@clidey/dory 0.47.0 → 0.49.0

package/src/plugins/frontmatter-dev-server.ts

@@ -1,155 +1,11 @@
 import type { Plugin } from 'vite';
-import fs from 'fs';
 import path from 'path';
+import { generateFrontmatterJson, generateSearchContentJson } from './frontmatter-generator';
 
-// Read dory.json to get navigation order (flat list, in order)
-function getNavigationOrder(docsDir: string): string[] {
-  const doryJsonPath = path.join(docsDir, 'dory.json');
-  if (!fs.existsSync(doryJsonPath)) return [];
-  let doryJson;
-  try {
-    doryJson = JSON.parse(fs.readFileSync(doryJsonPath, 'utf-8'));
-  } catch (error) {
-    const detail = error instanceof SyntaxError ? error.message : String(error);
-    console.error(`Failed to parse ${doryJsonPath}: ${detail}`);
-    return [];
-  }
-  const order: string[] = [];
-
-  function walkPages(pages: any[]) {
-    for (const page of pages) {
-      if (typeof page === 'string') {
-        order.push(page);
-      } else if (typeof page === 'object' && page.pages) {
-        walkPages(page.pages);
-      }
-    }
-  }
-
-  if (doryJson.navigation && Array.isArray(doryJson.navigation.tabs)) {
-    for (const tab of doryJson.navigation.tabs) {
-      if (tab.groups && Array.isArray(tab.groups)) {
-        for (const group of tab.groups) {
-          if (group.pages && Array.isArray(group.pages)) {
-            walkPages(group.pages);
-          }
-        }
-      }
-    }
-  }
-  return order;
-}
-
-// Function to parse frontmatter from MDX content
-function parseFrontmatter(content: string) {
-  const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---/);
-  if (!frontmatterMatch) return { data: {}, content };
-
-  const frontmatter = frontmatterMatch[1];
-  const data: Record<string, any> = {};
-
-  frontmatter.split('\n').forEach(line => {
-    const [key, ...valueParts] = line.split(':');
-    if (key && valueParts.length) {
-      const value = valueParts.join(':').trim();
-      data[key.trim()] = value.replace(/^["']|["']$/g, '');
-    }
-  });
-
-  return { data, content: content.slice(frontmatterMatch[0].length) };
-}
-
-// Convert filename to path format used by the store
-function pathFromFilename(filename: string, docsDir: string): string {
-  return filename
-    .replace(docsDir, '')
-    .replace(/\/?index\.mdx$/, '/')
-    .replace(/\.mdx$/, '')
-    .replace(/\\/g, '/')
-    .toLowerCase();
-}
-
-// Function to recursively find all MDX files and map by relative path (without .mdx)
-function findMdxFilesMap(dir: string, baseDir: string): Record<string, string> {
-  const files: Record<string, string> = {};
-  const items = fs.readdirSync(dir, { withFileTypes: true });
-
-  for (const item of items) {
-    const fullPath = path.join(dir, item.name);
-    if (item.isDirectory()) {
-      Object.assign(files, findMdxFilesMap(fullPath, baseDir));
-    } else if (item.isFile() && item.name.endsWith('.mdx')) {
-      // Key: relative path without .mdx, with forward slashes
-      let rel = path.relative(baseDir, fullPath).replace(/\\/g, '/');
-      if (rel.endsWith('.mdx')) rel = rel.slice(0, -4);
-      files[rel] = fullPath;
-    }
-  }
-
-  return files;
-}
-
-// Function to generate frontmatter JSON in dory.json order, then append any extra files
-function generateFrontmatterJson(docsDir: string): Array<Record<string, any>> {
