@flamingo-stack/openframe-frontend-core 0.0.533 → 0.0.534

package/src/components/ui/markdown/rich/embed-overrides.tsx

@@ -153,13 +153,15 @@ export function buildRichEmbedOverrides({
       return (standard.div as any)(divProps);
     },
 
-    // Reddit's OWN embed markup lives in 58 published blog posts as
-    // `<blockquote class="reddit-embed-bq">…<a href="post-url">` paired with
-    // a `<script src="embed.reddit.com/widgets.js">` loader. The sanitize
-    // stack strips the script (correctly), so the composition rehydrates the
-    // blockquote itself: extract the post URL from the first reddit link and
-    // render the RedditEmbedClient SSOT. Non-reddit blockquotes fall through
-    // to the engine's base blockquote.
+    // Pasted-from-the-platform embed markup lives in published blog posts as
+    // `<blockquote class="reddit-embed-bq">…<a href="post-url">` (58 blocks
+    // across 9 posts) — and Twitter's equivalent is
+    // `<blockquote class="twitter-tweet">…<a href="status-url">`. Each pair
+    // ships a `widgets.js` loader script, which `processShortcodes` strips
+    // from the source text (Step 1.5). The composition rehydrates the
+    // blockquote itself: extract the post URL from the first matching link
+    // and render the platform's embed-client SSOT. Other blockquotes fall
+    // through to the engine's base blockquote.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     blockquote: (bqProps: any) => {
       const { node, className } = bqProps;
@@ -168,6 +170,10 @@ export function buildRichEmbedOverrides({
         const postUrl = findFirstHref(node, /reddit\.com/);
         if (postUrl) return <RedditEmbedClient url={postUrl} />;
       }
+      if (classNames.includes('twitter-tweet')) {
+        const tweetUrl = findFirstHref(node, /(?:twitter\.com|x\.com)\/[^/]+\/status\//);
+        if (tweetUrl) return <TwitterEmbedClient url={tweetUrl} />;
+      }
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       return (standard.blockquote as any)(bqProps);
     },

package/src/components/ui/markdown/rich/shortcodes.ts

@@ -78,6 +78,21 @@ export const processShortcodes = (content: string): string => {
     return placeholder;
   });
 
+  // Step 1.5: Strip well-formed `<script …>…</script>` elements from prose.
+  // Pasted social embed markup ships a loader script alongside its markup
+  // (Reddit: `<blockquote class="reddit-embed-bq">…` + embed.reddit.com
+  // widgets.js; Twitter: platform.twitter.com widgets.js). Scripts NEVER
+  // execute on this surface — the sanitize stack strips real ones — but the
+  // engine's text pre-pass escapes the tag first, so it used to render as
+  // VISIBLE source text under every embed. Runs after Step 1 so script tags
+  // inside code fences / inline code stay literal sample code; an UNCLOSED
+  // opener is left alone (falls through to today's escape-to-text behavior,
+  // which is the safe degrade). Quantifiers are hard-bounded (ReDoS).
+  processedContent = processedContent.replace(
+    /<script\b[^>]{0,2000}>[\s\S]{0,20000}?<\/script\s{0,10}>/gi,
+    ''
+  );
+
   // Step 2: Temporarily replace markdown links to protect them
   const markdownLinks: string[] = [];
   processedContent = processedContent.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (match) => {

package/src/utils/social-embed-cache.ts

@@ -1,26 +1,35 @@
-// Unified Social Media Embed Caching System
-// Shared between Reddit and Twitter embeds for consistent behavior.
+// Unified Social Media Embed fetch layer.
+// Shared between Reddit and Twitter embed clients for consistent behavior.
 //
-// Lifted from hub `lib/utils/social-embed-cache.ts` so the lib's
-// RichMarkdownRenderer satellites (reddit/twitter embed clients) can
-// share it without an `@/lib/...` hub dependency. Pure-TS; no React.
+// SIMPLIFIED (2026-08, "all 58 Reddit embeds broken" incident): the server
+// proxy is now the single authority — it owns a DURABLE database cache and
+// the authenticated upstream fetch (Reddit's `.json` API 403s all
+// unauthenticated clients, so the old browser direct-fetch could never work
+// again). The old client-side hierarchy (cache-only preflight round-trip,
+// direct browser fetch, client→server POST cache pushes, background
+// refreshes) was flaky machinery layered over an unreliable server cache and
+// is DELETED — do not reintroduce it. Client flow is exactly:
+//
+//   memory (per-pageload dedupe) → GET proxy (server cache + upstream)
 //
 // Endpoint paths are passed in via `apiEndpoint` on each call so embedders
 // can route through their own reverse proxy (e.g. `/content/api/blog/reddit-proxy`).
 
