@de-otio/trellis 0.4.0

package/dist/lib/internal-docs-navigation.js

@@ -0,0 +1,73 @@
+"use strict";
+/**
+ * Internal Documentation Navigation Utilities
+ *
+ * Generates allowedFiles whitelist from navigation.json
+ * This eliminates the need for manual whitelist maintenance.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAllowedFilesFromNavigation = buildAllowedFilesFromNavigation;
+exports.validateNavigation = validateNavigation;
+/**
+ * Build allowedFiles whitelist from navigation data
+ *
+ * Converts navigation paths to the format expected by the API handler:
+ * - Input: "internal/OVERVIEW.md"
+ * - Output: { "OVERVIEW.md": "internal/OVERVIEW.md" }
+ *
+ * For subdirectories:
+ * - Input: "internal/bavaria-compliance/README.md"
+ * - Output: { "bavaria-compliance/README.md": "internal/bavaria-compliance/README.md" }
+ */
+function buildAllowedFilesFromNavigation(navigation) {
+    const allowedFiles = {};
+    for (const section of navigation.sections) {
+        for (const item of section.items) {
+            // Extract the filename/key from the path
+            // "internal/OVERVIEW.md" -> "OVERVIEW.md"
+            // "internal/bavaria-compliance/README.md" -> "bavaria-compliance/README.md"
+            const pathWithoutInternal = item.path.replace(/^internal\//, "");
+            // Use the path without "internal/" prefix as the key
+            // The value is the full path with "internal/" prefix
+            allowedFiles[pathWithoutInternal] = item.path;
+        }
+    }
+    return allowedFiles;
+}
+/**
+ * Validate that all navigation items have valid paths
+ *
+ * Checks:
+ * - Paths start with "internal/"
+ * - Paths end with ".md"
+ * - No path traversal attempts (no "..")
+ */
+function validateNavigation(navigation) {
+    const errors = [];
+    for (const section of navigation.sections) {
+        for (const item of section.items) {
+            const path = item.path;
+            // Check path starts with "internal/"
+            if (!path.startsWith("internal/")) {
+                errors.push(`Navigation item "${item.title}" has invalid path: "${path}" (must start with "internal/")`);
+            }
+            // Check path ends with ".md"
+            if (!path.endsWith(".md")) {
+                errors.push(`Navigation item "${item.title}" has invalid path: "${path}" (must end with ".md")`);
+            }
+            // Check for path traversal attempts
+            if (path.includes("..")) {
+                errors.push(`Navigation item "${item.title}" has invalid path: "${path}" (path traversal not allowed)`);
+            }
+            // Check for absolute paths
+            if (path.startsWith("/")) {
+                errors.push(`Navigation item "${item.title}" has invalid path: "${path}" (absolute paths not allowed)`);
+            }
+        }
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+}
+//# sourceMappingURL=internal-docs-navigation.js.map

package/dist/lib/internal-docs-navigation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-docs-navigation.js","sourceRoot":"","sources":["../../src/lib/internal-docs-navigation.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA2BH,0EAmBC;AAUD,gDA4CC;AApFD;;;;;;;;;;GAUG;AACH,SAAgB,+BAA+B,CAC7C,UAA0B;IAE1B,MAAM,YAAY,GAA2B,EAAE,CAAC;IAEhD,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,yCAAyC;YACzC,0CAA0C;YAC1C,4EAA4E;YAC5E,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAEjE,qDAAqD;YACrD,qDAAqD;YACrD,YAAY,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,UAA0B;IAI3D,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAEvB,qCAAqC;YACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CACT,oBAAoB,IAAI,CAAC,KAAK,wBAAwB,IAAI,iCAAiC,CAC5F,CAAC;YACJ,CAAC;YAED,6BAA6B;YAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CACT,oBAAoB,IAAI,CAAC,KAAK,wBAAwB,IAAI,yBAAyB,CACpF,CAAC;YACJ,CAAC;YAED,oCAAoC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CACT,oBAAoB,IAAI,CAAC,KAAK,wBAAwB,IAAI,gCAAgC,CAC3F,CAAC;YACJ,CAAC;YAED,2BAA2B;YAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CACT,oBAAoB,IAAI,CAAC,KAAK,wBAAwB,IAAI,gCAAgC,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/lib/internal-docs-navigation.json

