input.meta_pixel_id,
+    tiktok_pixel_id: input.tiktok_pixel_id,
+    extra_meta: input.extra_meta,
+    sort_order: input.sort_order,
+  };
+}
+
+/** Admin-only create/update of one profile, with an audit entry. */
+export async function saveInjectionCore(
+  context: PlatformAuthContext & { supabase: InjectionsClient },
+  input: InjectionInput,
+  audit: AuditWriter,
+): Promise<{ id: string }> {
+  await assertRole(context, "admin");
+  const row = toRow(input);
+  const scope = `${row.scope_type}:${row.scope_value}`;
+
+  if (input.id) {
+    const { error } = await context.supabase
+      .from("site_injections")
+      .update(row)
+      .eq("id", input.id);
+    if (error) throw new Error(error.message);
+    await audit({
+      actorId: context.userId,
+      actorEmail: actorEmail(context),
+      action: "injection.update",
+      entity: "site_injections",
+      entityId: input.id,
+      meta: { name: input.name, scope, enabled: input.enabled },
+    });
+    return { id: input.id };
+  }
+
+  const { data: inserted, error } = await context.supabase
+    .from("site_injections")
+    .insert(row)
+    .select("id")
+    .single();
+  if (error) throw new Error(error.message);
+  const id = String(inserted?.id ?? "");
+  await audit({
+    actorId: context.userId,
+    actorEmail: actorEmail(context),
+    action: "injection.create",
+    entity: "site_injections",
+    entityId: id || null,
+    meta: { name: input.name, scope },
+  });
+  return { id };
+}
+
+/** Admin-only delete of one profile, with an audit entry. */
+export async function deleteInjectionCore(
+  context: PlatformAuthContext & { supabase: InjectionsClient },
+  id: string,
+  audit: AuditWriter,
+): Promise<{ ok: true }> {
+  await assertRole(context, "admin");
+  const { error } = await context.supabase.from("site_injections").delete().eq("id", id);
+  if (error) throw new Error(error.message);
+  await audit({
+    actorId: context.userId,
+    actorEmail: actorEmail(context),
+    action: "injection.delete",
+    entity: "site_injections",
+    entityId: id,
+    meta: {},
+  });
+  return { ok: true };
+}
+
+/* ---------------- Request-time resolution ---------------- */
+
+const CACHE_TTL_MS = 30_000;
+const cache = new Map<string, { at: number; bundle: InjectionBundle }>();
+
+/**
+ * Resolve the merged bundle for a request host. Never throws: a backend hiccup
+ * degrades to "no injection" so the site still renders.
+ *
+ * `client` must be a privileged (service-role) client — `site_injections` and
+ * `locale_domains` are not readable anonymously.
+ */
+export async function resolveInjectionsCore(
+  client: InjectionsClient,
+  host: string,
+  options: { defaultLocale?: string } = {},
+): Promise<InjectionBundle> {
+  const key = normalizeHostname(host);
+  const hit = cache.get(key);
+  if (hit && Date.now() - hit.at < CACHE_TTL_MS) return hit.bundle;
+
+  let bundle = EMPTY_BUNDLE;
+  try {
+    const [{ data: rows }, { data: domains }] = await Promise.all([
+      client.from("site_injections").select("*").eq("enabled", true),
+      client.from("locale_domains").select("locale, domain, is_default"),
+    ]);
+
+    if (rows && rows.length > 0) {
+      const list = (domains ?? []) as { locale: string; domain: string; is_default: boolean }[];
+      const match = list.find((d) => normalizeHostname(d.domain) === key);
+      const fallback = list.find((d) => d.is_default);
+      const locale = match?.locale ?? fallback?.locale ?? options.defaultLocale ?? "en";
+      const profiles = (rows as Record<string, unknown>[]).map(rowToInjectionProfile);
+      bundle = mergeBundles(selectProfiles(profiles, locale, host));
+    }
+  } catch {
+    bundle = EMPTY_BUNDLE;
+  }
+
+  cache.set(key, { at: Date.now(), bundle });
+  return bundle;
+}
+
+/** True for paths that must never receive tracking code. */
+export function isInjectablePath(pathname: string, backofficePath = "/kontoret"): boolean {
+  if (pathname.startsWith(backofficePath)) return false;
+  if (pathname.startsWith("/preview")) return false;
+  if (pathname.startsWith("/api")) return false;
+  if (pathname.startsWith("/_serverFn")) return false;
+  return true;
+}
+
+/** Insert the bundle's three chunks into a rendered HTML document. */
+export function applyInjections(html: string, bundle: InjectionBundle): string {
+  let out = html;
+  if (bundle.head && out.includes("</head>")) {
+    out = out.replace("</head>", `${bundle.head}</head>`);
+  }
+  if (bundle.bodyStart) {
+    out = out.replace(/<body([^>]*)>/i, (m) => `${m}${bundle.bodyStart}`);
+  }
+  if (bundle.bodyEnd && out.includes("</body>")) {
+    out = out.replace("</body>", `${bundle.bodyEnd}</body>`);
+  }
+  return out;
+}

package/src/server/provider-secrets.ts

@@ -0,0 +1,170 @@
+/**
+ * Multi-provider secret handling.
+ *
+ * Every row in `public.email_providers` names the environment variable that
+ * holds its credential (`secret_ref_name`). The value itself lives only in the
+ * server's environment — never in PostgreSQL, never in a migration package,
+ * never in a log line.
+ *
+ * This is deliberately separate from the system-mail path: `SMTP_PASSWORD`
+ * powers self-hosted account/password emails, while provider credentials are
+ * resolved per provider through the preserved `secret_ref_name`.
