@crombolo/server 0.14.4 → 0.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/server",
-  "version": "0.14.4",
+  "version": "0.16.0",
   "description": "The crombolo HTTP server: routing, configuration, media stores and background jobs.",
   "license": "MIT",
   "author": "Crombolo",
@@ -18,7 +18,9 @@
   },
   "type": "module",
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/index.ts",
+    "./remote-credentials": "./src/remote-credentials.ts",
+    "./atomic-write": "./src/atomic-write.ts"
   },
   "files": [
     "src",
@@ -28,17 +30,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@crombolo/api-delivery": "0.14.4",
-    "@crombolo/api-management": "0.14.4",
-    "@crombolo/assistant": "0.14.4",
-    "@crombolo/auth": "0.14.4",
-    "@crombolo/backoffice-host": "0.14.4",
-    "@crombolo/contracts": "0.14.4",
-    "@crombolo/core": "0.14.4",
-    "@crombolo/data": "0.14.4",
-    "@crombolo/render": "0.14.4",
-    "@crombolo/schema": "0.14.4",
-    "@crombolo/transfer": "0.14.4",
+    "@crombolo/api-delivery": "0.16.0",
+    "@crombolo/api-management": "0.16.0",
+    "@crombolo/assistant": "0.16.0",
+    "@crombolo/auth": "0.16.0",
+    "@crombolo/backoffice-host": "0.16.0",
+    "@crombolo/contracts": "0.16.0",
+    "@crombolo/core": "0.16.0",
+    "@crombolo/data": "0.16.0",
+    "@crombolo/render": "0.16.0",
+    "@crombolo/schema": "0.16.0",
+    "@crombolo/transfer": "0.16.0",
     "@logtape/logtape": "^2.3.8"
   }
 }

package/src/atomic-write.ts

@@ -0,0 +1,13 @@
+/**
+ * Writes a file whole or not at all: to a temporary file beside it, then a
+ * rename, so a crash or a second process never sees half of it.
+ */
+import { mkdirSync, renameSync, writeFileSync } from 'node:fs'
+import { dirname } from 'node:path'
+
+export function writeFileAtomic(path: string, data: string | Uint8Array): void {
+  mkdirSync(dirname(path), { recursive: true })
+  const temporary = `${path}.${process.pid}.${Date.now().toString(36)}.tmp`
+  writeFileSync(temporary, data)
+  renameSync(temporary, path)
+}

package/src/config.ts

@@ -230,7 +230,7 @@ export interface CromboloConfig {
    * CROMBOLO_SCHEMA_WRITABLE says otherwise outright.
    */
   schemaWritable: boolean
-  /** Sync `schema/` at boot; a pipeline that runs `crombolo schema sync` turns this off. */
+  /** Sync `schema/` at boot; a pipeline that runs `crombolo types sync` turns this off. */
   syncSchemaAtBoot: boolean
   /** Which database engine; from CROMBOLO_DB. */
   dialect: 'sqlite' | 'postgres'
@@ -739,4 +739,4 @@ export function describeDatabase(
   }
 }
 
-export const VERSION = '0.14.4'
+export const VERSION = '0.16.0'

package/src/domains.ts

@@ -25,6 +25,7 @@ import {
   type NodeRow,
   resolveNodeRef,
 } from '@crombolo/data'
+import { writeFileAtomic } from './atomic-write.ts'
 
 export const DOMAINS_FILE = 'domains.toml'
 
@@ -152,8 +153,8 @@ export async function writeDomains(
   const file = domainsFilePath(siteDir)
   const backup = join(siteDir, DOMAINS_BACKUP_FILE)
   const kept = existsSync(file) ? readFileSync(file, 'utf8') : undefined
-  if (kept !== undefined) await Bun.write(backup, kept)
-  await Bun.write(file, writeDomainsFile(declarations))
+  if (kept !== undefined) writeFileAtomic(backup, kept)
+  writeFileAtomic(file, writeDomainsFile(declarations))
   return { file, backup: kept === undefined ? undefined : backup }
 }
 
