@hazem3500/komo 0.0.0-stage → 0.9.0

package/server/setup-page.ts

@@ -0,0 +1,14 @@
+export function setupPage() {
+  return new Response(
+    `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Set up komo</title><style>html{color-scheme:dark}body{margin:0;background:#111;color:#777;font:15px system-ui}main{height:100dvh;display:grid;place-items:center;background:#171717}h1{font-size:32px;letter-spacing:-1.5px;font-weight:500;color:#444}</style></head><body><main><h1>komo</h1></main><script type="module" src="/setup-client.js"></script></body></html>`,
+    {
+      headers: {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "Referrer-Policy": "no-referrer",
+        "Content-Security-Policy":
+          "default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; connect-src 'self'; img-src https: data:; frame-ancestors 'none'; base-uri 'none'; form-action 'none'",
+      },
+    }
+  );
+}

package/server/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["*.ts", "worker-configuration.d.ts", "../src/types.ts"]
+}

package/server/validation.ts

@@ -0,0 +1,220 @@
+import { canonicalPage } from "../src/page.js";
+import type { Anchor } from "../src/types.js";
+
+export class HttpError extends Error {
+  constructor(
+    public status: number,
+    message: string,
+    public code?: string,
+  ) {
+    super(message);
+  }
+}
+export function check(
+  condition: unknown,
+  status: number,
+  message: string,
+): asserts condition {
+  if (!condition) throw new HttpError(status, message);
+}
+export function string(value: unknown, max: number, label: string): string {
+  check(
+    typeof value === "string" && value.trim().length > 0 && value.length <= max,
+    400,
+    `Invalid ${label}.`,
+  );
+  return value.trim();
+}
+export function pagePath(value: unknown): string {
+  const page = string(value, 2000, "page");
+  check(
+    page.startsWith("/") &&
+      !page.startsWith("//") &&
+      !/[?#\\]/.test(page) &&
+      ![...page].some((char) => char.charCodeAt(0) < 32),
+    400,
+    "Invalid page path.",
+  );
+  return canonicalPage(page);
+}
+export function anchorValue(value: unknown): Anchor {
+  check(value && typeof value === "object", 400, "Invalid anchor.");
+  const a = value as Record<string, unknown>;
+  for (const key of [
+    "x",
+    "y",
+    "width",
+    "height",
+    "pageX",
+    "pageY",
+    "viewportWidth",
+  ]) {
+    check(
+      typeof a[key] === "number" && Number.isFinite(a[key]) && a[key] >= 0,
+      400,
+      `Invalid anchor ${key}.`,
+    );
+  }
+  for (const key of ["x", "y", "width", "height"])
+    check(Number(a[key]) <= 1, 400, "Anchor outside element.");
+  check(
+    Number(a.x) + Number(a.width) <= 1.001 &&
+      Number(a.y) + Number(a.height) <= 1.001,
+    400,
+    "Area outside element.",
+  );
+  check(
+    Number(a.viewportWidth) > 0 &&
+      Number(a.viewportWidth) <= 20000 &&
+      Number(a.pageY) <= 10000000 &&
+      Number(a.pageX) <= 20000,
+    400,
+    "Anchor outside page.",
+  );
+  check(
+    typeof a.selector === "string" &&
+      a.selector.length <= 2000 &&
+      typeof a.text === "string" &&
+      a.text.length <= 160,
+    400,
+    "Invalid anchor selector.",
+  );
+  let context: Anchor["context"];
+  if (a.context !== undefined) {
+    check(
+      a.context && typeof a.context === "object" && !Array.isArray(a.context),
+      400,
+      "Invalid anchor context.",
+    );
+    context = {};
+    const supplied = a.context as Record<string, unknown>;
+    for (const [key, max] of Object.entries({
+      tag: 32,
+      role: 80,
+      label: 160,
+      nearby: 160,
+      classes: 200,
+      selectedText: 200,
+      styles: 500,
