@bygghammar/cms-platform 0.80.1 → 0.90.0-m7.10

package/src/server/schemas.ts

@@ -33,6 +33,47 @@ export const cmsKey = z
 
 export const listLimit = z.object({ limit: z.number().min(1).max(500).default(200) });
 
+/* ---------------------------------------------------------------- edit locks */
+
+/**
+ * Identifies one editing session — one browser tab, across reloads. Opaque to
+ * the server, which only ever compares it with the one stored on the lock.
+ */
+export const editSessionId = z.string().min(1).max(120);
+
+/**
+ * What kind of thing is locked. Deliberately a validated string rather than an
+ * enum so a host can lock a record type this package has never heard of.
+ */
+export const lockResourceType = z
+  .string()
+  .min(1)
+  .max(64)
+  .regex(/^[a-z][a-z0-9_]*$/);
+
+/** Which one. A uuid for most records, a CMS key for others. */
+export const lockResourceId = z.string().min(1).max(200);
+
+export const editLockSchemas = {
+  ref: z.object({ resourceType: lockResourceType, resourceId: lockResourceId }),
+  acquire: z.object({
+    resourceType: lockResourceType,
+    resourceId: lockResourceId,
+    sessionId: editSessionId,
+    ttlSeconds: z.number().int().min(15).max(3600).optional(),
+  }),
+  release: z.object({
+    resourceType: lockResourceType,
+    resourceId: lockResourceId,
+    sessionId: editSessionId,
+  }),
+  status: z.object({
+    resourceType: lockResourceType,
+    resourceId: lockResourceId,
+    sessionId: editSessionId.optional(),
+  }),
+} as const;
+
 /* --------------------------------------------------------------- page builder */
 
 /** One block instance as it travels over the wire. */
@@ -46,17 +87,22 @@ export const blockInstanceSchema = z.object({
 
 export const pageSchemas = {
   key: z.object({ key: z.string() }),
-  pageId: z.object({ pageId: uuid }),
-  versionId: z.object({ versionId: uuid }),
-  sectionId: z.object({ sectionId: uuid }),
-  publicationId: z.object({ publicationId: uuid }),
+  pageId: z.object({ pageId: uuid, editSessionId: editSessionId.optional() }),
+  versionId: z.object({ versionId: uuid, editSessionId: editSessionId.optional() }),
+  sectionId: z.object({ sectionId: uuid, editSessionId: editSessionId.optional() }),
+  publicationId: z.object({ publicationId: uuid, editSessionId: editSessionId.optional() }),
   createPage: z.object({ key: cmsKey, name: z.string().min(1).max(120) }),
-  renamePage: z.object({ pageId: uuid, name: z.string().min(1).max(120) }),
+  renamePage: z.object({
+    pageId: uuid,
+    name: z.string().min(1).max(120),
+    editSessionId: editSessionId.optional(),
+  }),
   savePageVersion: z.object({
     pageId: uuid,
     blocks: z.array(blockInstanceSchema),
     publish: z.boolean().optional(),
     note: z.string().max(500).optional(),
+    editSessionId: editSessionId.optional(),
   }),
   createGlobalSection: z.object({
     key: cmsKey,
@@ -64,18 +110,28 @@ export const pageSchemas = {
     blocks: z.array(blockInstanceSchema).optional(),
     kind: z.enum(["block", "section"]).optional(),
   }),
-  setGlobalSectionKind: z.object({ sectionId: uuid, kind: z.enum(["block", "section"]) }),
+  setGlobalSectionKind: z.object({
+    sectionId: uuid,
+    kind: z.enum(["block", "section"]),
+    editSessionId: editSessionId.optional(),
+  }),
   saveGlobalSectionVersion: z.object({
     sectionId: uuid,
     blocks: z.array(blockInstanceSchema),
     note: z.string().max(500).optional(),
+    editSessionId: editSessionId.optional(),
+  }),
+  renameGlobalSection: z.object({
+    sectionId: uuid,
+    name: z.string().min(1).max(120),
+    editSessionId: editSessionId.optional(),
   }),
-  renameGlobalSection: z.object({ sectionId: uuid, name: z.string().min(1).max(120) }),
   schedulePageVersion: z.object({
     versionId: uuid,
     publishAt: z.string().datetime(),
     unpublishAt: z.string().datetime().nullable().optional(),
     note: z.string().max(500).optional(),
+    editSessionId: editSessionId.optional(),
   }),
 } as const;
 
