@crowi/api 2.0.0-alpha.0

package/dist/util/rate-limit.js

@@ -0,0 +1,87 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRateLimiter = createRateLimiter;
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('crowi:util:rate-limit');
+const KEY_PREFIX = 'crowi:ratelimit';
+/** Current fixed-window index for `now`. */
+const windowIndex = (now, windowMs) => Math.floor(now / windowMs);
+/** Milliseconds remaining until the window containing `now` resets. */
+const msUntilReset = (now, windowMs) => windowMs - (now % windowMs);
+const toRetryAfterSeconds = (ms) => Math.max(1, Math.ceil(ms / 1000));
+/**
+ * In-memory fallback store. One entry per `(name, userId, window)`
+ * triple; the value is the running count. Entries from elapsed windows
+ * are purged lazily and by a periodic sweep.
+ */
+class InMemoryWindowStore {
+    counts = new Map();
+    lastSweep = 0;
+    hit(key, window, windowMs) {
+        this.maybeSweep(window);
+        const entry = this.counts.get(key);
+        if (!entry || entry.window !== window) {
+            this.counts.set(key, { count: 1, window });
+            return 1;
+        }
+        entry.count += 1;
+        return entry.count;
+    }
+    /** Drop entries whose window has elapsed. Cheap enough to run inline. */
+    maybeSweep(currentWindow) {
+        // Sweep at most once per ~window so a burst of hits doesn't walk
+        // the whole map on every request.
+        if (currentWindow === this.lastSweep)
+            return;
+        this.lastSweep = currentWindow;
+        for (const [key, entry] of this.counts) {
+            if (entry.window < currentWindow)
+                this.counts.delete(key);
+        }
+    }
+}
+/**
+ * Build a per-user rate limiter. Same API whether it is Redis-backed or
+ * in-memory, so callers never branch.
+ */
+function createRateLimiter(options) {
+    const { name, limit, windowMs, redisClient } = options;
+    const memory = new InMemoryWindowStore();
+    const evaluate = (count, now) => ({
+        allowed: count <= limit,
+        count,
+        limit,
+        retryAfterSeconds: toRetryAfterSeconds(msUntilReset(now, windowMs)),
+    });
+    return {
+        async hit(userId) {
+            const now = Date.now();
+            const window = windowIndex(now, windowMs);
+            if (redisClient) {
+                const key = `${KEY_PREFIX}:${name}:${userId}:${window}`;
+                try {
+                    const count = await redisClient.incr(key);
+                    // Set the TTL once, when the window is first opened. A small
+                    // grace beyond `windowMs` avoids a race where the key expires
+                    // a hair before the window boundary.
+                    if (count === 1) {
+                        await redisClient.pExpire(key, windowMs + 1000);
+                    }
+                    return evaluate(count, now);
+                }
+                catch (err) {
+                    // Fail open — a Redis blip must not take the feature down.
+                    debug('redis hit failed for %s — failing open: %s', key, err.message);
+                    return { allowed: true, count: 0, limit, retryAfterSeconds: toRetryAfterSeconds(msUntilReset(now, windowMs)) };
+                }
+            }
+            const key = `${name}:${userId}`;
+            const count = memory.hit(key, window, windowMs);
+            return evaluate(count, now);
+        },
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/util/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/util/rate-limit.ts"],"names":[],"mappings":";;;;;AAqHA,8CAuCC;AA5JD,kDAA0B;AAE1B,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,uBAAuB,CAAC,CAAC;AAqE7C,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC,4CAA4C;AAC5C,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC;AAE1F,uEAAuE;AACvE,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAU,EAAE,CAAC,QAAQ,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC;AAE5F,MAAM,mBAAmB,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,mBAAmB;IACf,MAAM,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC9D,SAAS,GAAG,CAAC,CAAC;IAEtB,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,QAAgB;QAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,yEAAyE;IACjE,UAAU,CAAC,aAAqB;QACtC,iEAAiE;QACjE,kCAAkC;QAClC,IAAI,aAAa,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO;QAC7C,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC;QAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,OAAyB;IACzD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAEzC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,GAAW,EAAmB,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,IAAI,KAAK;QACvB,KAAK;QACL,KAAK;QACL,iBAAiB,EAAE,mBAAmB,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;KACpE,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAc;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAE1C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC1C,6DAA6D;oBAC7D,8DAA8D;oBAC9D,qCAAqC;oBACrC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;wBAChB,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAC;oBAClD,CAAC;oBACD,OAAO,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,2DAA2D;oBAC3D,KAAK,CAAC,4CAA4C,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;oBACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACjH,CAAC;YACH,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChD,OAAO,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/util/rebuild-backlink.d.ts

