@dytsou/shorten-url 2.4.3 → 2.4.5

package/frontend/static/favicon.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-labelledby="title">
+  <title id="title">Shorten URL</title>
+  <rect width="64" height="64" rx="12" fill="#d8ff54"/>
+  <path d="M25 22h-3a10 10 0 0 0 0 20h3M39 22h3a10 10 0 0 1 0 20h-3M24 32h16" fill="none" stroke="#111c1d" stroke-linecap="round" stroke-linejoin="round" stroke-width="6"/>
+</svg>

package/frontend/vite.config.js

@@ -0,0 +1,34 @@
+import { readFile } from "node:fs/promises";
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import { marked } from "marked";
+
+const docsDirectory = new URL("../docs/", import.meta.url);
+
+function siteDocsAssets() {
+  return {
+    name: "site-docs-assets",
+    apply: "build",
+    async generateBundle() {
+      const [aboutTemplate, aboutMarkdown, apiIndexHtml, openApiSpec] = await Promise.all([
+        readFile(new URL("about-template.html", import.meta.url), "utf8"),
+        readFile(new URL("about.md", docsDirectory), "utf8"),
+        readFile(new URL("api/index.html", docsDirectory), "utf8"),
+        readFile(new URL("api/openapi.yaml", docsDirectory), "utf8"),
+      ]);
+
+      const projectGuide = aboutMarkdown.replace(/^# URL Shortener$/m, "## URL Shortener");
+      const aboutHtml = aboutTemplate.replace("<!-- ABOUT_CONTENT -->", marked.parse(projectGuide));
+
+      this.emitFile({ type: "asset", fileName: "about.html", source: aboutHtml });
+      this.emitFile({ type: "asset", fileName: "api/index.html", source: apiIndexHtml });
+      this.emitFile({ type: "asset", fileName: "api/openapi.yaml", source: openApiSpec });
+    },
+  };
+}
+
+export default defineConfig({
+  base: "/",
+  publicDir: "static",
+  plugins: [react(), siteDocsAssets()],
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dytsou/shorten-url",
-  "version": "2.4.3",
+  "version": "2.4.5",
   "description": "A modern, fast URL shortener built with Cloudflare Workers and a responsive web interface",
   "type": "module",
   "main": "src/worker.js",
@@ -27,23 +27,24 @@
   "devDependencies": {
     "prettier": "^3.7.4",
     "vite": "7.3.6",
-    "vitest": "^4.1.10",
+    "vitest": "^5.0.0",
     "wrangler": "^4.120.0"
   },
   "files": [
     "src/worker.js",
-    "src/worker.example.js",
     "src/lib/",
     "config/",
     "docs/",
+    "frontend/",
     "README.md",
     "LICENSE"
   ],
   "scripts": {
-    "dev": "wrangler dev",
-    "deploy": "wrangler deploy",
+    "build": "pnpm --dir frontend build",
+    "dev": "pnpm build && wrangler dev --assets ./frontend/dist",
+    "deploy": "pnpm build && wrangler deploy",
     "logs": "wrangler tail",
-    "preview": "wrangler dev",
+    "preview": "pnpm build && wrangler dev --assets ./frontend/dist",
     "publish:npmjs": "pnpm publish --registry https://registry.npmjs.org",
     "publish:github": "pnpm publish --registry https://npm.pkg.github.com",
     "format": "prettier --write .",