@@ -233,8 +289,16 @@ export function pageSeoSchemas<P extends string, L extends string>(input: {
   return {
     seo,
     slugs,
-    save: z.object({ pageKey: z.enum(input.pageKeys as unknown as [P, ...P[]]), slugs, seo }),
-    delete: z.object({ pageKey: z.enum(input.pageKeys as unknown as [P, ...P[]]) }),
+    save: z.object({
+      pageKey: z.enum(input.pageKeys as unknown as [P, ...P[]]),
+      slugs,
+      seo,
+      editSessionId: editSessionId.optional(),
+    }),
+    delete: z.object({
+      pageKey: z.enum(input.pageKeys as unknown as [P, ...P[]]),
+      editSessionId: editSessionId.optional(),
+    }),
   } as const;
 }
 
@@ -242,4 +306,5 @@ export type PageSeoSaveInput = {
   pageKey: string;
   slugs: Record<string, unknown>;
   seo: Record<string, unknown>;
+  editSessionId?: string;
 };

package/src/server/webhook-url-guard.ts

@@ -0,0 +1,199 @@
+/**
+ * Where an outbound webhook is allowed to go.
+ *
+ * A webhook endpoint is a URL an administrator types in, and the server then
+ * fetches it. That is a server-side request forgery primitive unless something
+ * stops it: without this guard, "https://169.254.169.254/latest/meta-data/"
+ * turns the CMS into a proxy for reading the host's cloud credentials, and
+ * "https://127.0.0.1:5432" turns it into a port scanner for the private
+ * network the server sits in.
+ *
+ * So the rule is an allowlist of shapes, not a blocklist of strings:
+ *   - https only, never http, never file:, gopher:, data: or anything else;
+ *   - no credentials in the URL;
+ *   - a hostname that is not a literal IP address in any private, loopback,
+ *     link-local, unique-local or otherwise special range;
+ *   - no hostname that is a known cloud-metadata name.
+ *
+ * DNS is deliberately NOT resolved here. A name can resolve to a public
+ * address at validation time and a private one at delivery time, so the
+ * defence that matters is re-checking every hop at fetch time — which is what
+ * `safeFetch` does, including on each redirect.
+ *
+ * Server-only. Never import from client code.
+ */
+
+export type UrlRejection =
+  | "not-a-url"
+  | "not-https"
+  | "has-credentials"
+  | "blocked-host"
+  | "blocked-ip"
+  | "too-long";
+
+export type UrlCheck =
+  | { readonly ok: true; readonly url: URL }
+  | {
+      readonly ok: false;
+      readonly reason: UrlRejection;
+      /** Safe to show an administrator: never contains a resolved address. */
+      readonly message: string;
+    };
+
+const MAX_URL_LENGTH = 2048;
+
+/** Hostnames that address the machine or its cloud environment, never a customer's server. */
+const BLOCKED_HOSTNAMES: ReadonlySet<string> = new Set([
+  "localhost",
+  "localhost.localdomain",
+  "ip6-localhost",
+  "ip6-loopback",
+  // Cloud instance metadata. Reaching any of these leaks the host's own
+  // credentials, which is the single highest-value target of an SSRF.
+  "metadata",
+  "metadata.google.internal",
+  "metadata.goog",
+  "instance-data",
+]);
+
+/** Suffixes that only ever name something inside the network the server is on. */
+const BLOCKED_SUFFIXES: readonly string[] = [
+  ".localhost",
+  ".local",
+  ".internal",
+  ".intranet",
+  ".private",
+  ".corp",
+  ".home",
+  ".lan",
+];
+
+function parseIPv4(host: string): readonly number[] | null {
+  const parts = host.split(".");
+  if (parts.length !== 4) return null;
+  const octets = parts.map((part) => {
+    if (!/^\d{1,3}$/.test(part)) return -1;
+    const value = Number(part);
+    return value >= 0 && value <= 255 ? value : -1;
+  });
+  return octets.some((o) => o < 0) ? null : octets;
+}
+
+/** Every IPv4 range that is not a routable, public destination. */
+function isBlockedIPv4(octets: readonly number[]): boolean {
+  const [a, b] = octets as [number, number, number, number];
+  if (a === 0) return true; // "this network"
+  if (a === 10) return true; // private
+  if (a === 127) return true; // loopback
+  if (a === 169 && b === 254) return true; // link-local, incl. cloud metadata
+  if (a === 172 && b >= 16 && b <= 31) return true; // private
+  if (a === 192 && b === 168) return true; // private
