@ekrist1/vulse 0.1.6-alpha.3 → 0.1.7-alpha.4

package/src/server/forms/templates.ts

@@ -0,0 +1,24 @@
+import type { FormDefinition } from '../../core/forms/definition.js'
+import type { SubmissionRow } from '../../core/repos/forms.js'
+
+export interface TemplateContext {
+  form: FormDefinition
+  submission: SubmissionRow
+  payload: Record<string, unknown>
+}
+
+export function renderTemplate(template: string, ctx: TemplateContext): string {
+  const tokens: Record<string, string> = {
+    'form.label': ctx.form.label,
+    'submission.id': ctx.submission.id,
+    'submission.created_at': ctx.submission.createdAt.toISOString(),
+  }
+  for (const [key, value] of Object.entries(ctx.payload)) {
+    tokens[key] = value === null || value === undefined ? '' : String(value)
+  }
+
+  return template.replace(/\{\{([^}]+)\}\}/g, (_, key: string) => {
+    const trimmed = key.trim()
+    return tokens[trimmed] ?? ''
+  })
+}

package/src/server/forms/webhook.ts

@@ -0,0 +1,19 @@
+export async function sendFormWebhook(
+  url: string,
+  payload: unknown,
+  headers: Record<string, string> = {},
+): Promise<void> {
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), 5000)
+  try {
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', ...headers },
+      body: JSON.stringify(payload),
+      signal: controller.signal,
+    })
+    if (!res.ok) throw new Error(`webhook failed: ${res.status}`)
+  } finally {
+    clearTimeout(timeout)
+  }
+}

package/src/server/handler.ts

@@ -0,0 +1,66 @@
+import { z } from 'astro/zod'
+import type { Auth } from './better-auth.js'
+import type { AuthContext, Role } from '../core/blueprints/types.js'
+import { AccessDeniedError, ValidationError } from '../core/errors.js'
+import { fail, ok } from './envelope.js'
+
+export interface HandlerCtx<P, B> {
+  request: Request
+  url: URL
+  params: P
+  body: B
+  auth: AuthContext
+}
+
+export interface HandlerOptions<P, B> {
+  params?: z.ZodType<P>
+  body?: z.ZodType<B>
+  requireRole?: Role[]
+}
+
+export function defineHandler<P = unknown, B = unknown, R = unknown>(
+  auth: Auth,
+  opts: HandlerOptions<P, B>,
+  fn: (ctx: HandlerCtx<P, B>) => Promise<R>,
+) {
+  return async (request: Request, rawParams: Record<string, string> = {}): Promise<Response> => {
+    try {
+      const url = new URL(request.url)
+
+      let params: P = rawParams as unknown as P
+      if (opts.params) {
+        const parsed = opts.params.safeParse(rawParams)
+        if (!parsed.success) throw new ValidationError('Invalid params', { issues: parsed.error.issues })
+        params = parsed.data
+      }
+
+      let body: B = undefined as unknown as B
+      if (opts.body && request.method !== 'GET' && request.method !== 'DELETE') {
+        const raw = await request.json().catch(() => undefined)
+        const parsed = opts.body.safeParse(raw)
+        if (!parsed.success) throw new ValidationError('Invalid body', { issues: parsed.error.issues })
+        body = parsed.data
+      }
+
+      const session = await auth.api.getSession({ headers: request.headers })
+      const authCtx: AuthContext = session ? {
+        user: {
+          id: session.user.id,
+          email: session.user.email,
+          role: (session.user as { role?: Role }).role ?? 'member',
+        },
+      } : { user: null }
+
+      if (opts.requireRole && !authCtx.user) throw new AccessDeniedError('Authentication required')
+      if (opts.requireRole && authCtx.user && !opts.requireRole.includes(authCtx.user.role)) {
+        throw new AccessDeniedError(`Requires role: ${opts.requireRole.join(' or ')}`)
+      }
+
+      const result = await fn({ request, url, params, body, auth: authCtx })
+      if (result instanceof Response) return result
+      return ok(result)
+    } catch (err) {
+      return fail(err)
+    }
+  }
+}