-  const navOrder = getNavigationOrder(docsDir);
-  const mdxFilesMap = findMdxFilesMap(docsDir, docsDir);
-  const usedKeys = new Set<string>();
-  const frontmatterArray: Array<Record<string, any>> = [];
-
-  // Process files in navigation order first
-  for (const navKey of navOrder) {
-    // Try both with and without "index"
-    let fileKey = navKey;
-    if (mdxFilesMap[fileKey]) {
-      usedKeys.add(fileKey);
-    } else if (mdxFilesMap[`${fileKey}/index`]) {
-      fileKey = `${fileKey}/index`;
-      usedKeys.add(fileKey);
-    } else {
-      continue;
-    }
-
-    const filePath = mdxFilesMap[fileKey];
-    const rawContent = fs.readFileSync(filePath, 'utf-8');
-    const { data } = parseFrontmatter(rawContent);
-    const pathname = pathFromFilename(filePath, docsDir);
-
-    frontmatterArray.push({
-      ...data,
-      path: pathname
-    });
-  }
-
-  // Process any extra files not in navigation order, sorted
-  const extraKeys = Object.keys(mdxFilesMap).filter(k => !usedKeys.has(k)).sort();
-  for (const fileKey of extraKeys) {
-    const filePath = mdxFilesMap[fileKey];
-    const rawContent = fs.readFileSync(filePath, 'utf-8');
-    const { data } = parseFrontmatter(rawContent);
-    const pathname = pathFromFilename(filePath, docsDir);
-
-    frontmatterArray.push({
-      ...data,
-      path: pathname
-    });
-  }
-
-  return frontmatterArray;
-}
-
-// Strip MDX/JSX syntax to extract plain text for search indexing
-function stripMdxToText(content: string): string {
-  return content
-    .replace(/^import\s+.*$/gm, '')
-    .replace(/^export\s+.*$/gm, '')
-    .replace(/```[\s\S]*?```/g, '')
-    .replace(/<[^>]+>/g, '')
-    .replace(/\[([^\]]*)\]\([^)]*\)/g, '$1')
-    .replace(/[#*_~`>|]/g, '')
-    .replace(/\n{3,}/g, '\n\n')
-    .trim();
-}
-
+/**
+ * Dev server plugin that serves frontmatter.json and search-content.json
+ * on demand, generated fresh per request from the docs directory.
+ */
 export function frontmatterDevServer(): Plugin {
   return {
     name: 'frontmatter-dev-server',
@@ -159,15 +15,8 @@ export function frontmatterDevServer(): Plugin {
         if (req.method !== 'GET') return next();
         try {
           const docsDir = path.join(process.cwd(), 'docs');
-          const fmArray = generateFrontmatterJson(docsDir);
-          const mdxFilesMap = findMdxFilesMap(docsDir, docsDir);
-          const searchContent = fmArray.map(fm => {
-            const entry = Object.entries(mdxFilesMap).find(([, fp]) => pathFromFilename(fp, docsDir) === fm.path);
-            if (!entry) return { path: fm.path, title: fm.title || '', content: '' };
-            const raw = fs.readFileSync(entry[1], 'utf-8');
-            const { content } = parseFrontmatter(raw);
-            return { path: fm.path, title: fm.title || '', content: stripMdxToText(content) };
-          });
+          const frontmatterArray = generateFrontmatterJson(docsDir);
+          const searchContent = generateSearchContentJson(docsDir, frontmatterArray);
           const json = JSON.stringify(searchContent);
           res.setHeader('Content-Type', 'application/json; charset=utf-8');
           res.end(json);
@@ -199,4 +48,4 @@ export function frontmatterDevServer(): Plugin {
       });
     }
   };
-}
+}