package/src/lib/access.js

@@ -1,5 +1,245 @@
-export function hasPassedAccess(request) {
+function allowedHosts(env) {
+  return new Set(
+    String(env?.ACCESS_ALLOWED_HOSTS || "")
+      .split(",")
+      .map((host) => host.trim().toLowerCase())
+      .filter(Boolean)
+  );
+}
+
+export function isAllowedAccessHost(request, env) {
+  const hosts = allowedHosts(env);
+  return hosts.size === 0 || hosts.has(new URL(request.url).hostname.toLowerCase());
+}
+
+export function hasPassedAccess(request, env) {
+  if (!isAllowedAccessHost(request, env)) return false;
   const jwt = request.headers.get("Cf-Access-Jwt-Assertion");
   const email = request.headers.get("Cf-Access-Authenticated-User-Email");
   return Boolean(jwt && email);
 }
+
+const textEncoder = new TextEncoder();
+const jwksCache = new Map();
+const JWKS_TTL_MS = 5 * 60 * 1000;
+
+function decodeBase64Url(value) {
+  const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
+  const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (char) => char.codePointAt(0));
+}
+
+function decodeJson(value) {
+  return JSON.parse(new TextDecoder().decode(decodeBase64Url(value)));
+}
+
+function issuerFor(env) {
+  if (env?.CF_ACCESS_ISSUER) return env.CF_ACCESS_ISSUER.replace(/\/$/, "");
+  if (env?.CF_ACCESS_TEAM_DOMAIN) {
+    const domain = env.CF_ACCESS_TEAM_DOMAIN.replace(/^https?:\/\//, "").replace(/\/$/, "");
+    return `https://${domain}${domain.endsWith(".cloudflareaccess.com") ? "" : ".cloudflareaccess.com"}`;
+  }
+  return null;
+}
+
+function isObjectRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function decodeAccessToken(token, env) {
+  const segments = String(token).split(".");
+  if (segments.length !== 3) return null;
+  const [encodedHeader, encodedPayload, encodedSignature] = segments;
+  const issuer = issuerFor(env);
+  const audience = env?.CF_ACCESS_AUDIENCE;
+  const jwksUrl = env?.CF_ACCESS_JWKS_URL || (issuer ? `${issuer}/cdn-cgi/access/certs` : null);
+  if (!encodedHeader || !encodedPayload || !encodedSignature || !issuer || !audience || !jwksUrl) {
+    return null;
+  }
+
+  try {
+    const header = decodeJson(encodedHeader);
+    const payload = decodeJson(encodedPayload);
+    if (!isObjectRecord(header) || !isObjectRecord(payload)) return null;
+    if (header.alg !== "RS256" || typeof header.kid !== "string") return null;
+    return {
+      encodedHeader,
+      encodedPayload,
+      encodedSignature,
+      header,
+      payload,
+      issuer,
+      audience,
+      jwksUrl,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function hasValidAccessClaims({ payload, issuer, audience }) {
+  const now = Math.floor(Date.now() / 1000);
+  const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+  if (audiences.some((value) => typeof value !== "string")) return false;
+  if (payload.iss !== issuer || !audiences.includes(audience)) return false;
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= now) {
+    return false;
+  }
+  if (
+    payload.nbf !== undefined &&
+    (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > now)
+  ) {
+    return false;
+  }
+  return true;
+}
+
+async function loadJwks(jwksUrl, fetchImpl) {
+  let keys = jwksCache.get(jwksUrl);
+  if (keys && keys.expiresAt > Date.now()) return keys;
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 2000);
+  try {
+    const response = await fetchImpl(jwksUrl, {
+      headers: { accept: "application/json" },
+      signal: controller.signal,
+    });
+    if (!response.ok) return null;
+    keys = await response.json();
+    if (!Array.isArray(keys?.keys)) return null;
+    jwksCache.set(jwksUrl, { ...keys, expiresAt: Date.now() + JWKS_TTL_MS });
+    return jwksCache.get(jwksUrl);
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function verifyAccessSignature(
+  { encodedHeader, encodedPayload, encodedSignature, header },
+  keys
+) {
+  const jwk = keys?.keys?.find((key) => key.kid === header.kid && key.kty === "RSA");
+  if (!jwk) return false;
+  try {
+    const cryptoKey = await crypto.subtle.importKey(
+      "jwk",
+      jwk,
+      { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    return await crypto.subtle.verify(
+      "RSASSA-PKCS1-v1_5",
+      cryptoKey,
+      decodeBase64Url(encodedSignature),
+      textEncoder.encode(`${encodedHeader}.${encodedPayload}`)
+    );
+  } catch {
+    return false;
+  }
+}
+
+export async function verifyAccessJwt(token, env, { fetchImpl = globalThis.fetch } = {}) {
+  const decoded = decodeAccessToken(token, env);
+  if (!decoded || !hasValidAccessClaims(decoded)) return false;
+  const keys = await loadJwks(decoded.jwksUrl, fetchImpl);
+  if (!keys) return false;
+  return verifyAccessSignature(decoded, keys);
+}
+
+async function hmac(secret, value, usage) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    textEncoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    usage
+  );
+  return crypto.subtle.sign("HMAC", key, textEncoder.encode(value));
+}
+
+function base64Url(bytes) {
+  let binary = "";
+  for (const byte of new Uint8Array(bytes)) binary += String.fromCodePoint(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+
+function originFromRequest(request) {
+  return new URL(request.url).origin;
+}
+
+export async function createCsrfToken(request, env) {
+  const secret = env?.FLAGSHIP_CSRF_SECRET;
+  const email = request.headers.get("Cf-Access-Authenticated-User-Email") || "";
+  if (!secret || !email) return null;
+  return base64Url(await hmac(secret, `${originFromRequest(request)}\n${email}`, ["sign"]));
+}
+
+export async function verifyCsrfToken(request, env, token) {
+  const secret = env?.FLAGSHIP_CSRF_SECRET;
+  const email = request.headers.get("Cf-Access-Authenticated-User-Email") || "";
+  if (!secret || !email || typeof token !== "string") return false;
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      textEncoder.encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    return await crypto.subtle.verify(
+      "HMAC",
+      key,
+      decodeBase64Url(token),
+      textEncoder.encode(`${originFromRequest(request)}\n${email}`)
+    );
+  } catch {
+    return false;
+  }
+}
+
+export async function authorizeSettingsRequest(
+  request,
+  env,
+  { verifyToken = verifyAccessJwt, mutation = false, allowedOrigins = [] } = {}
+) {
+  if (!hasPassedAccess(request, env)) return { ok: false, status: 403, reason: "access_denied" };
+  let validJwt = false;
+  try {
+    validJwt = await verifyToken(request.headers.get("Cf-Access-Jwt-Assertion"), env);
+  } catch {
+    validJwt = false;
+  }
+  if (!validJwt) return { ok: false, status: 403, reason: "access_denied" };
+
+  if (!mutation) return { ok: true };
+  const origin = request.headers.get("origin");
+  const referer = request.headers.get("referer");
+  const expectedOrigin = originFromRequest(request);
+  let suppliedOrigin = origin || null;
+  if (!suppliedOrigin && referer) {
+    try {
+      suppliedOrigin = new URL(referer).origin;
+    } catch {
+      suppliedOrigin = null;
+    }
+  }
+  const trustedOrigins = new Set([
+    expectedOrigin,
+    ...(Array.isArray(allowedOrigins) ? allowedOrigins : []),
+  ]);
+  if (!suppliedOrigin || !trustedOrigins.has(suppliedOrigin)) {
+    return { ok: false, status: 403, reason: "origin_denied" };
+  }
+  if (!(request.headers.get("content-type") || "").toLowerCase().includes("application/json")) {
+    return { ok: false, status: 415, reason: "content_type_required" };
+  }
+  if (!(await verifyCsrfToken(request, env, request.headers.get("x-csrf-token")))) {
+    return { ok: false, status: 403, reason: "csrf_denied" };
+  }
+  return { ok: true };
+}

