@cobinar/dalus 0.1.1 → 0.1.5

package/src/commands/storage.js

@@ -0,0 +1,72 @@
+// src/storage.js
+import { generateId } from './utils.js';
+
+const FOLDER_COLLECTIONS = new Set(['posts', 'products', 'projects']);
+const FLAT_COLLECTIONS = new Set(['images', 'files']);
+export const ALL_COLLECTIONS = new Set([...FOLDER_COLLECTIONS, ...FLAT_COLLECTIONS]);
+export { FOLDER_COLLECTIONS, FLAT_COLLECTIONS };
+
+export function generateUploadPath(collection, entityId, ext, slot) {
+  const uid = generateId();
+  if (FLAT_COLLECTIONS.has(collection)) {
+    return `cobinar/${collection}/${uid}.${ext.toLowerCase()}`;
+  }
+  const prefix = slot ? `${slot}-${uid}` : uid;
+  return `cobinar/${collection}/${entityId}/${prefix}.${ext.toLowerCase()}`;
+}
+
+export async function uploadFile(bucket, key, body, contentType, metadata = {}) {
+  await bucket.put(key, body, {
+    httpMetadata: {
+      contentType,
+      cacheControl: 'public, max-age=31536000, immutable',
+    },
+    customMetadata: {
+      uploadedAt: new Date().toISOString(),
+      ...sanitizeMetadata(metadata),
+    },
+  });
+  return { key };
+}
+
+export async function deleteFiles(bucket, keys) {
+  if (!keys || keys.length === 0) return;
+  await bucket.delete(keys);
+}
+
+export async function streamFile(bucket, key, extraHeaders = {}) {
+  const object = await bucket.get(key);
+  if (!object) {
+    return new Response(JSON.stringify({ ok: false, error: 'File not found' }), {
+      status: 404,
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+  const headers = new Headers({
+    'Content-Type': object.httpMetadata?.contentType || 'application/octet-stream',
+    'Cache-Control': 'public, max-age=31536000, immutable',
+    ETag: object.etag,
+    'Last-Modified': object.uploaded?.toUTCString() || '',
+    'X-Served-By': 'cobinar-r2',
+    ...extraHeaders,
+  });
+  return new Response(object.body, { headers });
+}
+
+export function getPublicUrl(key, env) {
+  if (env.R2_PUBLIC_DOMAIN) {
+    return `https://${env.R2_PUBLIC_DOMAIN}/${key}`;
+  }
+  const domain = env.WORKER_DOMAIN || 'cobinar-r2.workers.dev';
+  return `https://${domain}/assets/${key}`;
+}
+
+function sanitizeMetadata(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== null && v !== undefined) {
+      out[k] = String(v);
+    }
+  }
+  return out;
+}

package/src/commands/utils.js

@@ -0,0 +1,7 @@
+// src/utils.js
+
+export function generateId() {
+  const buf = new Uint8Array(8);
+  crypto.getRandomValues(buf);
+  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('').slice(0, 12);
+}