+  if (a === 192 && b === 0) return true; // IETF protocol assignments
+  if (a === 100 && b >= 64 && b <= 127) return true; // carrier-grade NAT
+  if (a === 198 && (b === 18 || b === 19)) return true; // benchmarking
+  if (a >= 224) return true; // multicast and reserved, incl. 255.255.255.255
+  return false;
+}
+
+/**
+ * IPv6, including the forms that smuggle an IPv4 address inside one.
+ *
+ * `::ffff:127.0.0.1` and `::ffff:7f00:1` are both loopback wearing a different
+ * hat, and a guard that only looked at the textual prefix would pass them.
+ */
+function isBlockedIPv6(host: string): boolean {
+  const address = host.replace(/^\[|\]$/g, "").toLowerCase();
+  if (address === "::" || address === "::1") return true;
+
+  const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(address);
+  if (mapped !== null) {
+    const octets = parseIPv4(mapped[1] as string);
+    return octets === null || isBlockedIPv4(octets);
+  }
+  // ::ffff:7f00:1 — the same address written as hex groups.
+  const hexMapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(address);
+  if (hexMapped !== null) {
+    const high = Number.parseInt(hexMapped[1] as string, 16);
+    const low = Number.parseInt(hexMapped[2] as string, 16);
+    const octets = [high >> 8, high & 0xff, low >> 8, low & 0xff];
+    return isBlockedIPv4(octets);
+  }
+
+  if (/^fe[89ab][0-9a-f]:/.test(address)) return true; // link-local
+  if (/^f[cd][0-9a-f]{2}:/.test(address)) return true; // unique local
+  if (/^ff[0-9a-f]{2}:/.test(address)) return true; // multicast
+  return false;
+}
+
+/** Whether this hostname is one the server must never be told to fetch. */
+export function isBlockedHostname(hostname: string): boolean {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  if (host === "") return true;
+  if (BLOCKED_HOSTNAMES.has(host)) return true;
+  if (BLOCKED_SUFFIXES.some((suffix) => host.endsWith(suffix))) return true;
+
+  const v4 = parseIPv4(host);
+  if (v4 !== null) return isBlockedIPv4(v4);
+  if (host.includes(":")) return isBlockedIPv6(host);
+  return false;
+}
+
+/**
+ * Validate a webhook endpoint.
+ *
+ * Used both when an administrator saves a destination and again on every hop
+ * of the actual request — a URL that was fine at save time can redirect
+ * somewhere that is not.
+ */
+export function checkWebhookUrl(raw: string): UrlCheck {
+  const input = (raw ?? "").trim();
+  if (input === "")
+    return { ok: false, reason: "not-a-url", message: "Enter an endpoint." };
+  if (input.length > MAX_URL_LENGTH) {
+    return {
+      ok: false,
+      reason: "too-long",
+      message: "That endpoint is too long.",
+    };
+  }
+
+  let url: URL;
+  try {
+    url = new URL(input);
+  } catch {
+    return {
+      ok: false,
+      reason: "not-a-url",
+      message: "That is not a valid URL.",
+    };
+  }
+
+  if (url.protocol !== "https:") {
+    return {
+      ok: false,
+      reason: "not-https",
+      message:
+        "The endpoint must start with https:// — an unencrypted webhook would expose the data it carries.",
+    };
+  }
+  if (url.username !== "" || url.password !== "") {
+    return {
+      ok: false,
+      reason: "has-credentials",
+      message:
+        "Remove the username and password from the URL. Use the signing secret instead.",
+    };
+  }
+  if (isBlockedHostname(url.hostname)) {
+    const looksLikeIp =
+      parseIPv4(url.hostname) !== null || url.hostname.includes(":");
+    return {
+      ok: false,
+      reason: looksLikeIp ? "blocked-ip" : "blocked-host",
+      message:
+        "That address is inside this server's own network. A webhook must point at a public endpoint.",
+    };
+  }
+
+  return { ok: true, url };
+}

package/src/site/SiteHeader.tsx

@@ -12,10 +12,14 @@ import { ChevronDown, Menu, X } from "lucide-react";
 
 import { useT } from "../i18n";
 import type { LocalizedString } from "../i18n/types";
-import { navigationPanelId, type NavigationItem } from "../navigation";
+import { navigationPanelId, renderableNavigation, type NavigationItem } from "../navigation";
 
