@bygghammar/cms-platform 0.34.1 → 0.36.0

package/src/server/smtp.ts

@@ -0,0 +1,416 @@
+/**
+ * Minimal SMTP client for the serverless runtime.
+ *
+ * Node mail libraries (nodemailer & co.) cannot run here, but the runtime does
+ * expose raw TCP sockets, so we speak SMTP directly:
+ *
+ *   greeting -> EHLO -> STARTTLS -> TLS upgrade -> EHLO -> AUTH -> MAIL FROM
+ *   -> RCPT TO -> DATA -> message -> QUIT
+ *
+ * Only explicit-TLS-on-connect (port 465) is out of reach: the socket API can
+ * upgrade a plain connection to TLS but cannot open an encrypted one. Use the
+ * submission port (587) instead.
+ *
+ * Server-only. Never import from client code.
+ */
+
+export type SmtpConfig = {
+  host: string;
+  port: number;
+  username?: string;
+  password?: string;
+};
+
+export type SmtpMessage = {
+  to: string;
+  fromEmail: string;
+  fromName?: string | null;
+  replyTo?: string | null;
+  subject: string;
+  text: string;
+  html: string;
+};
+
+export type SmtpResult = { ok: true } | { ok: false; error: string };
+
+const CONNECT_TIMEOUT_MS = 15_000;
+const HOST_RE =
+  /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+const BLOCKED_HOSTS = new Set([
+  "localhost",
+  "localhost.localdomain",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+]);
+
+/** Ports we allow outbound. 465 is deliberately excluded (implicit TLS). */
+export const ALLOWED_SMTP_PORTS = [25, 587, 2525] as const;
+
+export function validateSmtpTarget(host: string, port: number): string | null {
+  const h = host.trim().toLowerCase();
+  if (!h) return "SMTP host is missing in the provider config.";
+  if (BLOCKED_HOSTS.has(h)) return "Connections to localhost are not allowed.";
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(h)) {
+    const [a, b] = h.split(".").map(Number);
+    if (
+      a === 10 ||
+      a === 127 ||
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 168) ||
+      (a === 169 && b === 254)
+    ) {
+      return "Connections to private network addresses are not allowed.";
+    }
+  } else if (!HOST_RE.test(h)) {
+    return `"${host}" is not a valid SMTP host name.`;
+  }
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return "SMTP port is invalid.";
+  if (port === 465) {
+    return "Port 465 (implicit TLS) is not supported by this runtime. Use port 587 with STARTTLS instead.";
+  }
+  if (!(ALLOWED_SMTP_PORTS as readonly number[]).includes(port)) {
+    return `Port ${port} is not allowed. Use 587 (recommended), 2525 or 25.`;
+  }
+  return null;
+}
+
+/* ---------------- reply parsing ---------------- */
+
+export type SmtpReply = { code: number; lines: string[]; text: string };
+
+/** True when `buf` holds a complete SMTP reply (last line uses "NNN " not "NNN-"). */
+export function isCompleteReply(buf: string): boolean {
+  const lines = buf.split(/\r?\n/).filter((l) => l.length > 0);
+  if (!lines.length) return false;
+  const last = lines[lines.length - 1];
+  return /^\d{3}(\s|$)/.test(last);
+}
+
+export function parseReply(buf: string): SmtpReply {
+  const lines = buf.split(/\r?\n/).filter((l) => l.length > 0);
+  const code = Number(lines[lines.length - 1]?.slice(0, 3)) || 0;
+  const text = lines
+    .map((l) => l.slice(4))
+    .join(" ")
+    .trim();
+  return { code, lines, text };
+}
+
+/* ---------------- MIME message ---------------- */
+
+function encodeHeaderWord(value: string): string {
+  // RFC 2047 for any non-ASCII header content.
