@growth-labs/cms 0.1.0

package/src/routes/preview.ts

@@ -0,0 +1,182 @@
+// Preview token route handler (Task 9 — P2).
+//
+// POST /content/:id/preview-token
+//   Mints a short-TTL HMAC token over { contentId, exp }.
+//   The PREVIEW_SECRET is injected via ctx.env — NEVER hardcoded.
+//   The Fronts `preview/[token].astro` consumer (which reads the draft row
+//   and bypasses the published filter) is §15 cutover glue (P8) and is NOT
+//   built here. P2 ships the package contract + tests.
+//
+// verifyPreviewToken(token, secret)
+//   Pure exported function: recomputes the HMAC + constant-time compares,
+//   rejects expired tokens, returns { contentId } | null.
+//
+// Token format:  base64url(JSON{ contentId, exp }).base64url(HMAC-SHA-256)
+//
+// SECURITY NOTE:
+//   The secret value lives in Cloudflare Secrets Store at the Fronts site
+//   (per the repo secrets rule). Operators bind it as PREVIEW_SECRET via
+//   [[secrets_store_secrets]] in their wrangler.toml. This file reads only
+//   ctx.env.PREVIEW_SECRET — it never stores or emits the value.
+
+import { getContentItem } from '../engine/publisher.js'
+import type { CmsRouteConfig } from './config.js'
+import { resolveConfig } from './config.js'
+import { json, type RouteContext, requireId } from './context.js'
+
+/** TTL for preview tokens: 1 hour (milliseconds). */
+const PREVIEW_TOKEN_TTL_MS = 60 * 60 * 1000
+
+export interface PreviewRouteHandlers {
+	/** POST /content/:id/preview-token — mint a signed preview token for a content item. */
+	mintToken(ctx: RouteContext): Promise<Response>
+}
+
+// ---- Base64url helpers ---------------------------------------------------
+
+function base64urlEncode(buf: Uint8Array): string {
+	return btoa(String.fromCharCode(...buf))
+		.replace(/\+/g, '-')
+		.replace(/\//g, '_')
+		.replace(/=+$/, '')
+}
+
+function base64urlDecodeToString(s: string): string | null {
+	try {
+		// Restore standard base64 padding
+		const padded =
+			s.replace(/-/g, '+').replace(/_/g, '/') + '==='.slice(0, (4 - (s.length % 4)) % 4)
+		return atob(padded)
+	} catch {
+		return null
+	}
+}
+
+// ---- HMAC helpers -------------------------------------------------------
+
+async function importHmacKey(secret: string): Promise<CryptoKey> {
+	const enc = new TextEncoder()
+	return crypto.subtle.importKey(
+		'raw',
+		enc.encode(secret),
+		{ name: 'HMAC', hash: 'SHA-256' },
+		false,
+		['sign', 'verify'],
+	)
+}
+
+async function signPayload(payload: string, secret: string): Promise<string> {
+	const enc = new TextEncoder()
+	const key = await importHmacKey(secret)
+	const sig = await crypto.subtle.sign('HMAC', key, enc.encode(payload))
+	return base64urlEncode(new Uint8Array(sig))
+}
+
+/** Constant-time buffer comparison (avoids timing attacks on the signature). */
+function bufEqual(a: Uint8Array, b: Uint8Array): boolean {
+	if (a.length !== b.length) return false
+	let diff = 0
+	for (let i = 0; i < a.length; i++) {
+		diff |= a[i] ^ b[i]
+	}
+	return diff === 0
+}
+
+// ---- Public pure export --------------------------------------------------
+
+/**
+ * Verify a preview token produced by `mintToken`.
+ * Returns `{ contentId }` on success, `null` on any failure:
+ *   - malformed token (not two base64url segments)
+ *   - invalid JSON payload
+ *   - expired (`exp < Date.now()`)
+ *   - signature does not verify (wrong secret or tampered payload)
+ */
+export async function verifyPreviewToken(
+	token: string,
+	secret: string,
+): Promise<{ contentId: string } | null> {
+	if (!token?.includes('.')) return null
+
+	const dotIdx = token.lastIndexOf('.')