 export type SiteHeaderProps = {
-  /** Top-level navigation, optionally with one level of children. */
+  /**
+   * Top-level navigation, optionally with one level of children. Entries with
+   * no label or no link in the current locale are left out; see
+   * `renderableNavigation`.
+   */
   nav: readonly NavigationItem[];
   /** Brand name, used as the logo link's accessible label. */
   brandName: LocalizedString;
@@ -176,7 +180,7 @@ export function SiteHeader({
   backoffice,
   lightTextPaths = ["/"],
 }: SiteHeaderProps) {
-  const { t } = useT();
+  const { t, locale } = useT();
   const pathname = useRouterState({ select: (r) => r.location.pathname });
 
   const [scrolled, setScrolled] = useState(false);
@@ -230,6 +234,8 @@ export function SiteHeader({
   const logo = onLightSurface && logoDarkSrc ? logoDarkSrc : logoSrc;
   const invertLogo = onLightSurface && !logoDarkSrc && invertLogoOnLightSurface;
   const showBackoffice = Boolean(backoffice?.signedIn);
+  // Half-finished entries are the editor's business, not a visitor's.
+  const items = renderableNavigation(nav, locale);
 
   return (
     <header
@@ -251,7 +257,7 @@ export function SiteHeader({
         </Link>
 
         <nav className="hidden md:flex items-center gap-10">
-          {nav.map((n) => (
+          {items.map((n) => (
             <NavEntry key={n.href} item={n} lightText={lightText} />
           ))}
         </nav>
@@ -301,7 +307,7 @@ export function SiteHeader({
       {open && (
         <div ref={panelRef} className="md:hidden bg-background border-t border-border">
           <nav className="container-editorial flex flex-col py-6">
-            {nav.map((n) => {
+            {items.map((n) => {
               const kids = n.children ?? [];
               if (kids.length === 0) {
                 return (