package/src/server/image-probe.ts

@@ -0,0 +1,35 @@
+/** Returns {width,height} from image headers without decoding the full file. */
+export function probeDimensions(buf: ArrayBuffer, mime: string): { width: number; height: number } | null {
+  const v = new DataView(buf)
+  if (mime === 'image/png') {
+    if (v.byteLength < 24) return null
+    return { width: v.getUint32(16), height: v.getUint32(20) }
+  }
+  if (mime === 'image/jpeg') {
+    let i = 2
+    while (i < v.byteLength) {
+      if (v.getUint8(i) !== 0xff) return null
+      const marker = v.getUint8(i + 1)
+      const len = v.getUint16(i + 2)
+      if ((marker >= 0xc0 && marker <= 0xcf) && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+        return { height: v.getUint16(i + 5), width: v.getUint16(i + 7) }
+      }
+      i += 2 + len
+    }
+    return null
+  }
+  if (mime === 'image/webp') {
+    if (v.byteLength < 30) return null
+    if (String.fromCharCode(v.getUint8(12), v.getUint8(13), v.getUint8(14), v.getUint8(15)) === 'VP8L') {
+      const b0 = v.getUint8(21)
+      const b1 = v.getUint8(22)
+      const b2 = v.getUint8(23)
+      const b3 = v.getUint8(24)
+      const width = 1 + (((b1 & 0x3f) << 8) | b0)
+      const height = 1 + (((b3 & 0x0f) << 10) | (b2 << 2) | ((b1 & 0xc0) >> 6))
+      return { width, height }
+    }
+    return null
+  }
+  return null
+}

package/src/server/loader.ts

@@ -0,0 +1,54 @@
+import type { Loader } from 'astro/loaders'
+import { createDb } from '../core/db.js'
+import { readLocalesConfig } from '../core/locales.js'
+import { EntriesRepo } from '../core/repos/entries.js'
+
+export interface VulseLoaderOptions {
+  collection: string
+  locale?: string
+}
+
+declare global {
+  // eslint-disable-next-line no-var
+  var __VULSE_TEST_DB__: D1Database | undefined
+}
+
+function resolveBinding(ctx: unknown): D1Database {
+  const c = ctx as { _vulseTestBinding?: D1Database }
+  if (c._vulseTestBinding) return c._vulseTestBinding
+  if (globalThis.__VULSE_TEST_DB__) return globalThis.__VULSE_TEST_DB__
+  throw new Error('vulseLoader: no D1 binding available. See https://vulse.dev/docs/loader-binding')
+}
+
+export function vulseLoader(opts: VulseLoaderOptions): Loader {
+  return {
+    name: `vulse-loader-${opts.collection}`,
+    load: async (ctx) => {
+      const includeDrafts = (ctx as { _vulseIncludeDrafts?: boolean })._vulseIncludeDrafts ?? false
+      const db = createDb(resolveBinding(ctx))
+      const repo = new EntriesRepo(db)
+      const locale = opts.locale ?? (await readLocalesConfig(db)).defaultLocale
+      const rows = await repo.list({
+        collection: opts.collection,
+        locale,
+        ...(includeDrafts ? {} : { status: 'published' }),
+      })
+
+      ctx.store.clear()
+      for (const r of rows) {
+        await ctx.store.set({
+          id: r.id,
+          digest: `v${r.version}`,
+          data: {
+            ...((r.content as Record<string, unknown>) ?? {}),
+            id: r.id,
+            slug: r.slug,
+            status: r.status,
+            publishedAt: r.publishedAt?.toISOString() ?? null,
+            updatedAt: r.updatedAt.toISOString(),
+          },
+        })
+      }
+    },
+  }
+}