@@ -167,10 +168,10 @@ export async function undoDomainsFile(
     return { ok: false, file, message: `there is no ${DOMAINS_BACKUP_FILE} to go back to` }
   const previous = readFileSync(backup, 'utf8')
   const current = existsSync(file) ? readFileSync(file, 'utf8') : undefined
-  await Bun.write(file, previous)
+  writeFileAtomic(file, previous)
   // So that undo is itself undoable, which is what somebody who has just undone
   // the wrong thing needs.
-  await Bun.write(backup, current ?? '')
+  writeFileAtomic(backup, current ?? '')
   return { ok: true, file }
 }
 

package/src/index.ts

@@ -1,3 +1,4 @@
+export { createNodeLookup } from './access.ts'
 export * from './adapters/audit.ts'
 export * from './adapters/blueprints.ts'
 export * from './adapters/bundles.ts'
@@ -12,7 +13,9 @@ export * from './adapters/public-access.ts'
 export * from './adapters/redirects.ts'
 export * from './adapters/references.ts'
 export * from './adapters/template-files.ts'
+export { createUserPorts } from './adapters/users.ts'
 export * from './api-client.ts'
+export * from './atomic-write.ts'
 export * from './backup.ts'
 export * from './boot-failure.ts'
 export * from './bundle-install.ts'

package/src/member-auth.ts

@@ -359,7 +359,11 @@ export function createMemberAuth(
     // Checked before the password, so the answer never depends on whether the
     // password was right; the same throwaway verify as above keeps the time taken
     // from saying what the response does not.
-    if (member.isLockedOut || !member.isApproved) {
+    // A member with no password signs in only through a provider (story 035).
+    // Refused like a wrong password, in the same time, and not counted: a
+    // stranger's guesses must not lock out the provider sign-in, nor say that
+    // the account has no password.
+    if (member.isLockedOut || !member.isApproved || !member.passwordHash) {
       await verifyPassword(input.password ?? '', await hashPassword(crypto.randomUUID()))
       return failed()
     }

package/src/remote-media.ts

@@ -7,8 +7,9 @@
  * Only the store the site serves from is wrapped. An export reads the plain
  * store, so pushing a lazily-pulled site never downloads what it never used.
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { writeFileAtomic } from './atomic-write.ts'
 import { logger } from './logging.ts'
 import type { MediaStore, StoredFile } from './media-store.ts'
 import { freshAccessToken, type Keychain, osKeychain } from './remote-credentials.ts'
@@ -36,8 +37,7 @@ export function readRemoteMedia(siteDir: string): RemoteMediaSource | undefined
 
 export function writeRemoteMedia(siteDir: string, source: RemoteMediaSource): void {
   const file = join(siteDir, REMOTE_MEDIA_FILE)
-  mkdirSync(dirname(file), { recursive: true })
-  writeFileSync(file, `${JSON.stringify(source, null, 2)}\n`)
+  writeFileAtomic(file, `${JSON.stringify(source, null, 2)}\n`)
 }
 
 /** The site's store, reading through to its remote when the site was pulled lazily. */

package/src/server.ts

@@ -39,6 +39,7 @@ import {
   resolveStaticFile,
   serveStaticFile,
 } from '@crombolo/backoffice-host'
+import { servedContract } from '@crombolo/contracts'
 import {
   CHOICE_SOURCE_KINDS,
   type ChoiceSourceKind,
@@ -185,8 +186,6 @@ import { summariseUpgrades } from './upgrade-summary.ts'
 import { assertViewRuntime } from './view-runtime.ts'
 import { bundleEventProblems, createWebhookService, webhookStoreView } from './webhooks.ts'
 
-const CONTRACT_PATH = Bun.resolveSync('@crombolo/contracts/OpenApi.json', import.meta.dir)
-
 export interface ServerHandle {
   config: CromboloConfig
   fetch(request: Request): Promise<Response>
@@ -1712,7 +1711,8 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
 
     if (pathname.startsWith(apiPrefix)) {
       if (pathname === `${apiPrefix}openapi.json`) {
-        return new Response(Bun.file(CONTRACT_PATH), {
+        // Umbraco's contract with crombolo's deliberate differences (contracts/src/overrides.ts).
+        return new Response(servedContract(), {
           headers: { 'content-type': 'application/json' },
         })
       }