@@ -0,0 +1,25 @@
+import type Crowi from '../crowi';
+/**
+ * RFC-0008 §8.5 — `crowi-admin rebuild backlink`.
+ *
+ * Rebuild the backlink index across all pages (the `Backlink` collection,
+ * which maps fromPage/fromRevision → toPage by scanning page bodies). This is
+ * a derived-data rebuild: version-independent, runnable any time (§3).
+ *
+ * NOT YET IMPLEMENTED (planner-confirmed: no legacy implementation exists as a
+ * CLI command). Phase 4 only registers the dispatcher entry so `rebuild --help`
+ * lists the full surface; the actual rebuild is left as explicit work.
+ *
+ * TODO(rfc-0008): implement. The primitive already exists on the model —
+ * `Backlink.createByAllPages()` (models/backlink.ts) drops + recreates the
+ * whole index. The rebuild wrapper should:
+ *   - iterate published pages through `runner.mapBounded` rather than the
+ *     model's all-at-once helper, so progress + SIGINT + concurrency are
+ *     honoured on large installs,
+ *   - report a candidate count and write nothing when `ctx.dryRun` is true.
+ */
+export interface BacklinkRebuildSummary {
+    pagesScanned: number;
+    backlinksWritten: number;
+}
+export declare function runBacklinkRebuild(_crowi: Crowi): Promise<BacklinkRebuildSummary>;

package/dist/util/rebuild-backlink.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runBacklinkRebuild = runBacklinkRebuild;
+async function runBacklinkRebuild(_crowi) {
+    throw new Error('rebuild backlink is not implemented yet (RFC-0008 §8.5). No legacy implementation exists to port; see util/rebuild-backlink.ts TODO.');
+}
+//# sourceMappingURL=rebuild-backlink.js.map

package/dist/util/rebuild-backlink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebuild-backlink.js","sourceRoot":"","sources":["../../src/util/rebuild-backlink.ts"],"names":[],"mappings":";;AA0BA,gDAEC;AAFM,KAAK,UAAU,kBAAkB,CAAC,MAAa;IACpD,MAAM,IAAI,KAAK,CAAC,sIAAsI,CAAC,CAAC;AAC1J,CAAC"}

package/dist/util/rebuild-renderer.d.ts

@@ -0,0 +1,31 @@
+import type Crowi from '../crowi';
+/**
+ * RFC-0008 §8.5 — `crowi-admin rebuild renderer`.
+ *
+ * Regenerate cached rendered HTML for pages (the `PluginRenderCache`
+ * collection populated by `src/renderer/` + plugin render scopes). This is a
+ * derived-data rebuild: version-independent, runnable any time (§3).
+ *
+ * NOT YET IMPLEMENTED (planner-confirmed: no legacy implementation exists —
+ * unlike `rebuild search`, which ported `runSearchRebuild`). Phase 4 only
+ * registers the dispatcher entry so `rebuild --help` lists the full surface;
+ * the actual rebuild is left as explicit work.
+ *
+ * TODO(rfc-0008): implement. The shape should mirror `runSearchRebuild`:
+ *   - resolve the active renderer scopes (`crowi.getRenderer()` /
+ *     the `PluginRenderCache` model registered by `src/renderer/index.ts`),
+ *   - with `--only-stale`, re-render only pages whose cache entry is older
+ *     than the page's `updatedAt` / current revision,
+ *   - otherwise drop + repopulate the cache,
+ *   - fan work out through `runner.mapBounded` for embed-plugin rate limits,
+ *   - honour `ctx.dryRun` (report candidate count, write nothing).
+ */
+export interface RendererRebuildOptions {
+    /** Only re-render pages whose cached HTML is stale. */
+    onlyStale: boolean;
+}
+export interface RendererRebuildSummary {
+    rerendered: number;
+    skipped: number;
+}
+export declare function runRendererRebuild(_crowi: Crowi, _opts: RendererRebuildOptions): Promise<RendererRebuildSummary>;