+	const payloadB64 = token.slice(0, dotIdx)
+	const sigB64 = token.slice(dotIdx + 1)
+
+	if (!payloadB64 || !sigB64) return null
+
+	// Decode + parse payload
+	const payloadStr = base64urlDecodeToString(payloadB64)
+	if (!payloadStr) return null
+
+	let parsed: { contentId?: unknown; exp?: unknown }
+	try {
+		parsed = JSON.parse(payloadStr) as typeof parsed
+	} catch {
+		return null
+	}
+
+	if (typeof parsed.contentId !== 'string' || typeof parsed.exp !== 'number') return null
+
+	// Expiry check
+	if (parsed.exp < Date.now()) return null
+
+	// Signature verification
+	const expectedSig = await signPayload(payloadB64, secret)
+
+	// Decode both signatures to raw bytes for constant-time compare
+	const decodeToBytes = (b64url: string): Uint8Array | null => {
+		const str = base64urlDecodeToString(b64url)
+		if (!str) return null
+		const bytes = new Uint8Array(str.length)
+		for (let i = 0; i < str.length; i++) bytes[i] = str.charCodeAt(i)
+		return bytes
+	}
+
+	const expectedBytes = decodeToBytes(expectedSig)
+	const actualBytes = decodeToBytes(sigB64)
+	if (!expectedBytes || !actualBytes) return null
+	if (!bufEqual(expectedBytes, actualBytes)) return null
+
+	return { contentId: parsed.contentId }
+}
+
+// ---- Route factory ------------------------------------------------------
+
+export function createPreviewRoutes(config: CmsRouteConfig): PreviewRouteHandlers {
+	const resolved = resolveConfig(config)
+
+	return {
+		async mintToken(ctx: RouteContext): Promise<Response> {
+			const guard = await resolved.authz.requirePublisher(ctx)
+			if (guard) return guard
+
+			const idResult = requireId(ctx)
+			if ('error' in idResult) return idResult.error
+			const { id } = idResult
+
+			// Verify the content item exists
+			const item = await getContentItem(ctx.db, id)
+			if (!item) return json({ error: 'Content not found', id }, 404)
+
+			// Read secret from ctx.env — never hardcoded
+			const secret = ctx.env?.PREVIEW_SECRET
+			if (typeof secret !== 'string' || !secret) {
+				return json({ error: 'PREVIEW_SECRET is not configured in env' }, 400)
+			}
+
+			const exp = Date.now() + PREVIEW_TOKEN_TTL_MS
+			const payload = base64urlEncode(
+				new TextEncoder().encode(JSON.stringify({ contentId: id, exp })),
+			)
+			const sig = await signPayload(payload, secret)
+			const token = `${payload}.${sig}`
+
+			// The URL is a relative path the Fronts site resolves; the package
+			// does not know the public origin. The consumer appends the token
+			// to its own preview base path (e.g. `/preview/${token}`).
+			const url = `/preview/${token}`
+
+			return json({ token, url })
+		},
+	}
+}

package/src/routes/rbac-invites.ts

@@ -0,0 +1,220 @@
+// rbac-invites.ts — Masthead-owned invite flow (P7 Task 5).
+//
+// POST /settings/members/invite — create an invite (gated on manage_team).
+// POST /invite/accept           — accept an invite (calls IdentityProvider.mintOrAttachAccount).
+//
+// Copies inbox-platform src/lib/invites/service.ts pattern re-keyed to
+// workspace_invites. The invite-email send is an OPTIONAL injected concern:
+// the engine writes the row + returns the token; email failure is returned
+// as a value, not a thrown error (the invite is still acceptable via its link).
+//
+// SCOPE GUARDS (spec §12):
+//   - invite route gated on requireRole('manage_team').
+//   - acceptInvite calls IdentityProvider.mintOrAttachAccount(email).
+//   - Membership is keyed on the REAL subject from mintOrAttachAccount result.
+//   - Email must match the invite (engine enforces invite_email_mismatch).
+//   - The null IdentityProvider is used in tests (cutover deferred to §15/#53).