+      scope: 2000,
+    })) {
+      if (supplied[key] === undefined) continue;
+      check(
+        typeof supplied[key] === "string" && supplied[key].length <= max,
+        400,
+        `Invalid anchor context ${key}.`,
+      );
+      context[key as keyof typeof context] = supplied[key];
+    }
+  }
+  const source =
+    typeof a.source === "string" &&
+    a.source.length <= 500 &&
+    !a.source.includes("..") &&
+    !a.source.startsWith("/")
+      ? a.source
+      : undefined;
+  return {
+    selector: a.selector,
+    text: a.text,
+    x: Number(a.x),
+    y: Number(a.y),
+    width: Number(a.width),
+    height: Number(a.height),
+    pageX: Number(a.pageX),
+    pageY: Number(a.pageY),
+    viewportWidth: Number(a.viewportWidth),
+    source,
+    ...(context ? { context } : {}),
+    ...(a.unstacked === true ? { unstacked: true } : {}),
+  };
+}
+
+/** A local dev server on any port. Browsers never send this from a remote site. */
+export function localOrigin(origin: string): boolean {
+  return /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin);
+}
+
+/**
+ * Every deploy of the same Cloudflare Pages project, derived from one of its
+ * origins. Only that project's owner can publish under *.<project>.pages.dev.
+ */
+export function previewPattern(origin: string): string | undefined {
+  const pages = /^https:\/\/(?:[a-z0-9-]+\.)?([a-z0-9-]+\.pages\.dev)$/.exec(
+    origin,
+  );
+  return pages ? `https://*.${pages[1]}` : undefined;
+}
+
+export function originAllowed(origin: string, patterns: string[]): boolean {
+  let url: URL;
+  try {
+    url = new URL(origin);
+  } catch {
+    return false;
+  }
+  if (url.origin !== origin) return false;
+  return patterns.some((pattern) => {
+    if (!pattern.includes("*")) return pattern === origin;
+    const escaped = pattern
+      .split("*")
+      .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+      .join("[a-zA-Z0-9-]+");
+    return new RegExp(`^${escaped}$`).test(origin);
+  });
+}
+
+/**
+ * Validate an owner-approved site: an exact HTTPS origin, localhost, or an
+ * HTTPS pattern with `*` in the leftmost host label only, such as
+ * https://*-site.example.workers.dev. The wildcard never spans dots.
+ */
+export function sitePattern(value: unknown): string {
+  check(
+    typeof value === "string" && value.length <= 300,
+    400,
+    "Enter a site address.",
+  );
+  const site = value.trim().replace(/\/$/, "").toLowerCase();
+  if (/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(site)) return site;
+  const match = /^https:\/\/([^/?#@]+)$/.exec(site);
+  const host = match?.[1] ?? "";
+  const [first = "", ...rest] = host.split(".");
+  let url: URL | undefined;
+  try {
+    url = new URL(site);
+  } catch {
+    url = undefined;
+  }
+  check(
+    !!match &&
+      url?.origin === site &&
+      !rest.join(".").includes("*") &&
+      first.split("*").length - 1 <= 1 &&
+      (!first.includes("*") ||
+        (rest.length >= 2 && /^[a-z0-9*-]+$/.test(first))),
+    400,
+    "Use an HTTPS site like https://your-site.com, or a wildcard like https://*-preview.your-site.com.",
+  );
+  return site;
+}
+
+export function cliReturnOrigin(value: unknown, fallback: string): string {
+  if (value === undefined) return fallback;
+  check(typeof value === "string", 400, "Invalid CLI return origin.");
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new HttpError(400, "Invalid CLI return origin.");
+  }
+  check(
+    url.protocol === "http:" &&
+      url.hostname === "127.0.0.1" &&
+      Number(url.port) >= 1024 &&
+      url.origin === value,
+    400,
+    "CLI sign-in must return to an ephemeral loopback port.",
+  );
+  return url.origin;
+}