package/dist/util/rebuild-renderer.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRendererRebuild = runRendererRebuild;
+async function runRendererRebuild(_crowi, _opts) {
+    throw new Error('rebuild renderer is not implemented yet (RFC-0008 §8.5). No legacy implementation exists to port; see util/rebuild-renderer.ts TODO.');
+}
+//# sourceMappingURL=rebuild-renderer.js.map

package/dist/util/rebuild-renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebuild-renderer.js","sourceRoot":"","sources":["../../src/util/rebuild-renderer.ts"],"names":[],"mappings":";;AAiCA,gDAEC;AAFM,KAAK,UAAU,kBAAkB,CAAC,MAAa,EAAE,KAA6B;IACnF,MAAM,IAAI,KAAK,CAAC,sIAAsI,CAAC,CAAC;AAC1J,CAAC"}

package/dist/util/redis-opts.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Translate a Crowi-style `REDIS_URL` (`redis://` or `rediss://` with
+ * optional `user:password@host:port`) into a node-redis v4
+ * `socket`-shaped config.
+ *
+ * The shape is intentionally compatible with `redis@4`'s
+ * `createClient(opts)` so collab and api can negotiate identical TLS /
+ * port / password semantics when both processes connect to the same
+ * Redis instance. Returns `null` for an empty `redisUrl` so callers can
+ * branch on "Redis not configured" without inventing a sentinel
+ * elsewhere.
+ *
+ * Lives in `packages/api/src/util/` (not `service/`) so the collab
+ * package can pull it through `api-dist.ts` without dragging in any
+ * Crowi-class context.
+ */
+export declare function buildRedisOpts(redisUrl: string | null, rejectUnauthorized: boolean): Record<string, unknown> | null;

package/dist/util/redis-opts.js

@@ -0,0 +1,40 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRedisOpts = buildRedisOpts;
+const node_url_1 = __importDefault(require("node:url"));
+/**
+ * Translate a Crowi-style `REDIS_URL` (`redis://` or `rediss://` with
+ * optional `user:password@host:port`) into a node-redis v4
+ * `socket`-shaped config.
+ *
+ * The shape is intentionally compatible with `redis@4`'s
+ * `createClient(opts)` so collab and api can negotiate identical TLS /
+ * port / password semantics when both processes connect to the same
+ * Redis instance. Returns `null` for an empty `redisUrl` so callers can
+ * branch on "Redis not configured" without inventing a sentinel
+ * elsewhere.
+ *
+ * Lives in `packages/api/src/util/` (not `service/`) so the collab
+ * package can pull it through `api-dist.ts` without dragging in any
+ * Crowi-class context.
+ */
+function buildRedisOpts(redisUrl, rejectUnauthorized) {
+    if (!redisUrl)
+        return null;
+    const { hostname: host, port, auth, protocol } = node_url_1.default.parse(redisUrl);
+    const password = auth ? { password: auth.split(':')[1] } : {};
+    const portNumber = port ? parseInt(port, 10) : 6379;
+    const tls = protocol === 'rediss:' ? { requestCert: true, rejectUnauthorized } : null;
+    return {
+        socket: {
+            host,
+            port: portNumber,
+            ...(tls && { tls }),
+        },
+        ...password,
+    };
+}
+//# sourceMappingURL=redis-opts.js.map

package/dist/util/redis-opts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-opts.js","sourceRoot":"","sources":["../../src/util/redis-opts.ts"],"names":[],"mappings":";;;;;AAkBA,wCAcC;AAhCD,wDAA2B;AAE3B;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,cAAc,CAAC,QAAuB,EAAE,kBAA2B;IACjF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,kBAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM,GAAG,GAAkB,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrG,OAAO;QACL,MAAM,EAAE;YACN,IAAI;YACJ,IAAI,EAAE,UAAU;YAChB,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;SACpB;QACD,GAAG,QAAQ;KACZ,CAAC;AACJ,CAAC"}

package/dist/util/regex.d.ts

@@ -0,0 +1,2 @@
+/** Escape a string so it can be embedded literally inside a `RegExp`. */
+export declare function escapeRegExp(value: string): string;

package/dist/util/regex.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapeRegExp = escapeRegExp;
+/** Escape a string so it can be embedded literally inside a `RegExp`. */
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=regex.js.map