package/src/plugins/frontmatter-generator.ts

@@ -1,106 +1,38 @@
 import type { Plugin } from 'vite';
 import fs from 'fs';
 import path from 'path';
+import {
+  getNavigationOrder,
+  parseFrontmatter,
+  pathFromFilename,
+  findMdxFilesMap,
+  stripMdxToText,
+} from './shared';
 
 interface FrontmatterGeneratorOptions {
   docsDir?: string;
-  outputPath?: string;
 }
 
-// Read dory.json to get navigation order (flat list, in order)
-function getNavigationOrder(docsDir: string): string[] {
-  const doryJsonPath = path.join(docsDir, 'dory.json');
-  if (!fs.existsSync(doryJsonPath)) return [];
-  let doryJson;
-  try {
-    doryJson = JSON.parse(fs.readFileSync(doryJsonPath, 'utf-8'));
-  } catch (error) {
-    const detail = error instanceof SyntaxError ? error.message : String(error);
-    console.error(`Failed to parse ${doryJsonPath}: ${detail}`);
-    return [];
-  }
-  const order: string[] = [];
-
-  function walkPages(pages: any[]) {
-    for (const page of pages) {
-      if (typeof page === 'string') {
-        order.push(page);
-      } else if (typeof page === 'object' && page.pages) {
-        walkPages(page.pages);
-      }
-    }
-  }
-
-  if (doryJson.navigation && Array.isArray(doryJson.navigation.tabs)) {
-    for (const tab of doryJson.navigation.tabs) {
-      if (tab.groups && Array.isArray(tab.groups)) {
-        for (const group of tab.groups) {
-          if (group.pages && Array.isArray(group.pages)) {
-            walkPages(group.pages);
-          }
-        }
-      }
-    }
-  }
-  return order;
-}
-
-// Function to parse frontmatter from MDX content
-function parseFrontmatter(content: string) {
-  const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---/);
-  if (!frontmatterMatch) return { data: {}, content };
-
-  const frontmatter = frontmatterMatch[1];
-  const data: Record<string, any> = {};
-
-  frontmatter.split('\n').forEach(line => {
-    const [key, ...valueParts] = line.split(':');
-    if (key && valueParts.length) {
-      const value = valueParts.join(':').trim();
-      data[key.trim()] = value.replace(/^["']|["']$/g, '');
-    }
-  });
-
-  return { data, content: content.slice(frontmatterMatch[0].length) };
-}
-
-// Convert filename to path format used by the store
-function pathFromFilename(filename: string, docsDir: string): string {
-  return filename
-    .replace(docsDir, '')
-    .replace(/\/?index\.mdx$/, '/')
-    .replace(/\.mdx$/, '')
-    .replace(/\\/g, '/')
-    .toLowerCase();
-}
-
-// Function to recursively find all MDX files and map by relative path (without .mdx)
-function findMdxFilesMap(dir: string, baseDir: string): Record<string, string> {
-  const files: Record<string, string> = {};
-  const items = fs.readdirSync(dir, { withFileTypes: true });
-
-  for (const item of items) {
-    const fullPath = path.join(dir, item.name);
-    if (item.isDirectory()) {
-      Object.assign(files, findMdxFilesMap(fullPath, baseDir));
-    } else if (item.isFile() && item.name.endsWith('.mdx')) {
-      // Key: relative path without .mdx, with forward slashes
-      let rel = path.relative(baseDir, fullPath).replace(/\\/g, '/');
-      if (rel.endsWith('.mdx')) rel = rel.slice(0, -4);
-      files[rel] = fullPath;
-    }
-  }
-
-  return files;
-}
-
-// Function to generate frontmatter JSON in dory.json order, then append any extra files
-function generateFrontmatterJson(docsDir: string): Array<Record<string, any>> {
+/**
+ * Generates the frontmatter array for all MDX files in dory.json navigation
+ * order, then appends any extra files (sorted).
+ */
+export function generateFrontmatterJson(docsDir: string): Array<Record<string, any>> {
   const navOrder = getNavigationOrder(docsDir);
   const mdxFilesMap = findMdxFilesMap(docsDir, docsDir);
   const usedKeys = new Set<string>();
   const frontmatterArray: Array<Record<string, any>> = [];
 