package/server/webhooks.ts

@@ -0,0 +1,206 @@
+const encoder = new TextEncoder();
+
+export const WEBHOOK_EVENTS = [
+  "comment.created",
+  "comment.replied",
+  "comment.resolved",
+] as const;
+export type WebhookEventName = (typeof WEBHOOK_EVENTS)[number];
+
+export type WebhookEvent = {
+  id: string;
+  event: WebhookEventName;
+  occurredAt: string;
+  projectKey: string;
+  repo: string;
+  branch: string;
+  threadId: string;
+  pageUrl: string;
+  selector: string;
+  author: string;
+  body: string | null;
+};
+
+type WebhookEnv = {
+  DB: {
+    prepare(sql: string): {
+      bind(...values: unknown[]): {
+        first<T>(): Promise<T | null>;
+      };
+    };
+  };
+  KOMO_WEBHOOK_KEYS?: string;
+  KOMO_WEBHOOK_SEND?: (
+    url: string,
+    body: string,
+    headers: Record<string, string>
+  ) => Promise<void>;
+};
+
+export function validateWebhookUrl(value: unknown): string {
+  if (typeof value !== "string" || value.length > 2048)
+    throw new Error("Enter an HTTPS webhook URL under 2048 characters.");
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Enter a valid HTTPS webhook URL.");
+  }
+  const host = url.hostname.toLowerCase().replace(/\.$/, "");
+  if (
+    url.protocol !== "https:" ||
+    url.username ||
+    url.password ||
+    url.hash ||
+    (url.port && url.port !== "443") ||
+    !host.includes(".") ||
+    /^(localhost|metadata|metadata\.google\.internal)(\.|$)/.test(host) ||
+    /\.(localhost|local|internal|test|invalid|example)$/.test(host) ||
+    host.startsWith("[") ||
+    /^(?:\d{1,3}\.){3}\d{1,3}$/.test(host)
+  )
+    throw new Error("Webhook URL must use a public HTTPS hostname on port 443.");
+  url.hostname = host;
+  return url.toString();
+}
+
+function keyring(raw: string | undefined) {
+  if (!raw) throw new Error("Webhook encryption is not configured.");
+  let value: unknown;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("Webhook encryption is not configured.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Webhook encryption is not configured.");
+  const ring = value as { current?: unknown; keys?: unknown };
+  if (
+    typeof ring.current !== "string" ||
+    !ring.keys ||
+    typeof ring.keys !== "object" ||
+    Array.isArray(ring.keys)
+  )
+    throw new Error("Webhook encryption is not configured.");
+  return ring as { current: string; keys: Record<string, string> };
+}
+
+async function aesKey(raw: string) {
+  let bytes: Uint8Array;
+  try {
+    bytes = Uint8Array.from(atob(raw), (char) => char.charCodeAt(0));
+  } catch {
+    throw new Error("Webhook encryption key is invalid.");
+  }
+  if (bytes.length !== 32) throw new Error("Webhook encryption key is invalid.");
+  const buffer = bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength
+  ) as ArrayBuffer;
+  return crypto.subtle.importKey("raw", buffer, "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+
+export async function encryptWebhookSecret(
+  rawKeyring: string | undefined,
+  project: string,
+  secret: string
+) {
+  if (secret.length < 32 || secret.length > 256)
+    throw new Error("Webhook signing secret must be 32–256 characters.");
+  const ring = keyring(rawKeyring);
+  const material = ring.keys[ring.current];
+  if (!material) throw new Error("Current webhook encryption key is unavailable.");
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, additionalData: encoder.encode(`komo-webhook:v1:${project}`) },
+    await aesKey(material),
+    encoder.encode(secret)
+  );
+  return `v1.${ring.current}.${toBase64(iv)}.${toBase64(new Uint8Array(ciphertext))}`;
+}
+
+export async function decryptWebhookSecret(
+  rawKeyring: string | undefined,
+  project: string,
+  stored: string
+) {
+  const [version, keyId, ivPart, dataPart, extra] = stored.split(".");
+  if (version !== "v1" || !keyId || !ivPart || !dataPart || extra)
+    throw new Error("Stored webhook secret is invalid.");
+  const ring = keyring(rawKeyring);
+  const material = ring.keys[keyId];
+  if (!material) throw new Error("Webhook decryption key is unavailable.");
+  try {
+    const clear = await crypto.subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv: fromBase64(ivPart),
+        additionalData: encoder.encode(`komo-webhook:v1:${project}`),
+      },
+      await aesKey(material),
+      fromBase64(dataPart)
+    );
+    return new TextDecoder().decode(clear);
+  } catch {
+    throw new Error("Webhook secret could not be decrypted.");
+  }
+}
+
+export async function signWebhook(secret: string, timestamp: number, body: string) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const digest = new Uint8Array(
+    await crypto.subtle.sign("HMAC", key, encoder.encode(`${timestamp}.${body}`))
+  );
+  return `t=${timestamp},v1=${Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+
+export async function dispatchWebhook(
+  env: WebhookEnv,
+  project: string,
+  event: WebhookEvent
+) {
+  const row = await env.DB.prepare(
+    "SELECT webhook_url,webhook_secret,webhook_events,webhook_enabled FROM project_settings WHERE project=?"
+  )
+    .bind(project)
+    .first<{
+      webhook_url: string | null;
+      webhook_secret: string | null;
+      webhook_events: string | null;
+      webhook_enabled: number | null;
+    }>();
+  if (!row?.webhook_enabled || !row.webhook_url || !row.webhook_secret) return;
+  const events = JSON.parse(row.webhook_events ?? "[]") as unknown;
+  if (!Array.isArray(events) || !events.includes(event.event)) return;
+  if (!env.KOMO_WEBHOOK_SEND) return;
+  const body = JSON.stringify(event);
+  if (encoder.encode(body).length > 16 * 1024) return;
+  const timestamp = Math.floor(Date.now() / 1000);
+  const secret = await decryptWebhookSecret(
+    env.KOMO_WEBHOOK_KEYS,
+    project,
+    row.webhook_secret
+  );
+  const signature = await signWebhook(secret, timestamp, body);
+  await env.KOMO_WEBHOOK_SEND(row.webhook_url, body, {
+    "X-Komo-Delivery": event.id,
+    "X-Komo-Event": event.event,
+    "X-Komo-Signature": signature,
+  });
+}
+
+function toBase64(bytes: Uint8Array) {
+  let value = "";
+  for (const byte of bytes) value += String.fromCharCode(byte);
+  return btoa(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64(value: string) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  return Uint8Array.from(atob(normalized), (char) => char.charCodeAt(0));
+}