@@ -0,0 +1,169 @@
+{
+    "sections": [
+        {
+            "title": "General",
+            "items": [
+                {
+                    "title": "Overview",
+                    "path": "internal/OVERVIEW.md"
+                },
+                {
+                    "title": "Architecture",
+                    "path": "internal/ARCHITECTURE.md"
+                }
+            ]
+        },
+        {
+            "title": "Sales",
+            "items": [
+                {
+                    "title": "Sales Guide",
+                    "path": "internal/SALES_GUIDE.md"
+                },
+                {
+                    "title": "Sales Documentation",
+                    "path": "internal/SALES_DOCS.md"
+                }
+            ]
+        },
+        {
+            "title": "Business Analysts",
+            "items": [
+                {
+                    "title": "Business Analyst Guide",
+                    "path": "internal/BUSINESS_ANALYST_GUIDE.md"
+                },
+                {
+                    "title": "Business Analyst Documentation",
+                    "path": "internal/BUSINESS_ANALYST_DOCS.md"
+                }
+            ]
+        },
+        {
+            "title": "Support",
+            "items": [
+                {
+                    "title": "Support Guide",
+                    "path": "internal/SUPPORT_GUIDE.md"
+                },
+                {
+                    "title": "Support Documentation",
+                    "path": "internal/SUPPORT_DOCS.md"
+                }
+            ]
+        },
+        {
+            "title": "Operations",
+            "items": [
+                {
+                    "title": "Operations Guide",
+                    "path": "internal/OPERATIONS_GUIDE.md"
+                },
+                {
+                    "title": "Operations Documentation",
+                    "path": "internal/OPERATIONS_DOCS.md"
+                }
+            ]
+        },
+        {
+            "title": "Market Analysis",
+            "items": [
+                {
+                    "title": "Market Analysis Documentation",
+                    "path": "internal/MARKET_ANALYSIS_DOCS.md"
+                },
+                {
+                    "title": "Competitor Analysis Overview",
+                    "path": "internal/market-analysis/README.md"
+                },
+                {
+                    "title": "Competitor Analysis Details",
+                    "path": "internal/market-analysis/competitor-analysis.md"
+                },
+                {
+                    "title": "Dogpack Deep Analysis",
+                    "path": "internal/market-analysis/dogpack-deep-analysis.md"
+                }
+            ]
+        },
+        {
+            "title": "Compliance",
+            "items": [
+                {
+                    "title": "Compliance Guide",
+                    "path": "internal/COMPLIANCE_GUIDE.md"
+                },
+                {
+                    "title": "Compliance Documentation",
+                    "path": "internal/COMPLIANCE_DOCS.md"
+                }
+            ]
+        },
+        {
+            "title": "Formal Compliance Documents",
+            "items": [
+                {
+                    "title": "Bavaria Compliance Overview",
+                    "path": "internal/bavaria-compliance/README.md"
+                },
+                {
+                    "title": "Handelsregisterauszug",
+                    "path": "internal/bavaria-compliance/handelsregisterauszug.md"
+                },
+                {
+                    "title": "Gewerbeanmeldung",
+                    "path": "internal/bavaria-compliance/gewerbeanmeldung.md"
+                },
+                {
+                    "title": "Steuerliche Erfassung",
+                    "path": "internal/bavaria-compliance/steuerliche-erfassung.md"
+                },
+                {
+                    "title": "Umsatzsteuer-Voranmeldung",
+                    "path": "internal/bavaria-compliance/umsatzsteuer-voranmeldung.md"
+                },
+                {
+                    "title": "Umsatzsteuererklärung",
+                    "path": "internal/bavaria-compliance/umsatzsteuererklaerung.md"
+                },
+                {
+                    "title": "E-Rechnungsverfahren",
+                    "path": "internal/bavaria-compliance/e-rechnungsverfahren.md"
+                },
+                {
+                    "title": "Datenschutzerklärung",
+                    "path": "internal/bavaria-compliance/datenschutzerklaerung.md"
+                },
+                {
+                    "title": "Verarbeitungsverzeichnis",
+                    "path": "internal/bavaria-compliance/verarbeitungsverzeichnis.md"
+                },
+                {
+                    "title": "Datenschutz-Folgenabschätzung",
+                    "path": "internal/bavaria-compliance/datenschutz-folgenabschaetzung.md"
+                }
+            ]
+        },
+        {
+            "title": "Developers",
+            "items": [
+                {
+                    "title": "Developer Guide",
+                    "path": "internal/DEVELOPER_GUIDE.md"
+                },
+                {
+                    "title": "Developer Documentation",
+                    "path": "internal/DEVELOPER_DOCS.md"
+                },
+                {
+                    "title": "Implementation Guide",
+                    "path": "internal/IMPLEMENTATION.md"
+                },
+                {
+                    "title": "Sync Strategy",
+                    "path": "internal/SYNC_STRATEGY.md"
+                }
+            ]
+        }
+    ]
+}