+
+import { acceptInvite, createInvite, loadInviteByToken } from '../engine/invites.js'
+import type { IdentityProvider } from '../providers/types.js'
+import type { CmsRole } from '../schema/types.js'
+import type { Authz, Capability, RouteContext } from './context.js'
+import { json } from './context.js'
+
+export interface InviteRouteConfig {
+	authz: Authz
+	workspaceId: string
+	/**
+	 * Identity provider for mint-or-attach on accept.
+	 * Defaults to a null impl (throws on mintOrAttachAccount) — production
+	 * impl injected by Fronts at cutover (spec §15 / platform-request #53).
+	 */
+	identityProvider?: IdentityProvider
+	/**
+	 * Optional: send the invite email. Called with the raw token AFTER the
+	 * invite row is written. Failures are returned as a value — the invite
+	 * remains acceptable via the token link (mirror inbox "failure-as-value").
+	 */
+	sendInviteEmail?: (input: {
+		to: string
+		token: string
+		inviteId: string
+		role: CmsRole
+		workspaceId: string
+	}) => Promise<void>
+}
+
+export interface InviteRouteHandlers {
+	invite(ctx: RouteContext): Promise<Response>
+	acceptInvite(ctx: RouteContext): Promise<Response>
+}
+
+const VALID_ROLES: ReadonlySet<string> = new Set([
+	'owner',
+	'senior_editor',
+	'editor',
+	'contributor',
+	'producer',
+])
+
+/** Null identity provider — used in tests and when no identity provider is injected. */
+const nullIdentityProvider: IdentityProvider = {
+	async getSubject() {
+		return null
+	},
+	async mintOrAttachAccount() {
+		throw new Error('IdentityProvider not configured')
+	},
+}
+
+export function createInviteRoutes(config: InviteRouteConfig): InviteRouteHandlers {
+	const identity = config.identityProvider ?? nullIdentityProvider
+
+	function requireWorkspace(): Response | null {
+		if (!config.workspaceId) {
+			return json({ error: 'Configuration error: workspaceId is required' }, 500)
+		}
+		return null
+	}
+
+	async function gate(ctx: RouteContext): Promise<Response | null> {
+		if (config.authz.requireRole) {
+			return config.authz.requireRole('manage_team' satisfies Capability, ctx)
+		}
+		return null
+	}
+
+	async function resolveActorSubject(ctx: RouteContext): Promise<string | null> {
+		if (!config.authz.getUser) return null
+		const user = await config.authz.getUser(ctx)
+		return user?.subject ?? null
+	}
+
+	return {
+		// -----------------------------------------------------------------------
+		// POST /settings/members/invite
+		// -----------------------------------------------------------------------
+		async invite(ctx: RouteContext): Promise<Response> {
+			const wsErr = requireWorkspace()
+			if (wsErr) return wsErr
+
+			const denied = await gate(ctx)
+			if (denied) return denied
+
+			const actorSubject = await resolveActorSubject(ctx)
+			if (!actorSubject) return json({ error: 'Unauthorized' }, 401)
+
+			let body: unknown
+			try {
+				body = await ctx.request.json()
+			} catch {
+				return json({ error: 'Invalid JSON' }, 400)
+			}
+
+			const b = body as Record<string, unknown>
+			const email = b?.email
+			const role = b?.role
+
+			if (!email || typeof email !== 'string') {
+				return json({ error: 'Missing email' }, 400)
+			}
+			if (!role || typeof role !== 'string' || !VALID_ROLES.has(role)) {
+				return json({ error: 'Missing or invalid role', validRoles: [...VALID_ROLES] }, 400)
+			}
+
+			const result = await createInvite(ctx.db, {
+				workspaceId: config.workspaceId,
+				email,
+				role: role as CmsRole,
+				invitedBy: actorSubject,
+			})
+
+			// Optional email send — failure is a value, the invite link still works
+			if (config.sendInviteEmail) {
+				try {
+					await config.sendInviteEmail({
+						to: email,
+						token: result.token,
+						inviteId: result.inviteId,
+						role: role as CmsRole,
+						workspaceId: config.workspaceId,
+					})
+				} catch (err) {
+					console.error(
+						'[cms/invite] email send failed (invite row written; link still valid):',
+						err,
+					)
+				}
+			}
+
+			return json({ ok: true, inviteId: result.inviteId, token: result.token })
+		},
+
+		// -----------------------------------------------------------------------
+		// POST /invite/accept
+		// -----------------------------------------------------------------------
+		async acceptInvite(ctx: RouteContext): Promise<Response> {
+			let body: unknown
+			try {
+				body = await ctx.request.json()
+			} catch {
+				return json({ error: 'Invalid JSON' }, 400)
+			}
+
+			const b = body as Record<string, unknown>
+			const token = b?.token
+			const email = b?.email
+			const name = typeof b?.name === 'string' ? b.name : null
+
+			if (!token || typeof token !== 'string') {
+				return json({ error: 'Missing token' }, 400)
+			}
+			if (!email || typeof email !== 'string') {
+				return json({ error: 'Missing email' }, 400)
+			}
+
+			// Validate the invite exists BEFORE calling mintOrAttachAccount so we
+			// can return invite_not_found / invite_email_mismatch immediately
+			// without touching identity for invalid tokens.