package/server/workspaces.ts

@@ -0,0 +1,168 @@
+import { check, string, originAllowed } from "./validation";
+import type { Identity } from "../src/types";
+import { editedOrigins, siteEdits } from "./project-sites";
+export type Project = {
+  repo: string;
+  origins: string[];
+  allowGuests?: boolean;
+  allowGuestResolve?: boolean;
+  requireOwner?: boolean;
+  bootstrapHash?: string;
+  suspended?: boolean;
+  writesPerDay?: number;
+  retainedCommentsPerUser?: number;
+};
+
+export function retainReviewerComments(
+  db: D1Database,
+  project: string,
+  user: string,
+  limit: number | undefined
+): D1PreparedStatement[] {
+  if (!limit || !Number.isInteger(limit) || limit < 1) return [];
+  // Remove only this reviewer's threads that would become empty. Do this before
+  // pruning their comments so candidate IDs remain available; delete triggers
+  // preserve quota/revision accounting. Newest retained comments are untouched.
+  return [
+    db.prepare(`WITH kept AS MATERIALIZED (
+      SELECT c.id FROM comments c JOIN threads t ON t.id=c.thread_id
+      WHERE c.user_id=? AND t.project=? ORDER BY c.created_at DESC,c.rowid DESC LIMIT ?
+    ) DELETE FROM threads WHERE project=?
+      AND id IN (SELECT thread_id FROM comments WHERE user_id=?)
+      AND NOT EXISTS (SELECT 1 FROM comments c WHERE c.thread_id=threads.id
+        AND (c.user_id<>? OR c.id IN (SELECT id FROM kept)))`)
+      .bind(user, project, limit, project, user, user),
+    db.prepare(`DELETE FROM comments WHERE user_id=?
+      AND thread_id IN (SELECT id FROM threads WHERE project=?)
+      AND id NOT IN (SELECT c.id FROM comments c JOIN threads t ON t.id=c.thread_id
+        WHERE c.user_id=? AND t.project=? ORDER BY c.created_at DESC,c.rowid DESC LIMIT ?)`)
+      .bind(user, project, user, project, limit),
+  ];
+}
+export async function projectConfig(
+  env: Env,
+  project: string
+): Promise<Project | undefined> {
+  const staticConfig = (JSON.parse(env.PROJECTS) as Record<string, Project>)[
+    project
+  ];
+  if (staticConfig)
+    return {
+      ...staticConfig,
+      origins: editedOrigins(
+        staticConfig.origins,
+        await siteEdits(env, project)
+      ),
+    };
+  const row = await env.DB.prepare(
+    "SELECT repo,origins,suspended FROM workspaces WHERE id=?"
+  )
+    .bind(project)
+    .first<{ repo: string; origins: string; suspended: number }>();
+  if (!row) return undefined;
+  const verified = await env.DB.prepare(
+    "SELECT origin FROM workspace_domains WHERE project=?"
+  )
+    .bind(project)
+    .all<{ origin: string }>();
+  // Localhost is allowed for every project at the router.
+  return {
+    repo: row.repo,
+    origins: verified.results.map((item) => item.origin),
+    requireOwner: true,
+    suspended: !!row.suspended,
+    writesPerDay: 500,
+  };
+}
+export async function googleOwner(env: Env, project: string, user: Identity) {
+  check(
+    user.verified && user.id.startsWith("google:"),
+    403,
+    "Sign in with Google to manage this workspace."
+  );
+  const owner = await env.DB.prepare(
+    "SELECT user_id FROM project_owners WHERE project=?"
+  )
+    .bind(project)
+    .first<{ user_id: string }>();
+  check(
+    owner?.user_id === user.id,
+    403,
+    "Only the workspace owner can do that."
+  );
+}