-// Global request deduplication to prevent duplicate caching requests
-const cachingRequests = new Map<string, Promise<void>>();
-
-// Global data cache to share fetched data between component instances
+// Per-pageload memory cache shared between component instances.
 const dataCache = new Map<string, any>();
 
-// Global refresh tracking to prevent duplicate background refreshes
-const refreshTimestamps = new Map<string, number>();
+// In-flight GET dedupe: several embeds of the same URL mount concurrently
+// (before any of them has populated the memory cache).
+const inflightRequests = new Map<string, Promise<any | null>>();
 
-interface CacheOptions {
+interface FetchOptions {
   platform: 'reddit' | 'twitter';
   url: string;
   apiEndpoint: string;
+  dataValidator: (data: any) => boolean;
+  onDataUpdate: (data: any) => void;
+  onError: (error: string) => void;
+  onLoading: (loading: boolean) => void;
 }
 
 export class SocialEmbedCache {
@@ -33,358 +42,76 @@ export class SocialEmbedCache {
     return SocialEmbedCache.instance;
   }
 
-  // Check if data exists in memory cache
   getFromMemory(url: string): any | null {
     return dataCache.get(url) || null;
   }
 
-  // Store data in memory cache
   setInMemory(url: string, data: any): void {
     dataCache.set(url, data);
   }
 
-  // Check server cache (cache-only mode)
-  async getFromServer(options: CacheOptions): Promise<any | null> {
-    try {
-      console.log(`🔍 [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Cache] Checking server cache for: ${options.url}`);
-      const response = await fetch(`${options.apiEndpoint}?url=${encodeURIComponent(options.url)}&cache-only=true`);
-
-      if (response.ok) {
-        const data = await response.json();
-        console.log(`✅ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Cache] Server cache hit: ${options.url}`);
-        return data;
-      } else if (response.status === 404) {
-        console.log(`💨 [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Cache] No server cache available for: ${options.url}`);
-        return null;
-      }
-    } catch (error) {
-      console.log(`❌ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Cache] Server cache check failed for: ${options.url}`, error);
-    }
-    return null;
-  }
-
-  // Helper method to update server cache asynchronously
-  private async updateServerCache(apiEndpoint: string, url: string, data: any): Promise<void> {
-    try {
-      console.log(`💾 [Cache] Updating server cache for: ${url}`);
-      await fetch(`${apiEndpoint}?url=${encodeURIComponent(url)}`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(data)
-      });
-      console.log(`✅ [Cache] Server cache updated for: ${url}`);
-    } catch (error) {
-      console.log(`❌ [Cache] Server cache update failed for: ${url}`, error);
-    }
-  }
+  /**
+   * Memory → proxy. Kept the historical name so the embed clients'
+   * call sites are unchanged.
+   */
+  async fetchWithHierarchy(options: FetchOptions): Promise<void> {
+    const { url, platform, apiEndpoint, dataValidator, onDataUpdate, onError, onLoading } = options;
 