package/src/site/host.ts

@@ -0,0 +1,172 @@
+/**
+ * One hostname implementation for the whole platform.
+ *
+ * Locale resolution, tracking domain scope, the admin-domain comparison and
+ * every generated origin used to carry their own near-miss normalizer. They
+ * disagreed on ports, on whitespace, on casing and — worst — on `www.`, so a
+ * domain saved through the backoffice could be unmatchable by construction.
+ *
+ * Two distinct jobs, kept as two functions rather than one ambiguous one:
+ *
+ *   `normalizeCanonicalDomain` is the STORAGE form. It is what the site
+ *   advertises: canonical URLs, hreflang, sitemaps. It preserves whether the
+ *   configured hostname starts with `www.`, because that is a real choice.
+ *
+ *   `hostMatchKey` is the MATCHING form. Apex and exactly one leading `www.`
+ *   are aliases of each other, so both fold to the same key.
+ *
+ * Pure module — no database, no filesystem, no network.
+ */
+
+/** Longest a hostname may be, per RFC 1035. */
+const MAX_HOST_LENGTH = 253;
+/** Longest a single label may be, per RFC 1035. */
+const MAX_LABEL_LENGTH = 63;
+
+/** A label: alphanumerics and inner hyphens. Underscores are not hostnames. */
+const LABEL = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+
+/**
+ * Reduce any host-ish string to its canonical stored form.
+ *
+ * Trims, strips a scheme, strips path/query/fragment, strips a trailing slash,
+ * strips a port, lowercases — and leaves a leading `www.` exactly as given.
+ *
+ * `https://WWW.Voyara.se/foo/` → `www.voyara.se`
+ * `voyara.se:443`              → `voyara.se`
+ */
+export function normalizeCanonicalDomain(value: string | null | undefined): string {
+  return (value ?? "")
+    .trim()
+    .replace(/^[a-z][a-z0-9+.-]*:\/\//i, "")
+    .replace(/[/?#].*$/, "")
+    .replace(/\.+$/, "")
+    .replace(/:\d*$/, "")
+    .toLowerCase();
+}
+
+/**
+ * The key two hostnames are compared on.
+ *
+ * Exactly one leading `www.` is folded away, so `voyara.se`, `www.voyara.se`
+ * and `WWW.VOYARA.SE` all resolve to the same mapping. `www.www.voyara.se`
+ * does not — only one level is an alias.
+ */
+export function hostMatchKey(value: string | null | undefined): string {
+  return normalizeCanonicalDomain(value).replace(/^www\./, "");
+}
+
+/**
+ * Whether a host only ever resolves on the machine serving it.
+ *
+ * Kept here rather than beside the backoffice guard because the server needs
+ * it too: a loopback address stored as the admin domain is a lockout nobody
+ * outside the box can undo, so it has to be refusable at the write.
+ */
+export function isLoopbackHost(value: string | null | undefined): boolean {
+  const host = normalizeCanonicalDomain(value);
+  return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "[::1]";
+}
+
+/** Whether two host-ish strings name the same site, apex/`www.` included. */
+export function hostsMatch(a: string | null | undefined, b: string | null | undefined): boolean {
+  const left = hostMatchKey(a);
+  return left !== "" && left === hostMatchKey(b);
+}
+
+/**
+ * `https://<canonical host>`, or "" when there is no usable host.
+ *
+ * Validity is checked here rather than at each call site because the rows this
+ * runs on predate the write validation. A `locale_domains` table filled before
+ * the backoffice started refusing bad hostnames still holds them, and without
+ * this every caller — canonical, hreflang, the sitemap index, the sitemap
+ * urlset — would happily publish `https://not a host/om-oss` as an address.
+ */
+export function domainOrigin(value: string | null | undefined): string {
+  if (!isValidCanonicalDomain(value)) return "";
+  const host = normalizeCanonicalDomain(value);
+  return host ? `https://${host}` : "";
+}
+
+export type CanonicalDomainResult =
+  | { ok: true; domain: string }
+  | { ok: false; reason: CanonicalDomainProblem };
+
+export type CanonicalDomainProblem =
+  | "empty"
+  | "credentials"
+  | "unsupported-scheme"
+  | "invalid-port"
+  | "whitespace"
+  | "too-long"
+  | "invalid-label";
+
+/**
+ * Validate and normalize a domain a human typed into the backoffice.
+ *
+ * Normalization is generous about the forms people paste — a full URL, a
+ * trailing slash, a port, stray casing. It is deliberately not generous about
+ * input that cannot be a hostname at all: embedded credentials, a non-HTTP
+ * scheme, internal whitespace or an unusable label are rejected rather than
+ * quietly stored as something the matcher will never find.
+ */
+export function parseCanonicalDomain(value: string | null | undefined): CanonicalDomainResult {
+  const raw = (value ?? "").trim();
+  if (!raw) return { ok: false, reason: "empty" };
+  if (/\s/.test(raw)) return { ok: false, reason: "whitespace" };
+
+  // No hostname contains one, in any of the forms people paste.
+  if (raw.includes("@")) return { ok: false, reason: "credentials" };
+
+  // The slashes are optional so `javascript:...` is named for what it is
+  // rather than failing later as a bad port. Two things keep a hostname from
+  // reading as a scheme: a colon followed by digits is a port (`example.com:443`),
+  // and a dotted prefix is a hostname (`example.com:notaport`), since no scheme
+  // anyone types contains a dot.
+  const scheme = /^([a-z][a-z0-9+-]*):(?=\/\/|[^\d\s])/i.exec(raw);
+  if (scheme && !/^https?$/i.test(scheme[1] as string)) {
+    return { ok: false, reason: "unsupported-scheme" };
+  }
+
+  const authority = raw.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/[/?#].*$/, "");
+  const port = /:(.*)$/.exec(authority);
+  if (port && !/^\d{1,5}$/.test(port[1] as string)) return { ok: false, reason: "invalid-port" };
+
+  const domain = normalizeCanonicalDomain(raw);
+  if (!domain) return { ok: false, reason: "empty" };
+  if (domain.length > MAX_HOST_LENGTH) return { ok: false, reason: "too-long" };
+
+  const labels = domain.split(".");
+  const usable = labels.every(
+    (label) => label.length > 0 && label.length <= MAX_LABEL_LENGTH && LABEL.test(label),
+  );
+  if (!usable) return { ok: false, reason: "invalid-label" };
+
+  return { ok: true, domain };
+}
+
+/** Whether a typed domain would be stored as-is. */
+export function isValidCanonicalDomain(value: string | null | undefined): boolean {
+  return parseCanonicalDomain(value).ok;
+}
+
+/** Human-readable reason a domain was rejected. */
+export function canonicalDomainProblemMessage(reason: CanonicalDomainProblem): string {
+  switch (reason) {
+    case "empty":
+      return "Enter a domain.";
+    case "credentials":
+      return "A domain cannot contain a username or password.";
+    case "unsupported-scheme":
+      return "Only http:// and https:// addresses are accepted.";
+    case "invalid-port":
+      return "That port is not a number.";
+    case "whitespace":
+      return "A domain cannot contain spaces.";
+    case "too-long":
+      return "That domain is too long.";
+    case "invalid-label":
+      return "That is not a valid hostname.";
+  }
+}