package/dist/util/regex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex.js","sourceRoot":"","sources":["../../src/util/regex.ts"],"names":[],"mappings":";;AACA,oCAEC;AAHD,yEAAyE;AACzE,SAAgB,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC"}

package/dist/util/search-rebuild.d.ts

@@ -0,0 +1,18 @@
+import type Crowi from '../crowi';
+/**
+ * Plugin-agnostic dispatcher for `crowi-admin search rebuild`. Resolves
+ * the active search driver and delegates to its `rebuild()` method.
+ *
+ * The actual rebuild semantics live in each plugin's driver
+ * (`packages/plugin-search-elasticsearch/src/driver.ts:rebuild` and
+ * future opensearch / algolia drivers). Keeping this wrapper to a
+ * single delegating call means new search backends don't have to touch
+ * admin-cli or the api repo to wire up `crowi-admin search rebuild` —
+ * they only have to implement the `SearchDriver.rebuild?()` contract
+ * declared in `@crowi/plugin-api`.
+ */
+export interface SearchRebuildSummary {
+    driverName: string;
+    pluginName: string;
+}
+export declare function runSearchRebuild(crowi: Crowi): Promise<SearchRebuildSummary>;

package/dist/util/search-rebuild.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSearchRebuild = runSearchRebuild;
+async function runSearchRebuild(crowi) {
+    const plugins = crowi.getPlugins();
+    const driver = plugins.active.search;
+    if (!driver) {
+        throw new Error('No active search driver. Set `search.driver` in crowi.config.json and install the matching plugin.');
+    }
+    if (typeof driver.rebuild !== 'function') {
+        throw new Error('The active search driver does not support rebuild. (Plugins without a persistent index — e.g. Mongo regex — are read-only.)');
+    }
+    // Resolve the (driverName, pluginName) for the summary by walking the
+    // registry list and matching by reference. Same approach the admin
+    // status endpoint uses — see `routes/ts-rest/admin/search.ts`.
+    let driverName = '<unknown>';
+    let pluginName = '<unknown>';
+    for (const entry of plugins.search.list()) {
+        if (plugins.search.get(entry.driverName) === driver) {
+            driverName = entry.driverName;
+            pluginName = entry.plugin;
+            break;
+        }
+    }
+    await driver.rebuild();
+    return { driverName, pluginName };
+}
+//# sourceMappingURL=search-rebuild.js.map

package/dist/util/search-rebuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-rebuild.js","sourceRoot":"","sources":["../../src/util/search-rebuild.ts"],"names":[],"mappings":";;AAmBA,4CAyBC;AAzBM,KAAK,UAAU,gBAAgB,CAAC,KAAY;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,6HAA6H,CAAC,CAAC;IACjJ,CAAC;IAED,sEAAsE;IACtE,mEAAmE;IACnE,+DAA+D;IAC/D,IAAI,UAAU,GAAG,WAAW,CAAC;IAC7B,IAAI,UAAU,GAAG,WAAW,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,MAAM,EAAE,CAAC;YACpD,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YAC9B,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;YAC1B,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC"}

package/dist/util/ssr.d.ts

@@ -0,0 +1,3 @@
+import Crowi from '../crowi';
+export declare const getPath: (crowi: Crowi, path: string) => string;
+export declare const assetPath: (path: string) => string;

package/dist/util/ssr.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assetPath = exports.getPath = void 0;
+const getPath = (crowi, path) => (crowi.node_env === 'development' ? `${path}.tsx` : `${path}.js`);
+exports.getPath = getPath;
+// FIXME: Use webpack mainfest in production
+const assetPath = (path) => path;
+exports.assetPath = assetPath;
+//# sourceMappingURL=ssr.js.map

package/dist/util/ssr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssr.js","sourceRoot":"","sources":["../../src/util/ssr.ts"],"names":[],"mappings":";;;AAEO,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;AAA5G,QAAA,OAAO,WAAqG;AAEzH,4CAA4C;AACrC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC;AAAnC,QAAA,SAAS,aAA0B"}