-  // Store data in server cache (with deduplication)
-  async setInServer(options: CacheOptions, data: any): Promise<void> {
-    const cacheKey = `${options.platform}-${options.url}`;
-
-    // Prevent duplicate caching requests
-    if (cachingRequests.has(cacheKey)) {
-      console.log(`⏭️ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Cache] Server cache update skipped (already in progress): ${options.url}`);
-      return;
-    }
-
-    console.log(`💾 [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Cache] Updating server cache for: ${options.url}`);
-    const cachePromise = fetch(`${options.apiEndpoint}?url=${encodeURIComponent(options.url)}`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(data)
-    }).then(() => {
-      console.log(`✅ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Cache] Server cache updated successfully: ${options.url}`);
-      cachingRequests.delete(cacheKey);
-    }).catch((error) => {
-      console.log(`❌ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Cache] Server cache update failed: ${options.url}`, error);
-      cachingRequests.delete(cacheKey);
-    });
-
-    cachingRequests.set(cacheKey, cachePromise);
-    await cachePromise;
-  }
-
-  // Direct fetch with platform-specific logic
-  async fetchDirect(options: CacheOptions & {
-    directFetcher: () => Promise<any>
-  }): Promise<any | null> {
-    try {
-      console.log(`🔄 [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Direct] Fetching content: ${options.url}`);
-      const result = await options.directFetcher();
-      console.log(`✅ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Direct] Fetch successful: ${options.url}`);
-      return result;
-    } catch (error) {
-      console.log(`❌ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Direct] Fetch failed: ${options.url}`, error);
-      return null;
-    }
-  }
-
-  // Unified cache hierarchy: Memory → Server → Direct
-  async fetchWithHierarchy(options: CacheOptions & {
-    dataValidator: (data: any) => boolean;
-    onDataUpdate: (data: any) => void;
-    onError: (error: string) => void;
-    onLoading: (loading: boolean) => void;
-  }): Promise<void> {
-    const { url, platform, onDataUpdate, onError, onLoading, dataValidator } = options;
-    const platformName = platform.charAt(0).toUpperCase() + platform.slice(1);
-
-    // Schedule background refresh for ALL loads (not just cache hits)
-    this.scheduleAsyncRefresh(platform, url, dataValidator, options.apiEndpoint);
-
-    // Step 1: Check memory cache first
-    console.log(`🔍 [${platformName} Cache] Checking memory cache for: ${url}`);
     const memoryData = this.getFromMemory(url);
     if (memoryData && dataValidator(memoryData)) {
-      console.log(`💎 [${platformName} Cache] Memory cache hit for: ${url}`);
       onDataUpdate(memoryData);
       onLoading(false);
       return;
     }
 
-    // Step 2: Check server cache (file system cache)
-    console.log(`🔍 [${platformName} Cache] No memory cache, checking server cache for: ${url}`);
-    const serverCacheData = await this.getFromServer(options);
-    if (serverCacheData && dataValidator(serverCacheData)) {
-      console.log(`🎯 [${platformName} Cache] Server cache hit (cached data) for: ${url}`);
-      onDataUpdate(serverCacheData);
-      this.setInMemory(url, serverCacheData); // Update memory cache
-      onLoading(false);
-      return;
-    }
-
-    // Step 3: Direct fetch from browser (bypasses server proxy)
-    console.log(`🔍 [${platformName} Cache] No server cache, attempting direct fetch for: ${url}`);
-
-    // For Reddit, try direct browser fetch first (CORS enabled). Use
-    // `AbortSignal.timeout(...)` to bound the wait — without it a hung
-    // upstream (Reddit dropping the connection without RST, or a captive-
-    // portal proxy stalling) would block this code path indefinitely and
-    // never fall through to the server proxy.
-    if (platform === 'reddit') {
-      try {
-        const directResponse = await fetch(url, {
-          method: 'GET',
-          headers: {
-            'Accept': 'application/json',
-          },
-          signal: AbortSignal.timeout(10_000),
-        });
-
-        if (directResponse.ok) {
-          const directData = await directResponse.json();
-          if (directData && dataValidator(directData)) {
-            console.log(`✅ [${platformName} Direct] Browser direct fetch successful for: ${url}`);
-            onDataUpdate(directData);
-            this.setInMemory(url, directData);
-            onLoading(false);
-
-            // Async server cache update
-            setTimeout(() => {
-              this.updateServerCache(options.apiEndpoint, url, directData);
-            }, 0);
-            return;
-          }
-        }
-        console.log(`💨 [${platformName} Direct] Browser direct fetch failed (${directResponse.status}), trying server proxy...`);
-      } catch (directError) {
-        console.log(`💨 [${platformName} Direct] Browser direct fetch failed, trying server proxy...`, directError);
-      }
-    }
-
-    // Step 4: Server proxy as fallback
-    console.log(`🔍 [${platformName} Cache] Trying server proxy for: ${url}`);
     try {
-      const response = await fetch(`${options.apiEndpoint}?url=${encodeURIComponent(url)}`);
-
-      if (response.ok) {
-        const serverData = await response.json();
-        if (serverData && dataValidator(serverData)) {
-          // Check X-Cache header to determine if this was a true cache hit or fresh fetch
-          const cacheStatus = response.headers.get('x-cache') || 'UNKNOWN';
-          if (cacheStatus === 'HIT') {
-            console.log(`🎯 [${platformName} Proxy] Server cache hit (cached data) for: ${url}`);
-          } else if (cacheStatus === 'MISS-FETCHED') {
-            console.log(`🔄 [${platformName} Proxy] Server processed fresh fetch (now cached) for: ${url}`);
-          } else {
-            console.log(`✅ [${platformName} Proxy] Server returned data (${cacheStatus}) for: ${url}`);
-          }
-          onDataUpdate(serverData);
-          this.setInMemory(url, serverData);
-          onLoading(false);
-          return;
-        } else {
-          // 200 with a body that fails our shape check — throw so the
-          // outer catch surfaces `onError` instead of silently dropping.
-          console.log(`⚠️ [${platformName} Proxy] Server returned data but validation failed for: ${url}`);
-          throw new Error('Server proxy returned invalid data shape');
-        }
-      } else {
-        // The Response body is a one-shot stream — read it ONCE and branch
-        // on shape afterwards. The previous code parsed 404s, fell through
-        // to the generic-error path, and then called `response.json()` a
-        // second time, which throws `TypeError: body stream already read`
-        // and masks the real status with a confusing error.
-        let errorData: { error?: string; message?: string } | null = null;
-        try {
-          errorData = await response.json();
-        } catch {
-          // Body wasn't JSON; errorData stays null and we fall through.
-        }
-        if (response.status === 404 && errorData?.error && errorData?.message) {
-          // Structured 404 (e.g. an unavailable Reddit post). Surface
-          // the proxy's message directly to the consumer.
-          console.log(`🚫 [${platformName} Proxy] Content unavailable: ${errorData.message}`);
-          onError(errorData.message);
-          onLoading(false);
-          return;
-        }
-        if (errorData?.error) {
-          throw new Error(`Server error: ${errorData.error}`);
-        }
-        throw new Error(`Server proxy failed: ${response.status}`);
+      const data = await this.fetchFromProxy(url, apiEndpoint, dataValidator);
+      if (data) {
+        this.setInMemory(url, data);
+        onDataUpdate(data);
+        onLoading(false);
+        return;
       }
+      // Structured 404 from the proxy — the content itself is unavailable.
+      onError(`This ${platform === 'reddit' ? 'Reddit post' : 'tweet'} could not be loaded.`);
     } catch (error) {
-      console.log(`❌ [${platformName} Cache] All fetch attempts failed for: ${url}`, error);
+      console.log(`❌ [${platform} embed] Proxy fetch failed for: ${url}`, error);
       onError(`Unable to load ${platform} content`);
-      onLoading(false);
     }
+    onLoading(false);
   }
 
