@hollware/server 0.9.1 → 0.11.0

package/dist/{ceremonies-D5dIEbha.mjs → ceremonies-CI3DkOEL.mjs}

@@ -1,4 +1,4 @@
-import { a as findInvitation, c as invitationById, d as redeemInvitation, f as saveChallenge, h as userHandle, i as createUser, m as touchPasskey, o as findPasskey, p as takeChallenge, r as createSession, t as addPasskey, u as passkeysOf } from "./store-C2hiR0yd.mjs";
+import { _ as saveChallenge, b as userHandle, c as findInvitation, d as invitationById, h as redeemInvitation, i as createUser, l as findPasskey, m as passkeysOf, r as createSession, t as addPasskey, v as takeChallenge, y as touchPasskey } from "./store-DjA9s95l.mjs";
 import { HollwareError, newId } from "@hollware/core";
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from "@simplewebauthn/server";
 import { isoBase64URL } from "@simplewebauthn/server/helpers";
@@ -15,6 +15,18 @@ function relyingParty(ceremony) {
 function refused(message, fix) {
 	return new HollwareError("invalid_input", message, fix);
 }
+/**
+* A verification of the library, or `{ verified: false }` when it throws: it throws for a response
+* from another origin, without user verification, or with a counter that went back, and each of
+* those is a passkey that could not be verified, not a failure of the server.
+*/
+async function unlessThrown(verify) {
+	try {
+		return await verify();
+	} catch {
+		return { verified: false };
+	}
+}
 /** The options of `navigator.credentials.create` for the person of an invitation. */
 async function registrationOptions(ceremony, invitationSecret) {
 	const invitation = await findInvitation(ceremony.db, invitationSecret, ceremony.now);
@@ -57,12 +69,13 @@ async function verifyRegistration(ceremony, input) {
 	});
 	if (challenge === null || challenge.invitationId === null || challenge.userId === null) throw refused("The registration expired.", "Start again from the link.");
 	const rp = relyingParty(ceremony);
-	const verified = await verifyRegistrationResponse({
+	const verified = await unlessThrown(() => verifyRegistrationResponse({
 		response: input.response,
 		expectedChallenge: challenge.challenge,
 		expectedOrigin: rp.origin,
-		expectedRPID: rp.id
-	});
+		expectedRPID: rp.id,
+		requireUserVerification: true
+	}));
 	if (!verified.verified) throw refused("The passkey could not be verified.", "Try again.");
 	const invitation = await invitationById(ceremony.db, challenge.invitationId);
 	if (invitation === null || !await redeemInvitation(ceremony.db, invitation.id, ceremony.now)) throw refused("This link is not valid: it was used already, or it expired.", "Ask the owner of this Hollware for a new invitation.");
@@ -122,18 +135,19 @@ async function verifyAuthentication(ceremony, input) {
 	const passkey = await findPasskey(ceremony.db, input.response.id);
 	if (passkey === null) throw refused("This passkey is not one of this Hollware.", "Use a passkey you registered here.");
 	const rp = relyingParty(ceremony);
-	const verified = await verifyAuthenticationResponse({
+	const verified = await unlessThrown(() => verifyAuthenticationResponse({
 		response: input.response,
 		expectedChallenge: challenge.challenge,
 		expectedOrigin: rp.origin,
 		expectedRPID: rp.id,
+		requireUserVerification: true,
 		credential: {
 			id: passkey.credentialId,
 			publicKey: isoBase64URL.toBuffer(passkey.publicKey),
 			counter: passkey.counter,
 			transports: JSON.parse(passkey.transports)
 		}
-	});
+	}));
 	if (!verified.verified) throw refused("The passkey could not be verified.", "Try again.");
 	await touchPasskey(ceremony.db, passkey.id, verified.authenticationInfo.newCounter, ceremony.now);
 	const session = await createSession(ceremony.db, {