package/dist/lib/invitation-handler.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Invitation Handler
+ *
+ * Handles user-to-user invitations for invitation-only sign-up mode.
+ * Users can create invitation codes that others can use to sign up.
+ */
+import type { Env } from "../env";
+import { type LoggerEnv } from "./logger";
+/**
+ * Invitation Handler class
+ */
+export declare class InvitationHandler {
+    private sessionManager;
+    private securityHeaders;
+    private rateLimiter;
+    private logger;
+    constructor(env?: LoggerEnv);
+    /**
+     * Generate a cryptographically secure session token for tracking who scanned an invitation
+     * SECURITY: Uses crypto.getRandomValues() for CSPRNG to prevent spoofing
+     */
+    private generateSessionToken;
+    /**
+     * Store session token in KV for validation during signup
+     * Key: invitation-session:{code}, Value: { token, email?, expiresAt }
+     * TTL: 1 hour (3600 seconds)
+     */
+    private storeSessionToken;
+    /**
+     * Validate session token for an invitation code
+     * Returns the stored email if token is valid, null otherwise
+     */
+    private validateSessionToken;
+    /**
+     * Generate a cryptographically secure random invitation code
+     * SECURITY: Uses crypto.getRandomValues() for CSPRNG (Cryptographically Secure Pseudo-Random Number Generator)
+     * Increased length to 10 characters for better security (1.1 trillion combinations)
+     */
+    private generateInvitationCode;
+    /**
+     * Delete expired invitations for a user
+     *
+     * Automatically removes invitations that have expired (expiresAt < now).
+     * This keeps the database clean and ensures expired invitations don't count toward limits.
+     */
+    private deleteExpiredInvitations;
+    /**
+     * Check if user has reached the limit for simultaneously open invitations
+     *
+     * An invitation is considered "open" if it:
+     * - Has not been used (used = false)
+     * - Has not expired (expiresAt is null or in the future)
+     *
+     * This prevents abuse while allowing users to create more invitations
+     * by deleting unused ones.
+     *
+     * Automatically deletes expired invitations before checking the limit.
+     */
+    private checkOpenInvitationLimit;
+    /**
+     * Create a new invitation
+     * POST /api/invitations
+     *
+     * Requires authentication. Users can have up to 10 simultaneously open invitations.
+     * An invitation is "open" if it's not used and not expired.
+     * Users can delete unused invitations to create new ones.
+     * SECURITY: Checks sign-up mode - if disabled, prevents invitation creation.
+     */
+    handleCreateInvitation(request: Request, env: Env): Promise<Response>;
+    /**
+     * Internal helper to create invitation (extracted for code reuse)
+     */
+    private createInvitationWithEmail;
+    /**
+     * Get inviter info for friend confirmation
+     * GET /api/invitations/inviter-info
+     *
+     * Returns the inviter information for a newly signed up user.
+     */
+    handleGetInviterInfo(request: Request, env: Env): Promise<Response>;
+    /**
+     * List user's invitations
+     * GET /api/invitations
+     *
+     * Returns all invitations created by the authenticated user.
+     */
+    handleListInvitations(request: Request, env: Env): Promise<Response>;
+    /**
+     * Delete an invitation
+     * DELETE /api/invitations/:id
+     *
+     * Allows the creator to delete their own invitation.
+     * Cannot delete invitations that are currently being used (scanned but not yet completed signup).
+     *
+     * SECURITY: Only the creator can delete their own invitations.
+     */
+    handleDeleteInvitation(request: Request, env: Env): Promise<Response>;
+    /**
+     * Validate an invitation code
+     * POST /api/invitations/validate
+     *
+     * Public endpoint to validate an invitation code before sign-up.
+     * Returns whether the code is valid and can be used.
+     *
+     * SECURITY: Rate limited to prevent brute force attacks.
+     */
+    handleValidateInvitation(request: Request, env: Env): Promise<Response>;
+    /**
+     * Mark an invitation as used
+     * Called internally when a user signs up with an invitation code
+     *
+     * SECURITY: Uses database transaction to prevent race conditions (multiple signups with same code)
+     *
+     * Also automatically creates a friendship between the inviter and the new user.
+     */
+    markInvitationAsUsed(code: string, userId: string, token: string | undefined, email: string, env: Env): Promise<{
+        success: boolean;
+        error?: string;
+        inviterId?: string;
+        inviterEmail?: string;
+    }>;
+    /**
+     * Create a friendship between the inviter and the new user
+     * This is called automatically when an invitation is used
+     */
+    private createFriendshipFromInvitation;
+    /**
+     * Add friend to user's friends list (helper for maintaining list)
+     * Throws error if MAX_FRIENDS limit is reached
+     */
+    private addToFriendsList;
+}
+//# sourceMappingURL=invitation-handler.d.ts.map

package/dist/lib/invitation-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation-handler.d.ts","sourceRoot":"","sources":["../../src/lib/invitation-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAElC,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAMlD;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,MAAM,CAAS;gBAEX,GAAG,CAAC,EAAE,SAAS;IAO3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAgC5B;;;;OAIG;YACW,iBAAiB;IA2B/B;;;OAGG;YACW,oBAAoB;IA2ClC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAoB9B;;;;;OAKG;YACW,wBAAwB;IAuDtC;;;;;;;;;;;OAWG;YACW,wBAAwB;IA0DtC;;;;;;;;OAQG;IACG,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAkP3E;;OAEG;YACW,yBAAyB;IAgJvC;;;;;OAKG;IACG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAiEzE;;;;;OAKG;IACG,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4I1E;;;;;;;;OAQG;IACG,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IA2Q3E;;;;;;;;OAQG;IACG,wBAAwB,CAC5B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IAgXpB;;;;;;;OAOG;IACG,oBAAoB,CACxB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,GAAG,GACP,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IAqKF;;;OAGG;YACW,8BAA8B;IAoE5C;;;OAGG;YACW,gBAAgB;CAsB/B"}