package/src/lib/assets.js

@@ -0,0 +1,58 @@
+const ROOT_ASSET_PATHS = new Set([
+  "/favicon.ico",
+  "/favicon.svg",
+  "/index.html",
+  "/manifest.webmanifest",
+  "/robots.txt",
+]);
+const ASSET_PREFIX = "/assets/";
+
+function unavailableResponse() {
+  return new Response("Frontend assets are unavailable", {
+    status: 503,
+    headers: { "content-type": "text/plain;charset=UTF-8" },
+  });
+}
+
+function hasUnsafeAssetSegment(pathname) {
+  let decoded = pathname;
+  try {
+    for (let index = 0; index < 2; index += 1) {
+      const next = decodeURIComponent(decoded);
+      if (next === decoded) break;
+      decoded = next;
+    }
+  } catch {
+    return true;
+  }
+
+  if (decoded.includes("%") || decoded.includes("\0") || decoded.includes("\\")) return true;
+  return decoded
+    .split("/")
+    .slice(2)
+    .some((segment) => !segment || segment === "." || segment === ".." || segment.startsWith("."));
+}
+
+export function isFrontendAssetPath(pathname) {
+  const candidate = String(pathname || "");
+  if (ROOT_ASSET_PATHS.has(candidate)) return true;
+  if (!candidate.startsWith(ASSET_PREFIX) || candidate === ASSET_PREFIX) return false;
+  return !hasUnsafeAssetSegment(candidate);
+}
+
+function requestForAsset(request, pathname) {
+  const url = new URL(request.url);
+  url.pathname = pathname;
+  return new Request(url, request);
+}
+
+/** Fetch a known built frontend asset without exposing request paths to a filesystem API. */
+export async function fetchFrontendAsset(env, request, pathname = "/") {
+  if (typeof env?.ASSETS?.fetch !== "function") return unavailableResponse();
+
+  try {
+    return await env.ASSETS.fetch(requestForAsset(request, pathname));
+  } catch {
+    return unavailableResponse();
+  }
+}

package/src/lib/endpoints.js

@@ -1,12 +1,37 @@
-/** Build hosted page URLs from a frontend config object. */
-export function endpointsFromFrontend(frontend) {
-  const pagesBase = frontend.pagesBase || frontend.url;
+function httpUrl(value) {
+  if (typeof value !== "string" || !value.trim()) return null;
+
+  try {
+    const url = new URL(value);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
+      return null;
+    }
+    return url.href;
+  } catch {
+    return null;
+  }
+}
+
+function pageUrl(path, base) {
+  if (!base) return null;
+  try {
+    return new URL(path, base).href;
+  } catch {
+    return null;
+  }
+}
+
+/** Build optional legacy hosted-page URLs from a frontend config object. */
+export function endpointsFromFrontend(frontend = {}) {
+  const shortenPage = httpUrl(frontend.url);
+  const pagesBase = httpUrl(frontend.pagesBase) || shortenPage;
   return {
-    shortenPage: frontend.url,
-    notFoundPage: new URL("404.html", pagesBase).href,
-    errorPage: new URL("error.html", pagesBase).href,
-    safeBrowsingWarning: new URL("safe-browsing-warning.html", pagesBase).href,
-    noRefPage: new URL("no-ref-page.html", pagesBase).href,
+    shortenPage,
+    frontendOrigin: shortenPage ? new URL(shortenPage).origin : null,
+    notFoundPage: pageUrl("404.html", pagesBase),
+    errorPage: pageUrl("error.html", pagesBase),
+    safeBrowsingWarning: pageUrl("safe-browsing-warning.html", pagesBase),
+    noRefPage: pageUrl("no-ref-page.html", pagesBase),
     safeBrowsing: "https://safebrowsing.googleapis.com/v4/threatMatches:find",
   };
 }