package/src/server/plugins.ts

@@ -0,0 +1,214 @@
+import { ValidationError } from '../core/errors.js'
+import {
+  assertValidPluginId,
+  type AuthUserBeforeCreateResult,
+  type AuthUserCreateEvent,
+  type AuthUserCreateInput,
+  type AuthUserCreatedEvent,
+  type FormAfterSubmitEvent,
+  type FormBeforeSubmitEvent,
+  type FormBeforeSubmitResult,
+  type FormProcessEvent,
+  type MaybePromise,
+  type VulseHookName,
+  type VulsePlugin,
+  type VulsePluginContext,
+} from '../core/plugins/definition.js'
+import { sendFormEmail } from './forms/email.js'
+import type { FormEmailEnv } from './forms/email.js'
+
+const DEFAULT_HOOK_TIMEOUT_MS = 5_000
+
+interface RegisteredPlugin {
+  plugin: VulsePlugin
+  order: number
+}
+
+let registeredPlugins: RegisteredPlugin[] = []
+
+function orderedPlugins(): RegisteredPlugin[] {
+  return [...registeredPlugins].sort((a, b) => {
+    const priority = (b.plugin.priority ?? 0) - (a.plugin.priority ?? 0)
+    return priority || a.order - b.order
+  })
+}
+
+export function setVulsePlugins(plugins: VulsePlugin[] = []): void {
+  const seen = new Set<string>()
+  registeredPlugins = plugins.map((plugin, order) => {
+    assertValidPluginId(plugin.id)
+    if (seen.has(plugin.id)) throw new Error(`Vulse plugin "${plugin.id}" is registered more than once`)
+    seen.add(plugin.id)
+    return { plugin, order }
+  })
+}
+
+export function getVulsePlugins(): VulsePlugin[] {
+  return orderedPlugins().map(({ plugin }) => plugin)
+}
+
+export function __testResetVulsePlugins(): void {
+  registeredPlugins = []
+}
+
+function loggerFor(pluginId: string): VulsePluginContext['logger'] {
+  return {
+    debug: (message, data) => console.debug(`[vulse:${pluginId}] ${message}`, data ?? ''),
+    info: (message, data) => console.info(`[vulse:${pluginId}] ${message}`, data ?? ''),
+    warn: (message, data) => console.warn(`[vulse:${pluginId}] ${message}`, data ?? ''),
+    error: (message, data) => console.error(`[vulse:${pluginId}] ${message}`, data ?? ''),
+  }
+}
+
+function pluginContext(pluginId: string, env?: Record<string, unknown>): VulsePluginContext {
+  const safeEnv = env ?? {}
+  return {
+    env: safeEnv,
+    logger: loggerFor(pluginId),
+    email: {
+      send: async (input) => {
+        await sendFormEmail(safeEnv as FormEmailEnv, {
+          to: input.to,
+          subject: input.subject,
+          body: input.body ?? input.text ?? input.html ?? '',
+        })
+      },
+    },
+  }
+}
+
+async function withTimeout<T>(
+  promise: Promise<T>,
+  pluginId: string,
+  hookName: VulseHookName,
+): Promise<T> {
+  let timeout: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<never>((_, reject) => {
+        timeout = setTimeout(() => {
+          reject(new Error(`Vulse plugin "${pluginId}" hook "${hookName}" timed out`))
+        }, DEFAULT_HOOK_TIMEOUT_MS)
+      }),
+    ])
+  } finally {
+    if (timeout) clearTimeout(timeout)
+  }
+}
+
+async function invokeHook<TEvent, TResult>(
+  plugin: VulsePlugin,
+  hookName: VulseHookName,
+  event: TEvent,
+  env: Record<string, unknown> | undefined,
+): Promise<TResult | undefined> {
+  const hook = plugin.hooks?.[hookName] as
+    | ((event: TEvent, ctx: VulsePluginContext) => MaybePromise<TResult>)
+    | undefined
+  if (!hook) return undefined
+  return await withTimeout(
+    Promise.resolve(hook(event, pluginContext(plugin.id, env))),
+    plugin.id,
+    hookName,
+  )
+}
+
+async function runContinueHook<TEvent>(
+  hookName: VulseHookName,
+  event: TEvent,
+  env?: Record<string, unknown>,
+): Promise<void> {
+  for (const { plugin } of orderedPlugins()) {
+    try {
+      await invokeHook<TEvent, void>(plugin, hookName, event, env)
+    } catch (err) {
+      pluginContext(plugin.id, env).logger.error(`Hook "${hookName}" failed`, err)
+    }
+  }
+}
+
+export async function runFormBeforeSubmitHooks(
+  event: FormBeforeSubmitEvent,
+  env?: Record<string, unknown>,
+): Promise<{ action: 'continue'; payload: Record<string, unknown> } | { action: 'drop'; reason?: string }> {
+  let payload = event.payload
+
+  for (const { plugin } of orderedPlugins()) {
+    const result = await invokeHook<FormBeforeSubmitEvent, FormBeforeSubmitResult>(
+      plugin,
+      'form:beforeSubmit',
+      { ...event, payload },
+      env,
+    )
+    if (!result) continue
+
+    if (result.action === 'drop') {
+      return { action: 'drop', ...(result.reason ? { reason: result.reason } : {}) }
+    }
+    if (result.action === 'reject') {
+      throw new ValidationError(result.message ?? `Submission rejected by plugin "${plugin.id}"`, { plugin: plugin.id })
+    }
+    if (result.payload) payload = result.payload
+  }
+
+  return { action: 'continue', payload }
+}
+
+export async function runFormAfterSubmitHooks(
+  event: FormAfterSubmitEvent,
+  env?: Record<string, unknown>,
+): Promise<void> {
+  await runContinueHook('form:afterSubmit', event, env)
+}
+
+export async function runFormBeforeProcessHooks(
+  event: FormProcessEvent,
+  env?: Record<string, unknown>,
+): Promise<void> {
+  for (const { plugin } of orderedPlugins()) {
+    await invokeHook<FormProcessEvent, void>(plugin, 'form:beforeProcess', event, env)
+  }
+}
+
+export async function runFormAfterProcessHooks(
+  event: FormProcessEvent,
+  env?: Record<string, unknown>,
+): Promise<void> {
+  await runContinueHook('form:afterProcess', event, env)
+}
+
+export async function runAuthUserBeforeCreateHooks(
+  event: AuthUserCreateEvent,
+  env?: Record<string, unknown>,
+): Promise<AuthUserCreateInput | false | undefined> {
+  let user = event.user
+  let changed = false
+
+  for (const { plugin } of orderedPlugins()) {
+    const result = await invokeHook<AuthUserCreateEvent, AuthUserBeforeCreateResult>(
+      plugin,
+      'auth:userBeforeCreate',
+      { user },
+      env,
+    )
+    if (result === false) return false
+    if (!result) continue
+    if (result.action === 'reject') {
+      throw new Error(result.message ?? `User rejected by plugin "${plugin.id}"`)
+    }
+    if (result.data) {
+      user = { ...user, ...result.data }
+      changed = true
+    }
+  }
+
+  return changed ? user : undefined
+}
+
+export async function runAuthUserAfterCreateHooks(
+  event: AuthUserCreatedEvent,
+  env?: Record<string, unknown>,
+): Promise<void> {
+  await runContinueHook('auth:userAfterCreate', event, env)
+}

