@geraldmaron/construct 1.2.3 → 1.3.0

package/lib/profiles/loader.mjs

@@ -1,123 +0,0 @@
-/**
- * lib/profiles/loader.mjs — Curated and custom org-type profile loader.
- *
- * Reads JSON profiles from `<repo>/profiles/<id>.json` for the curated set
- * (rnd, marketing, game-studio, internal-tools), and from `<cwd>/.cx/profile.json`
- * for user-defined profiles when `custom: true`.
- *
- * Resolution order for the active profile:
- *   1. `construct.config.json` -> `profile`
- *   2. `<cwd>/.cx/profile.json` -> `id` (custom)
- *   3. Default: 'rnd'
- *
- * All errors fall back to 'rnd' so a malformed profile never breaks the CLI.
- * Validation surfaces in `npm run lint:profiles` and in B3's pre-push gate.
- */
-
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
-const REPO_ROOT = resolve(MODULE_DIR, '..', '..');
-const PROFILES_DIR = join(REPO_ROOT, 'profiles');
-
-export const DEFAULT_PROFILE_ID = 'rnd';
-
-/**
- * Read a profile by id from the curated catalog. Returns null if not found.
- */
-export function loadProfile(id) {
-  if (!id || typeof id !== 'string') return null;
-  const path = join(PROFILES_DIR, `${id}.json`);
-  if (!existsSync(path)) return null;
-  try {
-    const raw = JSON.parse(readFileSync(path, 'utf8'));
-    return raw;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * List every curated profile id by scanning the profiles directory.
- */
-export function listProfiles() {
-  if (!existsSync(PROFILES_DIR)) return [];
-  return readdirSync(PROFILES_DIR)
-    .filter((f) => f.endsWith('.json'))
-    .map((f) => f.replace(/\.json$/, ''))
-    .sort();
-}
-
-/**
- * Load a user-defined profile from `<cwd>/.cx/profile.json`. Returns null if
- * the file is missing, malformed, or does not have `custom: true`.
- */
-export function loadCustomProfile(cwd) {
-  if (!cwd) return null;
-  const path = join(cwd, '.cx', 'profile.json');
-  if (!existsSync(path)) return null;
-  try {
-    const raw = JSON.parse(readFileSync(path, 'utf8'));
-    if (raw && raw.custom === true) return raw;
-    return null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Resolve the active profile for a project. Always returns a profile object.
- *
- * Precedence (highest first):
- *   1. Explicit `configProfileId` argument
- *   2. `<cwd>/.cx/profile.json` with `custom: true`
- *   3. `profile` field in `<cwd>/construct.config.json`
- *   4. Default `rnd`
- *
- * Falls back to a minimal RND object on any miss so the CLI never breaks.
- *
- * @param {string} cwd - project root
- * @param {string} [configProfileId] - explicit override, bypasses file lookups
- */
-export function resolveActiveProfile(cwd, configProfileId = null) {
-  if (configProfileId) {
-    const p = loadProfile(configProfileId);
-    if (p) return p;
-  }
-  const custom = loadCustomProfile(cwd);
-  if (custom) return custom;
-  const fromConfig = readProfileFromProjectConfig(cwd);
-  if (fromConfig) {
-    const p = loadProfile(fromConfig);
-    if (p) return p;
-  }
-  return loadProfile(DEFAULT_PROFILE_ID) ?? minimalRndFallback();
-}
-
-function readProfileFromProjectConfig(cwd) {
-  if (!cwd) return null;
-  const p = join(cwd, 'construct.config.json');
-  if (!existsSync(p)) return null;
-  try {
-    const raw = JSON.parse(readFileSync(p, 'utf8'));
-    return typeof raw?.profile === 'string' ? raw.profile : null;
-  } catch {
-    return null;
-  }
-}
-
-// Last-resort fallback if the curated rnd profile file is missing or
-// unreadable. Lets callers always rely on a non-null shape.
-function minimalRndFallback() {
-  return {
-    id: 'rnd',
-    displayName: 'Software R&D',
-    roles: [],
-    intake: { types: [], stages: [] },
-    docTemplates: [],
-    hooks: { sessionReflect: 'on', sessionOptimize: 'on' },
-    rebrand: { intakeQueueLabel: 'R&D intake queue', signalNoun: 'signal' },
-  };
-}