-  // Schedule async background refresh (runs once, 1 second after load)
-  //
-  // The hub's old version hard-coded `/api/blog/{reddit,twitter}-proxy`. We
-  // now require `apiEndpoint` so embedders can route through their own
-  // reverse proxy (e.g. `/content/api/blog/...`).
-  private scheduleAsyncRefresh(
-    platform: string,
+  /**
+   * Returns the validated payload, `null` for a structured "content
+   * unavailable" 404, and throws for everything else. Concurrent calls for
+   * the same URL share one request.
+   */
+  private fetchFromProxy(
     url: string,
-    dataValidator: (data: any) => boolean,
     apiEndpoint: string,
-  ): void {
-    setTimeout(() => {
-      const platformName = platform.charAt(0).toUpperCase() + platform.slice(1);
-      console.log(`🔄 [${platformName} Async] Background refresh starting for: ${url}`);
-
-      fetch(`${apiEndpoint}?url=${encodeURIComponent(url)}`)
-        .then(response => {
-          if (response.ok) {
-            return response.json();
-          } else {
-            console.log(`❌ [${platformName} Async] Background refresh failed (${response.status}) for: ${url}`);
-            return null;
-          }
-        })
-        .then(data => {
-          if (data && dataValidator(data)) {
-            this.setInMemory(url, data);
-            console.log(`✅ [${platformName} Async] Background refresh completed for: ${url}`);
-          } else if (data) {
-            console.log(`❌ [${platformName} Async] Background refresh failed (invalid data) for: ${url}`);
-          }
-        })
-        .catch((error) => console.log(`❌ [${platformName} Async] Background refresh failed for: ${url}`, error));
-    }, 1000); // Runs exactly once, 1 second after load
-  }
-
-  // Background refresh to keep cache fresh (with request deduplication)
-  private async backgroundRefresh(options: CacheOptions & {
-    directFetcher: () => Promise<any>;
-    dataValidator: (data: any) => boolean;
-    onDataUpdate: (data: any) => void;
-  }, currentData: any): Promise<void> {
-    const refreshKey = `refresh-${options.platform}-${options.url}`;
-    const now = Date.now();
-
-    // Check if we've refreshed this URL recently (within 30 seconds)
-    const lastRefresh = refreshTimestamps.get(refreshKey);
-    if (lastRefresh && (now - lastRefresh) < 30000) {
-      console.log(`⏭️ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Background] Refresh skipped (recent refresh): ${options.url}`);
-      return;
-    }
-
-    // Prevent multiple background refresh requests for the same URL
-    if (cachingRequests.has(refreshKey)) {
-      console.log(`⏭️ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Background] Refresh skipped (already in progress): ${options.url}`);
-      return;
-    }
-
-    const refreshPromise = (async () => {
-      try {
-        console.log(`🔄 [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Background] Starting background refresh for: ${options.url}`);
-        refreshTimestamps.set(refreshKey, now);
-
-        const freshData = await this.fetchDirect(options);
-
-        if (freshData && options.dataValidator(freshData)) {
-          // Update cache silently without triggering UI re-render
-          this.setInMemory(options.url, freshData);
-          await this.setInServer(options, freshData);
-
-          console.log(`✅ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Background] Background refresh completed for: ${options.url}`);
-        } else {
-          console.log(`❌ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Background] Background refresh failed (invalid data) for: ${options.url}`);
-        }
-      } catch (error) {
-        console.log(`❌ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Background] Background refresh failed for: ${options.url}`, error);
-      } finally {
-        cachingRequests.delete(refreshKey);
+    dataValidator: (data: any) => boolean
+  ): Promise<any | null> {
+    const inflight = inflightRequests.get(url);
+    if (inflight) return inflight;
+
+    const request = (async () => {
+      const response = await fetch(`${apiEndpoint}?url=${encodeURIComponent(url)}`, {
+        signal: AbortSignal.timeout(15_000),
+      });
+      if (response.ok) {
+        const data = await response.json();
+        if (data && dataValidator(data)) return data;
+        throw new Error('Server proxy returned invalid data shape');
       }
+      if (response.status === 404) return null;
+      throw new Error(`Server proxy failed: ${response.status}`);
     })();
 