+			const pendingInvite = await loadInviteByToken(ctx.db, token)
+			if (!pendingInvite) {
+				return json({ error: 'invite_not_found' }, 400)
+			}
+			if (pendingInvite.email.toLowerCase() !== email.toLowerCase()) {
+				return json({ error: 'invite_email_mismatch' }, 400)
+			}
+
+			// Call mintOrAttachAccount to ensure the identity is created/attached.
+			// The null impl throws "IdentityProvider not configured" in tests/dev.
+			let subject: string
+			try {
+				const result = await identity.mintOrAttachAccount(email)
+				subject = result.subject
+			} catch (err) {
+				// If the null impl throws (not configured), return a clear error
+				const msg = err instanceof Error ? err.message : String(err)
+				if (msg === 'IdentityProvider not configured') {
+					return json({ error: 'Identity provider not configured' }, 503)
+				}
+				throw err
+			}
+
+			try {
+				const { workspaceId, role } = await acceptInvite(ctx.db, {
+					token,
+					user: { id: subject, email, name, image: null },
+				})
+				return json({ ok: true, workspaceId, role, subject })
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err)
+				if (msg === 'invite_not_found') {
+					return json({ error: 'invite_not_found' }, 400)
+				}
+				if (msg === 'invite_email_mismatch') {
+					return json({ error: 'invite_email_mismatch' }, 400)
+				}
+				throw err
+			}
+		},
+	}
+}

package/src/routes/rbac.ts

@@ -0,0 +1,155 @@
+// rbac.ts — RBAC route factories: GET /settings/members, PATCH /settings/members/:userId,
+// DELETE /settings/members/:userId (P7 Task 4).
+//
+// All routes are gated on requireRole('manage_team') — owner + senior_editor only.
+// Mutations enforce the owner-invariant from membership-rules.ts (Task 3):
+//   - setRole: canChangeMemberRole (refuse to demote the sole owner)
+//   - remove:  canRemoveMember (refuse self-removal; refuse sole-owner removal)
+//
+// Actor subject resolved via config.authz.getUser — the real OpenAuth subject.