+  const pushEntry = (fileKey: string) => {
+    const filePath = mdxFilesMap[fileKey];
+    const rawContent = fs.readFileSync(filePath, 'utf-8');
+    const { data } = parseFrontmatter(rawContent);
+    frontmatterArray.push({
+      ...data,
+      path: pathFromFilename(filePath, docsDir),
+    });
+  };
+
   // Process files in navigation order first
   for (const navKey of navOrder) {
     // Try both with and without "index"
@@ -113,55 +45,30 @@ function generateFrontmatterJson(docsDir: string): Array<Record<string, any>> {
     } else {
       continue;
     }
-
-    const filePath = mdxFilesMap[fileKey];
-    const rawContent = fs.readFileSync(filePath, 'utf-8');
-    const { data } = parseFrontmatter(rawContent);
-    const pathname = pathFromFilename(filePath, docsDir);
-
-    frontmatterArray.push({
-      ...data,
-      path: pathname
-    });
+    pushEntry(fileKey);
   }
 
   // Process any extra files not in navigation order, sorted
   const extraKeys = Object.keys(mdxFilesMap).filter(k => !usedKeys.has(k)).sort();
   for (const fileKey of extraKeys) {
-    const filePath = mdxFilesMap[fileKey];
-    const rawContent = fs.readFileSync(filePath, 'utf-8');
-    const { data } = parseFrontmatter(rawContent);
-    const pathname = pathFromFilename(filePath, docsDir);
-
-    frontmatterArray.push({
-      ...data,
-      path: pathname
-    });
+    pushEntry(fileKey);
   }
 
   return frontmatterArray;
 }
 
-// Strip MDX/JSX syntax to extract plain text for search indexing
-function stripMdxToText(content: string): string {
-  return content
-    .replace(/^import\s+.*$/gm, '')           // import statements
-    .replace(/^export\s+.*$/gm, '')           // export statements
-    .replace(/```[\s\S]*?```/g, '')           // fenced code blocks
-    .replace(/<[^>]+>/g, '')                  // JSX/HTML tags
-    .replace(/\[([^\]]*)\]\([^)]*\)/g, '$1')  // markdown links → text
-    .replace(/[#*_~`>|]/g, '')               // markdown syntax chars
-    .replace(/\n{3,}/g, '\n\n')              // collapse blank lines
-    .trim();
-}
-
-// Generate search content JSON: [{ path, title, content }]
-function generateSearchContentJson(docsDir: string, frontmatterArray: Array<Record<string, any>>): Array<Record<string, any>> {
+/**
+ * Generates search content entries: [{ path, title, content }] with MDX
+ * stripped to plain text for client-side indexing.
+ */
+export function generateSearchContentJson(
+  docsDir: string,
+  frontmatterArray: Array<Record<string, any>>
+): Array<Record<string, any>> {
   const mdxFilesMap = findMdxFilesMap(docsDir, docsDir);
   const searchContent: Array<Record<string, any>> = [];
 
   for (const fm of frontmatterArray) {
-    // Find the MDX file for this frontmatter entry
     const fileEntry = Object.entries(mdxFilesMap).find(([, filePath]) =>
       pathFromFilename(filePath, docsDir) === fm.path
     );
@@ -169,14 +76,15 @@ function generateSearchContentJson(docsDir: string, frontmatterArray: Array<Reco
 
     const rawContent = fs.readFileSync(fileEntry[1], 'utf-8');
     const { content } = parseFrontmatter(rawContent);
-    const text = stripMdxToText(content);
-
-    searchContent.push({ path: fm.path, title: fm.title || '', content: text });
+    searchContent.push({ path: fm.path, title: fm.title || '', content: stripMdxToText(content) });
   }
 
   return searchContent;
 }
 
+/**
+ * Build plugin that emits frontmatter.json and search-content.json.
+ */
 export function frontmatterGenerator(options: FrontmatterGeneratorOptions = {}): Plugin {
   return {
     name: 'frontmatter-generator',
@@ -206,4 +114,4 @@ export function frontmatterGenerator(options: FrontmatterGeneratorOptions = {}):
       console.log(`🔍 Generated search content (${searchContent.length} pages, ${(searchJson.length / 1024).toFixed(0)} KB)`);
     }
   };
-}
+}