-    cachingRequests.set(refreshKey, refreshPromise);
-    await refreshPromise;
-  }
-
-  // Silent background refresh for UI-sensitive components
-  private silentBackgroundRefresh(options: CacheOptions & {
-    directFetcher: () => Promise<any>;
-    dataValidator: (data: any) => boolean;
-  }): void {
-    const refreshKey = `silent-refresh-${options.platform}-${options.url}`;
-    const now = Date.now();
-
-    // Check if we've refreshed this URL recently (within 5 minutes for silent refresh)
-    const lastRefresh = refreshTimestamps.get(refreshKey);
-    if (lastRefresh && (now - lastRefresh) < 300000) {
-      console.log(`⏭️ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Silent] Silent refresh skipped (recent refresh): ${options.url}`);
-      return; // Skip if refreshed within 5 minutes
-    }
-
-    // Prevent multiple silent refresh requests for the same URL
-    if (cachingRequests.has(refreshKey)) {
-      console.log(`⏭️ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Silent] Silent refresh skipped (already in progress): ${options.url}`);
-      return;
-    }
-
-    // Run in next tick to avoid blocking UI thread
-    setTimeout(() => {
-      const refreshPromise = (async () => {
-        try {
-          console.log(`🔄 [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Silent] Starting silent background refresh for: ${options.url}`);
-          refreshTimestamps.set(refreshKey, now);
-
-          // Fetch fresh data silently
-          const freshData = await this.fetchDirect(options);
-
-          if (freshData && options.dataValidator(freshData)) {
-            // Update cache silently - no UI notifications
-            this.setInMemory(options.url, freshData);
-            await this.setInServer(options, freshData);
-            console.log(`✅ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Silent] Silent refresh completed for: ${options.url}`);
-          } else {
-            console.log(`❌ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Silent] Silent refresh failed (invalid data) for: ${options.url}`);
-          }
-        } catch (error) {
-          console.log(`❌ [${options.platform.charAt(0).toUpperCase() + options.platform.slice(1)} Silent] Silent refresh failed for: ${options.url}`, error);
-        } finally {
-          cachingRequests.delete(refreshKey);
-        }
-      })();
-
-      cachingRequests.set(refreshKey, refreshPromise);
-    }, 0); // Defer to next event loop tick
+    inflightRequests.set(
+      url,
+      request.finally(() => inflightRequests.delete(url))
+    );
+    return inflightRequests.get(url)!;
   }
 }