+
+import { listMembers, removeMember, setRole } from '../engine/members.js'
+import { canChangeMemberRole, canRemoveMember } from '../engine/membership-rules.js'
+import type { CmsRole } from '../schema/types.js'
+import type { Authz, Capability, RouteContext } from './context.js'
+import { json } from './context.js'
+
+export interface RbacRouteConfig {
+	authz: Authz
+	workspaceId: string
+}
+
+export interface RbacRouteHandlers {
+	list(ctx: RouteContext): Promise<Response>
+	setRole(ctx: RouteContext): Promise<Response>
+	remove(ctx: RouteContext): Promise<Response>
+}
+
+const VALID_ROLES: ReadonlySet<string> = new Set([
+	'owner',
+	'senior_editor',
+	'editor',
+	'contributor',
+	'producer',
+])
+
+export function createRbacRoutes(config: RbacRouteConfig): RbacRouteHandlers {
+	/** Shared pre-flight guard: rejects any request when workspaceId is absent. */
+	function requireWorkspace(): Response | null {
+		if (!config.workspaceId) {
+			return json({ error: 'Configuration error: workspaceId is required for RBAC routes.' }, 500)
+		}
+		return null
+	}
+
+	async function gate(ctx: RouteContext): Promise<Response | null> {
+		if (config.authz.requireRole) {
+			return config.authz.requireRole('manage_team' satisfies Capability, ctx)
+		}
+		return null
+	}
+
+	async function resolveActorSubject(ctx: RouteContext): Promise<string | null> {
+		if (!config.authz.getUser) return null
+		const user = await config.authz.getUser(ctx)
+		return user?.subject ?? null
+	}
+
+	return {
+		// -----------------------------------------------------------------------
+		// GET /settings/members
+		// -----------------------------------------------------------------------
+		async list(ctx: RouteContext): Promise<Response> {
+			const wsErr = requireWorkspace()
+			if (wsErr) return wsErr
+			const denied = await gate(ctx)
+			if (denied) return denied
+
+			const members = await listMembers(ctx.db, config.workspaceId)
+			return json({
+				members: members.map((m) => ({
+					userId: m.userId,
+					role: m.role,
+					email: m.email,
+					name: m.name,
+					image: m.image,
+					acceptedAt: m.acceptedAt,
+					createdAt: m.createdAt,
+				})),
+			})
+		},
+
+		// -----------------------------------------------------------------------
+		// PATCH /settings/members/:userId
+		// -----------------------------------------------------------------------
+		async setRole(ctx: RouteContext): Promise<Response> {
+			const wsErr = requireWorkspace()
+			if (wsErr) return wsErr
+			const denied = await gate(ctx)
+			if (denied) return denied
+
+			const userId = ctx.params.userId
+			if (!userId) return json({ error: 'Missing userId' }, 400)
+
+			let body: unknown
+			try {
+				body = await ctx.request.json()
+			} catch {
+				return json({ error: 'Invalid JSON' }, 400)
+			}
+
+			const role = (body as Record<string, unknown>)?.role
+			if (!role || typeof role !== 'string' || !VALID_ROLES.has(role)) {
+				return json({ error: 'Missing or invalid role', validRoles: [...VALID_ROLES] }, 400)
+			}
+
+			const members = await listMembers(ctx.db, config.workspaceId)
+
+			// Verify the target is actually a member
+			const target = members.find((m) => m.userId === userId)
+			if (!target) return json({ error: 'Member not found' }, 404)
+
+			const decision = canChangeMemberRole(
+				members.map((m) => ({ userId: m.userId, role: m.role })),
+				userId,
+				role,
+			)
+			if (!decision.allowed) {
+				return json({ error: 'Forbidden', reason: decision.reason }, 403)
+			}
+
+			await setRole(ctx.db, config.workspaceId, userId, role as CmsRole)
+			return json({ ok: true, userId, role })
+		},
+
+		// -----------------------------------------------------------------------
+		// DELETE /settings/members/:userId
+		// -----------------------------------------------------------------------
+		async remove(ctx: RouteContext): Promise<Response> {
+			const wsErr = requireWorkspace()
+			if (wsErr) return wsErr
+			const denied = await gate(ctx)
+			if (denied) return denied
+
+			const userId = ctx.params.userId
+			if (!userId) return json({ error: 'Missing userId' }, 400)
+
+			const actorSubject = await resolveActorSubject(ctx)
+			if (!actorSubject) return json({ error: 'Unauthorized' }, 401)
+
+			const members = await listMembers(ctx.db, config.workspaceId)
+
+			const decision = canRemoveMember(
+				members.map((m) => ({ userId: m.userId, role: m.role })),
+				actorSubject,
+				userId,
+			)
+			if (!decision.allowed) {
+				return json({ error: 'Forbidden', reason: decision.reason }, 403)
+			}
+
+			await removeMember(ctx.db, config.workspaceId, userId)
+			return json({ ok: true, userId })
+		},
+	}
+}