+  if (/^[\x20-\x7e]*$/.test(value)) return value;
+  const bytes = new TextEncoder().encode(value);
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return `=?UTF-8?B?${btoa(binary)}?=`;
+}
+
+function addressHeader(email: string, name?: string | null): string {
+  return name ? `${encodeHeaderWord(name)} <${email}>` : email;
+}
+
+/** Escapes leading dots so message content cannot terminate the DATA stage. */
+function dotStuff(body: string): string {
+  return body.replace(/\r?\n/g, "\r\n").replace(/^\./gm, "..");
+}
+
+export function buildMimeMessage(msg: SmtpMessage, domain: string): string {
+  const boundary = `sba-${crypto.randomUUID()}`;
+  const headers = [
+    `From: ${addressHeader(msg.fromEmail, msg.fromName)}`,
+    `To: ${msg.to}`,
+    ...(msg.replyTo ? [`Reply-To: ${msg.replyTo}`] : []),
+    `Subject: ${encodeHeaderWord(msg.subject)}`,
+    `Date: ${new Date().toUTCString()}`,
+    `Message-ID: <${crypto.randomUUID()}@${domain}>`,
+    "MIME-Version: 1.0",
+    `Content-Type: multipart/alternative; boundary="${boundary}"`,
+  ];
+  const body = [
+    `--${boundary}`,
+    'Content-Type: text/plain; charset="UTF-8"',
+    "Content-Transfer-Encoding: 8bit",
+    "",
+    dotStuff(msg.text),
+    `--${boundary}`,
+    'Content-Type: text/html; charset="UTF-8"',
+    "Content-Transfer-Encoding: 8bit",
+    "",
+    dotStuff(msg.html),
+    `--${boundary}--`,
+  ].join("\r\n");
+  return `${headers.join("\r\n")}\r\n\r\n${body}`;
+}
+
+/* ---------------- connection ---------------- */
+
+type AnySocket = {
+  readable: ReadableStream<Uint8Array>;
+  writable: WritableStream<Uint8Array>;
+  close: () => Promise<void> | void;
+  startTls: () => AnySocket;
+};
+
+/**
+ * Node fallback (vite dev / any Node host): wrap a `node:net` socket in the
+ * same web-stream shape the Workers socket API exposes, with `startTls()`
+ * upgrading the live connection via `node:tls`.
+ */
+type NodeRawSocket = {
+  on(event: "data", cb: (chunk: Buffer) => void): void;
+  once(event: string, cb: (...args: never[]) => void): void;
+  off(event: "data", cb: (chunk: Buffer) => void): void;
+  removeAllListeners(event: string): void;
+  write(chunk: Buffer, cb: (err?: Error | null) => void): void;
+  destroy(): void;
+  __smtpHost?: string;
+};
+
+type NodeNetModule = { connect: (opts: { host: string; port: number }) => NodeRawSocket };
+type NodeTlsModule = {
+  connect: (opts: {
+    socket: NodeRawSocket;
+    servername?: string;
+    rejectUnauthorized: boolean;
+  }) => NodeRawSocket;
+};
+type WorkerSocketsModule = {
+  connect: (
+    address: { hostname: string; port: number },
+    options: { allowHalfOpen: boolean; secureTransport: string },
+  ) => AnySocket;
+};
+
+function wrapNodeSocket(raw: NodeRawSocket): AnySocket {
+  let onData: ((chunk: Buffer) => void) | null = null;
+  const readable = new ReadableStream<Uint8Array>({
+    start(controller) {
+      onData = (chunk) => controller.enqueue(new Uint8Array(chunk));
+      raw.on("data", onData);
+      raw.once("end", () => {
+        try {
+          controller.close();
+        } catch {
+          /* closed */
+        }
+      });
+      raw.once("error", (e: Error) => {
+        try {
+          controller.error(e);
+        } catch {
+          /* closed */
+        }
+      });
+    },
+    cancel() {
+      if (onData) raw.off("data", onData);
+    },
+  });
+  const writable = new WritableStream<Uint8Array>({
+    write(chunk) {
+      return new Promise<void>((resolve, reject) =>
+        raw.write(Buffer.from(chunk), (err?: Error | null) => (err ? reject(err) : resolve())),
+      );
+    },
+  });
+  return {
+    readable,
+    writable,
+    close: () => {
+      raw.destroy();
+    },
+    startTls: () => {
+      if (onData) raw.off("data", onData);
+      raw.removeAllListeners("end");
+      raw.removeAllListeners("error");
+
+      const tls = (globalThis as unknown as { __smtpTls: NodeTlsModule }).__smtpTls;
+      const secure = tls.connect({
+        socket: raw,
+        servername: raw.__smtpHost,
+        rejectUnauthorized: true,
+      });