package/src/plugins/html-files-middleware.test.ts

@@ -0,0 +1,21 @@
+import { describe, it, expect } from 'vitest';
+import { resolve } from 'path';
+import { isPathInside } from './html-files-middleware';
+
+describe('isPathInside', () => {
+  const root = resolve('/srv/app/dist');
+
+  it('accepts the root itself and children', () => {
+    expect(isPathInside(root, root)).toBe(true);
+    expect(isPathInside(root, resolve(root, 'assets/app.js'))).toBe(true);
+  });
+
+  it('rejects traversal outside the root', () => {
+    expect(isPathInside(root, resolve(root, '../../../etc/passwd'))).toBe(false);
+    expect(isPathInside(root, resolve('/etc/passwd'))).toBe(false);
+  });
+
+  it('rejects sibling directories sharing the root as a string prefix', () => {
+    expect(isPathInside(root, resolve('/srv/app/dist-other/file'))).toBe(false);
+  });
+});

package/src/plugins/html-files-middleware.ts

@@ -1,6 +1,14 @@
 import type { Plugin } from 'vite';
 import { readFileSync, existsSync, statSync } from 'fs';
-import { resolve, extname } from 'path';
+import { resolve, extname, sep } from 'path';
+
+/**
+ * Returns true if `target` is the `root` path itself or is contained within it.
+ * Both paths must already be resolved (absolute, normalized).
+ */
+export function isPathInside(root: string, target: string): boolean {
+  return target === root || target.startsWith(root + sep);
+}
 
 /**
  * Vite plugin to serve HTML files and assets directly from the docs directory
@@ -53,17 +61,24 @@ export function htmlFilesMiddleware(): Plugin {
 
         // Check if the request is for a file in the dist directory
         if (url.startsWith('/dist/')) {
+          const distRoot = resolve(process.cwd(), 'dist');
           const distPath = resolve(process.cwd(), url.slice(1));
 
+          // Reject paths that escape the dist directory (e.g. /dist/../../etc/passwd)
+          if (!isPathInside(distRoot, distPath)) {
+            res.statusCode = 403;
+            res.end('Forbidden');
+            return;
+          }
+
           if (existsSync(distPath)) {
             try {
-              const content = readFileSync(distPath, 'utf-8');
+              const content = readFileSync(distPath);
               const ext = extname(url).toLowerCase();
               const contentType = mimeTypes[ext] || 'application/octet-stream';
 
               res.setHeader('Content-Type', contentType);
               res.setHeader('Cache-Control', 'no-cache');
-              res.setHeader('Access-Control-Allow-Origin', '*');
               res.end(content);
               return;
             } catch (error) {
@@ -74,7 +89,15 @@ export function htmlFilesMiddleware(): Plugin {
 
         // Check if the request is for a file in the docs directory
         // This handles both direct file requests and directory requests
-        const docsPath = resolve(process.cwd(), 'docs', url.slice(1));
+        const docsRoot = resolve(process.cwd(), 'docs');
+        const docsPath = resolve(docsRoot, url.slice(1));
+
+        // Reject paths that escape the docs directory
+        if (!isPathInside(docsRoot, docsPath)) {
+          res.statusCode = 403;
+          res.end('Forbidden');
+          return;
+        }
 
         if (existsSync(docsPath)) {
           try {
@@ -91,7 +114,6 @@ export function htmlFilesMiddleware(): Plugin {
 
                 res.setHeader('Content-Type', contentType);
                 res.setHeader('Cache-Control', 'no-cache');
-                res.setHeader('Access-Control-Allow-Origin', '*');
                 res.end(content);
                 return;
               }