+ */
+
+/** Only plain, safe environment-variable names are accepted. */
+export const SECRET_REF_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+/** Environment variable used by the self-hosted system-mail path. */
+export const SYSTEM_SMTP_SECRET_NAME = "SMTP_PASSWORD";
+
+export type ProviderSecretRow = {
+  id?: string | null;
+  name?: string | null;
+  kind?: string | null;
+  is_active?: boolean | null;
+  secret_ref_name?: string | null;
+};
+
+export type Env = Record<string, string | undefined>;
+
+export function isValidSecretRefName(value: unknown): value is string {
+  return typeof value === "string" && SECRET_REF_NAME_RE.test(value);
+}
+
+function label(provider: ProviderSecretRow): string {
+  return provider.name?.trim() || provider.kind?.trim() || provider.id || "provider";
+}
+
+export type SecretResolution =
+  { ok: true; name: string; value: string } | { ok: false; name: string | null; error: string };
+
+/**
+ * Resolve one provider's credential. Errors mention only the variable name,
+ * never a value.
+ */
+export function resolveProviderSecret(
+  provider: ProviderSecretRow,
+  env: Env = process.env,
+): SecretResolution {
+  const raw = provider.secret_ref_name;
+  const who = label(provider);
+  if (raw == null || String(raw).trim() === "") {
+    return {
+      ok: false,
+      name: null,
+      error: `Provider "${who}" has no secret reference name configured.`,
+    };
+  }
+  const name = String(raw).trim();
+  if (!isValidSecretRefName(name)) {
+    return {
+      ok: false,
+      name: null,
+      error:
+        `Provider "${who}" has an invalid secret reference name — ` +
+        `it must match ${SECRET_REF_NAME_RE.source}.`,
+    };
+  }
+  const value = env[name];
+  if (value == null || value === "") {
+    return {
+      ok: false,
+      name,
+      error: `Environment variable "${name}" is not set on the server (provider "${who}").`,
+    };
+  }
+  return { ok: true, name, value };
+}
+
+export type ProviderSecretRequirement = {
+  provider: string;
+  kind: string | null;
+  name: string | null;
+  valid: boolean;
+  present: boolean;
+};
+
+/** Every active provider's required variable name — values are never read out. */
+export function requiredProviderSecrets(
+  providers: ProviderSecretRow[],
+  env: Env = process.env,
+): ProviderSecretRequirement[] {
+  return providers
+    .filter((p) => p.is_active !== false)
+    .map((p) => {
+      const res = resolveProviderSecret(p, env);
+      const name = res.ok ? res.name : res.name;
+      return {
+        provider: label(p),
+        kind: p.kind ?? null,
+        name,
+        valid: name !== null,
+        present: res.ok,
+      };
+    });
+}
+
+/** Distinct, valid variable names that must be configured. */
+export function requiredSecretNames(providers: ProviderSecretRow[]): string[] {
+  const out = new Set<string>();
+  for (const p of providers) {
+    if (p.is_active === false) continue;
+    const raw = typeof p.secret_ref_name === "string" ? p.secret_ref_name.trim() : "";
+    if (isValidSecretRefName(raw)) out.add(raw);
+  }
+  return [...out].sort();
+}
+
+/**
+ * Providers whose secret reference name is present but unsafe. A hard error:
+ * such a name can never be resolved to an environment variable.
+ */
+export function invalidSecretProviders(providers: ProviderSecretRow[]): string[] {
+  return providers
+    .filter((p) => p.is_active !== false)
+    .filter((p) => {
+      const raw = typeof p.secret_ref_name === "string" ? p.secret_ref_name.trim() : "";
+      return raw !== "" && !isValidSecretRefName(raw);
+    })
+    .map((p) => `${label(p)}: invalid secret reference name`);
+}
+
+/** Active providers that name no secret at all — a hard error. */
+export function providersWithoutSecretRef(providers: ProviderSecretRow[]): string[] {
+  return providers
+    .filter((p) => p.is_active !== false)
+    .filter((p) => (typeof p.secret_ref_name === "string" ? p.secret_ref_name.trim() : "") === "")
+    .map((p) => `${label(p)}: no secret reference name configured`);
+}
+
+/**
+ * Every hard problem with provider secret references: unsafe names and
+ * missing/blank names on active providers. Inactive providers are ignored.
+ * Values are never inspected or printed.
+ */
+export function secretRefProblems(providers: ProviderSecretRow[]): string[] {
+  return [...invalidSecretProviders(providers), ...providersWithoutSecretRef(providers)];
+}
+
+/**
+ * Operator-facing, value-free report of what must go into
+ * `deploy/provider-secrets.env`.
+ */
+export function formatProviderSecretReport(
+  providers: ProviderSecretRow[],
+  env: Env = process.env,
+): string {
+  const reqs = requiredProviderSecrets(providers, env);
+  if (reqs.length === 0) return "No active email providers — no provider secrets are required.";
+  const lines = [
+    "Provider secrets to configure in deploy/provider-secrets.env (names only):",
+    ...reqs.map((r) => {
+      const state = !r.valid ? "INVALID/MISSING NAME" : r.present ? "set" : "NOT SET";
+      return `  ${(r.name ?? "(none)").padEnd(28)} ${state.padEnd(20)} ${r.provider}${r.kind ? ` (${r.kind})` : ""}`;
+    }),
+    "",
+    `System mail (account/password emails) uses ${SYSTEM_SMTP_SECRET_NAME} and is configured separately in .env.`,
+    "Never paste secret values into chat, logs, PostgreSQL, Git or the migration package.",
+  ];
+  return lines.join("\n");
+}