+      secure.__smtpHost = raw.__smtpHost;
+      return wrapNodeSocket(secure);
+    },
+  };
+}
+
+async function openNodeSocket(host: string, port: number): Promise<AnySocket | null> {
+  try {
+    const net = (await import(/* @vite-ignore */ "node:net" as string)) as unknown as NodeNetModule;
+    const tls = (await import(/* @vite-ignore */ "node:tls" as string)) as unknown as NodeTlsModule;
+    if (!net?.connect) return null;
+    (globalThis as unknown as { __smtpTls: NodeTlsModule }).__smtpTls = tls;
+    const raw = await new Promise<NodeRawSocket>((resolve, reject) => {
+      const sock = net.connect({ host, port });
+      sock.once("connect", () => resolve(sock));
+      sock.once("error", reject);
+    });
+    raw.__smtpHost = host;
+    return wrapNodeSocket(raw);
+  } catch {
+    return null;
+  }
+}
+
+async function openSocket(host: string, port: number): Promise<AnySocket> {
+  const specifier = "cloudflare:sockets";
+  const mod = (await import(/* @vite-ignore */ specifier).catch(
+    () => null,
+  )) as WorkerSocketsModule | null;
+  if (mod?.connect) {
+    return mod.connect(
+      { hostname: host, port },
+      { allowHalfOpen: false, secureTransport: "starttls" },
+    );
+  }
+  const node = await openNodeSocket(host, port);
+  if (node) return node;
+  throw new Error("Raw TCP sockets are unavailable in this runtime, so SMTP cannot be used here.");
+}
+
+class SmtpSession {
+  private reader: ReadableStreamDefaultReader<Uint8Array>;
+  private writer: WritableStreamDefaultWriter<Uint8Array>;
+  private decoder = new TextDecoder();
+  private encoder = new TextEncoder();
+  private buffer = "";
+
+  constructor(private socket: AnySocket) {
+    this.reader = socket.readable.getReader();
+    this.writer = socket.writable.getWriter();
+  }
+
+  static async open(host: string, port: number) {
+    return new SmtpSession(await openSocket(host, port));
+  }
+
+  async read(): Promise<SmtpReply> {
+    while (!isCompleteReply(this.buffer)) {
+      const { value, done } = await this.reader.read();
+      if (done) break;
+      if (value) this.buffer += this.decoder.decode(value, { stream: true });
+    }
+    const reply = parseReply(this.buffer);
+    this.buffer = "";
+    if (!reply.code) throw new Error("The mail server closed the connection unexpectedly.");
+    return reply;
+  }
+
+  async send(line: string): Promise<SmtpReply> {
+    await this.writer.write(this.encoder.encode(`${line}\r\n`));
+    return this.read();
+  }
+
+  async sendRaw(data: string): Promise<void> {
+    await this.writer.write(this.encoder.encode(data));
+  }
+
+  /** Upgrade to TLS after a 220 STARTTLS reply, replacing the reader/writer. */
+  async upgrade(): Promise<void> {
+    this.reader.releaseLock();
+    this.writer.releaseLock();
+    this.socket = this.socket.startTls();
+    this.reader = this.socket.readable.getReader();
+    this.writer = this.socket.writable.getWriter();
+    this.buffer = "";
+  }
+
+  async close(): Promise<void> {
+    try {
+      this.reader.releaseLock();
+      this.writer.releaseLock();
+      await this.socket.close();
+    } catch {
+      /* already closed */
+    }
+  }
+}
+
+function expect(reply: SmtpReply, ok: number[], stage: string): void {
+  if (!ok.includes(reply.code)) {
+    throw new Error(`${stage} failed — server said ${reply.code} ${reply.text}`);
+  }
+}
+
+function b64(value: string): string {
+  const bytes = new TextEncoder().encode(value);
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+
+async function deliver(config: SmtpConfig, msg: SmtpMessage): Promise<void> {
+  const clientDomain = msg.fromEmail.split("@")[1] || "localhost";
+  const session = await SmtpSession.open(config.host, config.port);
+  try {
+    expect(await session.read(), [220], "Connection");
+
+    let ehlo = await session.send(`EHLO ${clientDomain}`);
+    expect(ehlo, [250], "EHLO");
+
+    const supportsStartTls = ehlo.lines.some((l) => /STARTTLS/i.test(l));
+    if (supportsStartTls) {
+      expect(await session.send("STARTTLS"), [220], "STARTTLS");
+      await session.upgrade();