package/dist/util/storage-copy.d.ts

@@ -0,0 +1,40 @@
+import type Crowi from '../crowi';
+export interface StorageCopyProgress {
+    current: number;
+    total: number | null;
+    key: string;
+    stage: 'start' | 'ok' | 'failed' | 'skipped';
+    reason?: string;
+}
+export interface StorageCopyOptions {
+    from: string;
+    to: string;
+    /** When true, enumerate candidate keys but never call `to.put`. */
+    dryRun: boolean;
+    onProgress?: (event: StorageCopyProgress) => void;
+}
+export interface StorageCopySummary {
+    ok: number;
+    failed: number;
+    skipped: number;
+    total: number;
+    /** Up to DRY_RUN_SAMPLE_LIMIT keys, populated only on dry-run. */
+    sampleKeys: string[];
+}
+/**
+ * Copy every stored object from `opts.from` to `opts.to`. Both drivers
+ * must be loaded by some plugin; the active-driver concept is irrelevant
+ * (an operator can stage data on the new driver while the old one is
+ * still active, then flip `crowi.config.json` and restart).
+ *
+ * Re-running is safe: per-key errors increment `summary.failed` without
+ * aborting the iteration, and the local + S3 drivers overwrite by key.
+ */
+export declare function runStorageCopy(crowi: Crowi, opts: StorageCopyOptions): Promise<StorageCopySummary>;
+/**
+ * Two URL shapes produced by `fileUploader.generateUrl()`:
+ *   1. Local driver: `<BY_KEY_URL_PREFIX>user%2F<id>.<ext>`
+ *   2. S3 signed URL with the raw `user/<id>.<ext>` segment in the path.
+ * Returns null for external URLs (e.g. OAuth-captured Google avatars).
+ */
+export declare function extractUserPictureKey(image: string | null | undefined): string | null;

package/dist/util/storage-copy.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runStorageCopy = runStorageCopy;
+exports.extractUserPictureKey = extractUserPictureKey;
+const fileUploader_1 = require("../util/fileUploader");
+const DRY_RUN_SAMPLE_LIMIT = 20;
+/**
+ * Copy every stored object from `opts.from` to `opts.to`. Both drivers
+ * must be loaded by some plugin; the active-driver concept is irrelevant
+ * (an operator can stage data on the new driver while the old one is
+ * still active, then flip `crowi.config.json` and restart).
+ *
+ * Re-running is safe: per-key errors increment `summary.failed` without
+ * aborting the iteration, and the local + S3 drivers overwrite by key.
+ */
+async function runStorageCopy(crowi, opts) {
+    const fromDriver = (0, fileUploader_1.getStorageDriverByName)(crowi, opts.from);
+    const toDriver = (0, fileUploader_1.getStorageDriverByName)(crowi, opts.to);
+    if (opts.from === opts.to) {
+        throw new Error(`Source and destination drivers must differ (both '${opts.from}').`);
+    }
+    const Attachment = crowi.model('Attachment');
+    const User = crowi.model('User');
+    const summary = { ok: 0, failed: 0, skipped: 0, total: 0, sampleKeys: [] };
+    // Cursor (not toArray) so memory stays constant on installations with
+    // millions of attachment rows.
+    const attachmentCursor = Attachment.find({}, { filePath: 1, fileFormat: 1 }).cursor();
+    for await (const doc of attachmentCursor) {
+        if (!doc.filePath)
+            continue;
+        summary.total += 1;
+        if (opts.dryRun) {
+            recordSkipped(doc.filePath, summary, opts);
+            continue;
+        }
+        await copyOne(fromDriver, toDriver, doc.filePath, doc.fileFormat || 'application/octet-stream', summary, opts);
+    }
+    // Profile pictures live outside the Attachment collection — they're
+    // referenced from `User.image`. The regex pre-filters in Mongo so we
+    // don't fetch every user just to skip non-storage URLs (Google avatars
+    // etc. captured at OAuth login). Both URL shapes that
+    // `fileUploader.generateUrl()` can produce — the by-key proxy form
+    // (`/api/v2/attachments/by-key/user%2F<id>.<ext>`) and any signed URL
+    // containing the raw `user/<id>.<ext>` segment — match this filter.
+    const userCursor = User.find({ image: { $regex: 'user(%2F|/)', $options: 'i' } }, { image: 1 }).cursor();
+    for await (const user of userCursor) {
+        const key = extractUserPictureKey(user.image);
+        if (!key)
+            continue;
+        summary.total += 1;
+        if (opts.dryRun) {
+            recordSkipped(key, summary, opts);
+            continue;
+        }
+        // contentType isn't stored alongside `User.image`; derive from the
+        // file extension so S3 still records something sensible in object
+        // metadata (no-op on local).
+        await copyOne(fromDriver, toDriver, key, contentTypeFromKey(key), summary, opts);
+    }
+    return summary;
+}
+function recordSkipped(key, summary, opts) {
+    if (summary.sampleKeys.length < DRY_RUN_SAMPLE_LIMIT)
+        summary.sampleKeys.push(key);
+    opts.onProgress?.({ current: summary.total, total: null, key, stage: 'skipped' });
+    summary.skipped += 1;
+}
+async function copyOne(fromDriver, toDriver, key, contentType, summary, opts) {
+    opts.onProgress?.({ current: summary.total, total: null, key, stage: 'start' });
+    let stream = null;
+    try {
+        stream = (await fromDriver.get(key));
+        await toDriver.put(key, stream, { contentType });
+        summary.ok += 1;
+        opts.onProgress?.({ current: summary.total, total: null, key, stage: 'ok' });
+    }
+    catch (err) {
+        // Destroy the source on failure — local `get()` returns an open file
+        // descriptor and S3 returns an open socket. Without this, a long run
+        // with intermittent failures leaks fds / sockets until GC.
+        if (stream && typeof stream.destroy === 'function')
+            stream.destroy();
+        summary.failed += 1;
+        const reason = err instanceof Error ? err.message : String(err);
+        opts.onProgress?.({ current: summary.total, total: null, key, stage: 'failed', reason });
+    }
+}
+/**
+ * Two URL shapes produced by `fileUploader.generateUrl()`:
+ *   1. Local driver: `<BY_KEY_URL_PREFIX>user%2F<id>.<ext>`
+ *   2. S3 signed URL with the raw `user/<id>.<ext>` segment in the path.
+ * Returns null for external URLs (e.g. OAuth-captured Google avatars).
+ */
+function extractUserPictureKey(image) {
+    if (!image)
+        return null;
+    if (image.includes(fileUploader_1.BY_KEY_URL_PREFIX)) {
+        const encoded = image.match(/user%2F([\w.-]+)/i);
+        if (encoded)
+            return `user/${encoded[1]}`;
+    }
+    const raw = image.match(/user\/([\w.-]+)/);
+    if (raw)
+        return `user/${raw[1]}`;
+    return null;
+}
+function contentTypeFromKey(key) {
+    const ext = key.toLowerCase().split('.').pop();
+    switch (ext) {
+        case 'png':
+            return 'image/png';
+        case 'jpg':
+        case 'jpeg':
+            return 'image/jpeg';
+        case 'gif':
+            return 'image/gif';
+        case 'webp':
+            return 'image/webp';
+        default:
+            return 'application/octet-stream';
+    }
+}
+//# sourceMappingURL=storage-copy.js.map