+export function workspaceConfig(config: Record<string, unknown>): {
+  repo: string;
+  origins: string[];
+} {
+  const repo = string(config.repo, 200, "repository");
+  const origins = config.origins;
+  check(
+    Array.isArray(origins) &&
+      origins.length > 0 &&
+      origins.length <= 10 &&
+      origins.every(
+        (origin) =>
+          typeof origin === "string" &&
+          origin.length <= 300 &&
+          originAllowed(origin, [origin]) &&
+          (origin.startsWith("https://") ||
+            /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin))
+      ),
+    400,
+    "Use exact HTTPS site origins or localhost."
+  );
+  return { repo, origins };
+}
+
+export async function provision(
+  env: Env,
+  user: Identity,
+  config: Record<string, unknown>
+) {
+  check(
+    user.verified && user.id.startsWith("google:"),
+    403,
+    "A Google account is required to create a workspace."
+  );
+  const { repo, origins } = workspaceConfig(config);
+  const id = `komo_${crypto.randomUUID().replaceAll("-", "")}`;
+  const results = await env.DB.batch([
+    env.DB.prepare(
+      "INSERT INTO workspaces(id,owner_id,repo,origins,created_at) SELECT ?,?,?,?,? WHERE (SELECT COUNT(*) FROM workspaces WHERE owner_id=?)<3"
+    ).bind(id, user.id, repo, JSON.stringify(origins), Date.now(), user.id),
+    env.DB.prepare(
+      "INSERT INTO project_owners(project,user_id) SELECT id,owner_id FROM workspaces WHERE id=?"
+    ).bind(id),
+    env.DB.prepare(
+      "INSERT INTO project_quotas(project,max_comments,max_bytes) SELECT id,250,10485760 FROM workspaces WHERE id=?"
+    ).bind(id),
+  ]);
+  check(
+    results[0].meta.changes,
+    409,
+    "Your account has reached three hosted projects."
+  );
+  return { project: id, repo };
+}
+
+// Cron owns hosted cleanup. Self-hosted deployments without cron get one attempt
+// per database/isolate/hour; concurrent requests share the same deadline.
+const nextCleanup = new WeakMap<D1Database, number>();
+export async function maintain(db: D1Database, scheduled = false) {
+  const now = Date.now();
+  if (!scheduled && now < (nextCleanup.get(db) ?? 0)) return;
+  nextCleanup.set(db, now + 3600000);
+  try {
+    await db.batch([
+      ...["rate_limits", "sessions", "project_invites", "oauth_states", "setup_requests"].map(
+        table => db.prepare(`DELETE FROM ${table} WHERE expires_at<?`).bind(now)
+      ),
+      db.prepare("DELETE FROM users WHERE id LIKE 'guest:%' AND id NOT IN (SELECT user_id FROM sessions) AND id NOT IN (SELECT user_id FROM comments) AND id NOT IN (SELECT user_id FROM project_members)"),
+    ]);
+  } catch (error) {
+    // Retry transient failures after a minute, not on every incoming request.
+    nextCleanup.set(db, now + 60000);
+    throw error;
+  }
+}

package/src/emoji.ts

@@ -0,0 +1,7 @@
+import emojiRegex from "emoji-regex";
+
+export function isEmoji(value: unknown): value is string {
+  if (typeof value !== "string" || value.length > 128) return false;
+  const match = value.match(emojiRegex());
+  return match?.length === 1 && match[0] === value;
+}

package/src/page.ts

@@ -0,0 +1,4 @@
+/** Static hosts may add a trailing slash to the same page. */
+export function canonicalPage(pathname: string): string {
+  return pathname.replace(/\/+$/, "") || "/";
+}