+      ehlo = await session.send(`EHLO ${clientDomain}`);
+      expect(ehlo, [250], "EHLO after STARTTLS");
+    } else if (config.port !== 25) {
+      throw new Error(
+        "The mail server does not advertise STARTTLS, so credentials cannot be sent securely.",
+      );
+    }
+
+    if (config.username && config.password) {
+      const authLine = ehlo.lines.find((l) => /AUTH\s/i.test(l)) ?? "";
+      if (/PLAIN/i.test(authLine) && !/LOGIN/i.test(authLine)) {
+        const token = b64(`\0${config.username}\0${config.password}`);
+        expect(await session.send(`AUTH PLAIN ${token}`), [235], "Authentication");
+      } else {
+        expect(await session.send("AUTH LOGIN"), [334], "Authentication");
+        expect(await session.send(b64(config.username)), [334], "Authentication (username)");
+        expect(await session.send(b64(config.password)), [235], "Authentication (password)");
+      }
+    }
+
+    expect(await session.send(`MAIL FROM:<${msg.fromEmail}>`), [250], "MAIL FROM");
+    expect(await session.send(`RCPT TO:<${msg.to}>`), [250, 251], "RCPT TO");
+    expect(await session.send("DATA"), [354], "DATA");
+    await session.sendRaw(`${buildMimeMessage(msg, clientDomain)}\r\n.\r\n`);
+    expect(await session.read(), [250], "Message delivery");
+
+    await session.send("QUIT").catch(() => undefined);
+  } finally {
+    await session.close();
+  }
+}
+
+export async function sendSmtp(config: SmtpConfig, msg: SmtpMessage): Promise<SmtpResult> {
+  const invalid = validateSmtpTarget(config.host, config.port);
+  if (invalid) return { ok: false, error: invalid };
+  if (config.username && !config.password) {
+    return { ok: false, error: "SMTP password secret is not available on the server." };
+  }
+  try {
+    await Promise.race([
+      deliver(config, msg),
+      new Promise<never>((_, reject) =>
+        setTimeout(
+          () => reject(new Error(`No response from ${config.host}:${config.port} within 15s.`)),
+          CONNECT_TIMEOUT_MS,
+        ),
+      ),
+    ]);
+    return { ok: true };
+  } catch (err) {
+    const base = err instanceof Error ? err.message : String(err);
+    const hint = /unavailable in this runtime|refused|not allowed|within 15s/i.test(base)
+      ? " If your host blocks outbound SMTP, use the Mailgun, Amazon SES or HTTP endpoint provider instead."
+      : "";
+    return { ok: false, error: `${base}${hint}` };
+  }
+}

package/src/tracking/injections.ts

@@ -0,0 +1,153 @@
+/**
+ * Pure helpers for the "Code & tracking" admin area.
+ *
+ * A profile holds raw code for three injection points plus well-known
+ * tracking IDs. Profiles are merged in scope order (global → locale → domain)
+ * into three final HTML strings that the root shell renders.
+ */
+
+export type InjectionScopeType = "global" | "locale" | "domain";
+
+export type ExtraMeta = { name: string; content: string };
+
+export type InjectionProfile = {
+  id: string;
+  name: string;
+  scope_type: InjectionScopeType;
+  scope_value: string;
+  enabled: boolean;
+  head_html: string;
+  body_start_html: string;
+  body_end_html: string;
+  gtm_id: string;
+  ga4_id: string;
+  meta_pixel_id: string;
+  tiktok_pixel_id: string;
+  extra_meta: ExtraMeta[];
+  sort_order: number;
+  updated_at?: string;
+};
+
+export type InjectionBundle = {
+  head: string;
+  bodyStart: string;
+  bodyEnd: string;
+};
+
+export const EMPTY_BUNDLE: InjectionBundle = { head: "", bodyStart: "", bodyEnd: "" };
+
+/** Escapes a value used inside a generated snippet / attribute. */
+function esc(v: string): string {
+  return v.replace(/[\\'"<>]/g, "");
+}
+
+export function normalizeHostname(host: string): string {
+  return host
+    .replace(/^https?:\/\//, "")
+    .replace(/\/+$/, "")
+    .replace(/:\d+$/, "")
+    .replace(/^www\./, "")
+    .toLowerCase();
+}
+
+/* ---------------- Snippet builders ---------------- */
+
+export function gtmHead(id: string): string {
+  const gtm = esc(id);
+  return `<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${gtm}');</script>`;
+}
+
+export function gtmBody(id: string): string {