package/src/commands/validators.js

@@ -0,0 +1,101 @@
+// src/validators.js
+
+export const ALLOWED_TYPES = {
+  image: {
+    mimes: ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif', 'image/svg+xml'],
+    extensions: ['jpg', 'jpeg', 'png', 'webp', 'gif', 'avif', 'svg'],
+    maxBytes: 25 * 1024 * 1024,
+    label: 'Image',
+  },
+  projectImage: {
+    mimes: ['image/jpeg', 'image/png', 'image/webp', 'image/avif'],
+    extensions: ['jpg', 'jpeg', 'png', 'webp', 'avif'],
+    maxBytes: 10 * 1024 * 1024,
+    label: 'Project image',
+  },
+  productImage: {
+    mimes: ['image/jpeg', 'image/png', 'image/webp', 'image/avif'],
+    extensions: ['jpg', 'jpeg', 'png', 'webp', 'avif'],
+    maxBytes: 10 * 1024 * 1024,
+    label: 'Product image',
+  },
+  postMedia: {
+    mimes: [
+      'image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif',
+      'video/mp4', 'video/webm', 'video/quicktime', 'application/pdf',
+    ],
+    extensions: ['jpg', 'jpeg', 'png', 'webp', 'gif', 'avif', 'mp4', 'webm', 'mov', 'pdf'],
+    maxBytes: 50 * 1024 * 1024,
+    label: 'Post media',
+  },
+  file: {
+    mimes: [
+      'application/pdf', 'application/zip', 'application/x-zip-compressed',
+      'application/octet-stream', 'text/plain', 'text/csv',
+      'application/vnd.ms-excel',
+      'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+      'application/msword',
+      'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+      'application/json',
+    ],
+    extensions: ['pdf', 'zip', 'txt', 'csv', 'xls', 'xlsx', 'doc', 'docx', 'json', 'bin'],
+    maxBytes: 100 * 1024 * 1024,
+    label: 'File',
+  },
+};
+
+export const DEFAULT_RULE = {
+  posts: 'postMedia',
+  products: 'productImage',
+  projects: 'projectImage',
+  images: 'image',
+  files: 'file',
+};
+
+export function validateFile(mimeType, sizeBytes, filename, ruleName) {
+  const rule = ALLOWED_TYPES[ruleName];
+  if (!rule) return { valid: false, error: `Unknown validation rule: "${ruleName}"` };
+
+  const baseMime = mimeType.split(';')[0].trim().toLowerCase();
+  if (!rule.mimes.includes(baseMime)) {
+    return { valid: false, error: `${rule.label} must be one of: ${rule.mimes.join(', ')}. Got: ${baseMime}` };
+  }
+
+  const rawExt = (filename.split('.').pop() || '').toLowerCase();
+  if (!rule.extensions.includes(rawExt)) {
+    return { valid: false, error: `${rule.label} extension must be .${rule.extensions.join(', .')}. Got: .${rawExt}` };
+  }
+
+  if (sizeBytes > rule.maxBytes) {
+    const maxMb = (rule.maxBytes / 1024 / 1024).toFixed(0);
+    const gotMb = (sizeBytes / 1024 / 1024).toFixed(1);
+    return { valid: false, error: `${rule.label} must be under ${maxMb} MB. Got: ${gotMb} MB` };
+  }
+
+  return { valid: true, ext: rawExt };
+}
+
+export function extFromMime(mimeType) {
+  const map = {
+    'image/jpeg': 'jpg',
+    'image/png': 'png',
+    'image/webp': 'webp',
+    'image/gif': 'gif',
+    'image/avif': 'avif',
+    'image/svg+xml': 'svg',
+    'video/mp4': 'mp4',
+    'video/webm': 'webm',
+    'video/quicktime': 'mov',
+    'application/pdf': 'pdf',
+    'application/zip': 'zip',
+    'application/x-zip-compressed': 'zip',
+    'text/plain': 'txt',
+    'text/csv': 'csv',
+    'application/vnd.ms-excel': 'xls',
+    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': 'xlsx',
+    'application/msword': 'doc',
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document': 'docx',
+    'application/json': 'json',
+  };
+  return map[mimeType.split(';')[0].trim().toLowerCase()] || 'bin';
+}

package/src/cors.js

@@ -0,0 +1,34 @@
+// src/cors.js
+
+export function getAllowedOrigins(env) {
+  return (env.ALLOWED_ORIGINS || '')
+    .split(/[,\n\r]+/)
+    .map((o) => o.trim())
+    .map((o) => o.replace(/[\r\n\t\x00-\x1F\x7F]/g, ''))
+    .filter((o) => /^https?:\/\/[a-zA-Z0-9.-]+(:\d+)?$/.test(o));
+}
+
+export function corsHeaders(env, requestOrigin = '') {
+  const allowed = getAllowedOrigins(env);
+  const origin = allowed.includes(requestOrigin) ? requestOrigin : allowed[0] || '';
+  const headers = {
+    'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With',
+    'Access-Control-Expose-Headers': 'X-Upload-Key, X-Served-By',
+    Vary: 'Origin',
+  };
+  if (origin) {
+    headers['Access-Control-Allow-Origin'] = origin;
+    headers['Access-Control-Allow-Credentials'] = 'true';
+    headers['Access-Control-Max-Age'] = '86400';
+  }
+  return headers;
+}
+
+export function handleCors(request, env) {
+  const origin = request.headers.get('Origin') || '';
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(env, origin),
+  });
+}