package/lib/profiles/rebrand.mjs

@@ -1,46 +0,0 @@
-/**
- * lib/profiles/rebrand.mjs — Profile-aware language helper.
- *
- * Each curated profile carries a `rebrand` block: how the active profile
- * wants the intake queue and individual signal items named in user-facing
- * surfaces (CLI output, daemon logs, session-start prelude). The helper
- * centralises that lookup so every consumer goes through one path with
- * safe defaults instead of hardcoding "intake queue" / "signal" / "intake".
- *
- * Defaults match the legacy strings so behaviour is unchanged for the rnd
- * profile and for any environment where profile resolution fails.
- */
-
-import { resolveActiveProfile } from './loader.mjs';
-
-export const DEFAULT_REBRAND = Object.freeze({
-  intakeQueueLabel: 'Intake queue',
-  signalNoun: 'signal',
-});
-
-/**
- * Return the active profile's rebrand labels.
- *
- * @param {string} [rootDir] - project root where profile.json / construct.config.json live.
- * @returns {{ intakeQueueLabel: string, signalNoun: string }}
- *
- * Returns defaults when `rootDir` is missing, when the profile cannot be
- * loaded, or when the profile omits its `rebrand` block. Never throws.
- */
-export function getRebrand(rootDir) {
-  if (!rootDir || typeof rootDir !== 'string') return { ...DEFAULT_REBRAND };
-  try {
-    const profile = resolveActiveProfile(rootDir);
-    const rb = profile?.rebrand;
-    if (!rb || typeof rb !== 'object') return { ...DEFAULT_REBRAND };
-    const intakeQueueLabel = typeof rb.intakeQueueLabel === 'string' && rb.intakeQueueLabel.trim()
-      ? rb.intakeQueueLabel.trim()
-      : DEFAULT_REBRAND.intakeQueueLabel;
-    const signalNoun = typeof rb.signalNoun === 'string' && rb.signalNoun.trim()
-      ? rb.signalNoun.trim()
-      : DEFAULT_REBRAND.signalNoun;
-    return { intakeQueueLabel, signalNoun };
-  } catch {
-    return { ...DEFAULT_REBRAND };
-  }
-}