+  const gtm = esc(id);
+  return `<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=${gtm}" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>`;
+}
+
+export function ga4Head(id: string): string {
+  const g = esc(id);
+  return `<script async src="https://www.googletagmanager.com/gtag/js?id=${g}"></script><script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config','${g}');</script>`;
+}
+
+export function metaPixelHead(id: string): string {
+  const p = esc(id);
+  return `<script>!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${p}');fbq('track','PageView');</script>`;
+}
+
+export function metaPixelBody(id: string): string {
+  const p = esc(id);
+  return `<noscript><img height="1" width="1" style="display:none" alt="" src="https://www.facebook.com/tr?id=${p}&ev=PageView&noscript=1" /></noscript>`;
+}
+
+export function tiktokPixelHead(id: string): string {
+  const p = esc(id);
+  return `<script>!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=["page","track","identify","instances","debug","on","off","once","ready","alias","group","enableCookie","disableCookie"];ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r="https://analytics.tiktok.com/i18n/pixel/events.js";ttq._i=ttq._i||{};ttq._i[e]=[];ttq._i[e]._u=r;ttq._t=ttq._t||{};ttq._t[e]=+new Date;ttq._o=ttq._o||{};ttq._o[e]=n||{};var o=d.createElement("script");o.type="text/javascript";o.async=!0;o.src=r+"?sdkid="+e+"&lib="+t;var a=d.getElementsByTagName("script")[0];a.parentNode.insertBefore(o,a)};ttq.load('${p}');ttq.page();}(window,document,'ttq');</script>`;
+}
+
+export function extraMetaTags(items: ExtraMeta[]): string {
+  return items
+    .filter((m) => m.name && m.content)
+    .map((m) => `<meta name="${esc(m.name)}" content="${m.content.replace(/"/g, "&quot;")}" />`)
+    .join("");
+}
+
+/* ---------------- Merge ---------------- */
+
+/** Turns one profile into its three HTML chunks (IDs first, then raw code). */
+export function profileToBundle(p: InjectionProfile): InjectionBundle {
+  const head: string[] = [];
+  const bodyStart: string[] = [];
+  const bodyEnd: string[] = [];
+
+  if (p.gtm_id?.trim()) {
+    head.push(gtmHead(p.gtm_id.trim()));
+    bodyStart.push(gtmBody(p.gtm_id.trim()));
+  }
+  if (p.ga4_id?.trim()) head.push(ga4Head(p.ga4_id.trim()));
+  if (p.meta_pixel_id?.trim()) {
+    head.push(metaPixelHead(p.meta_pixel_id.trim()));
+    bodyStart.push(metaPixelBody(p.meta_pixel_id.trim()));
+  }
+  if (p.tiktok_pixel_id?.trim()) head.push(tiktokPixelHead(p.tiktok_pixel_id.trim()));
+
+  const extras = Array.isArray(p.extra_meta) ? p.extra_meta : [];
+  const metas = extraMetaTags(extras);
+  if (metas) head.push(metas);
+
+  if (p.head_html?.trim()) head.push(p.head_html);
+  if (p.body_start_html?.trim()) bodyStart.push(p.body_start_html);
+  if (p.body_end_html?.trim()) bodyEnd.push(p.body_end_html);
+
+  return {
+    head: head.join("\n"),
+    bodyStart: bodyStart.join("\n"),
+    bodyEnd: bodyEnd.join("\n"),
+  };
+}
+
+/** Profiles that apply to the given locale + host, in scope order. */
+export function selectProfiles(
+  profiles: InjectionProfile[],
+  locale: string,
+  host: string,
+): InjectionProfile[] {
+  const h = normalizeHostname(host);
+  const rank: Record<InjectionScopeType, number> = { global: 0, locale: 1, domain: 2 };
+  return profiles
+    .filter((p) => p.enabled)
+    .filter((p) => {
+      if (p.scope_type === "global") return true;
+      if (p.scope_type === "locale") return p.scope_value === locale;
+      return normalizeHostname(p.scope_value) === h;
+    })
+    .sort((a, b) => rank[a.scope_type] - rank[b.scope_type] || a.sort_order - b.sort_order);
+}
+
+export function mergeBundles(profiles: InjectionProfile[]): InjectionBundle {
+  return profiles.map(profileToBundle).reduce<InjectionBundle>(
+    (acc, b) => ({
+      head: [acc.head, b.head].filter(Boolean).join("\n"),
+      bodyStart: [acc.bodyStart, b.bodyStart].filter(Boolean).join("\n"),
+      bodyEnd: [acc.bodyEnd, b.bodyEnd].filter(Boolean).join("\n"),
+    }),
+    EMPTY_BUNDLE,
+  );
+}