package/dist/util/storage-copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-copy.js","sourceRoot":"","sources":["../../src/util/storage-copy.ts"],"names":[],"mappings":";;AAyCA,wCAiDC;AAwCD,sDAYC;AA3ID,wDAAkF;AA2BlF,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;;;;GAQG;AACI,KAAK,UAAU,cAAc,CAAC,KAAY,EAAE,IAAwB;IACzE,MAAM,UAAU,GAAG,IAAA,qCAAsB,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAA,qCAAsB,EAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAExD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAuB,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAE/F,sEAAsE;IACtE,+BAA+B;IAC/B,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACtF,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,SAAS;QAC5B,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,MAAM,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,IAAI,0BAA0B,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACjH,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,uEAAuE;IACvE,sDAAsD;IACtD,mEAAmE;IACnE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACzG,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,6BAA6B;QAC7B,MAAM,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,OAA2B,EAAE,IAAwB;IACvF,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,UAAyB,EACzB,QAAuB,EACvB,GAAW,EACX,WAAmB,EACnB,OAA2B,EAC3B,IAAwB;IAExB,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,GAAoB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAa,CAAC;QACjD,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,qEAAqE;QACrE,2DAA2D;QAC3D,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACrE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,KAAgC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,KAAK,CAAC,QAAQ,CAAC,gCAAiB,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,OAAO,QAAQ,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,GAAG;QAAE,OAAO,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,WAAW,CAAC;QACrB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,WAAW,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;QACtB;YACE,OAAO,0BAA0B,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/util/ts-rest-helpers.d.ts