package/src/forgers/auth.js

@@ -0,0 +1,78 @@
+// src/auth.js
+
+const GOOGLE_JWK_URL = 'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com';
+
+let _keyCache = null;
+let _cacheExpires = 0;
+
+async function getVerificationKeys() {
+  const now = Date.now();
+  if (_keyCache && now < _cacheExpires) return _keyCache;
+
+  const res = await fetch(GOOGLE_JWK_URL);
+  if (!res.ok) throw new Error('Failed to fetch Firebase JWKs');
+  const jwks = await res.json();
+
+  const cc = res.headers.get('Cache-Control') || '';
+  const maxAge = parseInt((cc.match(/max-age=(\d+)/) || [, '3600'])[1], 10);
+  _cacheExpires = now + maxAge * 1000;
+
+  _keyCache = new Map();
+  await Promise.all(
+    (jwks.keys || []).map(async (jwk) => {
+      const key = await crypto.subtle.importKey(
+        'jwk',
+        jwk,
+        { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+        false,
+        ['verify'],
+      );
+      _keyCache.set(jwk.kid, key);
+    }),
+  );
+  return _keyCache;
+}
+
+function base64urlDecode(str) {
+  const b64 = str.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+
+function b64DecodeJson(b64url) {
+  return JSON.parse(new TextDecoder().decode(base64urlDecode(b64url)));
+}
+
+export async function verifyFirebaseToken(idToken, projectId) {
+  const parts = idToken.split('.');
+  if (parts.length !== 3) throw new Error('Malformed JWT: expected 3 segments');
+  const [headerB64, payloadB64, sigB64] = parts;
+
+  let header, payload;
+  try {
+    header = b64DecodeJson(headerB64);
+    payload = b64DecodeJson(payloadB64);
+  } catch {
+    throw new Error('Could not decode JWT segments');
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+  if (header.alg !== 'RS256') throw new Error(`Unexpected algorithm: ${header.alg}`);
+  if (payload.aud !== projectId) throw new Error(`Invalid audience: expected "${projectId}", got "${payload.aud}"`);
+  if (payload.iss !== `https://securetoken.google.com/${projectId}`) throw new Error('Invalid issuer');
+  if (payload.exp < now) throw new Error('Token expired');
+  if (payload.iat > now + 60) throw new Error('Token issued in the future — clock skew too large');
+  if (!payload.sub) throw new Error('Missing subject claim');
+
+  const keys = await getVerificationKeys();
+  const key = keys.get(header.kid);
+  if (!key) throw new Error(`Unknown key ID: ${header.kid}`);
+
+  const signingInput = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+  const signature = base64urlDecode(sigB64);
+  const valid = await crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, signature, signingInput);
+  if (!valid) throw new Error('Signature verification failed');
+
+  payload.uid = payload.sub || payload.user_id;
+  return payload;
+}

package/src/forgers/cors.js

@@ -0,0 +1,34 @@
+// src/cors.js
+
+export function getAllowedOrigins(env) {
+  return (env.ALLOWED_ORIGINS || '')
+    .split(/[,\n\r]+/)
+    .map((o) => o.trim())
+    .map((o) => o.replace(/[\r\n\t\x00-\x1F\x7F]/g, ''))
+    .filter((o) => /^https?:\/\/[a-zA-Z0-9.-]+(:\d+)?$/.test(o));
+}
+
+export function corsHeaders(env, requestOrigin = '') {
+  const allowed = getAllowedOrigins(env);
+  const origin = allowed.includes(requestOrigin) ? requestOrigin : allowed[0] || '';
+  const headers = {
+    'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With',
+    'Access-Control-Expose-Headers': 'X-Upload-Key, X-Served-By',
+    Vary: 'Origin',
+  };
+  if (origin) {
+    headers['Access-Control-Allow-Origin'] = origin;
+    headers['Access-Control-Allow-Credentials'] = 'true';
+    headers['Access-Control-Max-Age'] = '86400';
+  }
+  return headers;
+}
+
+export function handleCors(request, env) {
+  const origin = request.headers.get('Origin') || '';
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(env, origin),
+  });
+}