package/src/server/preview.ts

@@ -0,0 +1,25 @@
+import { SignJWT, jwtVerify } from 'jose'
+
+const ALG = 'HS256'
+
+export async function mintPreviewToken(secret: string, userId: string, ttlSeconds = 60 * 60): Promise<string> {
+  const key = new TextEncoder().encode(secret)
+  return await new SignJWT({ sub: userId, kind: 'vulse-preview' })
+    .setProtectedHeader({ alg: ALG })
+    .setExpirationTime(Math.floor(Date.now() / 1000) + ttlSeconds)
+    .sign(key)
+}
+
+export async function verifyPreviewToken(secret: string, token: string): Promise<boolean> {
+  try {
+    const key = new TextEncoder().encode(secret)
+    const { payload } = await jwtVerify(token, key)
+    return payload.kind === 'vulse-preview'
+  } catch {
+    return false
+  }
+}
+
+export function previewSecret(env: { VULSE_PREVIEW_SECRET?: string; BETTER_AUTH_SECRET: string }): string {
+  return env.VULSE_PREVIEW_SECRET ?? env.BETTER_AUTH_SECRET
+}

package/src/server/r2.ts

@@ -0,0 +1,13 @@
+import { nanoid } from 'nanoid'
+
+export interface UploadContext { bucket: R2Bucket }
+
+export async function putToR2(ctx: UploadContext, body: ArrayBuffer, mime: string): Promise<{ key: string }> {
+  const key = `${new Date().toISOString().slice(0, 10)}/${nanoid()}`
+  await ctx.bucket.put(key, body, { httpMetadata: { contentType: mime } })
+  return { key }
+}
+
+export async function deleteFromR2(ctx: UploadContext, key: string): Promise<void> {
+  await ctx.bucket.delete(key)
+}

package/src/server/routes/blueprints.ts

@@ -0,0 +1,62 @@
+import { z } from 'astro/zod'
+import type { Auth } from '../better-auth.js'
+import type { VulseDb } from '../../core/db.js'
+import {
+  BlueprintDefinitionSchema,
+  BlueprintDefinitionWithRenamesSchema,
+} from '../../core/blueprints/definition.js'
+import {
+  createBlueprint,
+  deleteBlueprint,
+  getBlueprintDefinition,
+  listBlueprintDefinitions,
+  updateBlueprint,
+} from '../../core/blueprints/mutations.js'
+import { _resetRegistry } from '../../core/blueprints/load.js'
+import { _resetRuntime } from '../runtime.js'
+import { defineHandler } from '../handler.js'
+
+const paramsHandle = z.object({ handle: z.string() })
+
+export function blueprintsRoutes(db: VulseDb, auth: Auth) {
+  return {
+    list: defineHandler(auth, {}, async () => listBlueprintDefinitions(db)),
+
+    get: defineHandler(auth, { params: paramsHandle }, async ({ params }) => {
+      const def = await getBlueprintDefinition(db, params.handle)
+      if (!def) throw new (await import('../../core/errors.js')).NotFoundError('blueprint not found')
+      return def
+    }),
+
+    create: defineHandler(auth, {
+      body: BlueprintDefinitionSchema,
+      requireRole: ['admin'],
+    }, async ({ body }) => {
+      const out = await createBlueprint(db, body)
+      _resetRegistry()
+      _resetRuntime()
+      return out
+    }),
+
+    update: defineHandler(auth, {
+      params: paramsHandle,
+      body: BlueprintDefinitionWithRenamesSchema,
+      requireRole: ['admin'],
+    }, async ({ params, body }) => {
+      const out = await updateBlueprint(db, params.handle, body)
+      _resetRegistry()
+      _resetRuntime()
+      return out
+    }),
+
+    delete: defineHandler(auth, {
+      params: paramsHandle,
+      requireRole: ['admin'],
+    }, async ({ params }) => {
+      await deleteBlueprint(db, params.handle)
+      _resetRegistry()
+      _resetRuntime()
+      return null
+    }),
+  }
+}