@@ -0,0 +1,110 @@
+import { Types } from 'mongoose';
+import type { PageUser, UserPublic } from '@crowi/api-contract';
+import type { UserDocument } from '../models/user';
+import type { PageDocument } from '../models/page';
+/**
+ * Shape of a populated User as it appears on Mongoose documents that have
+ * `creator` / `lastUpdateUser` / `revision.author` populated.
+ */
+export interface PopulatedUser {
+    _id: Types.ObjectId;
+    username: string;
+    name: string;
+    email: string;
+    image?: string | null;
+    createdAt?: Date;
+}
+export declare const toISOStringOrNull: (date: Date | undefined | null) => string | null;
+export declare const toStringId: (id: Types.ObjectId | string) => string;
+export declare const toPageUser: (user: PopulatedUser) => PageUser;
+/**
+ * Looser shape than UserDocument: covers populated subdocuments where _id may
+ * already be a string and most fields can be missing. Falls back gracefully so
+ * the response payload always satisfies UserPublicSchema.
+ */
+export interface PopulatedUserPublic {
+    _id: Types.ObjectId | string;
+    username?: string;
+    name?: string;
+    email?: string;
+    image?: string | null;
+    introduction?: string;
+    createdAt?: Date;
+    admin?: boolean;
+    status?: number;
+}
+export declare const toUserPublic: (user: UserDocument | PopulatedUserPublic) => UserPublic;
+/**
+ * Strict 24-character hex string check for Mongo ObjectId.
+ * `Types.ObjectId.isValid()` accepts 12-byte buffers and other formats; we
+ * only accept the canonical hex string used in URLs and request bodies.
+ */
+export declare const isValidObjectId: (id: string | undefined | null) => id is string;
+/**
+ * Heuristic for "this is a populated user document, not just an ObjectId".
+ * The 4 ts-rest routes all need this; the loose form (only _id + username +
+ * email) covers all current call sites.
+ */
+export declare const isPopulatedUser: (value: unknown) => value is PopulatedUser;
+/**
+ * Standard 404 for "page not found OR not granted". Mapped to 404 (not 403)
+ * so we do not leak page existence to callers without grant.
+ */
+export declare const pageNotFoundResponse: {
+    readonly status: 404;
+    readonly body: {
+        readonly error: {
+            readonly code: "PAGE_NOT_FOUND";
+            readonly message: "Page not found";
+        };
+    };
+};
+/**
+ * Standard 400 for an invalid page_id (not 24-char hex).
+ */
+export declare const invalidPageIdResponse: {
+    readonly status: 400;
+    readonly body: {
+        readonly error: {
+            readonly code: "INVALID_PAGE_ID";
+            readonly message: "Invalid page_id";
+        };
+    };
+};
+/**
+ * Standard 500 for an unexpected handler failure. Used by every admin
+ * handler that wraps its body in try/catch and needs to surface a typed
+ * `InternalServerError` shape (see `schemas/common.ts:InternalServerErrorSchema`).
+ */
+export declare const internalServerErrorResponse: {
+    readonly status: 500;
+    readonly body: {
+        readonly error: {
+            readonly code: "INTERNAL_ERROR";
+            readonly message: "Internal server error";
+        };
+    };
+};
+/**
+ * Minimum surface of the Page model that loadGrantedPage needs. We avoid
+ * importing the full Page model type because crowi.model('Page') returns
+ * a Mongoose Model with deeply-nested generics that would force every
+ * caller to mirror the same type.
+ */
+interface PageModelLike {
+    findPageByIdAndGrantedUser(pageId: string, user: UserDocument): Promise<PageDocument | null>;
+}
+export type LoadedGrantedPage = {
+    page: PageDocument;
+} | {
+    error: typeof pageNotFoundResponse | typeof invalidPageIdResponse;
+};
+/**
+ * Validate `pageId` and resolve a granted Page document, or return the
+ * standard 400 / 404 response otherwise. Centralises the
+ * isValidObjectId + findPageByIdAndGrantedUser + leak-prevention catch
+ * pattern that ts-rest page-related routes (page / bookmark / comment /
+ * revision / notification) all need.
+ */
+export declare const loadGrantedPage: (Page: PageModelLike, pageId: string, user: UserDocument) => Promise<LoadedGrantedPage>;
+export {};