package/src/forgers/index.js

@@ -0,0 +1,115 @@
+// ═══════════════════════════════════════════════════════════════════════════
+//  src/index.js — Cobinar R2 Worker · Entry Point
+//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
+//
+//  Routes:
+//    GET    /health              — Uptime check (no auth)
+//    GET    /assets/:key         — Stream public R2 asset (CDN fallback)
+//    POST   /api/auth/callback   — Cobinar Auth (OAuth) code exchange (public —
+//                                  this is how a visitor becomes authenticated)
+//    GET    /api/services         — where Cobinar's other workers currently
+//                                  live (public, read-only; see that
+//                                  handler for why this is KV-backed)
+//    POST   /api/upload          — Upload file to R2 (Firebase auth + admin only)
+//    DELETE /api/delete          — Delete R2 object (Firebase auth + admin only)
+//    (anything else)             — Delegated to env.ASSETS (the site in ./public)
+//
+//  assets.run_worker_first is set to `true` (unconditional) rather than a
+//  glob-pattern array scoped to /api/* — Cloudflare's asset-vs-worker
+//  precedence for that project turned out to return 405 for every method
+//  other than GET regardless of pattern, so this Worker now runs for every
+//  request and explicitly hands off anything it doesn't recognize to
+//  env.ASSETS.fetch(request) itself, rather than depending on that layer.
+//
+//  Bindings (wrangler.toml):
+//    COBINAR_R2          R2Bucket  — cobinar bucket
+//    FIREBASE_PROJECT_ID           — cobinar-prod
+//    ALLOWED_ORIGINS               — CORS allowlist
+//    WORKER_DOMAIN                 — worker.cobinar.com
+//    R2_PUBLIC_DOMAIN              — cdn.cobinar.com
+//    ADMIN_EMAIL                   — cobinar@cobinar.com
+//    MAX_UPLOAD_SIZE               — 104857600 (100 MB)
+//    COBINAR_AUTH_CLIENT_ID        — Cobinar Auth OAuth client id (public)
+//    COBINAR_AUTH_CLIENT_SECRET    — SECRET — set via `wrangler secret put`, never in this repo
+//    COBINAR_AUTH_BASE             — https://auth.cobinar.com
+//
+//  Folder layout in bucket:
+//    cobinar/posts/{postId}/{slot}-{uuid}.{ext}       ← post media
+//    cobinar/products/{productId}/{slot}-{uuid}.{ext} ← product images
+//    cobinar/projects/{projectId}/{slot}-{uuid}.{ext} ← project assets
+//    cobinar/images/{uuid}.{ext}                      ← flat image store
+//    cobinar/files/{uuid}.{ext}                       ← flat file store
+//
+//  CDN delivery (once cdn.cobinar.com R2 custom domain is configured):
+//    https://cdn.cobinar.com/{key}  →  direct R2 edge (zero Worker cost)
+// ═══════════════════════════════════════════════════════════════════════════
+
+import { handleCors, corsHeaders } from './cors.js';
+import { verifyFirebaseToken }     from './auth.js';
+import { handleUpload }            from './handlers/upload.js';
+import { handleDelete }            from './handlers/delete.js';
+import { handleServe }             from './handlers/serve.js';
+import { handleHealth }            from './handlers/health.js';
+import { handleAuthCallback }      from './handlers/auth-callback.js';
+import { handleServices }          from './handlers/services.js';
+
+export default {
+  async fetch(request, env, ctx) {
+    const url    = new URL(request.url);
+    const path   = url.pathname;
+    const method = request.method;
+
+    // ── CORS preflight ──────────────────────────────────────────────────────
+    if (method === 'OPTIONS') return handleCors(request, env);
+
+    // ── Health check (no auth) ──────────────────────────────────────────────
+    if (path === '/health' && method === 'GET') return handleHealth(request, env);
+
+    // ── Public asset serving — CDN fallback until cdn.cobinar.com is live ───
+    if (method === 'GET' && path.startsWith('/assets/')) {
+      return handleServe(request, env, path.slice('/assets/'.length));
+    }
+
+    // ── Cobinar Auth code exchange — public. A visitor has no session yet;
+    //    this is the one request that creates one, so it can't require one. ──
+    if (path === '/api/auth/callback' && method === 'POST') {
+      return handleAuthCallback(request, env);
+    }
+    if (path === '/api/services' && method === 'GET') {
+      return handleServices(request, env);
+    }
+
+    // ── Authenticated API routes ────────────────────────────────────────────
+    if (path.startsWith('/api/')) {
+      const token = (request.headers.get('Authorization') || '').replace(/^Bearer\s+/i, '').trim();
+      if (!token) return jsonError('Missing Authorization header', 401, env, request);
+
+      let claims;
+      try {
+        claims = await verifyFirebaseToken(token, env.FIREBASE_PROJECT_ID);
+      } catch (e) {
+        return jsonError('Invalid or expired token: ' + e.message, 401, env, request);
+      }
+
+      if (path === '/api/upload' && method === 'POST')   return handleUpload(request, env, claims);
+      if (path === '/api/delete' && method === 'DELETE') return handleDelete(request, env, claims);
+
+      return jsonError('Unknown API route', 404, env, request);
+    }
+
+    // ── Everything else: hand off to static assets (site pages, css, js, icons).
+    //    Explicit here rather than relying on Cloudflare's asset-vs-worker
+    //    precedence, since that's exactly the layer that's been unreliable. ──
+    return env.ASSETS.fetch(request);
+  },
+};
+
+function jsonError(message, status, env, request) {
+  const origin = request?.headers?.get('Origin') || '';
+  return new Response(JSON.stringify({ ok: false, error: message }), {
+    status,
+    headers: { 'Content-Type': 'application/json', ...corsHeaders(env, origin) },
+  });
+}
+//  Created by Marc-Arthur Samuel Dalus · Cobinar Systems
+//