package/lib/server/auth.mjs

@@ -1,169 +0,0 @@
-/**
- * lib/server/auth.mjs — Dashboard authentication middleware.
- *
- * Token-based auth for the Construct dashboard. A single shared bearer token
- * is stored at config.env in the XDG config dir under CONSTRUCT_DASHBOARD_TOKEN. If no
- * token is configured the dashboard runs open (localhost-only by design). The
- * browser receives a short-lived session cookie on successful token exchange so
- * subsequent requests don't need to re-send the Authorization header.
- *
- * API routes check: Authorization: Bearer <token>  OR  session cookie.
- * The login page POSTs to /api/auth/login and receives a Set-Cookie response.
- * GET /api/auth/status returns { configured, authenticated }.
- */
-
-import { randomBytes, timingSafeEqual } from 'crypto';
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-import { configDir } from '../config/xdg.mjs';
-
-const HOME = homedir();
-const CONFIG_ENV = join(configDir(HOME), 'config.env');
-const SESSION_COOKIE = 'cx_session';
-const SESSION_TTL_MS = 8 * 60 * 60 * 1000; // 8 hours
-const SUPPORTED_OAUTH_PROVIDERS = new Set(['github', 'google']);
-
-// ── In-memory session store ────────────────────────────────────────────────
-// Sessions are ephemeral — cleared on server restart. Acceptable for a local
-// single-user dashboard; no persistence needed.
-const sessions = new Map(); // token → { expiresAt }
-
-function parseEnvFile(filePath) {
-  if (!existsSync(filePath)) return {};
-  const out = {};
-  for (const line of readFileSync(filePath, 'utf8').split('\n')) {
-    const m = line.trim().match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
-    if (m) out[m[1]] = m[2].replace(/^["']|["']$/g, '');
-  }
-  return out;
-}
-
-// ── Token management ───────────────────────────────────────────────────────
-
-export function getDashboardToken() {
-  const env = parseEnvFile(CONFIG_ENV);
-  return env.CONSTRUCT_DASHBOARD_TOKEN || null;
-}
-
-export function setDashboardToken(token) {
-  mkdirSync(configDir(HOME), { recursive: true });
-  const env = existsSync(CONFIG_ENV) ? readFileSync(CONFIG_ENV, 'utf8') : '';
-  const lines = env.split('\n').filter(l => !l.startsWith('CONSTRUCT_DASHBOARD_TOKEN='));
-  lines.push(`CONSTRUCT_DASHBOARD_TOKEN=${token}`);
-  writeFileSync(CONFIG_ENV, lines.filter(Boolean).join('\n') + '\n', 'utf8');
-}
-
-export function generateToken() {
-  return randomBytes(32).toString('hex');
-}
-
-// ── Auth state ─────────────────────────────────────────────────────────────
-
-export function isAuthConfigured() {
-  return Boolean(getDashboardToken());
-}
-
-export function getAuthConfig(env = process.env) {
-  const rawMode = String(env.CONSTRUCT_AUTH_MODE || '').trim().toLowerCase();
-  const mode = rawMode === 'oauth' ? 'oauth' : 'token';
-  const providers = String(env.CONSTRUCT_OAUTH_PROVIDERS || '')
-    .split(',')
-    .map((value) => value.trim().toLowerCase())
-    .filter(Boolean)
-    .filter((value, index, array) => array.indexOf(value) === index)
-    .filter((value) => SUPPORTED_OAUTH_PROVIDERS.has(value));
-  const rolesEnabled = String(env.CONSTRUCT_AUTH_ROLES_ENABLED || '').trim() === '1';
-
-  return {
-    mode,
-    providers,
-    rolesEnabled,
-    sessionBackend: 'memory',
-    tokenConfigured: isAuthConfigured(),
-    oauthConfigured: providers.length > 0,
-    supportsTokenLogin: true,
-    supportsOauthLogin: providers.length > 0,
-  };
-}
-
-function safeCompare(a, b) {
-  try {
-    const ab = Buffer.from(a, 'utf8');
-    const bb = Buffer.from(b, 'utf8');
-    if (ab.length !== bb.length) {
-      // Still run the comparison to avoid timing leak
-      timingSafeEqual(ab, Buffer.alloc(ab.length));
-      return false;
-    }
-    return timingSafeEqual(ab, bb);
-  } catch {
-    return false;
-  }
-}
-
-export function validateToken(candidate) {
-  const stored = getDashboardToken();
-  if (!stored) return true; // No token configured → open
-  if (!candidate) return false;
-  return safeCompare(candidate, stored);
-}
-
-// ── Session cookie helpers ─────────────────────────────────────────────────
-
-function parseCookies(header) {
-  const out = {};
-  if (!header) return out;
-  for (const part of header.split(';')) {
-    const [k, ...rest] = part.trim().split('=');
-    if (k) out[k.trim()] = rest.join('=').trim();
-  }
-  return out;
-}
-
-export function createSession() {
-  const token = randomBytes(32).toString('hex');
-  sessions.set(token, { expiresAt: Date.now() + SESSION_TTL_MS });
-  return token;
-}
-
-export function validateSession(cookieHeader) {
-  const cookies = parseCookies(cookieHeader);
-  const token = cookies[SESSION_COOKIE];
-  if (!token) return false;
-  const session = sessions.get(token);
-  if (!session) return false;
-  if (Date.now() > session.expiresAt) { sessions.delete(token); return false; }
-  return true;
-}
-
-export function sessionCookieHeader(token) {
-  const maxAge = Math.floor(SESSION_TTL_MS / 1000);
-  return `${SESSION_COOKIE}=${token}; HttpOnly; SameSite=Strict; Max-Age=${maxAge}; Path=/`;
-}
-
-export function clearSessionCookieHeader() {
-  return `${SESSION_COOKIE}=; HttpOnly; SameSite=Strict; Max-Age=0; Path=/`;
-}
-
-// ── Middleware ─────────────────────────────────────────────────────────────
-
-/**
- * Returns true if the request is authenticated (or auth is not configured).
- * Checks: session cookie first, then Authorization: Bearer header.
- */
-export function isAuthenticated(req) {
-  if (!isAuthConfigured()) return true;
-  if (validateSession(req.headers.cookie)) return true;
-  const authHeader = req.headers.authorization || '';
-  const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : null;
-  return validateToken(bearer);
-}
-
-/**
- * Send a 401 JSON response.
- */
-export function rejectUnauthorized(res) {
-  res.writeHead(401, { 'Content-Type': 'application/json' });
-  res.end(JSON.stringify({ error: 'Unauthorized', hint: 'Set Authorization: Bearer <CONSTRUCT_DASHBOARD_TOKEN>' }));
-}