package/dist/index.d.mts

@@ -33,6 +33,8 @@ interface StoredEntry {
   readonly publishedAt: string | null;
   /** When a scheduled entry will be published, or `null`. */
   readonly scheduledAt: string | null;
+  /** When the entry went to the trash, or `null`. The reads leave a trashed entry out. */
+  readonly deletedAt: string | null;
   readonly updatedAt: string;
 }
 /** A revision as the store holds it. */
@@ -99,6 +101,8 @@ interface ListQuery {
   readonly locale?: string;
   readonly tag?: string;
   readonly status?: StoredEntry['status'];
+  /** The entries in the trash instead of the others; the published view has none. */
+  readonly trashed?: boolean;
   readonly view: View;
   readonly limit: number;
   /** The `nextCursor` of the previous page. */
@@ -200,6 +204,15 @@ interface OutboxEvent {
   readonly id: string;
   readonly payload: string;
 }
+/** A new entry whose slug or translation an entry in the trash holds: restore that one. */
+interface InTrash {
+  readonly outcome: 'in_trash';
+  readonly view: EntryView;
+}
+/**
+ * The reads of the store leave out an entry in the trash, in every view: for the operations it is
+ * not there until it is restored. Only `listEntries` with `trashed` reads the trash.
+ */
 interface ContentStore {
   /** The entry with that collection, locale and slug, in the given view, or `null`. */
   findEntry(site: string, ref: EntryRef, view: View): Promise<EntryView | null>;
@@ -228,14 +241,41 @@ interface ContentStore {
   lookup(site: string): EntryLookup;
   /** The latest publish or unpublish of an entry, or `null`. */
   lastPublication(site: string, entryId: string): Promise<StoredPublication | null>;
-  /** Creates an entry at version 1 with its first revision, as a draft. */
+  /**
+   * Creates an entry at version 1 with its first revision, as a draft. A slug or a translation
+   * that an entry in the trash holds is `in_trash`, by that entry.
+   */
   createEntry(site: string, entry: EntryRef & {
     readonly translationGroup: string | null;
     readonly revision: NewRevision;
   }): Promise<{
     readonly outcome: 'saved';
     readonly view: EntryView;
-  } | WriteRefusal>;
+  } | WriteRefusal | InTrash>;
+  /**
+   * Moves a draft to the trash, if it is still at `expectedVersion`: the entry gets its
+   * `deletedAt` and the next version, and its pending review is cancelled in the same batch. No
+   * row is deleted. An entry that is published or scheduled is `not_draft`, and nothing is written.
+   */
+  trashEntry(site: string, write: {
+    readonly entryId: string;
+    readonly expectedVersion: number;
+  }): Promise<{
+    readonly outcome: 'trashed' | 'not_draft';
+    readonly view: EntryView;
+  } | Extract<WriteRefusal, {
+    readonly outcome: 'conflict' | 'not_found';
+  }>>;
+  /** Brings an entry back from the trash as the draft it was, at the next version. */
+  restoreEntry(site: string, entryId: string): Promise<{
+    readonly outcome: 'restored';
+    readonly view: EntryView;
+  } | {
+    readonly outcome: 'not_trashed';
+    readonly view: EntryView;
+  } | {
+    readonly outcome: 'not_found';
+  }>;
   /**
    * Appends a revision and makes it the head, if the entry is still at `expectedVersion`. In
    * one batch: the revision, its tags (only where the revision was inserted), the cancellation of
@@ -441,12 +481,16 @@ interface StructureActor {
  */
 interface StructureStore {
   read(site: string): Promise<StoredStructure | null>;
-  /** A new definition, if the version is still `expected`: `conflict` when it moved. */
+  /**
+   * A new definition, if the version is still `expected`: `conflict` when it moved. Its `event`,
+   * a `site.changed`, goes to the outbox in the same batch, and only when the definition does.
+   */
   write(input: {
     readonly site: string;
     readonly expected: number;
     readonly definition: unknown;
     readonly actor: StructureActor;
+    readonly event?: OutboxEvent;
   }): Promise<'written' | 'conflict'>;
   /** A new site with its definition, and its maker as owner: `taken` when the key exists, trashed or not. */
   create(input: {
@@ -619,6 +663,13 @@ export interface HollwareEnv {
    * Personal tokens work without it; OAuth does not.
    */
   readonly OAUTH_KV: KVNamespace;
+  /**
+   * A Workers Rate Limiting binding (`ratelimits` in wrangler.jsonc): with it, the routes anyone
+   * may call without a token (sign-in and passkeys, OAuth's token and registration, the beacon)
+   * answer 429 past its limit, per address and route (T-10 of docs/security/threat-model.md).
+   * Without it, nothing is limited.
+   */
+  readonly HOLLWARE_RATE_LIMIT?: RateLimiter;
   /** The static assets of the Worker, which hold the admin at `/admin/`; without them, no admin. */
   readonly ASSETS?: Fetcher;
   /** The Queue of publication events (ADR-025); without it, the cron trigger delivers them. */
@@ -662,6 +713,12 @@ export interface HollwareRpc {
     readonly formats?: readonly ('markdown' | 'document' | 'html')[];
     /** Also the published entries closest by meaning (ADR-030). */
     readonly related?: boolean;
+    /**
+     * A preview token (`hw_prv_…`, made in the admin): the entry it names is read in its latest
+     * revision, a draft included. A token that does not hold (expired, of another site or
+     * entry, forged) is an `invalid_input` error, never the published version in its place.
+     */
+    readonly preview?: string;
   }): Promise<Output<typeof getEntry>>;
   listEntries(site: string, collection: string, options?: {
     readonly locale?: string;
@@ -706,5 +763,13 @@ export type CreateHollware = (config?: HollwareConfig) => HollwareWorker;
  * The config is resolved once, here; a broken one throws its `ConfigError`.
  */
 export declare const createHollware: CreateHollware;
+/** What a Workers Rate Limiting binding answers: whether one more request for `key` fits. */
+export interface RateLimiter {
+  limit(options: {
+    readonly key: string;
+  }): Promise<{
+    readonly success: boolean;
+  }>;
+}
 //#endregion
-export type { Actor, AnalyticsReader, AnalyticsWriter, Clock, ContentStore, Embedder, EntrySummaryView, EntryView, EventMessage, Handlers, ListQuery, NewRevision, OperationContext, OperationHandler, OutboxEvent, PageCount, PageView, Principal, PublishWrite, RelatedEntry, ReviewStatus, RevisionSummary, SearchHit, SearchQuery, Semantic, StoredEntry, StoredPublication, StoredReview, StoredReviewComment, StoredRevision, StoredSchedule, StoredStructure, StoredVector, Structure, StructureActor, StructureStore, VectorIndex, VectorMatch, VectorMetadata, View, WriteRefusal };
+export type { Actor, AnalyticsReader, AnalyticsWriter, Clock, ContentStore, Embedder, EntrySummaryView, EntryView, EventMessage, Handlers, InTrash, ListQuery, NewRevision, OperationContext, OperationHandler, OutboxEvent, PageCount, PageView, Principal, PublishWrite, RelatedEntry, ReviewStatus, RevisionSummary, SearchHit, SearchQuery, Semantic, StoredEntry, StoredPublication, StoredReview, StoredReviewComment, StoredRevision, StoredSchedule, StoredStructure, StoredVector, Structure, StructureActor, StructureStore, VectorIndex, VectorMatch, VectorMetadata, View, WriteRefusal };